@@ -184,14 +184,14 @@ fails when a contributor did not install the hook.
 > [docs/fork-pr-comments.md](docs/fork-pr-comments.md) for details on how to enable
 > this feature for fork contributions.
 >
-> **Dependabot pull requests** are skipped the same way. GitHub runs
-> Dependabot-triggered `pull_request` workflows with a read-only token even
-> when the workflow requests `pull-requests: write`, so the permission is not
-> the problem: the action logs a `::warning::`, leaves the report in the job
-> summary, and the step still exits by the checks' result. To comment on them
-> too, use the [two-workflow pattern](docs/fork-pr-comments.md), or run on
-> `pull_request_target` for Dependabot only. Adding `dependabot[bot]` to
-> `ignore_authors` skips the checks for those PRs altogether.
+> **Dependabot pull requests** are not forks, but GitHub gives their
+> `pull_request` runs a read-only `GITHUB_TOKEN` by default. The `permissions`
+> key is honoured for them, so the `pull-requests: write` grant in the
+> [usage example](#usage) is enough; without it the action logs a
+> `::warning::` on the 403 and leaves the report in the job summary. Note that
+> Actions secrets are not available in Dependabot-triggered runs. Adding
+> `dependabot[bot]` to `ignore_authors` skips the checks for those PRs
+> altogether.
 >
 > Note: write-access to pull-requests requires the `pull-requests: write` permission.
 > See [usage example](#usage).
 
@@ -2,10 +2,7 @@
 
 When a pull request is opened from a **forked repository**, the `GITHUB_TOKEN` used by the
 `pull_request` event has **read-only** permissions by design (GitHub security policy).
-This means `pr-comments: true` cannot write a comment back to the PR. Pull requests
-opened by **Dependabot** are in the same position: GitHub runs Dependabot-triggered
-`pull_request` workflows with a read-only token even though the branch lives in your own
-repository, so everything below applies to them too.
+This means `pr-comments: true` cannot write a comment back to the PR.
 
 By default, commit-check-action handles this gracefully:
 
 
@@ -1395,26 +1395,14 @@ def is_fork_pr() -> bool:
         return False
 
 
-#: The actor GitHub reports for pull requests Dependabot opens.
-DEPENDABOT_ACTOR = "dependabot[bot]"
-
-
 def is_fork_pr_with_readonly_token() -> bool:
-    """Returns True when this run's GITHUB_TOKEN cannot write to the pull request.
+    """Returns True when the PR is from a fork AND the event has a read-only token.
 
     Under the pull_request event, GITHUB_TOKEN is read-only for fork PRs.
-    GitHub runs Dependabot-triggered pull_request workflows with a read-only
-    token as well, although a Dependabot branch lives in the repository
-    itself, so those runs take the same path: judged by ``is_fork_pr()``
-    alone the action tried to comment, got a 403, and advised granting
-    ``pull-requests: write`` — which the workflow had already done.
-
     Under pull_request_target, GITHUB_TOKEN has the workflow's configured
-    permissions regardless of where, or from whom, the PR came.
+    permissions regardless of whether the PR is from a fork.
     """
-    if os.getenv("GITHUB_EVENT_NAME", "") == "pull_request_target":
-        return False
-    return is_fork_pr() or os.getenv("GITHUB_ACTOR", "") == DEPENDABOT_ACTOR
+    return is_fork_pr() and os.getenv("GITHUB_EVENT_NAME", "") != "pull_request_target"
 
 
 def get_pr_number() -> int:
@@ -1483,28 +1471,27 @@ def add_pr_comments(results: list[ScopeResult]) -> int:
         print("Skipping PR comment: not a pull request event.")
         return 0
 
-    # Fork PRs and Dependabot PRs triggered by the pull_request event receive
-    # a read-only token; the GitHub API will always reject comment writes with
-    # 403. pull_request_target events always have the configured permissions.
+    # Fork PRs triggered by the pull_request event receive a read-only token;
+    # the GitHub API will always reject comment writes with 403.
+    # pull_request_target events always have the configured token permissions.
     if is_fork_pr_with_readonly_token():
         msg = (
-            "Skipping PR comment: GITHUB_TOKEN is read-only for this run. "
-            "Pull requests from forked repositories, and pull requests opened "
-            "by Dependabot, cannot write comments via the pull_request event. "
+            "Skipping PR comment: pull requests from forked repositories "
+            "cannot write comments via the pull_request event (GITHUB_TOKEN is "
+            "read-only for forks). "
             "See https://github.com/commit-check/commit-check-action/blob/main/docs/fork-pr-comments.md "
-            "for how to enable PR comments on them."
+            "for how to enable PR comments on fork PRs."
         )
         print(f"::warning::{msg}")
         if JOB_SUMMARY_ENABLED and GITHUB_STEP_SUMMARY:
             with open(GITHUB_STEP_SUMMARY, "a", encoding="utf-8") as f:
                 f.write(
                     "\n---\n"
                     "### \u2139\ufe0f PR Comment Skipped\n\n"
-                    "Pull requests from forked repositories, and pull requests "
-                    "opened by Dependabot, cannot write comments using the "
-                    "`pull_request` event because `GITHUB_TOKEN` has read-only "
-                    "permissions.\n\n"
-                    "> **\U0001f4a1 Tip:** To enable PR comments on them, see "
+                    "Pull requests from forked repositories cannot write comments "
+                    "using the `pull_request` event because `GITHUB_TOKEN` has "
+                    "read-only permissions.\n\n"
+                    "> **\U0001f4a1 Tip:** To enable PR comments on fork PRs, see "
                     "[Enabling PR Comments on Fork Pull Requests]"
                     "(https://github.com/commit-check/commit-check-action/blob/main/docs/fork-pr-comments.md).\n"
                 )
 
@@ -1843,30 +1843,6 @@ def test_push_event_skips_comment_without_warning(self):
             [line for line in printed if line.startswith("::warning")], printed
         )
 
-    def test_dependabot_pr_takes_the_skip_path_and_names_dependabot(self):
-        with (
-            patch("main.PR_COMMENTS_ENABLED", True),
-            patch.dict(
-                os.environ,
-                {
-                    "GITHUB_EVENT_NAME": "pull_request",
-                    "GITHUB_ACTOR": "dependabot[bot]",
-                    "GITHUB_REF": "refs/pull/12/merge",
-                },
-            ),
-            patch("main.is_fork_pr", return_value=False),
-            patch("main.JOB_SUMMARY_ENABLED", False),
-            patch("main.get_pr_number") as mock_number,
-            patch("builtins.print") as mock_print,
-        ):
-            rc = main.add_pr_comments([fail_scope()])
-        self.assertEqual(rc, 0)
-        mock_number.assert_not_called()  # never reached the API
-        warning = mock_print.call_args_list[0][0][0]
-        self.assertTrue(warning.startswith("::warning::Skipping PR comment"), warning)
-        self.assertIn("Dependabot", warning)
-        self.assertNotIn("403", warning)
-
     def test_fork_pr_skips_comment_and_warns(self):
         with (
             patch("main.PR_COMMENTS_ENABLED", True),
@@ -2113,40 +2089,7 @@ def test_fork_pr_with_pull_request_target_event(self):
     def test_same_repo_not_fork(self):
         with (
             patch("main.is_fork_pr", return_value=False),
-            patch.dict(
-                os.environ,
-                {"GITHUB_EVENT_NAME": "pull_request", "GITHUB_ACTOR": "octocat"},
-            ),
-        ):
-            self.assertFalse(main.is_fork_pr_with_readonly_token())
-
-    def test_dependabot_pull_request_has_a_readonly_token(self):
-        """A Dependabot branch is in the same repository, so is_fork_pr() is
-        False, yet GitHub hands its pull_request runs a read-only token. It
-        used to fall through to the API, take a 403, and tell the user to
-        grant a permission the workflow already had."""
-        with (
-            patch("main.is_fork_pr", return_value=False),
-            patch.dict(
-                os.environ,
-                {
-                    "GITHUB_EVENT_NAME": "pull_request",
-                    "GITHUB_ACTOR": "dependabot[bot]",
-                },
-            ),
-        ):
-            self.assertTrue(main.is_fork_pr_with_readonly_token())
-
-    def test_dependabot_pull_request_target_has_a_write_token(self):
-        with (
-            patch("main.is_fork_pr", return_value=False),
-            patch.dict(
-                os.environ,
-                {
-                    "GITHUB_EVENT_NAME": "pull_request_target",
-                    "GITHUB_ACTOR": "dependabot[bot]",
-                },
-            ),
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request"}),
         ):
             self.assertFalse(main.is_fork_pr_with_readonly_token())