Uh oh!
There was an error while loading. Please reload this page.
Fix dependabot-check false positive: verify author, not committer - #356
Merged
Conversation
Dependabot creates commits via the GitHub API, so the committer is always web-flow/GitHub. The previous jq filter required the committer to be dependabot[bot], which could never pass and blocked every legitimate Dependabot PR (e.g. #354, #355). Keep the security intent - refuse auto-merge when a commit on the PR was authored by anyone other than dependabot[bot] - but only check the author identity: - .author.login must be dependabot[bot] - .commit.author.name must be dependabot[bot] - .commit.author.email must contain 'dependabot[bot]' The committer checks are removed because any commit created via the GitHub web/API (including a malicious one) shows web-flow/GitHub as committer, so the author is the meaningful signal. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. Scanned FilesNone |
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The 'Verify all commits are authored by Dependabot' step in
approve-dependabot-pr.ymlalso checked the committer identity. However, Dependabot creates its commits through the GitHub API, so the committer is alwaysweb-flow/GitHub:author_login: dependabot[bot] committer_login: web-flow author_name: dependabot[bot] committer_name: GitHubThis made the check fail on every legitimate Dependabot PR — #354 and #355 are blocked right now.
Fix
Keep the security intent (refuse auto-merge when a commit on the PR was authored by anyone other than dependabot[bot], preventing piggy-backed malicious commits), but only check the author identity:
.author.loginmust bedependabot[bot].commit.author.namemust bedependabot[bot].commit.author.emailmust containdependabot[bot](49699333+dependabot[bot]@users.noreply.github.com)The committer checks are removed: any commit created via the GitHub web/API — including a malicious one made with a compromised token — shows
web-flow/GitHubas committer, so the author is the meaningful signal.Verification
gh api repos/devops-actions/.github/pulls/355/commits --paginate --jq '<filter>'— commitc3650e7is no longer flagged (same for deps: bump jessehouwing/actions-dependency-submission from 1.0.16 to 1.0.17 #354).actionlintpasses on the workflow.