ci: skip security scans gracefully when secrets are unavailable

The Snyk and SonarCloud workflows were failing on every run for
auth/config reasons, not code:

- Snyk hard-failed with 401 Unauthorized because no SNYK_TOKEN secret
  is configured. Guard the scan on a job-level SNYK_TOKEN env so a
  missing token skips the scan (with a "Snyk Unavailable" notice)
  instead of failing the job.
- SonarCloud reported misleading green checks on Dependabot PRs (which
  cannot access repository secrets, so the scan was silently skipped),
  while pushes to main failed against an unauthorized token. Skip the
  job entirely for Dependabot so PR checks no longer masquerade as
  passing; pushes to main and normal PRs still run the real scan.

The scans themselves still require valid secrets to be configured
(see PR description).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ihudak

.github/workflows/snyk.yml

@@ -13,6 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     # Requires SNYK_TOKEN to be added as a repository secret:
     # Settings → Secrets and variables → Actions → New repository secret
+    # When the secret is absent (e.g. forks or Dependabot PRs, which do not
+    # receive repository secrets) the scan is skipped instead of failing with
+    # a 401 Unauthorized.
+    env:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
     steps:
       - uses: actions/checkout@v7
 
@@ -21,8 +26,13 @@ jobs:
           go-version-file: go.mod
 
       - name: Run Snyk to check for vulnerabilities
+        if: env.SNYK_TOKEN != ''
         uses: snyk/actions/golang@master
         env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+          SNYK_TOKEN: ${{ env.SNYK_TOKEN }}
         with:
           args: --severity-threshold=high
+
+      - name: Snyk Unavailable
+        if: env.SNYK_TOKEN == ''
+        run: echo "Skipping Snyk scan because SNYK_TOKEN is not available in this workflow context."

.github/workflows/sonar.yml

@@ -8,6 +8,11 @@ on:
 
 jobs:
   sonar:
+    # Dependabot PRs (and forks) cannot access repository secrets, so the
+    # SonarCloud scan cannot run there. Skip the job for Dependabot instead of
+    # reporting a misleading green "passing" check. Pushes to main and normal
+    # PRs still run the real scan.
+    if: github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     env:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}