Tracked as part of #1365.

Description

The Dependabot PR Review workflow (dependency-pr-review.lock.yml) fails when Dependabot bumps GitHub Actions versions because those PRs modify workflow files. GitHub strips secrets for pull_request events on PRs that modify workflow files, causing the secret validation step to fail.

Example: PR #1364 → Run #24412526951

Acceptance Criteria

• .github/workflows/*.yml is removed from the paths trigger filter in dependency-pr-review.md.
• Dependabot PRs that bump GitHub Actions versions no longer trigger the dependency PR review workflow and therefore no longer fail at secret validation.
• Dependabot PRs that modify only package manifests (package.json, pyproject.toml, etc.) continue to trigger and succeed as before.
  Related to fix(workflows): Agentic workflows fail when GitHub strips secrets for fork PRs and Dependabot workflow-file PRs #1365

Generated by Issue Triage for issue #1365 · ● 249.4K · ◷