more docs

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
2026-08-18 02:56:31 +00:00 · 2024-04-23 20:36:03 +00:00
parent 15dec13ba3
commit 843b2e5d33
1 changed files with 3 additions and 0 deletions
@@ -1,5 +1,8 @@
 # A workflow to run against renovate-bot's PRs,
 # such as `make package` after it updates the package.json and package-lock.json files.
+# The potentially untrusted code is first run inside a low-privilege Job, and the diff is uploaded as an artifact.
+# Then a higher-privilage Job applies the diff and pushes the changes to the PR.
+# It's important to only run this workflow against PRs from trusted sources, after also reviewing the changes!

 name: Post-Commit