Endre hvordan vi sjekker at PRs kommer fra dependabot

https://www.synacktiv.com/en/publications/github-actions-exploitation-dependabot

Author: androa

.github/workflows/dependabot-auto-merge.yaml

@@ -8,7 +8,7 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       - name: Dependabot metadata
         id: metadata