`zizmor: ignore[bot-conditions]` suppression comment dropped from updated `if:` condition

[twistedmelonman]

Non-Blocking Review Concern: zizmor: ignore[bot-conditions] suppression comment dropped from updated if: condition

Source: pre-push whole-codebase review
Location: .github/workflows/dependabot-auto-merge.yml:111
Date: 2026-08-11

What was flagged

The v1 if: github.actor == 'dependabot[bot]' line carried # zizmor: ignore[bot-conditions] to suppress a zizmor lint warning. The v2 replacement uses github.event.pull_request.user.login == 'dependabot[bot]' without the suppression comment. If your zizmor config flags any bot-conditions pattern (not just github.actor), CI will surface a new lint warning on this file. Low risk since the header comment explicitly explains why user.login is the correct field here, but worth confirming zizmor's behavior against the new expression before the tag is cut.

Context

This issue was automatically created from a non-blocking concern identified
during pre-push whole-codebase review. It was flagged for tracking.

---

Created by lib-review-issues.sh

[twistedmelonman]

Investigated — this isn't a live gap. zizmor's bot-conditions audit only fires on github.actor / github.triggering_actor comparisons (the spoofable ones); it does not flag github.event.pull_request.user.login, which is what this file switched to.

Verified locally against the current file:

$ zizmor .github/workflows/dependabot-auto-merge.yml
No findings to report. Good job! (5 suppressed)

No bot-conditions finding appears, suppressed or otherwise. The old # zizmor: ignore[bot-conditions] comment was needed because github.actor triggered the audit; user.login doesn't trigger it in the first place, so there's nothing to suppress. Re-adding the tag would be a stale/misleading suppression comment, not a fix.

The explanatory prose comment already in the file (lines 108-110) correctly documents why user.login was chosen over github.actor, which is the part worth keeping.

Closing as not-a-bug.