[ajitpratap0]

Summary

Dependabot-triggered workflows run without repository secrets, so claude-review starts with an empty CLAUDE_CODE_OAUTH_TOKEN and always fails on dependency PRs (e.g. #863), which blocks the all-green merge gate. Skip the job for PRs authored by dependabot[bot], mirroring the existing fork-PR skip; dependency bumps get a manual review instead.

Test Plan

• Workflow YAML parses
• CI on this PR (claude-review still runs here, since the author is not Dependabot)
• After merge, re-run CI on chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates #863: claude-review should be skipped

Breaking Changes

None.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RkzVu3JY9Y6BRWfjesWts9

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
gosqlx-website	Ignored	Preview	Oct 25, 2026 5:22pm UTC

[github-actions]

Claude finished @ajitpratap0's task in 20s —— View job

---

Review of PR #864

• Read the diff and the full workflow file
• Review the change

Summary: The change looks correct and I found no blocking issues.

What I checked

• github.event.pull_request.user.login != 'dependabot[bot]' is the right field and value. Dependabot PRs report the PR author as dependabot[bot].
• On workflow_dispatch, the first clause short-circuits to true. github.event.pull_request is empty there, so the second clause is never needed.
• The folded >- YAML block produces a single-line expression. It parses correctly, and the parentheses give the intended A || (B && C) precedence.
• The fork-PR skip behaves as before.
• The comment accurately explains why both cases are skipped.

Notes (non-blocking)

1. Skipped job and the merge gate: A job skipped by if: reports as "skipped", and branch protection treats a skipped required check as passing. If claude-review is a required status check, it will pass on Dependabot PRs. If an aggregate "all-green" job lists it in needs:, confirm that job accepts a skipped result. For example, it should use if: always() and check for failure/cancelled rather than requiring success. Otherwise the gate may still block on chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates #863.
2. Other Dependabot-actor cases: If a maintainer re-runs a Dependabot PR's workflow, the run's actor is the maintainer, but the PR author is still dependabot[bot]. Secrets are still withheld for these PRs, so keying on the PR author is correct here. Checking github.actor would be wrong.
3. Other bot authors: The skip only covers dependabot[bot]. Renovate or other bots would hit the same empty-secret failure, but that isn't a concern unless you use them.

Security: There's no new risk. The change only reduces when a secret-using job runs.

Tests: There's no practical unit test for this. Your test plan, checking #863 after merge, is the right validation. Also confirm that the aggregate gate treats "skipped" as passing, as noted in point 1.

I can't modify files under .github/workflows, so I made no edits.