Fix CI issues for Dependabot PRs - prevent duplicate runs and handle Codecov token issues

Author: kvz

.github/workflows/ci.yml

@@ -1,9 +1,15 @@
 name: CI
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
 
 jobs:
   python:
+    # Prevent duplicate runs on PRs from the same repository
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -57,14 +63,25 @@ jobs:
         run: poetry run pytest tests
 
       - name: Upload coverage reports
-        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
+        # Only upload coverage if we have a token (skip for Dependabot PRs)
+        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12' && (github.event_name != 'pull_request' || github.actor != 'dependabot[bot]')
         uses: codecov/codecov-action@v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage.xml
           flags: unittests
           name: python-sdk
-          fail_ci_if_error: true
+          fail_ci_if_error: false
+
+      - name: Upload coverage reports (tokenless)
+        # Use tokenless upload for Dependabot PRs
+        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12' && github.event_name == 'pull_request' && github.actor == 'dependabot[bot]'
+        uses: codecov/codecov-action@v4
+        with:
+          files: ./coverage.xml
+          flags: unittests
+          name: python-sdk
+          fail_ci_if_error: false
 
       - name: Upload coverage artifacts
         if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'