Renovate workflow: bot edits of the dashboard issue re-trigger Renovate (defective if: gate)

[marcusrbrown]

Problem

The Renovate caller (.github/workflows/renovate.yaml) has a defective job condition:

if: >
  (github.event.action == 'edited' && !contains(github.actor, '[bot]')) ||
  (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success')

The second clause is true for every event other than workflow_run, so the non-bot check in the first clause never gates anything. A Renovate bot edit of the dashboard issue (checking or unchecking a box) re-triggers Renovate.

Fix

Three disjoint branches — edits require a non-bot actor, push and dispatch always run, workflow_run requires a successful conclusion:

# Edits (dashboard checkbox) run only for non-bot actors; pushes and
# dispatches always run; workflow_run runs only after a successful CI.
if: >
  (github.event.action == 'edited' && !contains(github.actor, '[bot]')) ||
  (github.event.action != 'edited' && github.event_name != 'workflow_run') ||
  (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')

Landed in marcusrbrown/panthea#25 (reviewed there). actionlint passes on the replacement.

[fro-bot]

Triage

Confirmed defective. I read .github/workflows/renovate.yaml:37-39 on main (HEAD a3440c7) and the condition matches the issue exactly:

if: >
  (github.event.action == 'edited' && !contains(github.actor, '[bot]')) ||
  (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success')

Reproduction (static — logic trace, no live trigger needed)

For a Renovate-bot edit of the dashboard-tracking issue (event: issues, action: edited, actor: renovate[bot]):

• Clause 1: action == 'edited' → true, !contains(actor, '[bot]') → false (actor is a bot) → clause 1 = false
• Clause 2: event_name != 'workflow_run' → 'issues' != 'workflow_run' → true → clause 2 = true (short-circuits before the conclusion check)
• Overall: false || true = true → job runs

So the second clause's event_name != 'workflow_run' disjunct is true for every non-workflow_run event (issues, pull_request, push, workflow_dispatch), which makes clause 2 always satisfy the if regardless of clause 1. The intended bot-gate on issues/edited is dead code — confirmed by git blame: this exact condition has existed unchanged since the workflow was created in b664808 (only the pinned bfra-me/.github action ref has since been bumped, most recently in #1431). No fix has landed in this repo.

Practical effect: every time Renovate (or any [bot] actor) edits the dashboard issue — e.g. toggling a checkbox — this workflow re-triggers itself on the issues/edited event, since the intended non-bot gate never applies.

Proposed fix

The issue body already proposes a corrected, three-disjoint-branch condition (previously landed and reviewed in marcusrbrown/panthea#25, reported to pass actionlint):

# Edits (dashboard checkbox) run only for non-bot actors; pushes and
# dispatches always run; workflow_run runs only after a successful CI.
if: >
  (github.event.action == 'edited' && !contains(github.actor, '[bot]')) ||
  (github.event.action != 'edited' && github.event_name != 'workflow_run') ||
  (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')

Verifying the branches are disjoint and cover the intended cases:

• edited (issues/PR) → only branch 1 applies → gated on non-bot actor ✅
• push / workflow_dispatch (action is unset/not edited, not workflow_run) → only branch 2 applies → always runs ✅
• workflow_run → only branch 3 applies → gated on conclusion == 'success' ✅

I did not have actionlint available in this environment to re-verify the syntax locally, but the expression is a straightforward boolean rewrite of the existing pinned action's if: string and follows the same GitHub Actions expression syntax already in use in this file.

Next steps

1. Apply the corrected if: condition to .github/workflows/renovate.yaml (single-line change, no other file touched).
2. Open a PR; since the fix is already reviewed/landed in a sibling repo (marcusrbrown/panthea#25), this should be a low-risk, fast-track port.
3. No test coverage exists for this workflow's trigger conditions (workflows aren't covered by bun test) — consider a follow-up note in docs/solutions/ once fixed, since this is a subtle boolean-logic gate bug that could recur in other conditionally-triggered workflows in this repo (e.g. release-alert.yaml uses a simpler, correctly-scoped version of the same pattern and is a useful reference for the right shape).
4. No live re-trigger reproduction was run (would require simulating a bot edit against the actual GitHub Actions runner); the static trace above is conclusive given the condition is pure boolean logic over well-defined event fields.

---

Run Summary

Field	Value
Event	issues
Repository	marcusrbrown/infra
Run ID	36353515128
Cache	hit
Session	ses_f1b210d37ffeAjl1RQJh5SMlFe