1
0
mirror of synced 2026-02-02 15:02:03 -05:00
Files
docs/data/reusables/actions/workflow-runs-dependabot-note.md
2021-03-17 05:10:43 +00:00

8 lines
537 B
Markdown

{% if currentVersion == "free-pro-team@latest" %}
{% note %}
**Note:** Workflow runs triggered by {% data variables.product.prodname_dependabot %} pull requests run as if they are from a forked repository, and therefore use a read-only `GITHUB_TOKEN`. These workflow runs cannot access any secrets. See ["Keeping your GitHub Actions and workflows secure: Preventing pwn requests"](https://securitylab.github.com/research/github-actions-preventing-pwn-requests) for strategies to keep these workflows secure.
{% endnote %}
{% endif %}