fix: auto-approve Dependabot PRs without GitHub App token

.github/workflows/claude-pr-review.yml

@@ -22,7 +22,14 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Auto-approve Dependabot bump
+        if: github.actor == 'dependabot[bot]'
+        run: gh pr review ${{ github.event.pull_request.number }} --approve --body "Automated dependency bump — auto-approved."
+        env:
+          GH_TOKEN: ${{ github.token }}
+
       - name: Generate GitHub App token
+        if: github.actor != 'dependabot[bot]'
         id: app-token
         uses: actions/create-github-app-token@v3.2.0
         with:
@@ -31,6 +38,7 @@ jobs:
           owner: hotdata-dev
 
       - uses: actions/checkout@v6.0.2
+        if: github.actor != 'dependabot[bot]'
         with:
           repository: hotdata-dev/github-workflows
           ref: main
@@ -40,6 +48,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Load review prompt
+        if: github.actor != 'dependabot[bot]'
         id: prompt
         run: |
           PROMPT=$(cat .github-workflows/docs/claude-pr-review-prompt.md)
@@ -48,9 +57,11 @@ jobs:
           echo "EOF" >> $GITHUB_OUTPUT
 
       - name: Verify jq is available
+        if: github.actor != 'dependabot[bot]'
         run: jq --version
 
       - name: Gather review context
+        if: github.actor != 'dependabot[bot]'
         id: context
         run: |
           PR_NUMBER=${{ github.event.pull_request.number }}
@@ -85,6 +96,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
 
       - uses: anthropics/claude-code-action@v1
+        if: github.actor != 'dependabot[bot]'
         id: review
         continue-on-error: true
         with:
@@ -107,7 +119,7 @@ jobs:
             --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr review:*),Read"
 
       - name: Notify on review failure
-        if: steps.review.outcome == 'failure' || steps.review.outcome == 'cancelled'
+        if: github.actor != 'dependabot[bot]' && (steps.review.outcome == 'failure' || steps.review.outcome == 'cancelled')
         run: gh pr comment ${{ github.event.pull_request.number }} --body "Automated review unavailable (Claude step failed). Please review manually."
         env:
           GH_TOKEN: ${{ github.token }}