add-to-project workflow fails for Dependabot PRs

[koeaw]

Example from earlier today (one of several) shows the workflow fails for Dependabot PRs with:

Error: Input required and not supplied: github-token

I only realised earlier this week that our plan of adding all Dependabot PRs to our project won't work, see Pull request events for forked repositories in the GitHub Actions docs. The note at the end says:

Workflows triggered by Dependabot pull requests are treated as though they are from a forked repository, and are also subject to these restrictions.

and I think the workflow failing may be due to that.

The fact the PR still appears in the project is probably due to the built-in project automation (workflows) not being affected by that? Though it's a bit weird/confusing that there's no record of it in the PR, when I've seen it logged in the form of "github-project-automation added this to Prosnet" elsewhere...

I'd still wait for the same problem to occur in one of the other repos, to confirm it's indeed that and not e.g. something to do with the built-in automation, which only applies to apis-core-rdf. (Not sure if our workflow clashing with the built-in workflow is a possibility?)

For reference for later: Troubleshooting failures when Dependabot triggers existing workflows

[koeaw]

This really only seems to apply to Dependabot PRs.

The last release-please one from yesterday didn't trigger any workflows. Looks like it circumvents the problem with the permissions-based solution mentioned in the docs.

[koeaw]

Older, related ticket: #1370