fix: use pull_request.user.login instead of github.actor for bot check (fixes adamtheturtle/literalizer#146)

Made-with: Cursor

Author: adamtheturtle

.github/workflows/dependabot-merge.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       - name: Enable auto-merge for Dependabot PRs
         run: gh pr merge --auto --merge "$PR_URL"

zizmor.yml

@@ -5,7 +5,7 @@ rules:
   cache-poisoning:
     disable: true
   bot-conditions:
-    disable: true
+    disable: false
   dependabot-cooldown:
     disable: true
   superfluous-actions: