chore: [SECURITY-1357] refine condition for dependabot approval in workflow #2037
Conversation
…rkflow This change improves the security of the dependabot auto-approval workflow by: - Checking the PR user login instead of github.actor - Verifying the PR is from the same repository (not a fork) This prevents potential security issues where forked PRs could be auto-approved.
forged-request
force-pushed
the
chore/security-1357-dependabot-approval-fix
branch
from
5c94004 to
3b70dfd
Compare
There was a problem hiding this comment.
Pull request overview
This PR enhances the security of the dependabot auto-approval workflow by refining the conditions under which PRs are automatically approved. The changes prevent potential security issues where forked PRs could be auto-approved by verifying both the PR author and repository origin.
Changes:
- Modified the workflow condition to check
github.event.pull_request.user.logininstead ofgithub.actor - Added verification that the PR originates from the same repository (not a fork)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| id-token: write | ||
| runs-on: ubuntu-latest | ||
| if: github.actor == 'dependabot[bot]' | ||
| if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name |
There was a problem hiding this comment.
The condition github.event.pull_request.head.repo.full_name can be null for forked PRs in certain GitHub configurations, which could cause the workflow to fail or behave unexpectedly. Consider adding a null check or using a safer comparison pattern.
| if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name | |
| if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.head.repo != null && github.repository == github.event.pull_request.head.repo.full_name |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
forged-request
deleted the
chore/security-1357-dependabot-approval-fix
branch
2 participants
This change improves the security of the dependabot auto-approval workflow by:
This prevents potential security issues where forked PRs could be auto-approved.