⚙️ setup (ci): skip package and container builds for Dependabot PRs

.github/workflows/ci.yml

@@ -33,6 +33,10 @@ jobs:
             if [ "$GITHUB_EVENT_BEFORE" = "0000000000000000000000000000000000000000" ]; then
               # Initial push has no valid "before" SHA, so capture all reachable commits
               COMMITS=$(git log --format="%s" "$GITHUB_EVENT_AFTER")
+            elif ! git cat-file -e "${GITHUB_EVENT_BEFORE}^{commit}" 2>/dev/null; then
+              # Force-push: before SHA no longer exists, validate only the latest commit
+              echo "⚠ Force-push detected — before SHA not found, validating HEAD commit only"
+              COMMITS=$(git log --format="%s" -1 "$GITHUB_EVENT_AFTER")
             else
               COMMITS=$(git log --format="%s" "${GITHUB_EVENT_BEFORE}..${GITHUB_EVENT_AFTER}")
             fi

.github/workflows/container.yml

@@ -18,6 +18,7 @@ permissions:
 
 jobs:
   build:
+    if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

.github/workflows/package.yml

@@ -22,6 +22,7 @@ permissions:
 
 jobs:
   publish:
+    if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4