Giters

actions / add-to-project

Automate adding issues and pull requests to GitHub projects

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

dependabot labeled PRs do not add to project

gkwan-ibm opened this issue · comments

commented

I created a action:

name: Add PRs to Dependabot PRs dashboard

on:
  pull_request:
    types:
      - labeled

jobs:
  add-to-project:
    name: Add PR to dashboard
    runs-on: ubuntu-latest
    steps:
      - uses: actions/add-to-project@v0.5.0
        with:
          project-url: https://github.com/orgs/...
          github-token: ${{ secrets.ADMIN_BACKLOG }}
          labeled: dependencies

This action works to add the PR to the project if I manually add the dependencies label.
But, the dependabot created PRs (the Bump PRs) do not automatically add to the project.

commented

Seems to be this reason.

Error: Input required and not supplied: github-token
commented

The dependabot creates branch and PR in the repo, not from a fork, why the above action does not work?

commented

from the docs: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow

When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN, with the exception of workflow_dispatch and repository_dispatch, will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs. For example, if a workflow run pushes code using the repository's GITHUB_TOKEN, a new workflow will not run even when the repository contains a workflow configured to run when push events occur.

So if you want to respond to events that are triggered by bots you have two options:

commented

The token I used is my personal token. Again, manually label PR works fine.

The question is "Why the dependabot labeled PRs (the Bump PRs) does not work?"

commented

The token I used is my personal token

ah, my bad

Why the dependabot labeled PRs (the Bump PRs) does not work?

you cannot have a bot apply a label and then have the https://docs.github.com/en/webhooks/webhook-events-and-payloads?actionType=labeled#pull_request event trigger another workflow. So likely your issue is that the label is applied by dependabot. Our workaround is as I mentioned to have a cron job do this: https://github.com/neurobagel/planning/blob/3790a983b3c6aacf7eaabef05895b68cd200b99a/.github/workflows/global_move_bot_pr_to_board.yml

commented

How's about opened? I tried it and also not work. Same reason?

on:
  pull_request:
    types:
      - opened
commented

@surchs did you find another solution to this? I had a look round some of the neurobagal repos and I can see your not using it anymore. Did it not work as expected? I'm currently trying find a solution to adding dependabot prs from around 20-30 repos to a project.