From 09faa394dfacf8566480c56caf92b0bbc16fb72a Mon Sep 17 00:00:00 2001
From: coela <147021942+coela-oss@users.noreply.github.com>
Date: Tue, 20 Oct 2026 07:34:26 +0900
Subject: [PATCH] ci: use repository-scoped token for verified dependency
 updates

---
 .github/workflows/dependabot-automerge.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index cb71899..5eb8240 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -1,7 +1,7 @@
 name: Dependabot compatible merge
 on:
   workflow_run:
-    workflows: ["OSS policy", "Product workspace CI"]
+    workflows: ["Product workspace CI","OSS policy"]
     types: [completed]
   workflow_dispatch:
     inputs:
@@ -17,9 +17,11 @@ concurrency:
 jobs:
   merge:
     if: >-
-      vars.DEPENDABOT_AUTOMERGE_ENABLED == 'true' &&
+      vars.DEPENDABOT_AUTOMERGE_ENABLED == 'true' && github.ref == 'refs/heads/main' &&
       (github.event_name == 'workflow_dispatch' ||
-       (github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'))
+       (github.event.workflow_run.event == 'pull_request' &&
+        github.event.workflow_run.actor.id == 49699333 &&
+        github.event.workflow_run.conclusion == 'success'))
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
@@ -29,6 +31,7 @@ jobs:
       statuses: read
       actions: read
     steps:
-      - uses: zixcel/zixcel-repository-security/.github/actions/dependabot-merge@05bc24e1b7dc3374919a35093e53b3dc66d6ab24
+      - uses: zixcel/zixcel-repository-security/.github/actions/dependabot-merge@9adf87acebe1d68abf18f71af9cb1af8e3c96770
         with:
+          required-workflows: '["Product workspace CI","OSS policy"]'
           pull-request-number: ${{ github.event.inputs.number || '' }}