Skip to content

Commit 149c8d6

Browse files
Copilotmogya
andauthored
Remove misleading author check from Dependabot base-ref restrictions
Co-authored-by: mogya <10248+mogya@users.noreply.github.com>
1 parent 0226a2d commit 149c8d6

2 files changed

Lines changed: 2 additions & 2 deletions

File tree

‎content/code-security/reference/secret-security/secret-types.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ Organization-level secrets:
6161

6262
### Limitations and restrictions
6363

64-
For workflows initiated by {% data variables.product.prodname_dependabot %}, the `pull_request_target` event is treated differently to other events. For this event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %} (`github.event.pull_request.user.login == 'dependabot[bot]'`):
64+
For workflows initiated by {% data variables.product.prodname_dependabot %}, the `pull_request_target` event is treated differently to other events. For this event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %}:
6565

6666
* The workflow receives a read-only `GITHUB_TOKEN`.
6767
* Secrets are **not** available to the workflow.

‎content/code-security/reference/supply-chain-security/dependabot-on-actions.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ For workflows initiated by {% data variables.product.prodname_dependabot %} (`gi
2020
* `GITHUB_TOKEN` has read-only permissions by default.
2121
* Secrets are populated from {% data variables.product.prodname_dependabot %} secrets. {% data variables.product.prodname_actions %} secrets are not available.
2222

23-
For workflows initiated by {% data variables.product.prodname_dependabot %} (`github.actor == 'dependabot[bot]'`) using the `pull_request_target` event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %} (`github.event.pull_request.user.login == 'dependabot[bot]'`), the `GITHUB_TOKEN` will be read-only and secrets are not available.
23+
For workflows initiated by {% data variables.product.prodname_dependabot %} (`github.actor == 'dependabot[bot]'`) using the `pull_request_target` event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %}, the `GITHUB_TOKEN` will be read-only and secrets are not available.
2424

2525
These restrictions apply even if the workflow is re-run by a different actor.
2626

0 commit comments

Comments
 (0)