Remove misleading author check from Dependabot base-ref restrictions

[mogya]

Why

The pull_request_target restriction is described as applying when
the pull request's base ref was created by Dependabot. However, the
parenthetical expression checks the pull request author:

github.event.pull_request.user.login == 'dependabot[bot]'

This expression does not identify who created the base ref. It can
therefore suggest that every Dependabot-authored pull request receives
a read-only token under pull_request_target.

What changed

Remove the misleading expression from both affected articles.
The documented base-ref condition remains unchanged, consistent with
the original announcement:

https://github.blog/changelog/2021-12-09-github-actions-changes-to-permissions-in-workflows-triggered-by-dependabot/

Check off the following:

• A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• The changes in this PR meet the docs fundamentals that are required for all content.
• All CI checks are passing and the changes look good in the review environment.

[welcome]

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
code-security/reference/secret-security/secret-types.md	fpt ghec ghes@ 3.22 3.21 3.20 3.19 3.18	fpt ghec ghes@ 3.22 3.21 3.20 3.19 3.18
code-security/reference/supply-chain-security/dependabot-on-actions.md	fpt ghec ghes@ 3.22 3.21 3.20 3.19 3.18	fpt ghec ghes@ 3.22 3.21 3.20 3.19 3.18

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[Copilot]

🟢 Approval recommended

Both documentation-only deletions remove misleading guidance without changing the stated security restrictions.

0 open findings

What changed in this PR

Clarifies Dependabot’s pull_request_target restrictions by removing an expression that checks the pull request author, not the base-ref creator.

Changes:

• Removes the misleading expression from both articles.
• Preserves the documented base-ref condition and security restrictions.

File	Description
content/​code-security/​reference/​supply-chain-security/​dependabot-on-actions.md	Removes the author check from workflow restrictions.
content/​code-security/​reference/​secret-security/​secret-types.md	Removes the same check from secrets restrictions.

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[subatoi]

Thank you for spotting that and raising a fix, @mogya—I'll get this merged now

[github-actions]

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues ⚡