Am I going crazy or did the majority commenters here not read the article? These commits are not PRs. If I'm understanding this correct, the attacker got a hol

Am I going crazy or did the majority commenters here not read the article? These commits are not PRs. If I'm understanding this correct, the attacker got a hold of someone's personal access token in some way, then used that to make a commit that creates a new GHA workflow, in which the workflow ex-filtrate all the secrets and env vars to their servers. The commit was made directly to the main (?) branch and set up to be run on all pushes. So the branch doesn't even matter. So it has nothing to do with automerging dependabot PRs. Sure you shouldn't be doing that, but if your PAT is compromised, you're done for anyway. The reason dependabot is involved is because that commit looks like it came from dependabot, and that's likely because the email on the git commit was set to dependabot, which GitHub would see and show as being from dependabot.