SAP / ui5-project / 26511094400

96%

main: 96%

push

github

[INTERNAL] Harden workflows

Replace spoofable github.actor check in dependabot-auto-merge with
github.event.pull_request.user.login. Note: spoofing the dependabot
actor alone is not sufficient to trigger the auto-merge step. The
dependabot/fetch-metadata action only emits outputs for genuine
dependabot PRs, so the merge step's check on
steps.metadata.outputs.update-type would no-op on a spoofed run. The
change closes the gap defensively.

1457 of 1560 branches covered (93.4%)

Branch coverage included in aggregate %.

2836 of 2925 relevant lines covered (96.96%)

129.62 hits per line