ci: guard pr-notify against Dependabot runs explicitly

[jamesnrokt]

Background

Dependabot-triggered runs resolve secrets against a separate, repository-scoped store that GCHAT_PRS_WEBHOOK is not in, so on a Dependabot run gchat_webhook arrives blank and the notifier fails with Input required and not supplied: webhookUrl.

That does not happen today — but only incidentally. pr-notify needs security-checks; the shared security-checks workflow already guards on this same condition, so it skips on Dependabot PRs; and because pr-notify has no always(), a skipped dependency skips it too. Verified as skipping rather than failing on #722, #720 and #705.

Nothing local to this repo expresses that constraint, so two ordinary edits would silently turn every Dependabot PR red: adding always() to pr-notify (a reasonable-looking change, used elsewhere to keep a notifier alive when an upstream job is skipped by a path filter), or dropping security-checks from its needs while reshuffling required checks.

What changed

• pull-request.yml — added github.actor != 'dependabot[bot]' to the pr-notify job's if.

github.actor is what GitHub uses to decide which secrets store a run reads from, so the guard matches the exact circumstance under which the webhook is unavailable. A human pushing to a Dependabot branch still gets the notification.

Validation

actionlint and trunk check clean. No behaviour change: pr-notify already skipped on Dependabot PRs and still does; it already ran on human PRs and still does. This only makes the existing protection intentional and local rather than a side effect of the needs graph.

Being human-authored, this PR exercises the happy path — Notify GChat running and succeeding here is the regression signal.

[cursor]

PR Summary

Low Risk
CI-only workflow condition with no intended behavior change on human-authored PRs.

Overview
Adds github.actor != 'dependabot[bot]' to the pr-notify job’s if in pull-request.yml, so Notify GChat is skipped when the workflow run is triggered by Dependabot.

That documents locally why Dependabot PRs should not hit the GChat notifier: Dependabot runs use a different secrets scope, so GCHAT_PRS_WEBHOOK would be empty and the reusable workflow would fail on a missing webhookUrl. Skipping was already happening indirectly via security-checks in needs; this guard keeps the same runtime behavior if someone later adds always() or reshuffles needs.

^{Reviewed by Cursor Bugbot for commit c8fe400. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud