fix(ci): run adversarial audit on Dependabot PRs

[Conrad Rockenhaus (skyphusion)]

Summary

• Drop the Dependabot author skip on the adversarial audit workflow.
• Dependabot-triggered runs use org Dependabot secrets (same names as Actions secrets).
• PR comment step is continue-on-error (Dependabot GITHUB_TOKEN is read-only; artifact remains).

Template + runbook: skyphusion-labs/fleet-chezmoi#1520

Test plan

• After merge, update an open Dependabot PR onto main
• Confirm Adversarial audit runs and does not skip

[github-actions]

Adversarial security audit

Generated 2026-08-05T10:21:56.864Z · 9ddb88c...580fa5c

The workflow still exposes org-level AI tokens (ADVERSARIAL_AUDIT_CF_API_TOKEN, CF_AIG_TOKEN) to code defined on arbitrary PR branches, allowing a same-repo attacker to exfiltrate them and to silently suppress the advisory comment via continue-on-error.

Severity	Location	Finding
high	.github/workflows/adversarial-audit.yml:171	Org AI tokens exposed to PR branch-defined job: The run job and its env: come from the PR branch (pull_request trigger), so any same-repo attacker can modify the script to print/exfil ADVERSARIAL_AUDIT_CF_API_TOKEN and CF_AIG_TOKEN before the original code executes.
high	.github/workflows/adversarial-audit.yml:65	Dependabot PRs now run attacker-controllable audit with org secrets: Dependabot PRs were previously skipped because their manifest-only changes could not meaningfully alter code. Removing the skip means Dependabot PRs execute the PR branch workflow with org Dependabot secrets.
medium	.github/workflows/adversarial-audit.yml:209	continue-on-error hides comment failure/suppression: continue-on-error: true on the advisory PR-comment step means an attacker who suppresses the audit report (e.g., by corrupting audit-report.md or the posting script) will not fail the workflow run.
medium	.github/workflows/adversarial-audit.yml:70	Same-repo gate does not block malicious branch pushers: head.repo.full_name == github.repository only prevents forks; any user with write access to this repo can push a branch and open a PR that runs this workflow with org secrets.
medium	.github/workflows/adversarial-audit.yml:153	Verification only checks commit SHA, not branch/tag integrity: The read-back verifies HEAD equals the pin, but actions/checkout can still fetch a malicious object if the public repo is compromised between pinning and execution.
info	.github/workflows/adversarial-audit.yml:148	No explicit timeout on checkout/run steps: Job timeout is set but individual steps could hang; this is informational and not directly exploitable without other issues.

[github-code-quality]

Code Coverage Overview

Languages: JavaScript

JavaScript

The overall coverage in commit 2656952 in the fix/adversarial-audi... branch remains at 95%, unchanged from commit 9ddb88c in the main branch.