cistack 5.3.0 → 5.4.0

package/README.md

@@ -89,6 +89,8 @@ By default, `cistack` now generates a single GitHub Actions workflow that combin
 
 Dependabot remains a separate file in `.github/dependabot.yml`, because it is not a GitHub Actions workflow.
 
+If you want preview deployments on Dependabot pull requests, add deployment credentials as Dependabot secrets too, not only Actions secrets. For Vercel, that means `VERCEL_TOKEN`, `VERCEL_ORG_ID`, and `VERCEL_PROJECT_ID`.
+
 ### Split mode
 
 If you prefer the old multi-file layout, set:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cistack",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "description": "Automatically generate GitHub Actions CI/CD pipelines by analysing your codebase",
   "main": "src/index.js",
   "types": "index.d.ts",

package/src/generators/workflow.js

@@ -422,7 +422,7 @@ class WorkflowGenerator {
     if (previewSteps.length > 0) {
       jobs.preview = {
         name: `✨ Deploy → ${h.name} (Preview)`,
-        if: "github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository",
+        if: "github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository",
         'runs-on': 'ubuntu-latest',
         environment: 'preview',
         steps: [
@@ -430,7 +430,7 @@ class WorkflowGenerator {
           ...previewSteps,
           {
             name: 'Comment PR',
-            if: 'always()',
+            if: "always() && github.actor != 'dependabot[bot]'",
             uses: 'actions/github-script@v7',
             with: {
               script: `

package/tests/run.js

@@ -560,7 +560,7 @@ test('Netlify preview configuration uses the detected production branch instead
   assert.equal(previewStep.with['production-branch'], 'release');
 });
 
-test('Preview deploy jobs only run for same-repo pull requests with secrets access', () => {
+test('Preview deploy jobs run for same-repo pull requests, including Dependabot PRs', () => {
   const projectDir = makeTempDir();
   writeFiles(projectDir, {
     'package.json': json({
@@ -582,11 +582,13 @@ test('Preview deploy jobs only run for same-repo pull requests with secrets acce
 
   const deploy = generator.generate().find((workflow) => workflow.filename === 'deploy.yml');
   const parsed = parseWorkflow(deploy.content);
+  const commentStep = parsed.jobs.preview.steps.find((step) => step.name === 'Comment PR');
 
   assert.equal(
     parsed.jobs.preview.if,
-    "github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository"
+    "github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository"
   );
+  assert.equal(commentStep.if, "always() && github.actor != 'dependabot[bot]'");
 });
 
 test('Generic JavaScript builds no longer upload a fake dist artifact when no build directory is known', () => {