[AndreasIgel]

Summary

Hardens the Java CI with Maven secret-bearing steps so they never run automatically for bot-authored PRs, using a generic account-type check instead of secret-emptiness or a hard-coded bot login.

Fixes #206

Before, the steps gated only on secret availability:

if: env.SONAR_TOKEN != ''                 # Sonar
if: always() && env.CODECOV_TOKEN != ''   # Codecov

That is not robust: when a maintainer re-runs a Dependabot PR's jobs, secrets become available and the SonarCloud Analysis step executes (observed on #205: it ran and failed with HTTP 403 ... check SONAR_TOKEN). Matching github.actor != 'dependabot[bot]' is equally brittle — one exact name, misses other bots.

Now each secret step also requires the PR author to not be a bot:

if: env.SONAR_TOKEN != '' && github.event.pull_request.user.type != 'Bot'

• push to main: no PR context → user.type is '' → runs (unchanged).
• human same-repo PR: user.type == 'User' → runs.
• any bot PR (Dependabot, Renovate, …): user.type == 'Bot' → skipped, even on a maintainer re-run.
• fork PRs: unchanged — still covered by secret-withholding + the manual fork-coverage/fork-sonar workflows.

Validation

• actionlint passes.
• Condition-only change; no build/test behaviour changes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!