From e07220a5ad28d9768c6f6d6f827bf726defe99af Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 1 Mar 2022 23:23:05 +0000 Subject: build(deps): bump actions/labeler from 3 to 4 Bumps [actions/labeler](https://github.com/actions/labeler) from 3 to 4. - [Release notes](https://github.com/actions/labeler/releases) - [Commits](https://github.com/actions/labeler/compare/v3...v4) --- .github/workflows/labels.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows/labels.yml') diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index 4d1e2a2a0f9..c464f8bf58a 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest if: github.repository_owner == 'NixOS' steps: - - uses: actions/labeler@v3 + - uses: actions/labeler@v4 with: repo-token: ${{ secrets.GITHUB_TOKEN }} sync-labels: true -- cgit 1.4.1 From 92a720cbacbdbbdf4be68eb1d0c2f2b83b226406 Mon Sep 17 00:00:00 2001 From: Jörg Thalheim Date: Sat, 19 Mar 2022 19:43:22 +0100 Subject: ci: add warning to actions with writeable GITHUB_TOKEN Co-authored-by: ckie <25263210+ckiee@users.noreply.github.com> --- .github/workflows/backport.yml | 6 ++++++ .github/workflows/labels.yml | 5 +++++ .github/workflows/pending-set.yml | 5 +++++ 3 files changed, 16 insertions(+) (limited to '.github/workflows/labels.yml') diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index bcb164a04ee..4ee5adfaac1 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -2,6 +2,12 @@ name: Backport on: pull_request_target: types: [closed, labeled] + +# WARNING: +# When extending this action, be aware that $GITHUB_TOKEN allows write access to +# the GitHub repository. This means that it should not evaluate user input in a +# way that allows code injection. + jobs: backport: name: Backport Pull Request diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c464f8bf58a..5f949ddc56b 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -4,6 +4,11 @@ on: pull_request_target: types: [edited, opened, synchronize, reopened] +# WARNING: +# When extending this action, be aware that $GITHUB_TOKEN allows some write +# access to the GitHub API. This means that it should not evaluate user input in +# a way that allows code injection. + permissions: contents: read pull-requests: write diff --git a/.github/workflows/pending-set.yml b/.github/workflows/pending-set.yml index 944d1deefb9..b15e4847e67 100644 --- a/.github/workflows/pending-set.yml +++ b/.github/workflows/pending-set.yml @@ -3,6 +3,11 @@ name: "set pending status" on: pull_request_target: +# WARNING: +# When extending this action, be aware that $GITHUB_TOKEN allows write access to +# the GitHub repository. This means that it should not evaluate user input in a +# way that allows code injection. + jobs: action: runs-on: ubuntu-latest -- cgit 1.4.1