ci: skip secret-consuming live jobs on Dependabot PRs

[coderdan]

Problem

Dependabot PRs (e.g. #689, a dev-dependency bump) hard-fail the live integration jobs, blocking them on something Dependabot can't fix.

Dependabot branches live in this repo, so the existing fork gate — github.event.pull_request.head.repo.full_name == github.repository — is true for them, and the secret-consuming live jobs run. But Dependabot PRs execute under the Dependabot secret store, a separate/narrower set than Actions secrets: it carries CS_* but not the identity suites' CLERK_MACHINE_TOKEN. The lock-context integration suite is deliberately fail-not-skip (a green skip could hide a regression), so it throws when the token is absent — and the whole Drizzle v3 integration job goes red on a change Dependabot cannot fix. #689 tripped it because the bump touches packages/test-kit/**, an integration trigger path.

Fix

Give Dependabot PRs the same clean skip fork PRs already get: add github.actor != 'dependabot[bot]' to the job-level gate on all five secret-consuming workflows:

• integration-drizzle.yml
• integration-supabase.yml
• integration-prisma-next.yml
• prisma-next-e2e.yml
• prisma-example-readme-e2e.yml

A skipped required job reports success, so the PR is no longer blocked; tests.yml + the frozen-lockfile / OSV checks remain the real signal for a dependency bump. Not running live, secret-backed jobs on semi-trusted Dependabot PRs is also the supply-chain-safer default (aligns with the repo's supply-chain controls).

After merge

@dependabot rebase on #689 (and future Dependabot PRs) so its run picks up the updated gate and the live jobs skip cleanly.

Notes

• CI-only change; no published package surface touched, so no changeset.
• Push events are unaffected (github.actor is never dependabot[bot] on a push to main).

https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

Summary by CodeRabbit

• Chores
  • Updated automated integration and end-to-end checks to skip Dependabot pull requests when required secrets are unavailable.
  • Checks continue to run for pushes and eligible pull requests from the repository.
  • Preserved existing handling for pull requests from forks, ensuring workflows do not run when required credentials cannot be accessed.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ebb0f18

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 32370b62-6645-42d8-8b1f-f986e57766a8

📥 Commits

Reviewing files that changed from the base of the PR and between a2f80ea and ebb0f18.

📒 Files selected for processing (5)

• .github/workflows/integration-drizzle.yml
• .github/workflows/integration-prisma-next.yml
• .github/workflows/integration-supabase.yml
• .github/workflows/prisma-example-readme-e2e.yml
• .github/workflows/prisma-next-e2e.yml

---

📝 Walkthrough

Walkthrough

GitHub Actions integration and end-to-end jobs now skip Dependabot pull request runs while continuing to run for pushes and eligible same-repository pull requests. The Supabase workflow also documents fork and Dependabot secret restrictions.

Changes

CI workflow gating

Layer / File(s)	Summary
Dependabot-aware workflow conditions .github/workflows/integration-*.yml, .github/workflows/prisma-*-e2e.yml, .github/workflows/prisma-example-readme-e2e.yml	Job-level conditions exclude dependabot[bot] for pull request events while preserving push and same-repository pull request execution; Supabase adds explanatory comments.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: calvinbrewer

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: skipping secret-consuming CI jobs on Dependabot pull requests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/skip-live-jobs-on-dependabot

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderdan]

Closing — wrong approach. Rather than skipping live jobs on Dependabot PRs (which changes the security posture), the dependency bump in #689 will be re-authored as a maintainer PR so it runs under the normal Actions CI context.