Sometimes GH Action doesn't see CYPRESS_RECORD_KEY variable

We have a private GitHub repository setup with tests configured to run when a push happens. The action runs both when people create a pull request (e.g. push to a new branch) and when they merge to master. The action is configured with cypress-io/github-action@v2.

Recently we started getting test failures (the workflow is red) because the action can’t record the test results. The test still run fine. The cause is CYPRESS_RECORD_KEY is not set.

Normally I see this in the log:

  env:
    CYPRESS_RECORD_KEY: ***
    GITHUB_TOKEN: ***

But when the failure occurs I see this:

  env:
    CYPRESS_RECORD_KEY: 
    GITHUB_TOKEN: ***

... many lines of test results left out ...

You passed the --record flag but did not provide us your Record Key.

This doesn’t occurs all the time. It looks like the failure occurs on new PRs, while the merges continue to work. It’s the same repository and yml file, so I don’t understand why one would pick up the variable and the other wouldn’t. The changes being tested aren’t around the GH Action workflow.

I am not 100% sure, but this seemed to start with Cypress 9.1.0.

When we first upgraded to 9.1, there was a disconnect between Cypress and GitHub that caused the same issue - failing to record test results. I had to re-add one of our repositories to the Cypress “Installed GitHub Application” for the GH organization. This was strange as we have 2 repos that run cypress and only one of them was missing. This worked, but then I noticed that not all test runs were getting recorded.

BTW, we upgraded to 9.1.1 today and the issue still occurs.

[mellis481]

@skjnldsv It’s a Dependabot-thing, not specific to the cypress-io/github-action action. It would affect any Github Actions job/step that relies on an Actions secret when that workflow is triggered by Dependabot.

[mellis481]

Hello! It’s still happening for me I restarted the job and suddenly, it passed magically 🤷

This is because workflows triggered by Dependabot PRs will run with read-only permissions and Dependabot does not currently have access to Actions secrets. This is a result of the change that @bdelavega-maralytix linked. When a workflow is manually triggered (like when you re-ran your job), it will run with the permissions of the user triggering the run.

In my case, my Dependabot-triggered workflow no longer had access to an Actions secret which I was using in my cypress-io/github-action. The solution for me was simple: duplicate the secret as a Dependabot secret which Dependabot-triggered workflows have access to.