From ee33fdf33359b8d6289c51c92eca951747224ac3 Mon Sep 17 00:00:00 2001
From: Niclas Larsson <niclas@edgesystems.se>
Date: Mon, 8 Jun 2026 23:30:30 +0200
Subject: [PATCH] ci: skip codecov upload on dependabot PRs

Dependabot-triggered runs don't receive Actions secrets, so
CODECOV_TOKEN is empty and the gated upload fails with
"Token required because branch is protected". Skip the step
for dependabot[bot] instead of failing CI.
---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e4e2531..e2b4e7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -199,6 +199,7 @@ jobs:
 
 
       - name: Publish to codecov
+        if: github.actor != 'dependabot[bot]'
         uses: codecov/codecov-action@v5
         with:
           fail_ci_if_error: true # we weren't posting previously