internetarchive / internetarchive/openlibrary
Resolve pull_request_target FIX ME workflows: new_pr_labeler, pr_update_labeler (follow-up to #13411)
- Dominant language
- Python
- Stars
- 6.7k
- Forks
- 2k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 138
Description
#13411 suppressed zizmor's `dangerous-triggers` audit on these two workflows with `-- FIX ME!` markers:
- `.github/workflows/new_pr_labeler.yml`
- `.github/workflows/pr_update_labeler.yml`
Both run on `pull_request_target` with `pull-requests: write`. Template injection was fixed in #13411 (user input via env vars), but decide: can these move to safer triggers, or is `_target` required for fork PR labeling? Document the conclusion so the FIX ME markers are resolved or permanently justified.
Contributor guide
Research direction
Inspect .github/workflows/new_pr_labeler.yml and .github/workflows/pr_update_labeler.yml, along with the related change in #13411. Run zizmor's dangerous-triggers audit and determine whether fork PR labeling requires pull_request_target and its write permission. Done means the FIX ME markers are resolved or the security rationale is documented permanently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100