fix(ci): skip pull request automation without write credentials (#72)

* fix(ci): skip changeset hygiene without comment permissions

* fix(ci): skip project board updates without app credentials

Author: marandaneto

.github/workflows/changeset-hygiene.yml

@@ -15,6 +15,8 @@ permissions:
 
 jobs:
     check:
+        # Fork and Dependabot PR tokens are read-only, so they cannot upsert the report comment.
+        if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
         name: Check changeset hygiene
         runs-on: ubuntu-latest
         timeout-minutes: 10

.github/workflows/flags-project-board.yml

@@ -73,11 +73,13 @@ jobs:
         # the github.event_name is supposed to be `workflow_call`, but because this workflow lives in the special `.github` repository,
         # it preserves the original event name (e.g. pull_request).
         # This is a not well-documented special case.
-        # Dependabot-triggered runs execute in a restricted secret context with no
-        # access to PROJECT_BOARD_BOT_APP_ID / PRIVATE_KEY, so the token step below
-        # hard-fails because the client ID is empty on every dependency-bump
-        # PR. Skip them — dependency bumps don't belong on the feature flags board.
-        if: (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' || github.event_name == 'pull_request_review') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && github.actor != 'dependabot[bot]'
+        # Fork and Dependabot PRs run without the GitHub App credentials required below.
+        # On pull_request_review, github.actor is the reviewer, so inspect the PR author instead.
+        if: >-
+            github.event_name == 'workflow_dispatch' ||
+            ((github.event_name == 'pull_request' || github.event_name == 'pull_request_review') &&
+            github.event.pull_request.head.repo.full_name == github.repository &&
+            github.event.pull_request.user.login != 'dependabot[bot]')
         steps:
             - name: Generate GitHub App Token
               id: app-token