From d7cd01a015d5852198584e19544b08dcbfa659bd Mon Sep 17 00:00:00 2001
From: Marrrrrrrrry <34876935+Marrrrrrrrry@users.noreply.github.com>
Date: Wed, 28 Oct 2026 05:48:25 +0800
Subject: [PATCH 1/2] Fix outdated Dependabot PR token claim in
 workflow-runs-dependabot-note

The reusable states that workflow runs triggered by Dependabot pull requests "run as if they are from a forked repository" with a read-only GITHUB_TOKEN that "cannot access any secrets". This contradicts the Dependabot troubleshooting article, which states that the permissions key can increase the token's access, and the "Permissions for forked repositories" section on the same workflow-syntax reference page, which scopes the write-to-read downgrade to pull requests from forked repositories only. It also contradicts the Dependabot/fetch-metadata README, whose auto-approving example relies on this exact pattern.

Follow-up to #37657, which addressed other parts of this contradiction.
---
 data/reusables/actions/workflow-runs-dependabot-note.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/reusables/actions/workflow-runs-dependabot-note.md b/data/reusables/actions/workflow-runs-dependabot-note.md
index be4c9ebfdf8e..1714303b4a4f 100644
--- a/data/reusables/actions/workflow-runs-dependabot-note.md
+++ b/data/reusables/actions/workflow-runs-dependabot-note.md
@@ -1 +1 @@
-Workflow runs triggered by {% data variables.product.prodname_dependabot %} pull requests run as if they are from a forked repository, and therefore use a read-only `GITHUB_TOKEN`. These workflow runs cannot access any secrets. For information about strategies to keep these workflows secure, see [AUTOTITLE](/actions/reference/security/secure-use).
+By default, workflow runs triggered by {% data variables.product.prodname_dependabot %} pull requests use a read-only `GITHUB_TOKEN`. You can use the `permissions` key in your workflow to increase the access for the token. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions). For information about strategies to keep these workflows secure, see [AUTOTITLE](/actions/reference/security/secure-use).

From 1191f494f006da3b19d3a220a34bbabb1bedd633 Mon Sep 17 00:00:00 2001
From: mc <42146119+mchammer01@users.noreply.github.com>
Date: Mon, 2 Nov 2026 07:52:35 +0000
Subject: [PATCH 2/2] Update
 data/reusables/actions/workflow-runs-dependabot-note.md

---
 data/reusables/actions/workflow-runs-dependabot-note.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/reusables/actions/workflow-runs-dependabot-note.md b/data/reusables/actions/workflow-runs-dependabot-note.md
index 1714303b4a4f..e6a2db32139d 100644
--- a/data/reusables/actions/workflow-runs-dependabot-note.md
+++ b/data/reusables/actions/workflow-runs-dependabot-note.md
@@ -1 +1 @@
-By default, workflow runs triggered by {% data variables.product.prodname_dependabot %} pull requests use a read-only `GITHUB_TOKEN`. You can use the `permissions` key in your workflow to increase the access for the token. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions). For information about strategies to keep these workflows secure, see [AUTOTITLE](/actions/reference/security/secure-use).
+By default, workflow runs triggered by {% data variables.product.prodname_dependabot %} pull requests use a read-only `GITHUB_TOKEN` and cannot access secrets other than {% data variables.product.prodname_dependabot %} secrets. You can use the `permissions` key in your workflow to increase the access for the token. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions). For information about strategies to keep these workflows secure, see [AUTOTITLE](/actions/reference/security/secure-use).