systemd/.github/workflows/labeler.yml

---
# vi: ts=2 sw=2 et:
# SPDX-License-Identifier: LGPL-2.1-or-later
#
name: "Pull Request Labeler"

on:
- pull_request_target

permissions:
  contents: read

jobs:
  triage:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
    - uses: actions/labeler@69da01b8e0929f147b8943611bee75ee4175a49e
      with:
        repo-token: "${{ secrets.GITHUB_TOKEN }}"
        configuration-path: .github/labeler.yml
        sync-labels: "" # This is a workaround for issue 18671
github: use the same headers on yaml files Also adjust the mention of location of mkosi files, follow-up for d55ad7fe96eb1edf438a7a41a465723bd29d4b10. 2021-10-01 13:09:20 +03:00			`---`
			`# vi: ts=2 sw=2 et:`
ci: use LGPLv2+ for all our ci configuration 2021-10-01 13:10:22 +03:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
github: use the same headers on yaml files Also adjust the mention of location of mkosi files, follow-up for d55ad7fe96eb1edf438a7a41a465723bd29d4b10. 2021-10-01 13:09:20 +03:00			`#`
Add Pull Request Labeler 2020-12-12 09:30:26 +03:00			`name: "Pull Request Labeler"`
github: use the same headers on yaml files Also adjust the mention of location of mkosi files, follow-up for d55ad7fe96eb1edf438a7a41a465723bd29d4b10. 2021-10-01 13:09:20 +03:00
Add Pull Request Labeler 2020-12-12 09:30:26 +03:00			`on:`
			`- pull_request_target`

ci: tighten several GHActions a bit more with https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#permissions 2021-11-13 17:40:20 +03:00			`permissions:`
			`contents: read`

Add Pull Request Labeler 2020-12-12 09:30:26 +03:00			`jobs:`
			`triage:`
			`runs-on: ubuntu-latest`
ci: tighten codeql and labeler even more by moving the read permissions to the top level and granting additional permissions to the specific jobs. It should help to prevent new jobs that could be added there eventually from having write access to resources they most likely would never need. 2021-11-14 12:41:42 +03:00			`permissions:`
			`pull-requests: write`
Add Pull Request Labeler 2020-12-12 09:30:26 +03:00			`steps:`
ci: pin labeler Turns out GHActions where `pull_request_target` is used are capable of pwning repositories: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ labeler doesn't check out the source code or build anything so it's safe in its current form but to avoid surprises let's just pin it to the latest version. It's annoying to manage dependencies like this manually so additionally dependabot.yml is introduced to make it easier to keep GHActions up to date more or less automatically: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot 2021-11-11 04:56:02 +03:00			`- uses: actions/labeler@69da01b8e0929f147b8943611bee75ee4175a49e`
Add Pull Request Labeler 2020-12-12 09:30:26 +03:00			`with:`
			`repo-token: "${{ secrets.GITHUB_TOKEN }}"`
			`configuration-path: .github/labeler.yml`
GH Actions: Fix labeler bot 2021-02-19 08:28:20 +03:00			`sync-labels: "" # This is a workaround for issue 18671`