From 92341db8d604c99ed1e989c0a99ce9496a4fba9b Mon Sep 17 00:00:00 2001
From: zinduolis <ilgakulnis@gmail.com>
Date: Fri, 29 May 2026 13:55:53 +1000
Subject: [PATCH 1/2] CI: trigger BrowserStack directly on Dependabot PRs

The default GITHUB_TOKEN cannot trigger downstream workflows, so the
safe_to_test label added by dependabot_auto_label.yml never started the
BrowserStack run. Trigger BrowserStack directly for Dependabot PRs on
opened/synchronize/reopened, keep the safe_to_test label opt-in for human
PRs, and remove the now-redundant auto-label workflow.
---
 .github/workflows/dependabot_auto_label.yml | 35 ---------------------
 .github/workflows/github_actions.yml        |  8 +++--
 2 files changed, 6 insertions(+), 37 deletions(-)
 delete mode 100644 .github/workflows/dependabot_auto_label.yml

diff --git a/.github/workflows/dependabot_auto_label.yml b/.github/workflows/dependabot_auto_label.yml
deleted file mode 100644
index 9ad939e39..000000000
--- a/.github/workflows/dependabot_auto_label.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: 'Auto-label Dependabot PRs'
-
-on:
-  pull_request_target:
-    branches: [ master ]
-    types: [ opened, synchronize ]
-
-jobs:
-  auto-label:
-    name: 'Apply safe_to_test for Dependabot'
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Add safe_to_test label'
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const issue_number = context.payload.pull_request.number;
-
-            // Remove first so re-adding always fires a labeled event,
-            // which triggers the BrowserStack workflow.
-            try {
-              await github.rest.issues.removeLabel({
-                owner, repo, issue_number,
-                name: 'safe_to_test'
-              });
-            } catch (e) {
-              if (e.status !== 404) throw e;
-            }
-
-            await github.rest.issues.addLabels({
-              owner, repo, issue_number,
-              labels: ['safe_to_test']
-            });
diff --git a/.github/workflows/github_actions.yml b/.github/workflows/github_actions.yml
index 85600e868..e95f960c0 100644
--- a/.github/workflows/github_actions.yml
+++ b/.github/workflows/github_actions.yml
@@ -3,7 +3,7 @@ name: 'BrowserStack Test'
 on:
   pull_request_target:
     branches: [ master ]
-    types: [ labeled ]
+    types: [ opened, synchronize, reopened, labeled ]
 
 jobs:
   ubuntu-job:
@@ -12,12 +12,16 @@ jobs:
     concurrency:
       group: browserstack-${{ github.event.pull_request.number }}
       cancel-in-progress: true
-    if: github.event.label.name == 'safe_to_test'
+    # Auto-run for Dependabot; let humans opt in via the safe_to_test label.
+    if: >-
+      (github.event.pull_request.user.login == 'dependabot[bot]' && github.event.action != 'labeled') ||
+      github.event.label.name == 'safe_to_test'
     env:
       GITACTIONS: true
     steps:
 
       - name: 'Remove safe_to_test label'
+        if: github.event.action == 'labeled'
         uses: actions/github-script@v8
         with:
           script: |

From 420681489c2e9605e9ba0cb0e0ef745035ecc3e8 Mon Sep 17 00:00:00 2001
From: zinduolis <ilgakulnis@gmail.com>
Date: Fri, 29 May 2026 14:11:37 +1000
Subject: [PATCH 2/2] Require Dependabot actor for auto-run BrowserStack tests

Also gate the auto-run condition on github.actor == 'dependabot[bot]' so
commits pushed to a Dependabot PR by anyone else fall back to the explicit
safe_to_test opt-in instead of running automatically with secret access.
---
 .github/workflows/github_actions.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/github_actions.yml b/.github/workflows/github_actions.yml
index e95f960c0..6fd5bf34c 100644
--- a/.github/workflows/github_actions.yml
+++ b/.github/workflows/github_actions.yml
@@ -13,8 +13,12 @@ jobs:
       group: browserstack-${{ github.event.pull_request.number }}
       cancel-in-progress: true
     # Auto-run for Dependabot; let humans opt in via the safe_to_test label.
+    # Require the triggering actor to also be Dependabot so commits pushed by
+    # anyone else fall back to the explicit safe_to_test opt-in.
     if: >-
-      (github.event.pull_request.user.login == 'dependabot[bot]' && github.event.action != 'labeled') ||
+      (github.event.pull_request.user.login == 'dependabot[bot]' &&
+       github.actor == 'dependabot[bot]' &&
+       github.event.action != 'labeled') ||
       github.event.label.name == 'safe_to_test'
     env:
       GITACTIONS: true