From 149c8d68eee0054275d85a2859eeca044c46ef31 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 15 Oct 2026 10:56:07 +0000 Subject: [PATCH] Remove misleading author check from Dependabot base-ref restrictions Co-authored-by: mogya <10248+mogya@users.noreply.github.com> --- content/code-security/reference/secret-security/secret-types.md | 2 +- .../reference/supply-chain-security/dependabot-on-actions.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/code-security/reference/secret-security/secret-types.md b/content/code-security/reference/secret-security/secret-types.md index 0db20172de75..7994fa61e53b 100644 --- a/content/code-security/reference/secret-security/secret-types.md +++ b/content/code-security/reference/secret-security/secret-types.md @@ -61,7 +61,7 @@ Organization-level secrets: ### Limitations and restrictions -For workflows initiated by {% data variables.product.prodname_dependabot %}, the `pull_request_target` event is treated differently to other events. For this event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %} (`github.event.pull_request.user.login == 'dependabot[bot]'`): +For workflows initiated by {% data variables.product.prodname_dependabot %}, the `pull_request_target` event is treated differently to other events. For this event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %}: * The workflow receives a read-only `GITHUB_TOKEN`. * Secrets are **not** available to the workflow. diff --git a/content/code-security/reference/supply-chain-security/dependabot-on-actions.md b/content/code-security/reference/supply-chain-security/dependabot-on-actions.md index 43636ee18740..7c7015968503 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-on-actions.md +++ b/content/code-security/reference/supply-chain-security/dependabot-on-actions.md @@ -20,7 +20,7 @@ For workflows initiated by {% data variables.product.prodname_dependabot %} (`gi * `GITHUB_TOKEN` has read-only permissions by default. * Secrets are populated from {% data variables.product.prodname_dependabot %} secrets. {% data variables.product.prodname_actions %} secrets are not available. -For workflows initiated by {% data variables.product.prodname_dependabot %} (`github.actor == 'dependabot[bot]'`) using the `pull_request_target` event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %} (`github.event.pull_request.user.login == 'dependabot[bot]'`), the `GITHUB_TOKEN` will be read-only and secrets are not available. +For workflows initiated by {% data variables.product.prodname_dependabot %} (`github.actor == 'dependabot[bot]'`) using the `pull_request_target` event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %}, the `GITHUB_TOKEN` will be read-only and secrets are not available. These restrictions apply even if the workflow is re-run by a different actor.