This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git
The following commit(s) were added to refs/heads/main by this push:
new 964d0cc44 [#2905] chore: replace labeler with the one that works like
magpie and pull_r… (#2908)
964d0cc44 is described below
commit 964d0cc44b998df25c562804ad75742c0b69ae61
Author: Lenny Primak <[email protected]>
AuthorDate: Mon Oct 12 16:24:31 2026 -0500
[#2905] chore: replace labeler with the one that works like magpie and
pull_r… (#2908)
* chore: replace labeler with the one that works with magpie and
pull_request workflow
* chore: update permissions format in labeler configuration
* chore: update permissions format in labeler configuration attempt 2
---
.../workflows/{labeler.yml => labeler-signal.yml} | 26 ++++++++---------
.github/workflows/labeler.yml | 33 ++++++++++++++++++----
2 files changed, 39 insertions(+), 20 deletions(-)
diff --git a/.github/workflows/labeler.yml
b/.github/workflows/labeler-signal.yml
similarity index 67%
copy from .github/workflows/labeler.yml
copy to .github/workflows/labeler-signal.yml
index 7ac2df80b..1ef1e6215 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler-signal.yml
@@ -14,22 +14,18 @@
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
-
---
-# https://github.com/actions/labeler
-name: Pull Request Labeler
-on:
- - pull_request_target # zizmor: ignore[dangerous-triggers]
-permissions:
- contents: read
+# This unprivileged workflow only signals the completion of a pull_request run.
+# The labeler runs separately from the default branch and never checks out or
+# executes pull request code.
+name: Pull Request Labeler Signal
+"on":
+ pull_request:
+ types: [opened, reopened, synchronize]
+permissions: { }
jobs:
- triage:
- permissions:
- contents: read
- pull-requests: write
+ signal:
runs-on: ubuntu-latest
steps:
- - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
- with:
- repo-token: '${{ secrets.GITHUB_TOKEN }}'
- sync-labels: true
+ - name: Signal labeler
+ run: echo "Pull request event completed"
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 7ac2df80b..461f31b2d 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -16,20 +16,43 @@
# under the License.
---
-# https://github.com/actions/labeler
name: Pull Request Labeler
-on:
- - pull_request_target # zizmor: ignore[dangerous-triggers]
-permissions:
- contents: read
+"on":
+ workflow_run: # zizmor: ignore[dangerous-triggers] -- no PR code is checked
out or executed
+ workflows: ["Pull Request Labeler Signal"]
+ types: [completed]
+permissions: { }
jobs:
triage:
+ if: github.event.workflow_run.event == 'pull_request'
permissions:
contents: read
pull-requests: write
runs-on: ubuntu-latest
steps:
+ - name: Find pull request
+ id: pr
+ env:
+ GH_TOKEN: ${{ github.token }}
+ REPO: ${{ github.repository }}
+ HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+ run: |
+ set -euo pipefail
+ if ! [[ "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+ echo "::error::Unexpected pull request head SHA"
+ exit 1
+ fi
+
+ pr_numbers=$(gh api "repos/$REPO/commits/$HEAD_SHA/pulls" \
+ --jq '.[] | select(.state == "open") | .number')
+ {
+ echo "numbers<<EOF"
+ printf '%s\n' "$pr_numbers"
+ echo "EOF"
+ } >> "$GITHUB_OUTPUT"
- uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+ if: steps.pr.outputs.numbers != ''
with:
repo-token: '${{ secrets.GITHUB_TOKEN }}'
+ pr-number: ${{ steps.pr.outputs.numbers }}
sync-labels: true
