Require Shelly Dependabot secrets

Document the required Dependabot secret mappings and their pre-review trust boundary.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

docs/content/guides/github-app-authentication.md

@@ -33,11 +33,10 @@ jobs:
 The root reusable workflow forwards these two values to the Plan, Build-Module, and Publish-Module reusable jobs.
 Do not use `secrets: inherit` as a substitute for this mapping.
 
-Dependabot-triggered workflows cannot read regular Actions secrets. Do not duplicate Shelly's private key into
-Dependabot secrets by default: a compromised dependency update could alter workflow code that receives the key before
-human review. If an organization requires the Process-PSModule workflow to run on Dependabot pull requests, its
-security owners must explicitly accept that trust boundary and provision separate Dependabot secrets. Otherwise,
-skip token-consuming jobs for Dependabot pull requests and run the full workflow after review or merge.
+Dependabot-triggered workflows cannot read regular Actions secrets. To run Process-PSModule on Dependabot pull
+requests, create `SHELLY_CLIENT_ID` and `SHELLY_PRIVATE_KEY` as Dependabot secrets in addition to Actions secrets.
+This is a deliberate trust boundary: review the App's installation scope and every dependency update carefully,
+because the workflow can mint a Shelly token before human review.
 
 ## GitHub App installation permissions
 

docs/content/reference/workflow-inputs.md

@@ -29,8 +29,8 @@ credentials that are exposed. `secrets: inherit` is intentionally not required.
 | Name | Location | Description | Required |
 | ---- | -------- | ----------- | -------- |
 | `APIKey` | GitHub secrets | The API key for the PowerShell Gallery, used to publish the module. | Yes |
-| `GitHubAppClientId` | GitHub secrets | The GitHub App client ID used to mint scoped installation tokens for GitHub API operations. Map Shelly's `SHELLY_CLIENT_ID` in the caller. | Yes |
-| `GitHubAppPrivateKey` | GitHub secrets | The GitHub App private key used to mint scoped installation tokens for GitHub API operations. Map Shelly's `SHELLY_PRIVATE_KEY` in the caller. | Yes |
+| `GitHubAppClientId` | GitHub secrets | The GitHub App client ID used to mint scoped installation tokens for GitHub API operations. Map Shelly's `SHELLY_CLIENT_ID` in the caller and Dependabot secret store. | Yes |
+| `GitHubAppPrivateKey` | GitHub secrets | The GitHub App private key used to mint scoped installation tokens for GitHub API operations. Map Shelly's `SHELLY_PRIVATE_KEY` in the caller and Dependabot secret store. | Yes |
 | `TestData` | GitHub secrets | A single-line JSON object with `secrets` and `variables` maps, exposed as environment variables to the module test jobs. Values under `secrets` are masked; values under `variables` are not. | No |
 
 See [passing test data](../guides/calling-the-workflow.md#passing-test-data) for how to build the `TestData` value.