From cc14afcc156ee579833b69ed4e21d0d5dbf335d6 Mon Sep 17 00:00:00 2001
From: Simon Scatton <44714756+SDAChess@users.noreply.github.com>
Date: Mon, 26 Oct 2026 14:40:34 +0000
Subject: [PATCH] fix(ci): exempt Dependabot PRs from issue acceptance (#4928)

Signed-off-by: Simon Scatton <sscatton@nvidia.com>
---
 tasks/scripts/check_issue_acceptance.cjs      |  5 ++++
 tasks/scripts/check_issue_acceptance.test.cjs | 25 ++++++++++++++++---
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/tasks/scripts/check_issue_acceptance.cjs b/tasks/scripts/check_issue_acceptance.cjs
index 8b81ef82f..b8420f885 100644
--- a/tasks/scripts/check_issue_acceptance.cjs
+++ b/tasks/scripts/check_issue_acceptance.cjs
@@ -8,6 +8,11 @@ module.exports = async function checkIssueAcceptance({ github, context, core })
   });
   const author = pr.user.login;
 
+  if (author === 'dependabot[bot]') {
+    core.info('Dependabot PRs are exempt from issue acceptance.');
+    return;
+  }
+
   async function evaluate() {
     try {
       const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
diff --git a/tasks/scripts/check_issue_acceptance.test.cjs b/tasks/scripts/check_issue_acceptance.test.cjs
index 443c8edaf..46746f62c 100644
--- a/tasks/scripts/check_issue_acceptance.test.cjs
+++ b/tasks/scripts/check_issue_acceptance.test.cjs
@@ -8,6 +8,7 @@ const checkIssueAcceptance = require('./check_issue_acceptance.cjs');
 async function check({
   permission = 'read', issues = [], body = '', permissionError,
   number = 7, headSha = 'pr-head', pullError, issueError, labelError,
+  author = 'contributor', actor = 'maintainer',
 } = {}) {
   const failures = [];
   const github = {
@@ -17,13 +18,13 @@ async function check({
           assert.equal(pull_number, number);
           if (pullError) throw new Error('PR lookup failed');
           return { data: {
-            number, user: { login: 'contributor' }, head: { sha: headSha }, body,
+            number, user: { login: author }, head: { sha: headSha }, body,
           } };
         },
       },
       repos: {
         getCollaboratorPermissionLevel: async ({ username }) => {
-          assert.equal(username, 'contributor');
+          assert.equal(username, author);
           if (permissionError) throw Object.assign(new Error('lookup failed'), { status: permissionError });
           return { data: { permission } };
         },
@@ -53,13 +54,31 @@ async function check({
     context: {
       repo: { owner: 'NVIDIA', repo: 'OpenShell' },
       payload: { pull_request: { number } },
-      actor: 'maintainer', sha: 'base-commit', serverUrl: 'https://github.com', runId: 42,
+      actor, sha: 'base-commit', serverUrl: 'https://github.com', runId: 42,
     },
     core: { info() {}, setFailed: message => failures.push(message) },
   });
   return failures;
 }
 
+test('Dependabot PRs pass without permission or issue lookups', async () => {
+  assert.deepEqual(await check({
+    author: 'dependabot[bot]', permissionError: 403, issueError: true,
+  }), []);
+});
+
+test('other bots still require an accepted issue', async () => {
+  const failures = await check({ author: 'renovate[bot]' });
+  assert.equal(failures.length, 1);
+  assert.match(failures[0], /must link an issue with state:accepted/);
+});
+
+test('Dependabot triggering another author\'s PR does not bypass acceptance', async () => {
+  const failures = await check({ actor: 'dependabot[bot]' });
+  assert.equal(failures.length, 1);
+  assert.match(failures[0], /must link an issue with state:accepted/);
+});
+
 for (const permission of ['write', 'maintain', 'admin']) {
   test(`${permission} access allows an issue-less PR`, async () => {
     assert.deepEqual(await check({ permission }), []);