Summary

When dependabot issues PRs to update dependencies, the Chromatic check will always initially fail until re-run by someone at Coder. This is because the token is not applied for that agent.

Steps to Reproduce

1. Dependabot opens a PR
2. Chromatic fails (no token)

Expected

1. Dependabot opens a PR
2. Chromatic runs as normal

Logs

See here: https://github.com/coder/coder/runs/5859401270?check_suite_focus=true#step:4:47

From this PR created by dependabot: #902

Notes

A simple stop-gap solution is to not run chromatic on dependabot updates; however this feels unfortunate, as we'd be losing visual regression prevention on dependency updates. Ideally there's some way to allow dependabot to access this secret.