CI: gui-tests job fails on Dependabot PRs — LICENSEKEY (Squish) secret not forwarded

Summary

The gui-tests CI job fails consistently on Dependabot-authored PRs with:

❌ ocis failed to start
[SQUISH] Failed to install squish. ... license key not specified

Root cause

GitHub Actions does not forward normal repository secrets to pull_request-triggered workflow runs opened by Dependabot. LICENSEKEY (and any other secret the gui-tests job consumes, e.g. Squish licensing) is empty in these runs, so the Squish install step aborts before tests can run. This is infrastructure-side, not caused by the diffs in the affected PRs.

Observed on

• #12590
• #12591
• #12592

All three are unrelated dependency/workflow bumps hitting the identical failure signature, which rules out a code-side regression.

Suggested fix (needs repo admin)

• Add LICENSEKEY (and any other gui-tests-required secret) under Settings → Secrets and variables → Dependabot so it's available to Dependabot-triggered runs, or
• Mark gui-tests as non-required for dependabot/** branches.

Filed by the automated review bot after this diagnosis recurred identically across three separate Dependabot PRs without action. Linking here so it's tracked once instead of re-diagnosed per PR: #12590, #12591, #12592.

Start at the GitHub Actions workflow defining the gui-tests job and inspect its pull_request handling for Dependabot-authored runs. Confirm which secrets the job consumes, then make the required secrets available to Dependabot runs or exclude dependabot/** from the required gui-tests check; verify the result against failures in #12590, #12591, and #12592.