apache / apache/linkis-website
Remove unnecessary auto-close-issue.yml workflow that uses unmaintained action
- Dominant language
- JavaScript
- Stars
- 34
- Forks
- 111
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
I work with ASF Infra on managing the GitHub Actions allow list and came across an issue in your repo.
The [workflow](https://github.com/apache/linkis-website/blob/dev/.github/workflows/auto-close-issue.yml) uses an unmaintained action and is not required. Additionally the workflow does not limit the permissions of the GITHUB_TOKEN which is a considerable security issue, especially with an unmaintained action.
Github provides functionality that makes this workflow superflous, just use one of the [documented keywords](https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests#linking-a-pull-request-to-an-issue) to link a PR to an issue and GitHub will close it when the PR is merged.
Due to the security issue I will remove the peter-evans/close-issue action from the allow list today. (you are it's only user in apache/)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.