fix(ci): fix workflow failures for Dependabot PRs

- on_new_pr.yml: add checkout step before local composite action usage in
  enable-auto-merge and auto_approve_dependabot jobs; pull_request_target
  runs with an empty workspace so local actions are unresolvable without
  an explicit checkout
- pr-lint.yml: skip SOURCE_PUSH_TOKEN check for dependabot[bot] actor and
  fall back to github.token for super-linter so lint-code passes on
  Dependabot PRs where Actions secrets are unavailable
- build-and-publish-pre-release.yml: skip build-pre-release job for
  dependabot/* branches; Dependabot pushes run in a restricted secret
  context where SOURCE_PUSH_TOKEN is unavailable, causing the required
  check to fail
- pr-code-review-and-approve.yml: fall back to github.token when
  SOURCE_PUSH_TOKEN is not set so the Copilot review request does not
  error on missing required input

Prompt: Work on pull request #615 in credfeto/scripts. Fix CI failures for Dependabot PRs.

Author: dnyw4l3n13

.github/workflows/build-and-publish-pre-release.yml

@@ -19,6 +19,7 @@ permissions:
 
 jobs:
   build-pre-release:
+    if: "!startsWith(github.ref, 'refs/heads/dependabot/')"
 
     runs-on: ubuntu-latest
 

.github/workflows/on_new_pr.yml

@@ -27,6 +27,13 @@ jobs:
     # Specifically check that dependabot (or another trusted party) created this pull-request, and that it has been labelled correctly.
     if: contains(github.event.pull_request.labels.*.name, 'dependencies')
     steps:
+      - name: "Checkout Source"
+        uses: actions/checkout@v6.0.3
+        with:
+          clean: true
+          fetch-depth: 1
+          ref: ${{github.event.pull_request.base.sha}}
+
       - name: "Auto Merge"
         uses: ./.github/actions/enable-automerge
         with:
@@ -42,6 +49,13 @@ jobs:
 
     if: contains(github.event.pull_request.labels.*.name, 'dependencies')
     steps:
+      - name: "Checkout Source"
+        uses: actions/checkout@v6.0.3
+        with:
+          clean: true
+          fetch-depth: 1
+          ref: ${{github.event.pull_request.base.sha}}
+
       - name: "Auto Approve"
         uses: ./.github/actions/approve-pr
         with:

.github/workflows/pr-code-review-and-approve.yml

@@ -37,12 +37,11 @@ jobs:
       - name: "Request Copilot code review"
         uses: actions/github-script@v9.0.0
         with:
-          github-token: ${{ secrets.SOURCE_PUSH_TOKEN }}
+          github-token: ${{ secrets.SOURCE_PUSH_TOKEN || github.token }}
           script: |
             await github.rest.pulls.requestReviewers({
               owner: context.repo.owner,
               repo: context.repo.repo,
               pull_number: context.payload.pull_request.number,
               reviewers: ['copilot']
             });
-

.github/workflows/pr-lint.yml

@@ -413,6 +413,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Check Required Secrets"
+        if: github.actor != 'dependabot[bot]'
         shell: bash
         run: |
           if [ -z "${{secrets.SOURCE_PUSH_TOKEN}}" ]; then
@@ -424,7 +425,7 @@ jobs:
         uses: super-linter/super-linter@v8.6.0
         env:
           DEFAULT_BRANCH: main
-          GITHUB_TOKEN: ${{secrets.SOURCE_PUSH_TOKEN}}
+          GITHUB_TOKEN: ${{secrets.SOURCE_PUSH_TOKEN || github.token}}
           GITHUB_ACTIONS_CONFIG_FILE: actionlint.yaml
           ENABLE_GITHUB_ACTIONS_STEP_SUMMARY: true
           SAVE_SUPER_LINTER_SUMMARY: true