ci(connectors-ddl): temporarily disable the lane (manual dispatch only) - #2164
Conversation
Dependabot-triggered pull_request events receive Dependabot secrets, not the repository Actions secrets, so on every dependabot PR the lane fails its credentials preflight in seconds and paints the PR red. The in-repo head guard does not help: dependabot branches live in this repository. Switch the triggers to workflow_dispatch only until the lane comes back with an actor guard (github.actor != 'dependabot[bot]') on the gate job. The jobs themselves are untouched, so re-enabling is a one-hunk revert of this commit plus that guard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Roman Mitasov <Roman.Mitasov@constructor.tech>
📝 WalkthroughWalkthroughThe connectors DDL workflow now runs only through manual ChangesConnectors DDL workflow
Estimated code review effort: 2 (Simple) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/connectors-ddl.yml:
- Around line 42-43: Update the connectors-ddl job gate to allow
workflow_dispatch runs without relying on github.event.pull_request, while
requiring the manually selected ref to be a trusted branch before checkout
executes credential-loaded bootstrap scripts. Keep pull-request gating unchanged
for pull_request events. For regen-pr, either document that it remains
pull-request-only or add the necessary manual-dispatch PR inputs and handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6fb4ef43-f815-4d42-a773-ee89ece1c876
📒 Files selected for processing (1)
.github/workflows/connectors-ddl.yml
| on: | ||
| pull_request: | ||
| branches: [main] | ||
| push: | ||
| branches: [main] | ||
| workflow_dispatch: |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
sed -n '1,90p' .github/workflows/connectors-ddl.yml
echo
sed -n '200,235p' .github.workflow/connectors-ddl.yml 2>/dev/null || sed -n '200,235p' .github/workflows/connectors-ddl.yml
echo
echo "== github.event.pull_request references =="
rg -n "pull_request|workflow_dispatch|github\.event\.|if:|secrets\.|checkout" .github/workflows/connectors-ddl.yml || true
echo
echo "== changed files stat =="
git diff --stat || true
echo
echo "== changed context around relevant lines =="
git diff -- .github/workflows/connectors-ddl.yml | sed -n '1,220p' || trueRepository: constructorfabric/insight
Length of output: 8506
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import re
from pathlib import Path
path = Path('.github/workflows/connectors-ddl.yml')
text = path.read_text()
events = set()
for m in re.finditer(r'^(?! |\s+- |\#).*:\s*$', text, re.M):
line_no = text[:m.start()].count('\n') + 1
name = text[m.start():m.end()-1].strip().rstrip(':') or None
# Collect nested keys until next same indent or non-nested line
start = m.end()
for i in range(start, min(len(text), start + 2000)):
if text[i] == '\n':
next_line = text[i+1:]
if not next_line or next_line[:8].isspace() and next_line.strip().startswith('-'):
pass
else:
j = next_line.find(':')
if j >= 0:
events.add(next_line[:j].strip())
break
print("top-level key near trigger:", text[:240].splitlines()[27].strip() if text[:240].splitlines() else None)
print("top-level keys with workflow_dispatch trigger found:", events & {"push", "pull_request", "workflow_dispatch"})
print("\nRelevant if expressions:")
for i, expr in enumerate([
re.search(r'(?<= )if:', text),
]):
pass
for pat in [
r'if: github\.event_name == \'push\' \|\| github\.event\.pull_request\.head\.repo\.full_name == github\.repository',
r'always\(\) && github\.event_name == \'pull_request\' && needs\.connectors-ddl\.result == \'failure\' && needs\.connectors-ddl\.outputs\.drift == \'true\'',
]:
m = re.search(pat, text, re.S)
if m:
line = text[:m.start()].count('\n') + 1
print(f"{line}: {pat}")
print("\nAll if expressions:")
for i, line in enumerate(text.splitlines(), 1):
s = line.strip()
if s.startswith("if:"):
print(f"{i}: {s}")
print("\ncheckout steps with persist-credentials:")
m = re.finditer(r'- uses: actions/checkout', text)
for mm in m:
line_start = text[:mm.start()].count('\n') + 1
block = '\n'.join(text.splitlines()[text[:mm.start()].count('\n'):text[:mm.start()].count('\n')+8])
print(f"{line_start}:")
print(block)
print("\nSecret-bearing step condition excerpts:")
for i, line in enumerate(text.splitlines(), 1):
if re.search(r'([A-Z_]+_SECRET|ACCESS_TOKEN|CLIENT_ID|INSTANCE_URL):', line):
# print previous non-empty line
for j in range(i-1, 0, -1):
prev=text.splitlines()[j-1].strip()
if prev and not prev.startswith('#') and ('run:' in prev or 'if:' in prev):
fidx=j+1
print(f"{fidx}: {prev}")
break
PYRepository: constructorfabric/insight
Length of output: 273
🌐 Web query:
GitHub Actions workflow_dispatch selected ref github ref documentation
💡 Result:
When you manually trigger a workflow using the workflow_dispatch event, you can specify a branch, tag, or commit SHA using the ref parameter [1][2][3]. This selection is distinct from the default git reference that triggered the workflow run [4][5]. Key distinctions and behaviors include: 1. Request-time Ref: When using the REST API or GitHub CLI to trigger a workflow, you provide a ref as an explicit parameter [1][2][6]. This determines the git reference (e.g., branch or tag) against which the workflow runs [1][2]. 2. Context Variable: The github.ref context variable represents the ref that triggered the workflow run [4][5]. For a manually triggered workflow_dispatch event, github.ref will generally reflect the branch or tag specified during the trigger process [4]. 3. Manual Implementation: If your workflow requires users to select a ref manually, you can define an input in your workflow YAML file [7][8]. Since workflow_dispatch does not automatically provide a dedicated "ref input" field in the UI beyond the execution-time parameter, some developers define a custom input (e.g., named ref) to capture this information as part of the event payload [7][9]. 4. Accessing the Value: You can access the specified ref through the inputs context (e.g., ${{ inputs.ref }}) if you have defined it as an input, or you can rely on the default github.ref context if no custom input is required [7][8][5]. Many developers use a combination like ${{ inputs.ref || github.ref }} to fallback to the default ref if the manual input is not provided [9]. For workflows triggered via the web UI, the user is prompted to select a branch/tag in the "Run workflow" dialog; this selection is passed as the ref for the run [2][6].
Citations:
- 1: https://docs.github.com/en/rest/actions/workflows
- 2: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manually-run-a-workflow
- 3: https://github.com/github/docs/blob/main/content/actions/how-tos/manage-workflow-runs/manually-run-a-workflow.md
- 4: https://docs.github.com/en/actions/reference/workflows-and-actions/variables
- 5: https://github.com/github/docs/blob/main/content/actions/reference/workflows-and-actions/variables.md
- 6: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manually-run-a-workflow?tool=webui
- 7: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax?use_case=
- 8: https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow
- 9: https://github.com/emmercm/maxcso-js/blob/bf4c8ea0174ba59b0b9d3c6b8ba63922370dfbe5/.github/workflows/gh-release-drafter.yml
🌐 Web query:
GitHub Actions workflow_dispatch input selected ref repository branch tag selected input syntax
💡 Result:
In GitHub Actions, the workflow_dispatch event allows you to manually trigger a workflow from the GitHub UI, GitHub CLI, or REST API [1]. When using the GitHub UI, you are automatically provided with a branch selector dropdown, which allows you to choose the Git reference (branch or tag) on which the workflow will execute [1]. You do not need to configure specific input syntax to enable this branch selection; it is a built-in feature of the workflow_dispatch trigger [1]. While the branch selection is automatic in the UI, you can define custom input parameters within your workflow file to further configure the execution [2][3]. The following syntax shows how to define such inputs: name: Manual Workflow on: workflow_dispatch: inputs: logLevel: description: 'Log level' required: true default: 'warning' type: choice options: - info - warning - debug If you are triggering the workflow via the GitHub CLI (gh) or REST API, you must explicitly specify the reference using the --ref flag (CLI) or the ref request body parameter (API) [1]. Key points regarding workflow_dispatch inputs: - UI Branch Selection: The branch selection dropdown is a standard part of the interface for any workflow that includes the workflow_dispatch trigger [1]. - Input Definitions: You can define up to 25 optional or required inputs using types such as string, boolean, choice, number, and environment [1][4][5]. - Accessing Inputs: These inputs are accessible within your workflow jobs using the ${{ github.event.inputs.<input_name> }} context [4][5][2]. If you need to force a workflow to run only on specific branches, you must configure this in the workflow file using branch filters (e.g., on: push: branches: [main]), though this affects other triggers like push and pull_request as well [6][7]. For workflow_dispatch specifically, the UI allows the user to select any branch currently available in the repository [1].
Citations:
- 1: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manually-run-a-workflow?tool=webui
- 2: https://timesofcloud.com/github-actions/workflow-dispatch/
- 3: https://oneuptime.com/blog/post/2026-01-25-github-actions-workflow-dispatch/view
- 4: https://notes.kodekloud.com/docs/GitHub-Actions-Certification/GitHub-Actions-Core-Concepts/workflow-dispatch-Input-Options/page
- 5: https://adhdecode.com/articles/github-actions/github-actions-manual-dispatch-inputs/
- 6: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
- 7: http://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow
Fix the manual-dispatch job gate.
workflow_dispatch does not populate github.event.pull_request; the condition at lines 59-60 is false for every manual run, so the connectors-ddl job is skipped. Add explicit workflow_dispatch logic to the gate, and restrict the selected ref to a trusted branch before checkout runs credential-loaded bootstrap scripts.
regen-pr also remains pull-request-only at line 218. Document this limitation or add the required PR inputs for manual drift remediation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/connectors-ddl.yml around lines 42 - 43, Update the
connectors-ddl job gate to allow workflow_dispatch runs without relying on
github.event.pull_request, while requiring the manually selected ref to be a
trusted branch before checkout executes credential-loaded bootstrap scripts.
Keep pull-request gating unchanged for pull_request events. For regen-pr, either
document that it remains pull-request-only or add the necessary manual-dispatch
PR inputs and handling.
… regen-pr Since "refactor(crm): static schemas + raw_data for salesforce/hubspot" (5355791) every connector's `discover` runs on fake config values, so the lane needs no secrets at all. That dissolves both reasons it was paused (constructorfabric#2164): dependabot-triggered runs no longer have a credentials preflight to fail, and fork PRs validate like any other. * Triggers restored — pull_request + push to main, now filtered to src/ingestion/** plus the lane's own files: the contracts this gate guards cannot move unless something there changes, and dependency bumps elsewhere stop paying a 40-minute bootstrap for nothing. * The regen-pr job, its drift output and the regenerated-snapshot artifact are gone. The gate is validate-only again: on drift or field-parity findings it fails loudly with the reason, the diff (inline + artifact) and the regeneration recipe — which any contributor can now run locally, credentials-free, via the one-block in scripts/bootstrap-db/README.md. The stacked-PR delivery existed to spare authors a regeneration they could not perform without CRM credentials; with that constraint gone it is machinery without a purpose, and validate-only keeps write tokens out of the workflow entirely. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Roman Mitasov <Roman.Mitasov@constructor.tech>
2 participants
Why
Since #2133 merged, the connectors-ddl lane fails on every dependabot PR — this morning's whole dependabot batch is red. Root cause: Dependabot-triggered
pull_requestevents receive Dependabot secrets, not the repository Actions secrets, soHUBSPOT_ACCESS_TOKEN/SALESFORCE_*are empty and the credentials preflight fails in seconds (by design — it fails fast instead of 20 minutes into the bootstrap). The in-repo head guard does not filter these PRs: dependabot branches live in this repository.What
Triggers switched to
workflow_dispatchonly; both jobs are untouched. Manual runs remain possible from the Actions tab.Re-enabling
One-hunk revert of this commit plus an actor guard on the gate job:
(Alternative: add the four secrets as Dependabot secrets too — but running a 40-minute bootstrap on dependency bumps is waste, dependabot PRs rarely touch connector schemas.)
The lane is not a required check, so the reds were noise rather than blockers — but noise on every dependabot PR trains people to ignore the gate, which is worse than pausing it.
🤖 Generated with Claude Code
Summary by CodeRabbit