From cbeeef917fcc676d110438e16d471777128085b0 Mon Sep 17 00:00:00 2001 From: "zizmor-enterprise-analysis[bot]" <316478672+zizmor-enterprise-analysis[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 09:37:39 +0100 Subject: [PATCH 1/2] fix: 1 vulnerabilities in GitHub Actions Applied with zizmor 1.32.0 --fix=safe by BulkZizmorFix.ps1. --- .github/workflows/dependabot-auto-merge-actions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge-actions.yml b/.github/workflows/dependabot-auto-merge-actions.yml index 3e29e33..f737b6a 100644 --- a/.github/workflows/dependabot-auto-merge-actions.yml +++ b/.github/workflows/dependabot-auto-merge-actions.yml @@ -11,7 +11,7 @@ permissions: jobs: auto-merge-actions: runs-on: ubuntu-latest - if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.user.type == 'Bot' && github.event.pull_request.head.repo.full_name == github.repository && github.actor == 'dependabot[bot]' + if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.user.type == 'Bot' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login == 'dependabot[bot]' steps: - name: Fetch Dependabot metadata id: metadata From d9833516304733c821b7188508555f183fbd0b1f Mon Sep 17 00:00:00 2001 From: Christoph Hannebauer Date: Wed, 4 Nov 2026 11:10:14 +0100 Subject: [PATCH 2/2] Make Auto Merge safe again --- .../workflows/dependabot-auto-merge-actions.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge-actions.yml b/.github/workflows/dependabot-auto-merge-actions.yml index f737b6a..890da09 100644 --- a/.github/workflows/dependabot-auto-merge-actions.yml +++ b/.github/workflows/dependabot-auto-merge-actions.yml @@ -11,7 +11,13 @@ permissions: jobs: auto-merge-actions: runs-on: ubuntu-latest - if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.user.type == 'Bot' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login == 'dependabot[bot]' + # pull_request.user.login: PR author; unspoofable, since humans cannot register names ending in "[bot]". + # pull_request.user.type: defense in depth, the author must be a Bot account. + # head.repo.full_name: rejects PRs from forks. + # github.actor: whoever caused this event, i.e. the last pusher; rejects humans pushing onto a Dependabot PR. + # github.triggering_actor: whoever started this run; rejects re-runs by humans. + # zizmor flags actor checks as spoofable when used ALONE; here they only add to the author check, hence the ignore. + if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.user.type == 'Bot' && github.event.pull_request.head.repo.full_name == github.repository && github.actor == 'dependabot[bot]' && github.triggering_actor == 'dependabot[bot]' # zizmor: ignore[bot-conditions] steps: - name: Fetch Dependabot metadata id: metadata @@ -21,9 +27,12 @@ jobs: - name: Approve and auto-merge GitHub Actions updates if: steps.metadata.outputs.package-ecosystem == 'github_actions' + # Approve and merge only the exact commit checked above, so a commit pushed in the meantime is never merged. run: | - gh pr review --approve "$PR_URL" - gh pr merge --auto --merge "$PR_URL" + gh api --method POST "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/reviews" -f event=APPROVE -f commit_id="$HEAD_SHA" + gh pr merge --auto --merge --match-head-commit "$HEAD_SHA" "$PR_URL" env: + PR_NUMBER: ${{ github.event.pull_request.number }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} PR_URL: ${{ github.event.pull_request.html_url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}