Fix Dependabot PRs failing due to missing secrets

[sami-alajrami]

Problem

Dependabot PRs were triggering the Main workflow via the push event, but GitHub withholds repository secrets from Dependabot-initiated runs. This caused jobs requiring secrets (tests, Snyk scans, Kosli reporting) to fail, blocking the PRs from being merged.

Solution

Dependabot branches are excluded from the push trigger. Instead, a pull_request_target trigger handles Dependabot PRs — this event runs in the context of the base branch and has full access to repository secrets. A guard (github.actor == 'dependabot[bot]') ensures the secrets-bearing path is only reachable by Dependabot, not arbitrary external PRs. A checkout_ref input is threaded through all reusable workflows so each job checks out the PR head commit rather than the base branch.

Security concern

Code execution from untrusted ref is a risk with pull_request_target. The if guard ensures only Dependabot triggers the secret-bearing path, which is good. However, if Dependabot's account were ever compromised (or a malicious dependency update shipped code in a pre-install script), we would be running that code with full secrets access.
If we are not happy to take that risk, we might have to find another way to update dependencies as the alternative it to duplicate all needed secrets for Dependabot in github which causes significant maintenance ovverhead.

[mbevc1]

LGTM, but just to check here if I open a PR on a fork and change that conditional to allow triggering on my workflow would I still be able to get secrets? Also what secrets are we trying to protect, just Snyk or something else?

[sami-alajrami]

LGTM, but just to check here if I open a PR on a fork and change that conditional to allow triggering on my workflow would I still be able to get secrets?

No, because the workflow YAML that runs is the one from the main branch, not the one from the fork.

Also what secrets are we trying to protect, just Snyk or something else?
there is a bunch of secrets for testing 3rd party integrations.