Re:Weaponizing Dependabot: Pwn Request at its finest
by bavarianbob on Friday June 06, 2025 @10:29AM
(#44201308)
This is explained here:
> Here's the trick: github.actor does not always refer to the actual creator of the Pull Request. It's the user who caused the latest event that triggered the workflow.
> Here's the trick: github.actor does not always refer to the actual creator of the Pull Request. It's the user who caused the latest event that triggered the workflow.