use PAT if available else fall back to workflow token

we don't need to run these on PR close or when we apply labels, for example

.github/workflows/auto-close.yml

@@ -1,5 +1,7 @@
 name: Auto close
-on: pull_request_target
+on:
+  pull_request_target:
+    types: [opened]
 
 permissions:
   pull-requests: write

.github/workflows/enforce-dependency-review.yml

@@ -1,5 +1,7 @@
 name: 'Dependency Review'
-on: [pull_request]
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
 
 jobs:
   enforce-dependency-review:

.github/workflows/test-integration-17.yml

@@ -4,10 +4,13 @@ on:
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-integration-17:
     runs-on: ubuntu-latest
+    env:
+      PAT_EXISTS: ${{ secrets.GH_PAT != '' }}
 
     services:
       redis:
@@ -31,7 +34,14 @@ jobs:
         env:
           NPM_CONFIG_ENGINE_STRICT: 'false'
 
-      - name: Integration Tests
+      - name: Integration Tests (with PAT)
+        if: ${{ env.PAT_EXISTS == 'true' }}
+        uses: ./.github/actions/integration-tests
+        with:
+          github-token: '${{ secrets.GH_PAT }}'
+
+      - name: Integration Tests (with workflow token)
+        if: ${{ env.PAT_EXISTS == 'false' }}
         uses: ./.github/actions/integration-tests
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'

.github/workflows/test-integration.yml

@@ -4,10 +4,13 @@ on:
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-integration:
     runs-on: ubuntu-latest
+    env:
+      PAT_EXISTS: ${{ secrets.GH_PAT != '' }}
 
     services:
       redis:
@@ -29,7 +32,14 @@ jobs:
         with:
           node-version: 16
 
-      - name: Integration Tests
+      - name: Integration Tests (with PAT)
+        if: ${{ env.PAT_EXISTS == 'true' }}
+        uses: ./.github/actions/integration-tests
+        with:
+          github-token: '${{ secrets.GH_PAT }}'
+
+      - name: Integration Tests (with workflow token)
+        if: ${{ env.PAT_EXISTS == 'false' }}
         uses: ./.github/actions/integration-tests
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'

.github/workflows/test-lint.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-lint:

.github/workflows/test-main-17.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-main-17:

.github/workflows/test-main.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-main:

.github/workflows/test-package-cli.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 # Smoke test (render a badge with the CLI) with only the package
 # dependencies installed.

.github/workflows/test-package-lib.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-package-lib: