Dependabot token input fails with “Missing input! A token must be provided”

[JSChronicles]

After upgrading from slackapi/slack-github-action@v2.1.0 to v2.1.1, our previously working workflow fails with: SlackError: Missing input! A token must be provided to use the method decided.

However, the token is being passed explicitly via the with: block, and the secret is defined and available. The same configuration works without issue on v2.1.0. We also had just minutes before gotten a properly formatted message sent to our channel about a PR then minutes later this PR came in but failed on the workflow for the above error. So we know it works with a previous version just fine and had been seeing PR's come in all day yesterday on v2.1.0.

Did this introduce stricter input validation or escaping?

Steps to Reproduce

1. Create a workflow step using slackapi/slack-github-action@v2.1.1
2. Pass token: ${{ secrets.SLACK_BOT_TOKEN }} inside the with: block
3. Ensure the secret is present, non-empty, and has been verified to work on v2.1.0
4. Run the workflow

Below is our working version on v2.1.0 but on v2.1.1 it breaks

      - name: Notify Slack (if all checks passed)
        if: steps.checks.outputs.ready == 'true' || github.event.pull_request.user.login == 'dependabot[bot]'
        uses: slackapi/slack-github-action@v2.1.0
        with:
          token: ${{ secrets.SLACK_BOT_TOKEN }}
          method: chat.postMessage
          errors: "true"
          payload: |
            channel: ${{ secrets.SLACK_CHANNEL_ID }}
            text: "Pull Request is ready to merge"
            blocks:
              - type: section
                text:
                  type: mrkdwn
                  text: |
                    :rocket: *Pull Request Ready to Merge*
                    
                    *<https://github.com/${{ github.repository }}/tree/${{ github.event.pull_request.head.ref }}|${{ github.event.pull_request.head.ref }}>* 
                    Author: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && ':robot_face: Dependabot' || format('<https://github.com/{0}|@{0}>', github.event.pull_request.user.login || github.actor || 'N/A') }}
              - type: context
                elements:
                  - type: mrkdwn
                    text: "Branch: `${{ github.event.pull_request.head.ref || github.ref_name }} → ${{ github.event.pull_request.base.ref || 'main' }}`"
                  - type: mrkdwn
                    text: "Repo: `${{ github.repository }}`"
                  - type: mrkdwn
                    text: "${{ steps.checks.outputs.check_summary || '⚠️ Skipped waiting for checks (Dependabot)' }}"
              - type: actions
                elements:
                  - type: button
                    text:
                      type: plain_text
                      text: "View PR"
                      emoji: true
                    style: primary
                    url: "${{ github.event.pull_request.html_url || format('https://github.com/{0}/pulls', github.repository) }}"

[zimeg]

Hey @JSChronicles! 👋 Thanks for sharing this with us and apologies for the broken workflow 👾

I don't believe changes to token validation were included with the v2.1.1 release and am also not finding a similar error with this version. That makes me hope something unexpected might be happening with the token 👁️‍🗨️

Could you share logs from an erroring attempt?

I notice in a similar setup the following appears in output and the message is sent as expected 🔍

Run slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a
  with:
    method: chat.postMessage
    token: ***
    payload: channel: ***
  text: "chore(<!channel>): merge w the latest changes on main"

[zimeg]

Also wanting to note that @dependabot secrets are stored separate from other workflow secrets, although I don't think this would be causing a problem if prior versions were working 📚

When a Dependabot event triggers a workflow, the only secrets available to the workflow are Dependabot secrets. GitHub Actions secrets are not available.

🔗 https://docs.github.com/en/code-security/dependabot/troubleshooting-dependabot/troubleshooting-dependabot-on-github-actions#accessing-secrets

[JSChronicles]

@zimeg You were right on the money, it seems that the one repository didn't have dependabot secrets for some reason. The workflow file for this one was working fine but only so far for the non-bot notifications. Once it used the bot it broke because the lack of tokens saved specifically for it.

All other repos for us are working fine. My fault for assuming it was the version bump instead of a misconfiguration.

[zimeg]

@JSChronicles This is so good to hear! Thank you for checking this and confirming these secrets can be found! 🤖

I've run into this issue more than handfuls times myself too FWIW. Perhaps we include a note on this in documentation?

[JSChronicles]

I've updated our docs on our end to make sure people are aware of the two separate areas. I'm not sure if you need the "warning" in your docs since it's an issue on our end. Though I could see it being good just to hopefully mitigate simple mistakes like ours.