From 420681489c2e9605e9ba0cb0e0ef745035ecc3e8 Mon Sep 17 00:00:00 2001 From: zinduolis Date: Fri, 29 May 2026 14:11:37 +1000 Subject: [PATCH] Require Dependabot actor for auto-run BrowserStack tests Also gate the auto-run condition on github.actor == 'dependabot[bot]' so commits pushed to a Dependabot PR by anyone else fall back to the explicit safe_to_test opt-in instead of running automatically with secret access. --- .github/workflows/github_actions.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/github_actions.yml b/.github/workflows/github_actions.yml index e95f960c0..6fd5bf34c 100644 --- a/.github/workflows/github_actions.yml +++ b/.github/workflows/github_actions.yml @@ -13,8 +13,12 @@ jobs: group: browserstack-${{ github.event.pull_request.number }} cancel-in-progress: true # Auto-run for Dependabot; let humans opt in via the safe_to_test label. + # Require the triggering actor to also be Dependabot so commits pushed by + # anyone else fall back to the explicit safe_to_test opt-in. if: >- - (github.event.pull_request.user.login == 'dependabot[bot]' && github.event.action != 'labeled') || + (github.event.pull_request.user.login == 'dependabot[bot]' && + github.actor == 'dependabot[bot]' && + github.event.action != 'labeled') || github.event.label.name == 'safe_to_test' env: GITACTIONS: true