fix(ci): route Dependabot PRs through the maintainer-dispatched service tests - #802

Motivation

Every Dependabot PR fails CI on two jobs, Service Tests and Notebook Validation, regardless of what it bumps. Dependabot pushes its branches to this repository, so its PRs pass the same-repository guard that keeps fork PRs away from secret-dependent jobs. GitHub, however, gives runs that Dependabot triggers no Actions secrets, so those jobs start with every API key empty. On #751, Service Tests stops at the Google Cloud authentication step for want of GOOGLE_CREDENTIALS, and the notebooks fall through to getpass prompts that cannot run in CI. The same two jobs failed on #744, #749, #751 and #799.

Changes

This PR treats Dependabot PRs the way fork PRs are already treated: the secret-dependent jobs skip, and a maintainer runs them with secrets after reading the change.

• .github/workflows/test.yml: Service Tests and Notebook Validation also skip when github.actor is dependabot[bot]. The guard keys on the actor because that is what GitHub withholds secrets on, so a maintainer's push to a Dependabot branch still runs both jobs with secrets.
• .github/workflows/test-fork-pr.yml: the dispatch-only workflow now accepts PRs opened by dependabot[bot] as well as fork PRs, and still rejects other same-repository PRs.
• CONTRIBUTING.md: a short section telling maintainers to run gh workflow run test-fork-pr.yml -f pr_number=<n> before merging a fork or Dependabot PR.

Notes

• A skipped job shows as passing, so the manual dispatch is a convention, not an enforced gate. Copying the API keys into the Dependabot secrets store would make the jobs run automatically, but it would also hand those keys to newly bumped dependency code before anyone has reviewed it, which defeats the purpose of waiting for a maintainer.
• The check run keeps the name "Fork PR - Service Tests" so that any branch-protection rule or tooling referring to it keeps matching.
• Notebook Validation has no manual equivalent, as is already the case for fork PRs. It still runs on main after merge and nightly.

Reviewer Brief

Start here: .github/workflows/test.yml:25, the Service Tests if: guard. It decides which PR runs get secret-dependent jobs, and the Notebook Validation guard at :152 repeats it.

Where it could fail

• .github/workflows/test-fork-pr.yml:46-51: the new acceptance checks who opened the PR (pr.data.user.login), not who wrote its commits, so a write-access user's commit on a Dependabot branch would also be tested with secrets; that user can already run code with secrets from any same-repository branch.

Not verified: neither workflow has run with this change. The github.actor guard and the Dependabot acceptance in test-fork-pr.yml can only be confirmed on a real Dependabot PR plus a manual dispatch. actionlint was not available; both files parse as YAML, and the setup script passes node --check.

Beyond CI: the logs of run 37937957172 (#751) show every secret empty on a Dependabot-triggered run, Service Tests failing at Google Cloud authentication, and Notebook Validation failing on getpass API-key prompts, which confirms that both jobs need secrets and lose no working coverage by skipping.

Since the last brief: a59789b7 passes GEMINI_API_KEY to the dispatched service tests, matching test.yml, so the Google GenAI fixture exercises the Gemini backend there too.

_{Reviewed d8a7d3a7 · Claude Code (claude-opus-5-5) · lenses: correctness, security, design, tests, docs, Redis behaviour}