From a95bacb7a7ea08398a7fd760e9eb2c6a1fbb684f Mon Sep 17 00:00:00 2001 From: Mark Lauter <10211200+marklauter@users.noreply.github.com> Date: Sat, 10 Oct 2026 13:23:54 -0400 Subject: [PATCH] Pin dependabot/fetch-metadata to a commit SHA The auto-merge job runs with contents/pull-requests write, so a moved tag would execute third-party code with those rights. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 7e6500f..a66429c 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -12,7 +12,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: meta - uses: dependabot/fetch-metadata@v3 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Enable auto-merge for patch and minor updates