SEC011 — spoofable-bot-condition

Severity: warning · Category: Security

What it checks

Flags a job or step if: condition that checks github.actor == against a trusted bot name (e.g. github.actor == 'dependabot[bot]').

Why it matters

github.actor reflects the last actor to act on the triggering context — not necessarily the author of the pull request being built. An attacker can arrange for a trusted bot's name to end up on the HEAD commit's metadata (for example, by having a bot approve or touch a PR after the attacker's own commits are already in the branch), bypassing an actor-only check while their own code still runs in whatever privileged context that check was meant to gate.

Examples

Flagged:

jobs:
  automerge:
    if: github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - run: gh pr merge --auto
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Fixed — check who actually opened the pull request instead:

jobs:
  automerge:
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - run: gh pr merge --auto
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Suppressing

The finding is reported on the job's line (for a job-level if:) or the step's line (for a step-level if:):

  automerge: # vlotpipe: ignore[SEC011]
    if: github.actor == 'dependabot[bot]'

Rarely a good idea — github.event.pull_request.user.login is a direct, equally simple replacement in almost every case this rule fires on.