Skip to content

Add condition to skip security review for dependabot #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Neil-Smithline wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add condition to skip security review for dependabot #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/security-review-required.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ on:

jobs:
security-review:
if: github.event.pull_request.user.login != 'dependabot[bot]'

@github-actions github-actions Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Security Issue: The newly added job-level condition if: github.event.pull_request.user.login != 'dependabot[bot]' causes the org-required security-review job to be skipped entirely for any pull request opened by dependabot[bot]. Because this workflow is the file enforced by the org ruleset's 'Require workflows to pass before merging' rule, and GitHub treats a skipped required check as non-failing, dependabot PRs now bypass the mandatory security review gate and can be merged with no automated scanning. Dependency-update PRs are precisely the highest-risk class for supply-chain attacks (malicious or compromised upstream package versions), so this removes the security control from the surface where it matters most.

Severity: MEDIUM
Category: authorization_bypass
Tool: ClaudeCode AI Security Analysis

Exploit Scenario: An attacker who compromises or publishes a malicious version of a dependency used by a targeted repository waits for Dependabot to open an automated version-bump PR pulling that version in. That PR is authored by dependabot[bot], so the security-review job is skipped and reports as a non-failing (skipped) required check. The malicious dependency change can then be merged into the protected branch without ever being scanned by the security review that all other PRs must pass.

Recommendation: Do not skip the security review for dependabot PRs. If the goal is to reduce noise on automated dependency bumps, instead run the review with a softer policy (e.g. fail-on-findings: false) for dependabot rather than skipping the job, so dependency updates are still scanned. If a skip is truly required, ensure branch protection explicitly fails (rather than passes) when this required check is skipped, and scope any exception as narrowly as possible.

permissions:
contents: read
pull-requests: write
Expand Down
Loading