From ec93d374707aefe194eebc1e12a7e980cb55a5e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Sun, 19 Apr 2026 21:06:38 +0200 Subject: [PATCH] Prefix dedupe commit message + set GH_TOKEN for push step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Commit subject prefixed with "[github-actions]" so the audit trail is obvious at a glance in `git log`. - GH_TOKEN exposed as an env var on the commit step so the PAT is also available to any `gh` invocations the step might grow, and the token plumbing is visible at the site where the push happens — not only up at the checkout step. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/dependabot-dedupe.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-dedupe.yml b/.github/workflows/dependabot-dedupe.yml index 5707ffe..09c90b1 100644 --- a/.github/workflows/dependabot-dedupe.yml +++ b/.github/workflows/dependabot-dedupe.yml @@ -59,12 +59,14 @@ jobs: - run: pnpm install --frozen-lockfile=false - run: pnpm dedupe - name: Commit dedupe changes + env: + GH_TOKEN: ${{ secrets.DEPENDABOT_DEDUPE_TOKEN }} run: | if [ -n "$(git status --porcelain pnpm-lock.yaml)" ]; then git config user.name "dependabot[bot]" git config user.email "49699333+dependabot[bot]@users.noreply.github.com" git add pnpm-lock.yaml - git commit -m "pnpm dedupe" + git commit -m "[github-actions] pnpm dedupe" git push echo "Deduped lockfile pushed." else