diff --git a/content/code-security/reference/secret-security/secret-types.md b/content/code-security/reference/secret-security/secret-types.md index 0db20172de75..7994fa61e53b 100644 --- a/content/code-security/reference/secret-security/secret-types.md +++ b/content/code-security/reference/secret-security/secret-types.md @@ -61,7 +61,7 @@ Organization-level secrets: ### Limitations and restrictions -For workflows initiated by {% data variables.product.prodname_dependabot %}, the `pull_request_target` event is treated differently to other events. For this event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %} (`github.event.pull_request.user.login == 'dependabot[bot]'`): +For workflows initiated by {% data variables.product.prodname_dependabot %}, the `pull_request_target` event is treated differently to other events. For this event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %}: * The workflow receives a read-only `GITHUB_TOKEN`. * Secrets are **not** available to the workflow. diff --git a/content/code-security/reference/supply-chain-security/dependabot-on-actions.md b/content/code-security/reference/supply-chain-security/dependabot-on-actions.md index 43636ee18740..7c7015968503 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-on-actions.md +++ b/content/code-security/reference/supply-chain-security/dependabot-on-actions.md @@ -20,7 +20,7 @@ For workflows initiated by {% data variables.product.prodname_dependabot %} (`gi * `GITHUB_TOKEN` has read-only permissions by default. * Secrets are populated from {% data variables.product.prodname_dependabot %} secrets. {% data variables.product.prodname_actions %} secrets are not available. -For workflows initiated by {% data variables.product.prodname_dependabot %} (`github.actor == 'dependabot[bot]'`) using the `pull_request_target` event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %} (`github.event.pull_request.user.login == 'dependabot[bot]'`), the `GITHUB_TOKEN` will be read-only and secrets are not available. +For workflows initiated by {% data variables.product.prodname_dependabot %} (`github.actor == 'dependabot[bot]'`) using the `pull_request_target` event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %}, the `GITHUB_TOKEN` will be read-only and secrets are not available. These restrictions apply even if the workflow is re-run by a different actor.