ci: skip secret-consuming live jobs on Dependabot PRs

.github/workflows/integration-drizzle.yml

@@ -76,7 +76,12 @@ jobs:
       cancel-in-progress: false
     # Fork PRs have no secrets. Skip cleanly rather than fail on something the
     # contributor cannot fix — `tests.yml` still gives them a green signal.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # Dependabot PRs are skipped for the same reason: they run under the
+    # Dependabot secret store, which does not carry the identity suites'
+    # CLERK_MACHINE_TOKEN, so the lock-context suite would fail-loud (by design
+    # it throws rather than skips) on a change Dependabot cannot fix. A
+    # dependency bump's real signal is `tests.yml` + the lockfile checks.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     strategy:
       fail-fast: false

.github/workflows/integration-prisma-next.yml

@@ -65,7 +65,11 @@ jobs:
       cancel-in-progress: false
     # Fork PRs have no secrets. Skip cleanly rather than fail on something the
     # contributor cannot fix — `tests.yml` still gives them a green signal.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # Dependabot PRs skip for the same reason: they run under the Dependabot
+    # secret store (a distinct, narrower set), so a secret-consuming live suite
+    # can fail on a change Dependabot cannot fix. A dependency bump's real
+    # signal is `tests.yml` + the lockfile checks.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     strategy:
       fail-fast: false

.github/workflows/integration-supabase.yml

@@ -64,7 +64,11 @@ jobs:
       cancel-in-progress: false
     # Fork PRs have no secrets. Skip cleanly rather than fail loudly on something
     # the contributor cannot fix — `tests.yml` still gives them a green signal.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # Dependabot PRs skip for the same reason: they run under the Dependabot
+    # secret store (a distinct, narrower set), so a secret-consuming live suite
+    # can fail on a change Dependabot cannot fix. A dependency bump's real
+    # signal is `tests.yml` + the lockfile checks.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     strategy:
       # A one-element matrix, not a cross-product: the Supabase adapter only ever

.github/workflows/prisma-example-readme-e2e.yml

@@ -33,7 +33,10 @@ jobs:
     # Skip cleanly on fork PRs where secrets aren't available. The
     # test's `describe.skipIf(!authConfigured)` would also skip, but
     # gating at the job level produces a clean "skipped" status.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # Dependabot PRs skip too — they run under the Dependabot secret store, so a
+    # secret-consuming live suite can fail on a change Dependabot cannot fix;
+    # `tests.yml` + lockfile checks are the real signal for a dependency bump.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     env:
       CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}

.github/workflows/prisma-next-e2e.yml

@@ -34,8 +34,11 @@ jobs:
     # Skip cleanly on fork PRs where secrets aren't available. The
     # global-setup hook in the suite hard-errors when `CS_WORKSPACE_CRN`
     # is unset; gating at the job level produces a clean "skipped"
-    # status instead of a noisy failure.
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # status instead of a noisy failure. Dependabot PRs skip too — they run
+    # under the Dependabot secret store, so a secret-consuming live suite can
+    # fail on a change Dependabot cannot fix; `tests.yml` + lockfile checks are
+    # the real signal for a dependency bump.
+    if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
 
     env:
       CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }}