ci: skip the jobs dependabot's token can't run

[NickJosevski]

Every dependabot PR currently shows two red checks that have nothing to do with the bump — #222, #224 and #225 all build green and pass e2e, then fail these two.

validate-pr-title — Resource not accessible by integration

The action validates the title from the event payload and then labels the PR from it. Dependabot PRs (like fork PRs) run with a read-only token, so the label call fails after the title has already validated.

Reading the action at the pinned SHA, applyLabel returns before it constructs its Octokit client:

async function applyLabel(pr, commitDetail) {
    const addLabel = getInput('add_label');
    if (addLabel !== undefined && addLabel.toLowerCase() === 'false') {
        return;
    }

so add_label: false keeps the title check (checkConventionalCommits, checkScope, checkTextMatches — all payload-only, no API) and drops only the write. The condition covers fork PRs too, since they get the same read-only token.

Publish to Octopus — The Octopus instance URL is required

The job log says Secret source: Dependabot, and that store holds neither OCTOPUS_SERVER nor vars.OCTOPUS_SERVICE_ACCOUNT, so OctopusDeploy/login has nothing to log in with. An actions bump produces no plugin change worth publishing, so the job is skipped rather than handed a copy of the secrets.

Not touched

Build and Package, End-to-end tests, Analyze (java) and CodeQL already pass on dependabot PRs, so their conditions are unchanged. The existing release-please condition on publish is preserved and now &&-ed with the actor check.

🤖 Generated with Claude Code