ci: run dependency review on Dependabot pull requests too

The actor filter made this job a no-op. Every dependency change in this repo comes
from Dependabot, and because dependency-review is a required status check, a
`skipped` run satisfies it -- so the supply-chain gate reported green while
reviewing nothing at all.

On a public repository the dependency-review API is readable with the Dependabot
token, so the job can run for those pull requests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: TheStreamCode

.github/workflows/dependency-review.yml

@@ -14,10 +14,11 @@ concurrency:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
-    # Dependabot PRs run with a restricted token that can't reach the
-    # dependency-review API, so the check always fails for them. Skip it for
-    # Dependabot (its bumps are curated) while keeping it for human PRs.
-    if: ${{ github.actor != 'dependabot[bot]' }}
+    # No actor filter. Skipping Dependabot made this a no-op: every dependency
+    # change in this repo comes from Dependabot, and because the job is a required
+    # status check, a `skipped` run *satisfies* it -- the gate reported green while
+    # reviewing nothing. On a public repository the dependency-review API is
+    # readable with the Dependabot token, so the job runs for those PRs too.
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7