If you look at dependabot PRs like #407 you see it fails because it can't get the PGP key,

Run echo "$COLUMNAR_GPG_KEY" | gpg --batch --import
gpg: directory '/home/runner/.gnupg' created
gpg: keybox '/home/runner/.gnupg/pubring.kbx' created
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
Error: Process completed with exit code 2.

I'm assuming this is because dependabot PRs run with lower privs and don't have access to secrets/environments. So I think we should just skip the snapshot job on dependabot PRs.

Goes with #409.