chore(ci): auto-heal vendorHash on Dependabot PRs#190
Merged
Conversation
Dependency bumps change go.mod/go.sum, which invalidates the buildGoModule vendorHash in nix/package.nix and turns the Nix build red on the PR. The existing `nix-vendor-hash.yml` workflow fixes this on `pull_request`, but GitHub withholds Actions secrets from Dependabot- triggered `pull_request` runs, so the PAT-based checkout fails with "Input required and not supplied: token" (see PR #188). Add a companion workflow on `pull_request_target`, which does grant Actions secrets to Dependabot-triggered runs. Guard by `actor == dependabot[bot]` and same-repo head, and drop Dependabot from the existing workflow's `if:` so the two do not double-fire. Security tradeoff: the job still checks out and runs `nix build` on the PR branch while a write-scoped PAT is in the environment. Scope is confined to Dependabot's own bumps; the remaining trust surface is a compromised upstream dependency exfiltrating the PAT during the build.
mmanciop
force-pushed
the
nix-vendor-hash-dependabot
branch
from
July 16, 2026 07:41
49f10d9 to
43d4784
Compare
mmanciop
changed the title
Merge the Dependabot-only sibling back into `nix-vendor-hash.yml`. A single `pull_request_target` workflow handles both Dependabot and human dependency PRs uniformly: `pull_request_target` grants Actions secrets to Dependabot runs (which `pull_request` denies), and same-repo human branches are pushable the same way. Tradeoff: a change to this workflow on a PR branch is not exercised by that PR — `pull_request_target` evaluates the workflow file from the base branch. Manual runs via `workflow_dispatch` cover pre-merge testing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nix-vendor-hash-dependabot.yml: apull_request_targetworkflow that recomputes thenix/package.nixvendorHashon Dependabot PRs and pushes the fix back to the PR branch.nix-vendor-hash.ymlif:so the two workflows don't both fire on the same PR.Why
Dependency bumps change
go.mod/go.sum, which invalidates thebuildGoModulevendorHashinnix/package.nixand turns the Nix build red on the PR. The existingnix-vendor-hash.ymlworkflow already fixes this for human PRs onpull_request, but GitHub withholds Actions secrets from Dependabot-triggeredpull_requestruns, so the PAT-based checkout fails withInput required and not supplied: token.See the
update-vendor-hashfailure on PR #188 — that's the failure mode this addresses.pull_request_targetruns the workflow file from the base branch and does grant Actions secrets to Dependabot-triggered runs, so it is the supported way to push back to a Dependabot PR branch without also registering the PAT as a Dependabot secret.