From 730aebba53c46990ed68f6df5dfcb863b745f34c Mon Sep 17 00:00:00 2001
From: Defang Claude <140542220+defangdevs@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:29:20 -0700
Subject: [PATCH 1/2] ci: pin Dependabot metadata action

---
 .github/workflows/dependabot-automerge.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 0940ec0..5e6e099 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Fetch dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 

From 5e4580ca3be635a472910436fc6d018dc51d8826 Mon Sep 17 00:00:00 2001
From: Defang Claude <140542220+defangdevs@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:37:52 -0700
Subject: [PATCH 2/2] ci: tighten Dependabot auto-merge checks

---
 .github/workflows/dependabot-automerge.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 5e6e099..ebc625e 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -9,7 +9,7 @@ permissions:
 jobs:
   automerge:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       - name: Fetch dependabot metadata
         id: metadata