Repository navigation
Remove misleading author check from Dependabot base-ref restrictions - #46333
Conversation
Co-authored-by: mogya <10248+mogya@users.noreply.github.com>
|
Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines. |
How to review these changes 👓Thank you for your contribution. To review these changes, choose one of the following options: A Hubber will need to deploy your changes internally to review. Table of review linksNote: Please update the URL for your staging server or codespace. The table shows the files in the
Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server 🤖 This comment is automatically generated. |
There was a problem hiding this comment.
🟢 Approval recommended
Both documentation-only deletions remove misleading guidance without changing the stated security restrictions.
0 open findings
What changed in this PR
Clarifies Dependabot’s pull_request_target restrictions by removing an expression that checks the pull request author, not the base-ref creator.
Changes:
- Removes the misleading expression from both articles.
- Preserves the documented base-ref condition and security restrictions.
| File | Description |
|---|---|
| content/code-security/reference/supply-chain-security/dependabot-on-actions.md | Removes the author check from workflow restrictions. |
| content/code-security/reference/secret-security/secret-types.md | Removes the same check from secrets restrictions. |
🧠 Review effort: Max
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues ⚡ |
Why
The
pull_request_targetrestriction is described as applying whenthe pull request's base ref was created by Dependabot. However, the
parenthetical expression checks the pull request author:
github.event.pull_request.user.login == 'dependabot[bot]'This expression does not identify who created the base ref. It can
therefore suggest that every Dependabot-authored pull request receives
a read-only token under
pull_request_target.What changed
Remove the misleading expression from both affected articles.
The documented base-ref condition remains unchanged, consistent with
the original announcement:
https://github.blog/changelog/2021-12-09-github-actions-changes-to-permissions-in-workflows-triggered-by-dependabot/
Check off the following: