Fix Commit Injection from dependency bot automerge workflow

adobe · Feb 12, 2025 · fa80172 · fa80172
1 parent d745281
commit fa80172
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
@@ -9,7 +9,7 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'adobe/css-tools'}}
     steps:
       - name: Dependabot metadata
         id: metadata