From 34ec95dd32cdcd04b17df1c0dfc635a4aba3ce62 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 15 Oct 2026 10:50:59 +0000 Subject: [PATCH] Update from template: X0000-setupAutomergeDependabot --- .github/workflows/automerge-dependabot.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/automerge-dependabot.yml b/.github/workflows/automerge-dependabot.yml index cd5c91bcf..94aa5a073 100644 --- a/.github/workflows/automerge-dependabot.yml +++ b/.github/workflows/automerge-dependabot.yml @@ -6,8 +6,10 @@ name: Auto-Merge Dependabot PRs on: # Trigger when a PR is opened or updated - # WARNING: This needs to be run in the PR base, DO NOT build untrusted code in this action - pull_request_target: + # Normally pull_request gets a GITHUB_TOKEN with read access only. + # But workflows run for PRs created by dependabot get write access anyway, + # so the less secure 'pull_request_target' trigger is not required. + pull_request: types: [opened, synchronize, reopened] jobs: