Dependabot Actions troubleshooting suggestions might be insecure

[Marcono1234]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

docs/data/reusables/dependabot/dependabot-on-actions-troubleshooting-workflows.md

Lines 7 to 8 in e2f952a

	1. You can update your workflows so that they are no longer triggered by {% data variables.product.prodname_dependabot %} using an expression like: `if: github.actor != 'dependabot[bot]'`. For more information, see [AUTOTITLE](/actions/learn-github-actions/expressions).
	1. You can modify your workflows to use a two-step process that includes `pull_request_target` which does not have these limitations. For more information, see [AUTOTITLE](/code-security/dependabot/troubleshooting-dependabot/troubleshooting-dependabot-on-github-actions#restrictions-when-dependabot-triggers-events).

What part(s) of the article would you like to see updated?

• It currently recommends a if: github.actor != 'dependabot[bot]' check
  Maybe (at least for pull requests) it would be safer to use github.event.pull_request.user.login != 'dependabot[bot]'. Otherwise malicious users could abuse this to skip certain workflows, see related https://www.synacktiv.com/publications/github-actions-exploitation-dependabot.
• It currently suggests using pull_request_target and a "two-step process" without going into detail.
  It might be safer to not recommend pull_request_target (due to its inherent security risks), but rather suggest increasing the permissions and using Dependabot secrets (which is bullet point 3 of that recommendations list, so maybe this point 2 can simply be omitted?).

Additional information

I am not completely sure about the proposed changes, so please let me know if I forget to consider something, or if something I wrote is incorrect.

[Sharra-writes]

Thanks so much for opening another issue! I'll get this triaged for review, too.

[github-actions]

Thanks for opening an issue! We've triaged this issue for technical review by a subject matter expert 👀

[rohitkuril]

Full access

[github-actions]

This is a gentle bump for the docs team that this issue is waiting for technical review.

[github-actions]

This is a gentle reminder for the docs team that this issue is waiting for technical review by a subject matter expert (SME).

[Sharra-writes]

@Marcono1234 The Dependabot team never followed up with me about this, despite me asking several times, so I'm going to have to close it. They should be aware of it since I asked more than once, and may investigate for themselves in the future.