ci: run build-linux on Dependabot PRs without secrets; drop the workflow_run rerun

.github/workflows/test.yml

@@ -1,10 +1,12 @@
 name: test
 
 on:
-  workflow_run:
-    workflows: ["Dependabot PR Check"]
-    types:
-      - completed
+  # No workflow_run trigger. It used to run this workflow again after the
+  # "Dependabot PR Check" workflow, to give build-linux the Docker Hub secrets
+  # that Dependabot's pull_request runs do not get. But a workflow_run run
+  # checks out the default branch, not the PR, so it never built the
+  # dependency bump. Checking out the PR there instead would build untrusted
+  # code with secrets. build-linux now runs on pull_request without secrets.
   pull_request:
     branches:
       - main
@@ -79,9 +81,14 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
 
+  # Runs on every pull request, including Dependabot and fork PRs, which get no
+  # secrets. A --snapshot build never pushes images ("snapshot build: will not
+  # push any images"), so Docker Hub credentials are only used to authenticate
+  # the pull of the public alpine base image. Log in when they are available and
+  # pull anonymously when they are not, rather than skipping the job: a skipped
+  # required check counts as passing.
   build-linux:
     runs-on: ubuntu-latest
-    if: ${{ github.actor != 'dependabot[bot]' || github.event.workflow_run.conclusion == 'success' }}
     env:
       # https://goreleaser.com/customization/docker_manifest/
       DOCKER_CLI_EXPERIMENTAL: "enabled"
@@ -90,7 +97,20 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      # A step's `if` cannot read `secrets` directly, so check for them here.
+      - name: Check for Docker Hub credentials
+        id: docker-creds
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: |
+          if [ -n "$DOCKER_USERNAME" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::No Docker Hub credentials in this run (Dependabot or fork PR); pulling base images anonymously."
+          fi
       - name: Docker Login
+        if: steps.docker-creds.outputs.available == 'true'
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}