From 46d64da93126e2a83ac8c046f22a35c63c504031 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?= Date: Thu, 1 Oct 2026 08:40:44 +0000 Subject: [PATCH] :construction_worker: Scope the triage GitHub App token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Request a token for this repository only, instead of every repository in the installation, and only with the permissions the job uses: issues (labels) and organization projects (the board). Also document why the workflow needs pull_request_target and why it is safe. Signed-off-by: David Barragán Merino --- .github/workflows/auto-label.yml | 8 +++++++- .github/zizmor.yml | 4 ---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/auto-label.yml b/.github/workflows/auto-label.yml index 7bbfba22fb..7d50d52a88 100644 --- a/.github/workflows/auto-label.yml +++ b/.github/workflows/auto-label.yml @@ -1,5 +1,8 @@ name: Auto Label and Add to Project +# pull_request_target is required so the GitHub App secrets are available +# for PRs from forks. It is safe here: the job never checks out or runs PR +# code, it only reads ids from the event payload. on: issues: types: [opened] @@ -18,7 +21,10 @@ jobs: with: app-id: ${{ secrets.TRIAGE_APP_ID }} private-key: ${{ secrets.TRIAGE_APP_PRIVATE_KEY }} - owner: penpot + # No owner/repositories: the token is scoped to this repository. + # Organization permissions (the project board) still apply. + permission-issues: write + permission-organization-projects: write - name: Process Issue or PR uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 6bcbaebf0a..645e3764d8 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -21,10 +21,6 @@ rules: dangerous-triggers: ignore: - auto-label.yml - # Scope GitHub App tokens. - github-app: - ignore: - - auto-label.yml # Style nudge towards the `$/...` syntax; not worth enforcing. self-repository: disable: true