Open
Description
Code of Conduct
- I have read and agree to the GitHub Docs project's Code of Conduct
What article on docs.github.com is affected?
What part(s) of the article would you like to see updated?
- It currently recommends a
if: github.actor != 'dependabot[bot]'check
Maybe (at least for pull requests) it would be safer to usegithub.event.pull_request.user.login != 'dependabot[bot]'. Otherwise malicious users could abuse this to skip certain workflows, see related https://www.synacktiv.com/publications/github-actions-exploitation-dependabot. - It currently suggests using
pull_request_targetand a "two-step process" without going into detail.
It might be safer to not recommendpull_request_target(due to its inherent security risks), but rather suggest increasing thepermissionsand using Dependabot secrets (which is bullet point 3 of that recommendations list, so maybe this point 2 can simply be omitted?).
Additional information
I am not completely sure about the proposed changes, so please let me know if I forget to consider something, or if something I wrote is incorrect.