ci: shellcheck fixes + don't check github.actor (security)

https://github.com/synacktiv/octoscan?tab=readme-ov-file#bot-check
alterway · Nov 8, 2024 · 98089f9 · 98089f9
1 parent 193f1b6
commit 98089f9
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/.github/workflows/auto_release_trigger.yml b/.github/workflows/auto_release_trigger.yml
@@ -21,12 +21,12 @@ jobs:
       - name: Force update latest tag if there is changes
         id: release
         run: |
-          echo "RELEASE=false" >> $GITHUB_OUTPUT
-          git log $(git describe --tags --abbrev=0)..HEAD --oneline | grep -Evq "(ci:|doc:|gh-actions)" || exit 0
+          echo "RELEASE=false" >> "$GITHUB_OUTPUT"
+          git log "$(git describe --tags --abbrev=0)"..HEAD --oneline | grep -Evq "(ci:|doc:|gh-actions)" || exit 0
           new_tag=$(git describe --tags --abbrev=0 | awk -F. '{OFS="."; $NF+=1; print $0}')
           git tag "$new_tag" -f
           git push -f origin tag "$new_tag"
-          echo "RELEASE=true" >> $GITHUB_OUTPUT
+          echo "RELEASE=true" >> "$GITHUB_OUTPUT"
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
   goreleaser:

diff --git a/.github/workflows/dependabot_auto_merge.yml b/.github/workflows/dependabot_auto_merge.yml
@@ -8,7 +8,7 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     steps:
       - name: Dependabot metadata
         id: metadata