Repository: Activiti/Activiti
Pull request #5013: AAE-34998 Dependabot check to skip steps
Author: login: mauriziovitale
Created: 2025-05-16T12:59:18Z | Merged: 2025-05-20T15:18:56Z

<!--
     For Work In Progress Pull Requests, please use the Draft PR feature,
     see https://github.blog/2019-02-14-introducing-draft-pull-requests/ for further details.

     Before submitting a Pull Request, please ensure you've done the following:
     - 📖 The commit message follows our guidelines
     - 👷‍♂️ Tests for the changes have been added (for bug fixes / features)
     - 👷‍♀️ Create small PRs. In most cases this will be possible.
     - ✅ Provide tests for your changes.
     - 📝 Use descriptive commit messages.
     - 📗 Update any related documentation and include any relevant screenshots.
-->

<!--
(check one with "x") one of the following
-->

**What kind of change does this PR introduce?**

> - [ ] Bugfix
> - [ ] Feature
> - [ ] Code style update (formatting, local variables)
> - [ ] Refactoring (no functional changes, no api changes)
> - [ ] Build related changes
> - [ ] Documentation
> - [ ] Other... Please describe:

## Description

<!--
You can also link to an open issue here
-->

- Issue Link:

<!--
If this PR contains a breaking change, please describe the impact and migration path for existing applications: ...
-->

**Does this PR introduce a breaking change?** (check one with "x")

> - [ ] Yes
> - [ ] No



Diff:
diff --git a/.github/actions/dependabot-check/action.yml b/.github/actions/dependabot-check/action.yml
new file mode 100644
index 00000000000..cd3f9c0bab1
--- /dev/null
+++ b/.github/actions/dependabot-check/action.yml
@@ -0,0 +1,34 @@
+name: Dependabot check
+description: Checks if author is dependabot and if specific label is added to PR
+
+inputs:
+  gh-token:
+    description: 'GitHub token'
+    required: true
+  label:
+    description: 'Check if the commit contains this label '
+    required: true
+
+outputs:
+  result:
+    description: "Result of the check"
+    value: ${{ steps.check.outputs.SKIP }}
+
+runs:
+  using: composite
+  steps:
+    - name: Check
+      id: check
+      env:
+        GH_TOKEN: ${{ inputs.gh-token }}
+        SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        FOUND_LABEL: ${{ inputs.label }}
+      shell: bash
+      run: |
+        LABELS=$(gh api /repos/$GITHUB_REPOSITORY/commits/$SHA/pulls | jq -r '.[].labels.[].name')
+        echo "Labels found: $LABELS"
+        if [[ "$GITHUB_ACTOR" == "dependabot[bot]" && "$LABELS" == *"$FOUND_LABEL"* ]]
+        then
+          echo "PR opened by dependabot and with gh_action. The result is true"
+          echo "SKIP=true" >> $GITHUB_OUTPUT
+        fi
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index cf87f0c3032..0a448b37244 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,11 +9,15 @@ updates:
       interval: "weekly"
 
   - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "github-actions"
-    directory: "/.github/actions/check-ext-build"
+    directories:
+      - "/"
+      - "/.github/actions/*"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 271fca9b162..9cede1c98bc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,8 +25,22 @@ concurrency:
   cancel-in-progress: ${{ github.event_name != 'push' }}
 
 jobs:
+  pre-checks:
+    runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.dependabot.outputs.result }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: dependabot check
+        id: dependabot
+        uses: ./.github/actions/dependabot-check
+        with:
+          gh-token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          label: github_actions
   analyze:
     name: Analyze
+    needs: pre-checks
+    if: ${{ needs.pre-checks.outputs.skip != 'true' }}
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
     #   - https://gh.io/supported-runners-and-hardware-resources
diff --git a/.github/workflows/main_push.yml b/.github/workflows/main_push.yml
index 73f59193595..0a32b7e4f9a 100644
--- a/.github/workflows/main_push.yml
+++ b/.github/workflows/main_push.yml
@@ -21,8 +21,16 @@ jobs:
 
   pre-checks:
     runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.dependabot.outputs.result }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: dependabot check
+        id: dependabot
+        uses: ./.github/actions/dependabot-check
+        with:
+          gh-token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          label: github_actions
       - name: pre-commit
         uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@8cd8c3798c79d10540e2876ad7cf2a5311cbd1ae # v8.20.0
         with:
@@ -33,6 +41,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     needs: pre-checks
+    if: ${{ needs.pre-checks.outputs.skip != 'true' }}
     steps:
 
       - name: Checkout repository
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 61db69aac84..131a0ebdbea 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -19,7 +19,7 @@ repos:
         types_or:
           - markdown
   - repo: https://github.com/sirosen/check-jsonschema
-    rev: 0.23.3
+    rev: 0.33.0
     hooks:
       - id: check-dependabot
       - id: check-github-actions


Reviews:
user: login: atchertchian
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T13:48:55Z
user: login: atchertchian
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T13:49:55Z
user: login: atchertchian
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T12:04:29Z
user: login: atchertchian
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T12:05:02Z
user: login: mauriziovitale
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T12:41:56Z
user: login: atchertchian
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-19T14:25:21Z
user: login: gicappa
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T14:21:53Z
user: login: atchertchian
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T14:34:53Z
user: login: mauriziovitale
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T14:40:06Z
user: login: mauriziovitale
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T14:44:46Z
user: login: atchertchian
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T14:56:55Z

Review comments:
diff_hunk: @@ -1,27 +1,52 @@
 name: Check Ext build
 description: Checks if the build is a dependabot build or external contribution
 
+inputs:
+  gh-token:
+    description: 'GitHub token'
+    required: true
+
+outputs:
+  skip-build:
+    description: "Skip the build"
+    value: ${{ steps.check_build.outputs.SKIP_BUILD }}
+
+permissions:
+  contents: read
+  actions: read
+  checks: write
+
 runs:
   using: composite
   steps:
-
     - name: Check build
+      id: check_build
       env:
+        GH_TOKEN: ${{ inputs.gh-token }}
         SENDER_LOGIN: ${{ github.event.sender.login }}
         EVENT_ACTION: ${{ github.event.action }}
         LABEL: ${{ github.event.label.name }}
         PR_REPO_NAME: ${{ github.event.pull_request.head.repo.full_name }}
         REPO_NAME: ${{ github.repository }}
+        GITHUB_PR_NUMBER: ${{github.event.pull_request.number}}
path: .github/actions/check-ext-build/action.yml
user: login: atchertchian
body: you will not have the PR number on push events: you need to retrieve it from the sha commit with rest api https://docs.github.com/en/rest/commits/commits?apiVersion=2022-11-28#list-commits

$ gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/activiti/activiti/commits/[sha]/pulls | jq -r '.[].number'
created_at: 2025-05-16T13:48:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,27 +1,52 @@
 name: Check Ext build
 description: Checks if the build is a dependabot build or external contribution
 
+inputs:
+  gh-token:
+    description: 'GitHub token'
+    required: true
+
+outputs:
+  skip-build:
+    description: "Skip the build"
+    value: ${{ steps.check_build.outputs.SKIP_BUILD }}
+
+permissions:
+  contents: read
+  actions: read
+  checks: write
+
 runs:
   using: composite
   steps:
-
     - name: Check build
+      id: check_build
       env:
+        GH_TOKEN: ${{ inputs.gh-token }}
         SENDER_LOGIN: ${{ github.event.sender.login }}
         EVENT_ACTION: ${{ github.event.action }}
         LABEL: ${{ github.event.label.name }}
         PR_REPO_NAME: ${{ github.event.pull_request.head.repo.full_name }}
         REPO_NAME: ${{ github.repository }}
+        GITHUB_PR_NUMBER: ${{github.event.pull_request.number}}
       shell: bash
       run: |
+        GH_ACTION_LABEL=$(gh api repos/:owner/:repo/issues/$pr_number/labels --jq '.[].name' | grep -q "gh_action")
path: .github/actions/check-ext-build/action.yml
user: login: atchertchian
body: this is the issues api, you should have something like this:
```
        LABELS=$(gh api repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER)
        echo "Labels: $(echo $LABELS | jq -rc '[.labels[].name]')"
```
created_at: 2025-05-16T13:49:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -23,10 +23,18 @@ jobs:
 
   pre-checks:
     runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.dependabot.outputs.result }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Check dependabot build
         uses: ./.github/actions/check-ext-build
path: .github/workflows/main_pull.yml
user: login: atchertchian
body: this action is already supposed to do the dependabot check
created_at: 2025-05-19T12:04:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,8 +21,16 @@ jobs:
 
   pre-checks:
     runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.dependabot.outputs.result }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: dependabot check
+        id: dependabot
+        uses: ./.github/actions/dependabot-check
path: .github/workflows/main_push.yml
user: login: atchertchian
body: this does not make sense on push
created_at: 2025-05-19T12:05:02Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,8 +21,16 @@ jobs:
 
   pre-checks:
     runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.dependabot.outputs.result }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: dependabot check
+        id: dependabot
+        uses: ./.github/actions/dependabot-check
path: .github/workflows/main_push.yml
user: login: mauriziovitale
body: why ? I think this is the most important one, on push I don't want to build and promote since there is no code affected when changing a gh_action 
created_at: 2025-05-19T12:41:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,8 +21,16 @@ jobs:
 
   pre-checks:
     runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.dependabot.outputs.result }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: dependabot check
+        id: dependabot
+        uses: ./.github/actions/dependabot-check
path: .github/workflows/main_push.yml
user: login: atchertchian
body: I misunderstood what you were doing
created_at: 2025-05-19T14:25:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -9,11 +9,8 @@ updates:
       interval: "weekly"
 
   - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "github-actions"
-    directory: "/.github/actions/check-ext-build"
+    directories:
+      - "/"
+      - "/.github/actions/*"
path: .github/dependabot.yml
user: login: atchertchian
body: Does that really work? I'm not sure the glob pattern is supported here, I've seen the following in other repos:
```
    - "/.github/actions/dependabot-check"
    - "/.github/actions/check-ext-build"
```
created_at: 2025-05-20T14:24:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -9,11 +9,8 @@ updates:
       interval: "weekly"
 
   - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "github-actions"
-    directory: "/.github/actions/check-ext-build"
+    directories:
+      - "/"
+      - "/.github/actions/*"
     schedule:
       interval: "weekly"
path: .github/dependabot.yml
user: login: atchertchian
body: ```suggestion
      interval: "weekly"
    groups:
      github-actions:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
```

(I think we want to group those only, I took this from hxps-studio-services conf
created_at: 2025-05-20T14:25:11Z
author_association: CONTRIBUTOR
diff_hunk: @@ -25,8 +25,22 @@ concurrency:
   cancel-in-progress: ${{ github.event_name != 'push' }}
 
 jobs:
+  pre-checks:
+    runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.dependabot.outputs.result }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: dependabot check
path: .github/workflows/codeql.yml
user: login: atchertchian
body: We don't want to run codeql if the PR is from a fork or a dependabot PR (whatever label) so it would be good to call check-ext-build on pull_request event too on this workflow.
And on push, I don't see the point of calling dependabot-check (but I agree it does not hurt)
created_at: 2025-05-20T14:29:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -27,6 +27,9 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Check dependabot build
         uses: ./.github/actions/check-ext-build
+        with:
+          gh-token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          label: github_actions
path: .github/workflows/main_pull.yml
user: login: atchertchian
body: this is a leftover that should be removed, right?
created_at: 2025-05-20T14:29:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -9,11 +9,8 @@ updates:
       interval: "weekly"
 
   - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "github-actions"
-    directory: "/.github/actions/check-ext-build"
+    directories:
+      - "/"
+      - "/.github/actions/*"
     schedule:
       interval: "weekly"
path: .github/dependabot.yml
user: login: mauriziovitale
body: fixed
created_at: 2025-05-20T14:40:06Z
author_association: CONTRIBUTOR
diff_hunk: @@ -25,8 +25,22 @@ concurrency:
   cancel-in-progress: ${{ github.event_name != 'push' }}
 
 jobs:
+  pre-checks:
+    runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.dependabot.outputs.result }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: dependabot check
path: .github/workflows/codeql.yml
user: login: mauriziovitale
body: ok let's merge what it does not hurt and raise a task for the fork
created_at: 2025-05-20T14:44:45Z
author_association: CONTRIBUTOR

PR comments:
user: login: sonarqubecloud[bot]
created_at: 2025-05-20T15:12:18Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=Activiti_Activiti&pullRequest=5013) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=Activiti_Activiti&pullRequest=5013&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=Activiti_Activiti&pullRequest=5013&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=Activiti_Activiti&pullRequest=5013&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=Activiti_Activiti&pullRequest=5013&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=Activiti_Activiti&pullRequest=5013&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=Activiti_Activiti&pullRequest=5013)


author_association: NONE
user: login: atchertchian
created_at: 2025-05-20T15:15:43Z
body: license/cla misbehaving -> force-merging
author_association: CONTRIBUTOR