Revision history [back]

There are a few ways to exclude Dependabot pull requests from GitHub Actions:

Using the if condition in the workflow file: You can use the if condition to only run the workflow if the pull request is not generated by the Dependabot. For example:
```
on:
 pull_request:
   branches: [main]
jobs:
 build:
   if: "!contains(github.actor, '[bot]')"
   runs-on: ubuntu-latest
   steps:
     - name: Checkout
       uses: actions/checkout@v2
     - name: Build
       run: ./build.sh
```
In this example, the if: "!contains(github.actor, '[bot]')" line checks if the username of the actor (who triggered the workflow) doesn't contain [bot]. This will skip the workflow if Dependabot created the pull request.

Using the jobs.<job_id>.if condition: You can also use the jobs.<job_id>.if condition to run specific jobs only if the pull request is not generated by the Dependabot. For example:

on:
 pull_request:
   branches: [main]
jobs:
 build:
   runs-on: ubuntu-latest
   steps:
     - name: Checkout
       uses: actions/checkout@v2
     - name: Build
       run: ./build.sh
 test:
   if: "!contains(github.actor, '[bot]')"
   runs-on: ubuntu-latest
   steps:
     - name: Checkout
       uses: actions/checkout@v2
     - name: Test
       run: ./test.sh

In this example, the test job will only run if the actor is not a bot (i.e. Dependabot).

Using the pull_request_target event: Another option is to use the pull_request_target event, which is triggered when a pull request is targeted at a specific branch (e.g. main). This event includes a pull_request object for the target branch, which you can use to filter out the Dependabot pull requests. For example:
```
on:
 pull_request_target:
   branches: [main]
jobs:
 build:
   runs-on: ubuntu-latest
   steps:
     - name: Checkout
       uses: actions/checkout@v2
     - name: Build
       run: ./build.sh
     - name: Test
       if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' }}
       run: ./test.sh
```
In this example, the Test step will only run if the pull_request.user.login is not dependabot[bot].