From 44deac785a6f0c44f06cf289a31dabd2dda13062 Mon Sep 17 00:00:00 2001 From: admin Date: Wed, 12 Aug 2026 15:24:29 -0500 Subject: [PATCH] fix(hybrid-gate): stop failing the build when FLEET_REPO_TOKEN is absent MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The credential step exited 1 whenever the token was empty, regardless of whether any fleet dep actually needed it. Dependabot-triggered runs read a separate secret store and receive no Actions secrets, so the token is always empty for them — which made every dependabot PR unmergeable by construction. Measured in aletheia: dependabot PR #6679 died at this step, while #6681 two hours earlier passed it. Whether a run sees the secret depends on how it was triggered, not on what it needs, so a caller-side opt-out cannot express the condition either. Warn and continue instead. Every forkwright git dep is public, so anonymous fetch succeeds; the token path stays for any future private dep. A genuine missing-credential failure now surfaces at the fetch itself, with this warning directly above it in the log. This is the guard aletheia already ships in its own .github/actions/fleet-git-credentials composite. A reusable workflow cannot reference a composite from its own repo, so the duplication is structural and noted as such in the step. Refs forkwright/aletheia#6684 --- .github/workflows/hybrid-gate.yml | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/.github/workflows/hybrid-gate.yml b/.github/workflows/hybrid-gate.yml index 761a8d9..46f6cbd 100644 --- a/.github/workflows/hybrid-gate.yml +++ b/.github/workflows/hybrid-gate.yml @@ -334,8 +334,26 @@ jobs: FLEET_REPO_TOKEN: ${{ secrets.FLEET_REPO_TOKEN }} run: | if [ -z "${FLEET_REPO_TOKEN}" ]; then - echo "FLEET_REPO_TOKEN is not set; fleet git deps will fail to fetch." >&2 - exit 1 + # WHY: dependabot-triggered runs read a separate secret store and receive no + # Actions secrets, so this token is ALWAYS empty for them. Every forkwright git + # dep is public, so anonymous fetch succeeds. Failing here made every bot PR + # unmergeable by construction — measured in aletheia, where dependabot PR #6679 + # died at this step while #6681 two hours earlier passed it, because whether a + # run sees the secret depends on how it was triggered rather than on need. + # The token path stays for any future private dep; populate BOTH the Actions and + # Dependabot secret stores at that point. + # + # WHY warn-and-continue rather than a needs_fleet_repo_token=false caller opt-out: + # a caller cannot know at declaration time whether THIS run will be handed the + # secret. The condition is the run's trigger, not the repo's dependency set. + # + # NOTE: aletheia carries the identical guard in its own + # .github/actions/fleet-git-credentials composite. A reusable workflow cannot + # reference a composite from its own repo (`./` resolves against the CALLER's + # checkout), so this duplication is structural, not an oversight — keep the two + # in sync by hand. + echo "FLEET_REPO_TOKEN not set; skipping credential setup (public fleet deps fetch anonymously)." + exit 0 fi git config --global credential.helper store printf 'https://forkwright:%s@github.com\n' "${FLEET_REPO_TOKEN}" > ~/.git-credentials