[bug-hunter] Dependency Review example can generate invalid workflow when configuring Updatecli bot user

[github-actions]

The Dependency Review examples currently include an Updatecli customization hint that can lead users to create an invalid workflow file.

Affected files

• gh-agent-workflows/dependency-review/example.yml (lines 19-27)
• .github/workflows/trigger-dependency-review.yml (lines 21-29)

Both files contain:

• a commented # with: block
• a comment: For updatecli: uncomment and set your repo's updatecli bot actor...
• a commented # allowed-bot-users: "github-actions[bot]"

User impact

Users following that instruction can reasonably uncomment only allowed-bot-users, which places allowed-bot-users at the job top level (instead of under with:). GitHub Actions rejects this workflow at parse/validation time, so dependency review never runs.

Minimal reproduction

Run locally with actionlint:

cat <<'YAML' | actionlint -oneline -stdin-filename invalid.yml -
name: Dependency Review
on:
  pull_request:
    types: [opened]
jobs:
  run:
    uses: elastic/ai-github-actions/.github/workflows/gh-aw-dependency-review.lock.yml@v0
    allowed-bot-users: "github-actions[bot]"
    secrets:
      COPILOT_GITHUB_TOKEN: $\{\{ secrets.COPILOT_GITHUB_TOKEN }}
YAML

Observed error:

unexpected key "allowed-bot-users" for "job" section ... expected ... "with"

Why this is not by-design

allowed-bot-users is a reusable-workflow input (must be nested under with:). The current examples' comment wording suggests toggling that single line for Updatecli, but does not explicitly require uncommenting/adding with:. This creates a deterministic configuration trap in copy-paste setup.

Suggested fix

Update both example comments to explicitly require with: (or provide an uncommented, valid with: snippet for Updatecli overrides).

Note

🔒 Integrity filter blocked 6 items

The following items were blocked because they don't meet the GitHub integrity level.

• #1029 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #1025 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #1024 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #1010 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #461 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #600 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Trigger Bug Hunter

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on May 28, 2026, 12:17 PM UTC

[github-actions]

This issue was automatically closed because it expired on 2026-05-28T12:17:53.082Z.

Closed by Workflow