From f92349f4a18f7fdfcd74c02060150c1554479b6b Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Sun, 6 Sep 2026 18:18:02 +0800
Subject: [PATCH] fix(ci): pass workflow_run branch via env for Dependabot
 merge

Move untrusted head_branch/head_sha from shell script text into step
env so branch names cannot break or inject into privileged auto-merge.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/dependabot_auto_merge.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dependabot_auto_merge.yml b/.github/workflows/dependabot_auto_merge.yml
index 476c38d..5408f64 100644
--- a/.github/workflows/dependabot_auto_merge.yml
+++ b/.github/workflows/dependabot_auto_merge.yml
@@ -19,9 +19,10 @@ jobs:
         id: pr
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
+          EXPECTED_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
           set -euo pipefail
-          BRANCH_NAME="${{ github.event.workflow_run.head_branch }}"
           PR_PAYLOAD=$(gh pr list --repo "${GITHUB_REPOSITORY}" --state open --head "${BRANCH_NAME}" --json number,headRefOid --jq '.[0] // {}')
           PR_NUMBER=$(python3 -c 'import json,sys; print(json.load(sys.stdin).get("number", ""))' <<<"${PR_PAYLOAD}")
           PR_HEAD_SHA=$(python3 -c 'import json,sys; print(json.load(sys.stdin).get("headRefOid", ""))' <<<"${PR_PAYLOAD}")
@@ -29,8 +30,8 @@ jobs:
             echo "No open Dependabot PR found for ${BRANCH_NAME}." >> "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
-          if [ "${PR_HEAD_SHA}" != "${{ github.event.workflow_run.head_sha }}" ]; then
-            echo "Skipping auto-merge: PR #${PR_NUMBER} head ${PR_HEAD_SHA} does not match completed CI head ${{ github.event.workflow_run.head_sha }}." >> "$GITHUB_STEP_SUMMARY"
+          if [ "${PR_HEAD_SHA}" != "${EXPECTED_HEAD_SHA}" ]; then
+            echo "Skipping auto-merge: PR #${PR_NUMBER} head ${PR_HEAD_SHA} does not match completed CI head ${EXPECTED_HEAD_SHA}." >> "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
           echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"