ci: bypass do gate pr-author-org-member para PRs de bots#379
Merged
Conversation
Adicionado para destravar PRs do Dependabot (e qualquer bot futuro como
github-actions, Renovate). Bots não são "members" no sentido
organizacional — endpoint /collaborators/{login}/permission retorna 404
para bot logins, fazendo o gate sempre falhar.
Bypass explícito via github.event.pull_request.user.type == 'Bot'
preserva a semântica para humanos: o step seguinte só roda quando
type != 'Bot', mantendo a validação intacta de membership real
(permission write/admin/maintain + não-outside-collaborator).
Sem condicional, todos os PRs Dependabot ficariam bloqueados pelo
status check obrigatório, exigindo --admin merge — anti-pattern.
jf2s
approved these changes
May 10, 2026
Contributor
jf2s
left a comment
jf2s
left a comment
There was a problem hiding this comment.
Aprovado. Bypass minimal para bots (user.type == 'Bot') preserva validação para humanos no step seguinte. CI 8/8 verde.
This was referenced May 10, 2026
marmota-alpina
added a commit
that referenced
this pull request
May 10, 2026
Substitui os 6 PRs Dependabot abertos automaticamente após o merge da config #369 — todos fechados sem merge por dois bloqueios estruturais: gate org-member para bot (resolvido em #379) e lockfile drift transitivo NU1004 com --locked-mode. Em vez de esperar nova rodada semanal, batch manual regenera todos os 17 packages.lock.json via dotnet restore --force-evaluate. Directory.Packages.props - WolverineFx + companion EFC/Postgresql/Kafka: 5.32.1 → 5.39.0 (7 minors) - Microsoft.EntityFrameworkCore + companion InMemory/Relational/Design: 10.0.5 → 10.0.7 (2 patches) - Npgsql: 9.0.4 → 10.0.2 (major — validado via suite Outbox/Cascading completa: 71 testes integration Selecao + 10 Infra.Core, todos verdes) - OpenTelemetry.Extensions.Hosting: 1.15.2 → 1.15.3 (alinha com Exporter já em 1.15.3 entregue na Story #30) - Microsoft.NET.Test.Sdk: 18.3.0 → 18.5.1 (minor) - Microsoft.AspNetCore.Mvc.Testing: 10.0.0 → 10.0.7 (patches) .config/dotnet-tools.json - dotnet-reportgenerator-globaltool: 5.5.4 → 5.5.10 (6 patches) Validação - dotnet restore --force-evaluate: 20 projetos restaurados sem NU1004 - dotnet build UniPlus.slnx: 0 warning, 0 error (TreatWarningsAsErrors) - dotnet test UniPlus.slnx: 629 testes verdes, 0 falhas - 540 unit + arch - 8 Ingresso.IntegrationTests - 10 Infrastructure.Core.IntegrationTests (inclui OTel wiring E2E) - 71 Selecao.IntegrationTests (Outbox/Cascading com Wolverine 5.39 + EF Core 10.0.7 + Npgsql 10.0.2 reais via Testcontainers) Closes #380
This was referenced May 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resumo
Destrava PRs do Dependabot (e qualquer bot futuro — github-actions, Renovate) que ficavam bloqueados pelo gate
PR author is org member. Bots não passam pelo endpoint/collaborators/{login}/permission(retorna 404 para bot logins), fazendo o status check obrigatório sempre falhar.Mudança
Step novo no início do job que bypass explícito quando
user.type == 'Bot'. Step seguinte ganha condiçãoif: user.type != 'Bot'para preservar a validação para humanos.Por que bypass + nominal em vez de reescrever o gate
write/admin/maintain+ não-outside-collaborator)user.loginaparece no log do bypass step (dependabot[bot],github-actions[bot], etc.)user.type == 'Bot'é genérico — vale para qualquer bot integrationAlternativa rejeitada:
--adminmerge para cada PR DependabotAnti-pattern que mascara CI failures e quebra histórico de status checks como evidência de aprovação. Bypass explícito do gate é o caminho correto.
Impacto
Após mergeado, os PRs Dependabot atuais (#371, #373, #374) precisam re-disparar CI (ou rebase em main) para o status
PR author is org membervirar SUCCESS — então conseguem mergear normalmente.