From 7adbce07f17e2b4f35fbb4aec29a2c2368365bcf Mon Sep 17 00:00:00 2001 From: Leandro Lucarella Date: Mon, 16 Feb 2026 14:19:00 +0100 Subject: [PATCH] Use pull_request_target trigger instead of pull_request We need this in order to be able to get the secrets. Signed-off-by: Leandro Lucarella --- .github/workflows/auto-dependabot.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/auto-dependabot.yaml b/.github/workflows/auto-dependabot.yaml index 0016929..9a596ec 100644 --- a/.github/workflows/auto-dependabot.yaml +++ b/.github/workflows/auto-dependabot.yaml @@ -1,7 +1,15 @@ name: Auto-merge Dependabot PR on: - pull_request: + # XXX: !!! SECURITY WARNING !!! + # pull_request_target has write access to the repo, and can read secrets. We + # need to audit any external actions executed in this workflow and make sure no + # checked out code is run (not even installing dependencies, as installing + # dependencies usually can execute pre/post-install scripts). We should also + # only use hashes to pick the action to execute (instead of tags or branches). + # For more details read: + # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ + pull_request_target: permissions: contents: read