Repository navigation
Conversation
✅ Deploy Preview for docs-nebula ready!
|
Dependabot-triggered runs get a read-only GITHUB_TOKEN unless a job asks for more, so the deploy job's PR comment failed with "Resource not accessible by integration" and the pass/fail check went red on every bump. Grant the deploy job pull-requests: write. Those runs also read secrets from the Dependabot store, which needs its own CLOUDFLARE_API_TOKEN. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jasikpark
force-pushed
the
b-dependabot-skip-deploy
branch
from
November 2, 2026 17:33
f250d12 to
5dbc5b4
Compare
jasikpark
changed the title
Member
Author
|
lol actually the deploy token was just dead, replaced and things are gucci |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every Dependabot PR since #382 has a red pass/fail check (#383–#385, #394–#397), even though typecheck, prettier, test and build all pass.
#382 moved previews from the Cloudflare Pages GitHub app to a deploy job in our own workflow. The app deployed on Cloudflare's side, so it didn't care who opened the PR. The workflow job does: runs triggered by Dependabot get a read-only
GITHUB_TOKENunless a job asks for more, and they read secrets from the Dependabot store instead of the Actions one. So "Comment deploy start" fails withResource not accessible by integration, and the deploy after it would fail anyway becauseCLOUDFLARE_API_TOKENis empty there.This grants the deploy job
pull-requests: write, which fixes the comments. Previews also need the secret:@nbrownus:
CLOUDFLARE_API_TOKENis an org Actions secret, and Dependabot can't read those. Could you add the same token as an org Dependabot secret, scoped to nebula-docs? It needs an org admin, and the value can't be read back from the Actions secret. Until that's set, Dependabot deploys will still fail, now at the wrangler step.Only the deploy job references the secret. It deploys the artifact from the build job and never runs
pnpm install, so the bumped dependencies' install scripts don't see the token.After the secret is in place,
@dependabot rebaseon the open bumps should give them previews.