diff --git a/.github/workflows/claude-code-reusable.yml b/.github/workflows/claude-code-reusable.yml index 11d09ff..f5c6d34 100644 --- a/.github/workflows/claude-code-reusable.yml +++ b/.github/workflows/claude-code-reusable.yml @@ -18,7 +18,8 @@ jobs: claude: if: >- (github.event_name == 'pull_request' && - github.event.pull_request.head.repo.full_name == github.repository) || + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login != 'dependabot[bot]') || (github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.comment.user.login != 'claude[bot]' && contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || @@ -41,7 +42,6 @@ jobs: fetch-depth: 1 token: ${{ secrets.GH_PAT_WORKFLOWS || github.token }} - name: Run Claude Code - if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]' uses: anthropics/claude-code-action@6e2bd52842c65e914eba5c8badd17560bd26b5de # v1.0.89 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/AGENTS.md b/AGENTS.md index ea6a1ef..2286914 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -511,13 +511,14 @@ The `dependabot-automerge.yml` workflow handles automatic merging of Dependabot | **Eligible updates** | Patch, minor, and indirect dependency bumps | | **Major version bumps** | Require manual review and approval | | **Merge strategy** | `gh pr merge --squash --auto` (queues merge until all checks pass) | -| **AI reviewers** | Claude Code is skipped on Dependabot PRs (step-level `if`); Copilot/CodeRabbit threads are auto-resolved by the workflow | +| **AI reviewers** | Claude Code job is skipped on Dependabot PRs (job-level `if`); Copilot/CodeRabbit threads are auto-resolved by the workflow | | **Approval** | GitHub App token provides the required approving review | #### Claude Code Workflow on Dependabot PRs -The `claude.yml` workflow skips the Claude Code action step for Dependabot PRs (`github.event.pull_request.user.login != 'dependabot[bot]'`). -The job still runs and reports SUCCESS to satisfy required status checks, but the Claude action step is skipped since: +The `claude-code-reusable.yml` workflow skips the entire `claude` job for Dependabot PRs +via a job-level `if` condition (`github.event.pull_request.user.login != 'dependabot[bot]'`). +The job shows as **skipped** (not failed) in GitHub, which satisfies required status checks. The job is skipped because: - `CLAUDE_CODE_OAUTH_TOKEN` is an Actions secret, not a Dependabot secret - AI code review on automated version bumps adds cost without value