chore: rename the dependency upgrade repair workflow - #10324
Merged
Merged
Conversation
mcmire
reviewed
Sep 21, 2026
cryptodev-2s
changed the title
cryptodev-2s
force-pushed
the
chore/rename-repair-workflow
branch
2 times, most recently
from
September 21, 2026 17:06
27e1d2e to
8136a5f
Compare
cryptodev-2s
enabled auto-merge
September 21, 2026 17:06
cryptodev-2s
force-pushed
the
chore/rename-repair-workflow
branch
from
September 21, 2026 17:06
8136a5f to
f0d7829
Compare
Mrtenz
reviewed
Sep 21, 2026
4 tasks
pull Bot
pushed a commit
to Reality2byte/core
that referenced
this pull request
Sep 21, 2026
## Explanation The branch prefix alone was too loose. `actions/checkout` here passes `ref:` with no `repository:`, so it always checks out from `MetaMask/core`. A fork pull request whose head branch happens to be named after an existing `renovate/` branch would pass the gate, mint a write token through the exchange, and push to that branch. No attacker code runs, since the tree comes from this repo, but an outsider should not be able to trigger it at all. Requiring `metamask-ci[bot]` as the author closes it, and nobody can impersonate a bot login. Verified against the real payloads: Renovate pull requests are `user.login = metamask-ci[bot]`, `type = Bot`, and Dependabot ones are `dependabot[bot]`. Raised by Mrtenz on MetaMask#10324. ## References Follows MetaMask#10324. Part of WPC-1161. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > One-line workflow gate change with no app runtime impact; wrong bot matching would only stop repairs on Renovate PRs. > > **Overview** > **Tightens who can run the dependency-upgrade repair workflow** so it no longer keys off a `renovate/` branch name alone. > > The job’s `if` condition now runs for **Dependabot** (`dependabot[bot]`) as before, or for **Renovate** only when the PR author is `metamask-ci[bot]` **and** the head ref still starts with `renovate/`. That blocks fork (or other) PRs that reused a `renovate/…` branch name from triggering OIDC token exchange and pushes to the head branch, while keeping legitimate Renovate automation unchanged. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4923adb. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Renames the workflow file and its
nametorepair-dependency-upgrade-pull-requests.ymland Repair dependency upgrade pull requests. Once #10322 lands it repairs Renovate pull requests too, sorepair-dependabot-pull-requests.ymlis misleading.Important
Depends on consensys-vertical-apps/token-exchange-service#184. The token exchange policy globs on the workflow path, so renaming the file before that merges makes the token request fail and the job never starts. #184 matches both names, so after it merges the two can land in any order.
Merge after #10322, which edits the same file. #10322 is already queued with the interim name Repair dependency update pull requests, so this rebases onto that.
References
Depends on consensys-vertical-apps/token-exchange-service#184. Follows #10322. Part of WPC-1161.
Checklist
Note
Low Risk
Cosmetic workflow metadata only; behavior is unchanged in this diff.
Overview
Renames the GitHub Actions workflow’s
namefrom Repair dependency update pull requests to Repair dependency upgrade pull requests, matching the renamed workflow file and the fact that the job will repair Renovate PRs as well as Dependabot (not just “update” wording).No job steps, triggers, or permissions change in this diff—only the workflow title shown in the Actions UI.
Reviewed by Cursor Bugbot for commit f0d7829. Bugbot is set up for automated code reviews on this repo. Configure here.