ci: skip SonarQube and Stryker on Dependabot PRs (secrets withheld)

GitHub withholds repository secrets from Dependabot-triggered workflow runs, so
the SonarQube scan (SONAR_TOKEN) and Stryker dashboard reporter
(STRYKER_DASHBOARD_API_KEY) hard-fail on every Dependabot PR — the
browser-mutation job went red on #64 and #65. The existing guard only excluded
fork PRs, but Dependabot branches live in the same repo, so they slipped
through.

Exclude `github.actor == 'dependabot[bot]'` from both steps. The vitest suite
still runs (so any future npm-dependency Dependabot PR is still gated on tests),
and mutation-testing a dependency bump added no signal anyway.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: wolpert

.github/workflows/ci.yml

@@ -81,16 +81,21 @@ jobs:
       - name: SonarQube scan
         # JavaScript/browser-SDK static analysis only. SonarQube was dropped for the JVM modules
         # (ADR 0018, native JaCoCo gates) but retained here for the TypeScript SDK.
-        # SONAR_TOKEN is unavailable to PRs from forks; skip there to avoid a hard failure.
-        # Manual (workflow_dispatch) and push runs always have the secret available.
-        if: github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+        # Needs SONAR_TOKEN, which GitHub withholds from fork PRs AND from Dependabot-triggered
+        # runs — skip in both cases so the scan doesn't hard-fail without a token. Manual
+        # (workflow_dispatch) and push runs always have the secret available.
+        if: github.actor != 'dependabot[bot]' && (github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository)
         uses: sonarsource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with:
           projectBaseDir: clients/passkeys-browser
 
       - name: Run Stryker mutation tests
+        # Skip on Dependabot PRs: the dashboard reporter needs STRYKER_DASHBOARD_API_KEY, which is
+        # withheld from Dependabot-triggered runs, and mutation testing a dependency bump adds no
+        # signal. The vitest suite above still runs and gates the PR.
+        if: github.actor != 'dependabot[bot]'
         run: npm exec --no-install -- stryker run
         working-directory: clients/passkeys-browser
         env: