4 ms·
Seems like a bit forced scenario to me. I have never seen anyone auto-merge Dependabot PR automatically using GitHub Action. Also pull_request_target is a big
by abhisek 1y ago
Seems like a bit forced scenario to me. I have never seen anyone auto-merge Dependabot PR automatically using GitHub Action.
Also pull_request_target is a big red flag in any GHA and even highlighted in GHA docs. It’s like running untrusted code with all your secrets handed over to it.
- woodruffw 1y ago> I have never seen anyone auto-merge Dependabot PR automatically using GitHub Action. For better or worse, it's a pattern that GitHub explicitly documents[1]. (An earlier version of this page also recommended `pull_request_target`, hence the long tail of public repositories that use it.) [1]: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#enabling-automerge-on-a-pull-request https://docs.github.com/en/code-security/dependabot/working-...