Build(deps): Bump frequenz-floss/gh-action-setup-python-with-deps from 0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 to e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 #571
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pull Request Labeler | |
| on: [pull_request_target] | |
| jobs: | |
| Label: | |
| permissions: | |
| # Read the labeler configuration from the repository. | |
| contents: read | |
| # Add labels to pull requests. | |
| pull-requests: write | |
| runs-on: ubuntu-slim | |
| steps: | |
| - name: Labeler | |
| # XXX: !!! SECURITY WARNING !!! | |
| # pull_request_target has write access to the repo, and can read secrets. We | |
| # need to audit any external actions executed in this workflow and make sure no | |
| # checked out code is run (not even installing dependencies, as installing | |
| # dependencies usually can execute pre/post-install scripts). We should also | |
| # only use hashes to pick the action to execute (instead of tags or branches). | |
| # For more details read: | |
| # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ | |
| uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # 6.0.1 | |
| with: | |
| repo-token: "${{ secrets.GITHUB_TOKEN }}" | |
| dot: true |