Skip AI code review on Dependabot PRs

[circlecube]

Summary

• Skip the AI code review workflow when the PR author is Dependabot
• GitHub withholds org secrets from Dependabot-context runs, which caused the workflow to hard-fail and block auto-merge

Test plan

• Verify workflow YAML is valid
• Confirm AI code review still runs on normal PRs
• Confirm Dependabot PRs skip the review job (job shows as skipped, not failed)

[github-actions]

AI code review

✅ Strengths

• Clear intent and rationale documented inline: skipping AI review for Dependabot PRs to avoid secret-withholding failures and unblock auto-merge.
• Maintains existing safeguards (no drafts, no forks) and extends them succinctly.
• Uses a folded multiline if: for readability; condition remains easy to scan.

⚠️ Suggestions (non-blocking)

• Consider checking the PR author instead of the workflow actor. On Dependabot PRs, re-runs or manual actions by humans can set github.actor to a maintainer, which would bypass your skip and potentially reintroduce the secret-withholding failure. Using github.event.pull_request.user.login is more robust for the stated goal ("skip when PR author is Dependabot"). For example:
  • github.event.pull_request.user.login != 'dependabot[bot]'
  • Optionally also exclude the deprecated dependabot-preview[bot] for completeness.
• Minor: Mirror the comment wording to match the condition (“skip when PR author is Dependabot”) if you keep using github.actor, or update the condition to align with the comment.

❌ Issues (potential impact)

• None blocking. The current github.actor != 'dependabot[bot]' can miss some Dependabot-authored PR runs (e.g., manual re-runs triggered by a human), which could still hard-fail due to missing secrets. This is a reliability gap rather than a security bug; addressing via PR-author check would close the edge case.

Verdict

⚠️ Verdict: Solid improvement and low-risk. Recommend merge with a small follow-up to key off the PR author (github.event.pull_request.user.login) to ensure Dependabot PRs are always skipped, even on human-triggered re-runs.

[github-actions]

Coverage: Base 14.16% → PR 14.16% (must not decrease).
✅ No decrease.

project coverage report 14.16% @ 7a7e690

[arunshenoy99]

LGTM — targeted workflow guard to skip AI code review on Dependabot PRs and avoid secret-withholding failures that block auto-merge.