Merge pull request #129 from libranet/fix/dotenv-permission-and-str-t… #166
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Security references: | ||
| # - https://securitylab.github.com/resources/github-actions-preventing-pwn-requests | ||
| # - https://securitylab.github.com/resources/github-actions-untrusted-input | ||
| # - https://securitylab.github.com/resources/github-actions-building-blocks | ||
| # - https://securitylab.github.com/resources/github-actions-new-patterns-and-mitigations | ||
| name: Auto Merge Dependabot | ||
| on: | ||
| pull_request: | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | ||
| cancel-in-progress: true | ||
| permissions: {} | ||
| jobs: | ||
| auto-merge: | ||
| name: Auto Merge Dependabot | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| permissions: | ||
| contents: write # Required to squash/merge/rebase the dependabot PR | ||
| pull-requests: write # Required to approve and merge the pull request | ||
| workflows: write # Required when the dependabot PR itself modifies workflow files | ||
| # Only run for Dependabot PRs - security: prevent running on PRs from forks or other actors | ||
| # Uses the PR creator (pull_request.user.login) rather than github.actor, which reflects | ||
| # the last actor to touch the ref and can be spoofed via a crafted commit history. | ||
| if: github.event.pull_request.user.login == 'dependabot[bot]' | ||
| steps: | ||
| # repo: https://github.com/actions/checkout | ||
| # releases: https://github.com/actions/checkout/tags | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| persist-credentials: false | ||
| # repo: https://github.com/fastify/github-action-merge-dependabot | ||
| # releases: https://github.com/fastify/github-action-merge-dependabot/tags | ||
| # The action waits for required status checks by default | ||
| - uses: fastify/github-action-merge-dependabot@73ec4cbb5e56df5591eae286972d5b2201ffe90f # v3.15.0 | ||
| with: | ||
| # github-token: ${{ secrets.TOKEN_AUTOMERGE }} | ||
| # Using built-in GITHUB_TOKEN for better security (auto-scoped, auto-expires) | ||
| # Falls back to TOKEN_AUTOMERGE if GITHUB_TOKEN lacks permissions | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| merge-method: squash # merge|squash|rebase | ||
| target: minor | ||
