Dependabot GITHUB_TOKEN does not trigger workflows in CI
By design, events created using the built-in GITHUB_TOKEN (including Dependabot pushes) do not trigger new workflow runs, to prevent recursive runs. If your checks only run on push or on tokens, a Dependabot PR can sit with no checks and block automerge.
What this error means
A Dependabot PR shows "Expected - Waiting for status to be reported" indefinitely, or no workflows appear at all, so required checks never pass.
This branch has not been checked yet.
Expected - Waiting for status to be reported (required)Common causes
Workflows only trigger on events the token cannot raise
A push made with GITHUB_TOKEN does not start new runs. If a required check only listens on such events, it never fires for Dependabot commits.
Required checks are gated behind the wrong trigger
The check runs on push but the branch protection expects it on pull_request, so the Dependabot PR waits forever.
How to fix it
Trigger CI on pull_request events
- Ensure required checks run on
pull_request(which Dependabot PRs raise). - Do not rely on a
GITHUB_TOKENpush to start them. - Confirm the check names match the required contexts in branch protection.
on:
pull_request:
push:
branches: [main]Use a PAT or app token when a re-trigger is required
If you must push commits that themselves start workflows, use a personal access token or GitHub App token stored as a Dependabot secret instead of the default token.
How to prevent it
- Run required checks on
pull_requestso Dependabot PRs are always checked. - Match required check contexts exactly to workflow job names.
- Reserve PAT/app tokens for cases that must re-trigger workflows.