mirror of
https://github.com/systemd/systemd.git
synced 2026-07-24 16:25:52 +00:00
6461eccacb
Set `persist-credentials: false` for actions/checkout. By default, using `actions/checkout` causes a credential to be persisted on disk. Subsequent steps may accidentally publicly persist the credential, e.g. by including it in a publicly accessible artifact via actions/upload-artifact. However, even without this, persisting the credential on disk is non-ideal unless actually needed. Link: https://docs.zizmor.sh/audits/#artipacked
39 lines
956 B
YAML
39 lines
956 B
YAML
---
|
|
|
|
name: Issue labeler
|
|
on:
|
|
issues:
|
|
types: [ opened ]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
label-component:
|
|
runs-on: ubuntu-24.04
|
|
|
|
permissions:
|
|
issues: write
|
|
|
|
strategy:
|
|
matrix:
|
|
template: [ bug_report.yml, feature_request.yml ]
|
|
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Parse issue form
|
|
uses: stefanbuck/github-issue-parser@1e5bdee70d4b3e066a33aa0669ab782943825f94
|
|
id: issue-parser
|
|
with:
|
|
template-path: .github/ISSUE_TEMPLATE/${{ matrix.template }}
|
|
|
|
- name: Set labels based on component field
|
|
uses: redhat-plumbers-in-action/advanced-issue-labeler@b80ae64e3e156e9c111b075bfa04b295d54e8e2e
|
|
with:
|
|
issue-form: ${{ steps.issue-parser.outputs.jsonString }}
|
|
template: ${{ matrix.template }}
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|