mirror of
https://github.com/systemd/systemd-stable.git
synced 2025-01-26 10:03:40 +03:00
5570313421
Turns out GHActions where `pull_request_target` is used are capable of pwning repositories: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ labeler doesn't check out the source code or build anything so it's safe in its current form but to avoid surprises let's just pin it to the latest version. It's annoying to manage dependencies like this manually so additionally dependabot.yml is introduced to make it easier to keep GHActions up to date more or less automatically: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot
19 lines
424 B
YAML
19 lines
424 B
YAML
---
|
|
# vi: ts=2 sw=2 et:
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
name: "Pull Request Labeler"
|
|
|
|
on:
|
|
- pull_request_target
|
|
|
|
jobs:
|
|
triage:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/labeler@69da01b8e0929f147b8943611bee75ee4175a49e
|
|
with:
|
|
repo-token: "${{ secrets.GITHUB_TOKEN }}"
|
|
configuration-path: .github/labeler.yml
|
|
sync-labels: "" # This is a workaround for issue 18671
|