tighten security in gituhb-actions

Author: woutervh

.github/workflows/dependabot-auto-merge.yaml

@@ -17,7 +17,14 @@ permissions:
 
 jobs:
   auto-merge:
+
     runs-on: ubuntu-latest
+
+    timeout-minutes: 5
+
+    # Only run for Dependabot PRs - security: prevent running on PRs from forks or other actors
+    if: github.actor == 'dependabot[bot]'
+
     steps:
 
       # repo: https://github.com/actions/checkout
@@ -26,6 +33,12 @@ jobs:
 
       # repo: https://github.com/fastify/github-action-merge-dependabot
       # releases: https://github.com/fastify/github-action-merge-dependabot/tags
+      # The action waits for required status checks by default
       - uses: fastify/github-action-merge-dependabot@1b2ed42db8f9d81a46bac83adedfc03eb5149dff  # v3.11.2 released on 03-10-2025
         with:
-          github-token: ${{ secrets.TOKEN_AUTOMERGE }}
+            # github-token: ${{ secrets.TOKEN_AUTOMERGE }}
+            # Using built-in GITHUB_TOKEN for better security (auto-scoped, auto-expires)
+            # Falls back to TOKEN_AUTOMERGE if GITHUB_TOKEN lacks permissions
+            github-token: ${{ secrets.GITHUB_TOKEN }}
+            merge-method: squash  # merge|squash|rebase
+            target: minor