From cc6c57994581d439c5558257c32d7b27b1cdef95 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= <freben@spotify.com>
Date: Thu, 5 Mar 2026 19:08:22 +0100
Subject: [PATCH] ci: add upfront dependabot branch check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the branch verification to a separate step right after checkout,
and gate all subsequent steps on its output. Removes the redundant
branch check from inside the changeset generation script.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
---
 .../workflows/sync_dependabot-changesets.yml  | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/sync_dependabot-changesets.yml b/.github/workflows/sync_dependabot-changesets.yml
index 4f9c90a363..4f3bbee376 100644
--- a/.github/workflows/sync_dependabot-changesets.yml
+++ b/.github/workflows/sync_dependabot-changesets.yml
@@ -21,15 +21,27 @@ jobs:
           fetch-depth: 2
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
+      - name: Verify Dependabot branch
+        id: verify
+        run: |
+          if git branch --show-current | grep -q '^dependabot/'; then
+            echo "is_dependabot=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Not a dependabot branch, skipping"
+            echo "is_dependabot=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git
+        if: steps.verify.outputs.is_dependabot == 'true'
         run: |
           git config --global user.email noreply@backstage.io
           git config --global user.name 'Github changeset workflow'
       - name: Setup Node
+        if: steps.verify.outputs.is_dependabot == 'true'
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: 22.x
       - name: Dedupe lockfiles
+        if: steps.verify.outputs.is_dependabot == 'true'
         id: dedupe
         run: |
           corepack enable
@@ -48,6 +60,7 @@ jobs:
 
           echo "changed=$changed" >> "$GITHUB_OUTPUT"
       - name: Generate changeset
+        if: steps.verify.outputs.is_dependabot == 'true'
         id: changeset
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -73,12 +86,6 @@ jobs:
               await fs.writeFile(fileName, body);
             }
 
-            const branch = await exec.getExecOutput('git branch --show-current');
-            if (!branch.stdout.startsWith('dependabot/')) {
-              console.log('Not a dependabot branch, skipping');
-              return;
-            }
-
             const diffOutput = await exec.getExecOutput('git diff --name-only HEAD~1');
             const diffFiles = diffOutput.stdout.split('\n');
 
@@ -104,7 +111,7 @@ jobs:
             await exec.exec('git', ['add', fileName]);
             core.setOutput('changed', 'true');
       - name: Commit and push
-        if: steps.dedupe.outputs.changed == 'true' || steps.changeset.outputs.changed == 'true'
+        if: steps.verify.outputs.is_dependabot == 'true' && (steps.dedupe.outputs.changed == 'true' || steps.changeset.outputs.changed == 'true')
         run: |
           git commit -C HEAD --amend --no-edit
           git push --force