fix: stop trusting dependabot by default

Co-authored-by: Codex [email protected]

README.md

@@ -113,7 +113,7 @@ jobs:
 | `safety-strategy`        | Controls how the action restricts Codex privileges. See [Safety strategy](#safety-strategy).                                                   | `drop-sudo` |
 | `codex-user`             | Username to run Codex as when `safety-strategy` is `unprivileged-user`.                                                                        | `""`        |
 | `allow-users`            | List of GitHub usernames who can trigger the action in addition to those who have write access to the repo.                                    | `""`        |
-| `allow-bots`             | Allow runs triggered by trusted GitHub bot accounts (`dependabot[bot]` and `github-actions[bot]`) to bypass the write-access check.             | `false`     |
+| `allow-bots`             | Allow runs triggered by trusted GitHub bot accounts (`github-actions[bot]`) to bypass the write-access check.                                  | `false`     |
 | `allow-bot-users`        | List of GitHub bot usernames that can bypass the write-access check. `*` is not supported; list trusted bots explicitly.                       | `""`        |
 
 ## Safety Strategy

action.yml

@@ -94,7 +94,7 @@ inputs:
     required: false
     default: ""
   allow-bots:
-    description: "Allow runs triggered by trusted GitHub bot accounts (dependabot[bot] and github-actions[bot]) to bypass the write-access check."
+    description: "Allow runs triggered by trusted GitHub bot accounts (github-actions[bot]) to bypass the write-access check."
     required: false
     default: "false"
   allow-bot-users:

docs/security.md

@@ -4,7 +4,7 @@ Running Codex as part of a GitHub workflow can be a powerful tool, but it is imp
 
 ## Limiting who can run your workflow
 
-One of the most fundamental ways to safeguard your workflow is to limit who can run it in the first place. By default, `openai/codex-action` can only be run by a user who has _write_ access to your repository. While you can expand this list via `allow-users`, allow trusted GitHub bot actors (`dependabot[bot]` and `github-actions[bot]`) via `allow-bots`, or list custom trusted bots via `allow-bot-users`, do so with caution. `allow-bot-users` does not support `*`; list each trusted bot explicitly.
+One of the most fundamental ways to safeguard your workflow is to limit who can run it in the first place. By default, `openai/codex-action` can only be run by a user who has _write_ access to your repository. While you can expand this list via `allow-users`, allow trusted GitHub bot actors (`github-actions[bot]`) via `allow-bots`, or list custom trusted bots via `allow-bot-users`, do so with caution. `allow-bot-users` does not support `*`; list each trusted bot explicitly.
 
 Further, while you may design your workflow such that those with _write_ access can trigger it on content from arbitrary users (i.e., by adding a label to an issue created by an external user) such that you rely on manual approval as a means of defense, it is still important to consider other potential exploits, such as untrusted input.
 

src/checkActorPermissions.ts

@@ -18,9 +18,9 @@ type EnsureWriteAccessOptions = {
   actor?: string;
   repository?: string;
   /**
-   * When true, trusted GitHub bot actors such as dependabot are allowed without
-   * checking collaborator permissions. Other bots must pass the same checks as
-   * human users.
+   * When true, trusted GitHub bot actors are allowed without checking
+   * collaborator permissions. Other bots must pass the same checks as human
+   * users.
    */
   allowBotActors?: boolean;
   /**
@@ -178,7 +178,7 @@ function getTokenFromEnv(): string {
   return token && token.trim().length > 0 ? token : "";
 }
 
-const TRUSTED_GITHUB_BOT_ACTORS = new Set(["dependabot[bot]", "github-actions[bot]"]);
+const TRUSTED_GITHUB_BOT_ACTORS = new Set(["github-actions[bot]"]);
 
 function isTrustedGitHubBotActor(actor: string): boolean {
   return isBotActor(actor) && TRUSTED_GITHUB_BOT_ACTORS.has(normalizeBotActor(actor));

test/checkActorPermissions.test.mjs

@@ -28,14 +28,21 @@ test("does not trust arbitrary bot actor suffixes", () => {
 });
 
 test("allows trusted GitHub bot actors when enabled", () => {
-  const result = runCheckWriteAccess("dependabot[bot]", ["--allow-bots", "true"]);
+  const result = runCheckWriteAccess("github-actions[bot]", ["--allow-bots", "true"]);
 
   assert.equal(result.status, 0, result.stderr);
   assert.match(result.stdout, /permitted to continue/);
 });
 
 test("requires explicit opt-in for trusted GitHub bot actors", () => {
-  const result = runCheckWriteAccess("dependabot[bot]");
+  const result = runCheckWriteAccess("github-actions[bot]");
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /A GitHub token is required/);
+});
+
+test("does not trust dependabot when generic bot bypass is enabled", () => {
+  const result = runCheckWriteAccess("dependabot[bot]", ["--allow-bots", "true"]);
 
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /A GitHub token is required/);