Add condition to skip security review for dependabot

[Neil-Smithline]

No description provided.

[github-actions]

🤖 Security Issue: The newly added job-level condition if: github.event.pull_request.user.login != 'dependabot[bot]' causes the org-required security-review job to be skipped entirely for any pull request opened by dependabot[bot]. Because this workflow is the file enforced by the org ruleset's 'Require workflows to pass before merging' rule, and GitHub treats a skipped required check as non-failing, dependabot PRs now bypass the mandatory security review gate and can be merged with no automated scanning. Dependency-update PRs are precisely the highest-risk class for supply-chain attacks (malicious or compromised upstream package versions), so this removes the security control from the surface where it matters most.

Severity: MEDIUM
Category: authorization_bypass
Tool: ClaudeCode AI Security Analysis

Exploit Scenario: An attacker who compromises or publishes a malicious version of a dependency used by a targeted repository waits for Dependabot to open an automated version-bump PR pulling that version in. That PR is authored by dependabot[bot], so the security-review job is skipped and reports as a non-failing (skipped) required check. The malicious dependency change can then be merged into the protected branch without ever being scanned by the security review that all other PRs must pass.

Recommendation: Do not skip the security review for dependabot PRs. If the goal is to reduce noise on automated dependency bumps, instead run the review with a softer policy (e.g. fail-on-findings: false) for dependabot rather than skipping the job, so dependency updates are still scanned. If a skip is truly required, ensure branch protection explicitly fails (rather than passes) when this required check is skipped, and scope any exception as narrowly as possible.