feat(ci): run integration tests on Dependabot PRs

Author: zfarrell

.github/workflows/dependabot-integration.yml

@@ -0,0 +1,49 @@
+name: Dependabot Integration Tests
+
+# Dependabot's pull_request runs are sandboxed: secrets and vars resolve empty,
+# so the normal Integration Tests workflow skips every credentialed scenario and
+# a behavioral regression in a bump would go unnoticed. This workflow runs the
+# real integration suite for Dependabot bumps via pull_request_target, which
+# executes in the base-repo context where the test credentials are available.
+#
+# Security posture (pull_request_target runs trusted-context with secrets):
+#   - Gated to dependabot[bot], so no fork PR can trigger a credentialed run.
+#   - permissions: contents: read only — the suite talks to the Hotdata API, not
+#     GitHub, so no writable GITHUB_TOKEN is ever exposed to the build.
+#   - No shared cargo cache: building the bumped crate runs its build scripts, so
+#     we never persist a cache other workflows could restore.
+# The bumped dependency's code still runs with the (test-scoped) API key present;
+# that is inherent to live coverage and is bounded to Dependabot-authored runs.
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependabot-integration-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  integration:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      # pull_request_target defaults to the base ref; check out the PR head so we
+      # build against the bumped Cargo.lock.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - name: Run integration tests
+        env:
+          HOTDATA_SDK_TEST_API_URL: ${{ vars.HOTDATA_SDK_TEST_API_URL }}
+          HOTDATA_SDK_TEST_API_KEY: ${{ secrets.HOTDATA_SDK_TEST_API_KEY }}
+          HOTDATA_SDK_TEST_WORKSPACE_ID: ${{ vars.HOTDATA_SDK_TEST_WORKSPACE_ID }}
+          HOTDATA_SDK_TEST_CONNECTION_ID: ${{ vars.HOTDATA_SDK_TEST_CONNECTION_ID }}
+        # --no-fail-fast runs every scenario binary even after one fails, so a
+        # red run surfaces all failing scenarios at once.
+        run: cargo test --test '*' --no-fail-fast -- --nocapture