From 6a827f4175d587e723ca02b81958495d8e42e457 Mon Sep 17 00:00:00 2001 From: Rob Bos Date: Mon, 31 Aug 2026 09:15:12 +0200 Subject: [PATCH] Fix dependabot-check: only verify author, not committer Dependabot creates commits via the GitHub API, so the committer is always web-flow/GitHub. The previous jq filter required the committer to be dependabot[bot], which could never pass and blocked every legitimate Dependabot PR (e.g. #354, #355). Keep the security intent - refuse auto-merge when a commit on the PR was authored by anyone other than dependabot[bot] - but only check the author identity: - .author.login must be dependabot[bot] - .commit.author.name must be dependabot[bot] - .commit.author.email must contain 'dependabot[bot]' The committer checks are removed because any commit created via the GitHub web/API (including a malicious one) shows web-flow/GitHub as committer, so the author is the meaningful signal. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/approve-dependabot-pr.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/approve-dependabot-pr.yml b/.github/workflows/approve-dependabot-pr.yml index e05156e..05e0ea2 100644 --- a/.github/workflows/approve-dependabot-pr.yml +++ b/.github/workflows/approve-dependabot-pr.yml @@ -56,9 +56,8 @@ jobs: offenders=$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER/commits" --paginate \ --jq '[.[] | select( (.author.login // "") != "dependabot[bot]" or - (.committer.login // "") != "dependabot[bot]" or (.commit.author.name // "") != "dependabot[bot]" or - (.commit.committer.name // "") != "dependabot[bot]" + ((.commit.author.email // "") | contains("dependabot[bot]") | not) ) | .sha] | .[]') if [[ -n "$offenders" ]]; then echo "Refusing to auto-merge: found commits not created by dependabot[bot]:"