ci: skip acceptance on Dependabot pull requests instead of failing them

.agents/skills/hookdeck-cli-review/SKILL.md

@@ -66,6 +66,18 @@ than the colour:
 gh run view --job=<id> --log | grep -E -- '--- (SKIP|PASS): <TestName>'
 ```
 
+### Dependabot pull requests skip acceptance, on purpose
+
+GitHub does not pass repository secrets to a workflow Dependabot triggers, so
+acceptance on a Dependabot PR used to fail every slice in seconds on an empty
+test key, whatever the bump. `test-acceptance.yml` now skips the job when
+`github.actor` is `dependabot[bot]`, so the check reads skipped, not red.
+
+That is not the same as covered. The post-merge push to `main` runs as the
+person who merged, with secrets, and is the real run -- confirm it finished.
+For a bump that touches something tests exercise, check before merging: run the
+related tags locally, or dispatch the workflow on the Dependabot branch.
+
 ### A cancelled acceptance run is not a run either
 
 Every acceptance run shares one concurrency group, `acceptance-suite`, so runs

.github/workflows/test-acceptance.yml

@@ -76,5 +76,16 @@ on:
 
 jobs:
   acceptance:
+    # Not for Dependabot. GitHub does not pass repository secrets to a workflow
+    # Dependabot triggers, so every test key is empty and every slice fails in
+    # seconds with "HOOKDECK_CLI_TESTING_API_KEY ... must be set" -- whatever the
+    # dependency. A check that is always red teaches people to ignore red, so
+    # it is skipped instead.
+    #
+    # A dependency bump is still covered: merging it pushes to main as the
+    # merger, not Dependabot, so the post-merge run has secrets and runs in full.
+    # To test before merging, dispatch this workflow on the Dependabot branch.
+    # The release gate calls acceptance.yml directly and is unaffected.
+    if: github.actor != 'dependabot[bot]'
     uses: ./.github/workflows/acceptance.yml
     secrets: inherit