Non-Blocking Review Concern: Security invariant comment removed along with the inline implementation it documented
Source: pre-push whole-codebase review
Location: .github/workflows/dependabot-auto-merge.yml:3
Date: 2026-08-11
What was flagged
The deleted block explicitly documented why pull_request_target is safe here: it runs from the base branch, not the PR branch, and never executes PR code. It also noted the dependabot[bot] actor check and the trusted-namespace allowlist. The replacement zizmor: ignore comment is generic and loses that audit trail. If the reusable workflow doesn't include equivalent documentation, future reviewers (or security scanners) will have no basis for evaluating whether the pull_request_target use is safe. Consider adding a brief comment referencing where the security controls now live.
Context
This issue was automatically created from a non-blocking concern identified
during pre-push whole-codebase review. It was flagged for tracking.
Created by lib-review-issues.sh
Non-Blocking Review Concern: Security invariant comment removed along with the inline implementation it documented
Source: pre-push whole-codebase review
Location:
.github/workflows/dependabot-auto-merge.yml:3Date: 2026-08-11
What was flagged
The deleted block explicitly documented why
pull_request_targetis safe here: it runs from the base branch, not the PR branch, and never executes PR code. It also noted thedependabot[bot]actor check and the trusted-namespace allowlist. The replacementzizmor: ignorecomment is generic and loses that audit trail. If the reusable workflow doesn't include equivalent documentation, future reviewers (or security scanners) will have no basis for evaluating whether thepull_request_targetuse is safe. Consider adding a brief comment referencing where the security controls now live.Context
This issue was automatically created from a non-blocking concern identified
during pre-push whole-codebase review. It was flagged for tracking.
Created by lib-review-issues.sh