Skip to content

Skip Neon preview branch jobs when PR secrets are unavailable #51

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
quantumdynamics927-dotcom merged 3 commits into from
Apr 4, 2026
Merged

Skip Neon preview branch jobs when PR secrets are unavailable #51

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b6a3864
fix: skip neon workflow when secrets are unavailable
Copilot Apr 4, 2026
a131a4a
chore: finalize neon workflow fix
Copilot Apr 4, 2026
119e77a
chore: restore unchanged coverage report
Copilot Apr 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 21 additions & 2 deletions .github/workflows/neon-preview-branches.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,30 @@ jobs:
name: Setup
outputs:
branch: ${{ steps.branch_name.outputs.current_branch }}
neon_enabled: ${{ steps.neon_guard.outputs.enabled }}
runs-on: ubuntu-latest
steps:
- name: Get branch name
id: branch_name
uses: tj-actions/branch-names@v8
- name: Check Neon preview availability
id: neon_guard
env:
NEON_API_KEY: ${{ secrets.NEON_API_KEY }}
NEON_PROJECT_ID: ${{ vars.NEON_PROJECT_ID }}
WORKFLOW_ACTOR: ${{ github.actor }}
run: |
enabled=true

if [ -z "$NEON_API_KEY" ] || [ -z "$NEON_PROJECT_ID" ]; then
enabled=false
echo "Skipping Neon preview jobs because repository Neon credentials are unavailable."
elif [ "$WORKFLOW_ACTOR" = "dependabot[bot]" ]; then
enabled=false
echo "Skipping Neon preview jobs for Dependabot pull requests because secrets are not exposed."
Comment on lines +34 to +39
Copy link

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Dependabot-specific skip message is currently unreachable when secrets are not exposed: for Dependabot PRs, NEON_API_KEY will be empty, so the first if branch fires and logs "credentials are unavailable" instead of the Dependabot explanation. Consider checking WORKFLOW_ACTOR == dependabot[bot] first (or using separate if blocks) so the logs accurately describe why the jobs are skipped.

Suggested change
if [ -z "$NEON_API_KEY" ] || [ -z "$NEON_PROJECT_ID" ]; then
enabled=false
echo "Skipping Neon preview jobs because repository Neon credentials are unavailable."
elif [ "$WORKFLOW_ACTOR" = "dependabot[bot]" ]; then
enabled=false
echo "Skipping Neon preview jobs for Dependabot pull requests because secrets are not exposed."
if [ "$WORKFLOW_ACTOR" = "dependabot[bot]" ]; then
enabled=false
echo "Skipping Neon preview jobs for Dependabot pull requests because secrets are not exposed."
elif [ -z "$NEON_API_KEY" ] || [ -z "$NEON_PROJECT_ID" ]; then
enabled=false
echo "Skipping Neon preview jobs because repository Neon credentials are unavailable."

Copilot uses AI. Check for mistakes.
fi

echo "enabled=$enabled" >> "$GITHUB_OUTPUT"

create_neon_branch:
name: Create Neon Branch
Expand All @@ -29,7 +48,7 @@ jobs:
db_url_with_pooler: ${{ steps.create_neon_branch_encode.outputs.db_url_with_pooler }}
needs: setup
if: |
github.event_name == 'pull_request' && (
needs.setup.outputs.neon_enabled == 'true' && github.event_name == 'pull_request' && (
github.event.action == 'synchronize'
|| github.event.action == 'opened'
|| github.event.action == 'reopened')
Expand Down Expand Up @@ -86,7 +105,7 @@ jobs:
delete_neon_branch:
name: Delete Neon Branch
needs: setup
if: github.event_name == 'pull_request' && github.event.action == 'closed'
if: needs.setup.outputs.neon_enabled == 'true' && github.event_name == 'pull_request' && github.event.action == 'closed'
runs-on: ubuntu-latest
steps:
- name: Delete Neon Branch
Expand Down
8 changes: 8 additions & 0 deletions GITHUB_ACTIONS_SETUP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -317,6 +317,14 @@ neonctl branches delete --project-id YOUR_PROJECT_ID preview/pr-123-old
3. Update GitHub Secret: `NEON_API_KEY`
4. Re-run workflow

### Workflow Is Skipped on Dependabot PRs

**Cause**: GitHub does not expose repository secrets to Dependabot-triggered `pull_request` workflows.

**Fix**:
1. Treat this as expected behavior for Dependabot PRs
2. If you want Neon preview branches on non-Dependabot PRs, verify both `NEON_API_KEY` and `NEON_PROJECT_ID` are configured

### Branch Already Exists

**Cause**: Previous workflow didn't clean up
Expand Down
12 changes: 12 additions & 0 deletions docs/neon-preview-workflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,6 +229,18 @@ Use Vercel's API to set environment variables for preview deployment:
2. Check API key has sufficient permissions
3. Regenerate API key if needed

### Workflow Skips Neon Jobs on Dependabot or Unconfigured PRs

**Behavior**: `create_neon_branch` and `delete_neon_branch` are skipped instead of failing.

**Why it happens**:
1. GitHub does not expose repository secrets to Dependabot-triggered `pull_request` workflows
2. The repository is missing `NEON_API_KEY` or `NEON_PROJECT_ID`

**What to do**:
1. No action is required for Dependabot PRs; skipping is expected
2. For regular PRs, add `NEON_API_KEY` and `NEON_PROJECT_ID` in repository Actions settings if Neon preview branches should run
Copy link

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This troubleshooting step says to add both NEON_API_KEY and NEON_PROJECT_ID in "repository Actions settings", but earlier in the doc NEON_API_KEY is a Secret while NEON_PROJECT_ID is a Repository Variable. Suggest explicitly calling out "Secrets and variables" (and which one goes where) to avoid misconfiguration.

Suggested change
2. For regular PRs, add `NEON_API_KEY` and `NEON_PROJECT_ID` in repository Actions settings if Neon preview branches should run
2. For regular PRs, add `NEON_API_KEY` as a repository Actions **Secret** and `NEON_PROJECT_ID` as a repository Actions **Variable** if Neon preview branches should run

Copilot uses AI. Check for mistakes.

### Branch Already Exists

**Error**: `Branch already exists`
Expand Down
Loading