`fetch-metadata` can not fetch metadata when using `workflow_run` event

[kimnh-0823]

Errror

I'm using mono-repository for the microservices:

• Dependabot opens PR for Microservice 1 (Ex: path: /src/microservices-1/*)
• The workflow CI for Microservice 1 is triggered.
• The workflow Dependabot is triggered after CI for Microservice 1 passed
• The workflow Dependabot shows error.

It says:

Warning: Event payload missing `pull_request` key. Make sure you're triggering this action on the `pull_request` or `pull_request_target` events.
Error: PR is not from Dependabot, nothing to do.

Expect

The workflow Dependabot can fetch metadata in this case.

My workflow

name: Dependabot
on:
  workflow_run:
    workflows:
      - CI for Microservice 1
      - CI for Microservice 2
    types:
      - completed

permissions:
  contents: write
  pull-requests: write

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: |-
      github.actor == 'dependabot[bot]' &&
      github.event.workflow_run.conclusion == 'success'
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v1
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Enable auto-approve non-major updates
        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
      - name: Enable auto-merge non-major updates
        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
        run: gh pr merge --auto --merge "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

[GersonTf]

I just created this bug: #498

but I realize now that my issue is the same as yours. Did you find any workaround?

[dfmpinto]

I'm also struggling with this issue. Any workarounds?

[ppkarwasz]

We’d also like to use this action with events beyond just pull_request and pull_request_target. In our case, our workflow modifies Dependabot PRs by adding changelog files, and to simplify the security audit on the workflow, we prefer to trigger this on push rather than pull_request_target.

However, it looks like the current implementation blocks support for push and similar events due to this section of code:

fetch-metadata/src/dependabot/util.ts

Lines 18 to 21 in 496eb7a

	export function getBranchNames (context: Context): branchNames {
	const { pull_request: pr } = context.payload
	return { headName: pr?.head.ref || '', baseName: pr?.base.ref }
	}

Would it be possible to expand support or make this check more flexible for other event types?

[jorge-moreira]

@dependabot/maintainers any update on this?
2 years have passed and this is still a problem