Remove dependabot restriction (#258)

Previously dependabot PRs were skipped as secret access was restricted.
GitHub has since added dependabot secrets, making the blanket skip
unnecessary and actively harmful to users that depend on private BSR
modules during dependabot PRs.

The guard is redundant because the action already handles this correctly
without it:

- login() skips gracefully when no token is provided, so dependabot runs
without a configured BUF_TOKEN behave identically to before.
- push and archive default to false for pull_request events (which
dependabot triggers), so there is no risk of accidental publishing.
- pr_comment has a fork check built into its default expression.
- lint, format, and breaking default to true on PRs, which is correct
behavior for dependabot PRs as well.

The only behavioral change is for users who have configured a BUF_TOKEN
dependabot secret: those runs will now log in to the BSR, allowing buf
to resolve private dependencies. Users without a dependabot secret see
no change.

Closes #255

Author: emcfarlane

dist/index.js

@@ -105975,10 +105975,6 @@ async function main() {
     lib_core.setOutput(Outputs.BufVersion, bufVersion);
     lib_core.setOutput(Outputs.BufPath, bufPath);
     lib_core.saveState(Outputs.BufPath, bufPath);
-    if (inputs.github_actor == "dependabot[bot]") {
-        lib_core.info("Skipping steps for dependabot");
-        return;
-    }
     await login(bufPath, inputs);
     if (inputs.setup_only) {
         lib_core.info("Setup only, skipping steps");

src/main.ts

@@ -63,10 +63,6 @@ async function main() {
   core.setOutput(Outputs.BufVersion, bufVersion);
   core.setOutput(Outputs.BufPath, bufPath);
   core.saveState(Outputs.BufPath, bufPath);
-  if (inputs.github_actor == "dependabot[bot]") {
-    core.info("Skipping steps for dependabot");
-    return;
-  }
   await login(bufPath, inputs);
   if (inputs.setup_only) {
     core.info("Setup only, skipping steps");