Dependabot pushes in-repo branches, so its PRs pass the fork guard and the
per-PR OTA job runs — but GitHub withholds repo secrets from Dependabot-
triggered runs, so EXPO_TOKEN is empty and the job fails at "Setup Expo
project". Result: a red check on every dependabot PR (fails closed, nothing
reaches AWS, but it's noise on an unrelated PR).
Exclude bot authors via user.type. This keeps the fork guard as the trust
boundary and does not reintroduce the author_association check, which
wrongly skipped private org members' PRs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Austin McKinley
61b3f29bc5