chore(ci): skip Claude Code Review for Dependabot PRs

[cfdude]

Summary

• Adds if: github.actor != 'dependabot[bot]' condition to the Claude Code Review workflow
• Prevents unnecessary workflow failures when Dependabot opens automated dependency bump PRs

Test plan

• Verify Claude Code Review workflow no longer triggers on Dependabot PRs
• Verify it still triggers normally on human-authored PRs

[claude]

Code Review - PR #6: Skip Claude Code Review for Dependabot PRs

Summary

This PR adds a conditional check to skip the Claude Code Review workflow for Dependabot PRs. The implementation is clean and follows best practices.

✅ Positives

1. Clear Intent: The change is well-scoped and solves a specific problem (unnecessary workflow failures on automated dependency bumps)

2. Proper Implementation: Using github.actor != 'dependabot[bot]' is the correct approach for filtering Dependabot PRs

3. Good Placement: The condition is placed at the job level, which prevents the entire job from running (better than skipping at a step level)

4. Commit Quality: Commit message follows conventional commit format (chore(ci):) consistent with CONTRIBUTING.md guidelines

5. Documentation: The commit body and PR description clearly explain the reasoning

🔍 Observations

1. Consistency Pattern: This is currently the only workflow using github.actor filtering. Consider whether other workflows (ci.yml, security.yml) should also skip Dependabot PRs if they're experiencing similar issues.

2. Alternative Approach: There's a commented-out example (lines 16-20) showing PR author filtering. The new condition could be combined with this using:

   if: |
     github.actor != 'dependabot[bot]' &&
     (github.event.pull_request.user.login == 'external-contributor' || ...)

   However, this is only relevant if you plan to use that author filtering in the future.

3. Dependabot Configuration: Consider if you want to document this exclusion pattern in CONTRIBUTING.md for future workflow additions.

🎯 Recommendations

Optional Enhancement: If you want to be more explicit about bot exclusions in general, you could use:

if: github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]'

However, this depends on whether you use other bots that might open PRs.

✅ Approval

No blocking issues found. This PR is ready to merge.

• ✅ Code quality: Clean, focused change
• ✅ Best practices: Follows GitHub Actions conventions
• ✅ Security: No concerns (read-only conditional logic)
• ✅ Performance: Actually improves efficiency by preventing unnecessary runs
• ✅ Testing: The test plan is appropriate - verify workflow behavior on bot vs. human PRs

Verdict: LGTM 🚀