As explained in "GitHub Actions: Workflows triggered by Dependabot PRs will run with read-only permissions" [1], we need to consider Dependabot pull requests as external pull requests. [1] https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/