dependabot[bot]
b6ab9d7ade
build(deps): bump actions/labeler from 3.1.0 to 4
...
Bumps [actions/labeler](https://github.com/actions/labeler ) from 3.1.0 to 4.
- [Release notes](https://github.com/actions/labeler/releases )
- [Commits](3d612d72e6...9fd24f1f9d
2022-04-01 21:41:06 +00:00
dependabot[bot]
8b94bcbd04
build(deps): bump actions/labeler from 3.0.2 to 3.1.0
...
Bumps [actions/labeler](https://github.com/actions/labeler ) from 3.0.2 to 3.1.0.
- [Release notes](https://github.com/actions/labeler/releases )
- [Commits](69da01b8e0...3d612d72e6
2022-03-02 11:56:24 +00:00
Evgeny Vereshchagin
510afa460a
ci: tighten codeql and labeler even more
...
by moving the read permissions to the top level and
granting additional permissions to the specific jobs.
It should help to prevent new jobs that could be added
there eventually from having write access to resources they
most likely would never need.
2021-11-14 10:51:07 +00:00
Evgeny Vereshchagin
311956ccd9
ci: tighten several GHActions a bit more
...
with https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#permissions
2021-11-13 22:17:21 +03:00
Evgeny Vereshchagin
5570313421
ci: pin labeler
...
Turns out GHActions where `pull_request_target` is used are capable
of pwning repositories: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
labeler doesn't check out the source code or build anything so
it's safe in its current form but to avoid surprises let's just pin
it to the latest version. It's annoying to manage dependencies like this
manually so additionally dependabot.yml is introduced to make it
easier to keep GHActions up to date more or less automatically:
https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot
2021-11-11 10:19:06 +00:00
Zbigniew Jędrzejewski-Szmek
186b9041ae
ci: use LGPLv2+ for all our ci configuration
2021-10-01 14:45:00 +02:00
Zbigniew Jędrzejewski-Szmek
43d6fcc09f
github: use the same headers on yaml files
...
Also adjust the mention of location of mkosi files,
follow-up for d55ad7fe96
2021-10-01 14:45:00 +02:00
Jameer Pathan
63f48ab3fa
GH Actions: Fix labeler bot
2021-02-19 14:51:59 +09:00
Jameer Pathan
292420ce4b
Add Pull Request Labeler
2020-12-14 09:43:38 +09:00
