CI: Use same workflow for dependabot and pulls

These had diverged a bit, and I think it’d be good for most things to be
shared (everything that dependabot _can_ run), by using if conditions on
the individual steps rather than the whole job.

.github/workflows/ci.yml

@@ -10,10 +10,7 @@ on:
 
 jobs:
   CI:
-    if: >-
-      github.actor != 'dependabot[bot]'
-      && github.event.pull_request.user.login != 'dependabot[bot]'
-      && github.repository_owner == 'guardian'
+    if: github.repository_owner == 'guardian'
     # Required by actions-assume-aws-role
     permissions:
       id-token: write
@@ -36,15 +33,15 @@ jobs:
       - name: Env
         run: env
 
+      - name: Dump GitHub context
+        id: github_context_step
+        run: echo $JSON
+        env:
+          JSON: ${{ toJSON(github) }}
+
       - name: Checkout
         uses: actions/checkout@v3
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v2
-        with:
-          aws-region: eu-west-1
-          role-to-assume: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
-
       - name: Setup Node
         uses: actions/setup-node@v3
         with:
@@ -64,8 +61,20 @@ jobs:
       - name: Generate CFN templates from GuCDK
         run: ./script/cfn.sh
 
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v2
+        if: >-
+          github.actor != 'dependabot[bot]'
+          && github.event.pull_request.user.login != 'dependabot[bot]'
+        with:
+          aws-region: eu-west-1
+          role-to-assume: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
+
       - name: Upload to Riff-Raff
         uses: guardian/actions-riff-raff@v2
+        if: >-
+          github.actor != 'dependabot[bot]'
+          && github.event.pull_request.user.login != 'dependabot[bot]'
         with:
           app: support-reminders
           configPath: ./riff-raff.yaml