ci: skip the Codex review job for Dependabot PRs (#127)

Author: EdHasNoLife

.github/workflows/codex-review.yml

@@ -25,8 +25,13 @@ jobs:
   codex:
     name: Codex Review
     runs-on: ubuntu-latest
-    # Skip forks (no secret access) so they don't show a spurious failure.
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Skip forks and Dependabot (neither gets secret access) so they don't show
+    # a spurious failure. Dependabot pushes to a same-repo branch, so the fork
+    # check below does not catch it — pull_request runs for Dependabot are
+    # withheld secrets, so the Codex step would fail with no OPENAI_API_KEY.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     permissions:
       contents: read
     outputs: