Run Dependabot pull requests on GitHub-hosted runners

.github/workflows/ci.yml

@@ -37,7 +37,8 @@ jobs:
         include:
           - platform: linux
             os: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
           - platform: macos
             os: macos-15
@@ -172,8 +173,12 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: read
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     env:
       MAKEUTIL_REVISION: '7ab9b7b73a8f50ef1d3df548c7def7b94db35ba2'
@@ -288,7 +293,10 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: read
-    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubicloud-standard-2' }}
+    runs-on: >-
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
+      && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     # Job-level because two steps read it: `install-tool` pins the archive to
     # this version, and the lane assertion below names it. A step-level `env:`
     # is visible only to the step that declares it.

.github/workflows/rust-toy-app.yml

@@ -18,17 +18,20 @@ jobs:
         include:
           - platform: linux
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
             target: x86_64-unknown-linux-gnu
           - platform: linux
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
             target: aarch64-unknown-linux-gnu
           - platform: linux
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
             target: x86_64-unknown-illumos
           - platform: macos
@@ -39,7 +42,8 @@ jobs:
             target: aarch64-apple-darwin
           - platform: linux
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
             target: x86_64-unknown-freebsd
           # - platform: linux

.github/workflows/test-coverage-watchdog.yml

@@ -40,8 +40,12 @@ jobs:
     # regardless, so a green run is not evidence that it parsed as one
     # line. The workflow contract reads the raw value and refuses one
     # carrying a break.
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     steps:
       - name: Checkout repository

.github/workflows/test-cv005-contracts.yml

@@ -25,8 +25,12 @@ jobs:
     # The library's own lane is short and needs nothing from a hosted image, so
     # it runs on the smallest Ubicloud runner; a fork's pull request cannot
     # obtain one and falls back to a hosted runner.
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 20
     strategy:

.github/workflows/test-determine-release-modes.yml

@@ -15,8 +15,12 @@ on:
 
 jobs:
   test-determine-modes:
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     permissions:

.github/workflows/test-export-cargo-metadata.yml

@@ -5,8 +5,12 @@ on:
 
 jobs:
   test-export-metadata:
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     permissions:
@@ -33,7 +37,8 @@ jobs:
 
   test-export-metadata-env-overrides:
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     permissions:

.github/workflows/test-install-makeutil.yml

@@ -30,7 +30,8 @@ jobs:
         include:
           - platform: linux-x86_64
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
           - platform: linux-aarch64
             runner: ubuntu-24.04-arm
@@ -103,7 +104,8 @@ jobs:
         include:
           - platform: linux-x86_64
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
           - platform: linux-aarch64
             runner: ubuntu-24.04-arm
@@ -135,8 +137,12 @@ jobs:
     # replaces only what the download is checked against, not what is
     # fetched, so this proves the verification is not merely decorative.
     name: Fail closed on a tampered digest
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 15
     steps:
@@ -171,7 +177,8 @@ jobs:
     # an unpinned version is refused before anything is downloaded.
     name: Fail closed on an unpinned version
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     steps:

.github/workflows/test-install-mdtablefix.yml

@@ -32,7 +32,8 @@ jobs:
         include:
           - platform: linux
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
           - platform: macos
             runner: macos-15

.github/workflows/test-install-tool.yml

@@ -34,7 +34,8 @@ jobs:
           # A tarball with the binary under one directory, GNU tar.
           - platform: linux
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
             tool: sccache
             version: 0.17.0
@@ -46,7 +47,8 @@ jobs:
           # repository depends on every pull request.
           - platform: linux
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
             tool: merman-cli
             version: 0.7.0
@@ -139,8 +141,12 @@ jobs:
   refuses-an-unpinned-version:
     # A version outside the manifest must fail closed rather than reach for
     # whatever is newest, which is the failure mode this action exists to end.
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     steps:

.github/workflows/test-install-whitaker.yml

@@ -16,8 +16,12 @@ env:
 
 jobs:
   install-whitaker:
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 15
     steps:
@@ -99,7 +103,8 @@ jobs:
 
   install-whitaker-failure:
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     steps:

.github/workflows/test-install-yaml-lint.yml

@@ -34,7 +34,8 @@ jobs:
         include:
           - platform: linux
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
           - platform: linux-arm64
             runner: ubuntu-24.04-arm
@@ -127,7 +128,13 @@ jobs:
     # embedded in the action, so an archive no runner here exercises cannot
     # carry a wrong digest or a wrong asset name unnoticed.
     name: Verify every configured release digest
-    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubicloud-standard-2' }}
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
+    runs-on: >-
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
+      && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/test-rust-build-release-root-discovery.yml

@@ -5,8 +5,12 @@ on:
 
 jobs:
   test-action-setup-root:
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     permissions:

.github/workflows/test-setup-rust-clang-lld.yml

@@ -25,8 +25,12 @@ concurrency:
 jobs:
   installs-on-linux:
     name: Install clang and lld (linux)
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 15
     steps:

.github/workflows/test-setup-rust-mold.yml

@@ -34,7 +34,8 @@ jobs:
         include:
           - platform: linux-x86_64
             runner: >-
-              ${{ github.event.pull_request.head.repo.fork
+              ${{ (github.event.pull_request.head.repo.fork
+              || github.event.pull_request.user.login == 'dependabot[bot]')
               && 'ubuntu-latest' || 'ubicloud-standard-2' }}
           - platform: linux-aarch64
             runner: ubuntu-24.04-arm

.github/workflows/test-setup-rust-sccache.yml

@@ -118,8 +118,12 @@ jobs:
   respects_a_caller_backend_choice:
     # A caller who turned the backend off must stay off, so the action cannot
     # quietly re-enable a cache they declined.
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     env:
@@ -153,7 +157,8 @@ jobs:
 
   respects_a_caller_wrapper:
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     env:
@@ -192,7 +197,8 @@ jobs:
     # survives the action. SCCACHE_GHA_ENABLED is off so the assertion is about
     # the variable alone, not about reaching any cache service.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     env:

.github/workflows/test-stage-release-artefacts.yml

@@ -5,8 +5,12 @@ on:
 
 jobs:
   test-stage-artefacts:
+    # Dependabot pull requests run on the hosted pool too (free on a public
+    # repository). The author is tested, not the actor, which changes when
+    # someone else pushes to the branch.
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     permissions:
@@ -60,7 +64,8 @@ jobs:
 
   test-stage-artefacts-env-overrides:
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     permissions:
@@ -119,7 +124,8 @@ jobs:
 
   test-stage-artefacts-powershell-help:
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     permissions:
@@ -192,7 +198,8 @@ jobs:
 
   test-stage-artefacts-binstall:
     runs-on: >-
-      ${{ github.event.pull_request.head.repo.fork
+      ${{ (github.event.pull_request.head.repo.fork
+      || github.event.pull_request.user.login == 'dependabot[bot]')
       && 'ubuntu-latest' || 'ubicloud-standard-2' }}
     timeout-minutes: 10
     permissions: