From 1486078265f42aa977c17f5335f9dfd3ab8ef881 Mon Sep 17 00:00:00 2001
From: J3vb <192430104+J3vb@users.noreply.github.com>
Date: Tue, 4 Aug 2026 17:19:33 +0200
Subject: [PATCH] ci: skip the Tauri full build on Dependabot PRs (#1325)

Dependabot PRs run under the separate `dependabot` secrets scope, so
TAURI_SIGNING_PRIVATE_KEY arrives empty and `npm run tauri build` always
aborted with "failed to decode secret key" while signing the updater
artifact -- after the compile and the NSIS/AppImage/deb bundle had both
already succeeded. Every dependency PR therefore burned ~50 min of runner
time across three platforms to produce a red check carrying no signal,
and the permanent red masked whether the job would have caught a real
break.

Granting Dependabot the signing secret would clear the symptom but hands
a release signing key to workflows triggered by third-party dependency
updates, so the job is skipped for that actor instead.

Coverage is preserved where it matters: `rust-tests` is a required check,
runs on every event, and compiles the crate via `cargo clippy
--all-targets` and `cargo test --lib`, so a dependency bump that breaks
the Rust build is still caught. Given up on Dependabot PRs only:
bundling, Windows/ARM-specific compilation, and the `cargo audit` step --
which overlaps with Dependabot's own cargo scanning.

`Tauri Full Build` is not among the required status checks on main
(Server Build & Test x2, Client Static Checks, Client Unit Tests, Rust
Unit Tests), so skipping it cannot leave a PR waiting on a status.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d78b7804..7fb5ea52 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -341,11 +341,30 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  # Full Tauri build only on PRs to main (expensive: ~15 min x2 multiplier)
+  # Full Tauri build only on PRs to main (expensive: ~15 min x2 multiplier).
+  #
+  # Skipped for Dependabot: its PRs run under the separate `dependabot` secrets
+  # scope, so TAURI_SIGNING_PRIVATE_KEY arrives empty and `npm run tauri build`
+  # always aborts with "failed to decode secret key" while signing the updater
+  # artifact — after a successful compile and bundle. That burned ~50 min of
+  # runner time per dependency PR to produce a red check that never carried any
+  # signal. Granting Dependabot the signing key would fix the symptom but hands
+  # a release key to workflows triggered by third-party dependency updates.
+  #
+  # What still covers Dependabot PRs: the required `rust-tests` job compiles the
+  # crate (cargo clippy --all-targets + cargo test --lib), so a dependency bump
+  # that breaks the Rust build is still caught.
+  # What this gives up on those PRs: bundling (NSIS/AppImage/deb), Windows and
+  # ARM-specific compilation, and the `cargo audit` step below — that last one
+  # overlaps with Dependabot's own cargo scanning, which is what opens these PRs
+  # in the first place.
   tauri-build:
     name: Tauri Full Build (${{ matrix.os }})
     needs: client-check
-    if: github.event_name == 'pull_request' && github.base_ref == 'main'
+    if: >-
+      github.event_name == 'pull_request'
+      && github.base_ref == 'main'
+      && github.actor != 'dependabot[bot]'
     strategy:
       fail-fast: false
       matrix: