ci: add a CI labeller workflow to handle labeling PRs from all branches
What the developer wrote
Authored by Nick Johnson
ci: add a CI labeller workflow to handle labeling PRs from all branches
What changed, and why it matters
This commit adds a new GitHub Actions workflow that automatically adds or removes an 'API diff' label on pull requests after CI finishes. It is a defensive security improvement: it separates the labeling step from the main CI workflow and runs with minimal permissions, following GitHub's own guidance for safely handling pull requests from external branches. There is no indication of a vulnerability being introduced or fixed.
No security action required. As a routine hygiene check, verify that the upstream CI workflow generating the api-diff artifact writes only a PR number and exit code, and that the artifact is not modifiable by untrusted forks.
Security signals we found
New GitHub Actions workflow using workflow_run trigger
Minimal and scoped permissions (actions:read, contents:read, pull-requests:write)
References GitHub Security Lab guidance on preventing pwn requests
Pinned third-party action to a SHA
No checkout of PR code or execution of untrusted inputs
Artifact content is used only as PR number and exit code, not shell-evaluated
Evidence from the diff
The new .github/workflows/ci-labeller.yml runs on workflow_run events after the ‘Continuous integration’ workflow completes. It downloads an artifact named api-diff produced by the upstream CI run, reads the PR number and a diff-detection exit code, and uses gh pr edit to add or remove the ‘API diff’ label. The workflow explicitly sets permissions: {} at the top level and grants only actions:read, contents:read, and pull-requests:write to the single job. It pins the actions/download-artifact action to a specific SHA and references GitHub Security Lab guidance on preventing pwn requests. The workflow_run trigger is inherently privileged, but the implementation follows the recommended pattern of not checking out or executing code from the untrusted PR.
Changed components
.github/workflows/ci-labeller.ymlInspect captured patch +42 / −0
diff --git a/.github/workflows/ci-labeller.yml b/.github/workflows/ci-labeller.yml
new file mode 100644
index 00000000..e210a188
--- /dev/null
+++ b/.github/workflows/ci-labeller.yml
@@ -0,0 +1,42 @@
+# This workflow is triggered on completion of a CI job. It handles adding
+# labels to the PR which triggered the job. It is a separate workflow from
+# the CI workflow itself in order to follow security best practices.
+#
+# Since only workflows on the default branch (`master`) can be triggered, this
+# workflow is called by CI jobs on LTS branches as well.
+#
+# https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
+
+on: # yamllint disable-line rule:truthy
+ workflow_run: # zizmor: ignore[dangerous-triggers]
+ workflows: [Continuous integration]
+ types: [completed]
+
+name: CI Labeller
+
+permissions: {}
+
+jobs:
+ Label:
+ runs-on: ubuntu-24.04
+ permissions:
+ actions: read
+ contents: read
+ pull-requests: write
+ steps:
+ - name: "Download Workflow Artifacts"
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ # The workflow which completed a CI run and needs PR labels.
+ run-id: ${{ github.event.workflow_run.id }}
+ # The API diff label artifact must have the PR number on the first line,
+ # and the exit code of the diff detection on the second line.
+ - name: "Toggle API diff Label"
+ if: ${{ hashFiles('api-diff') != '' }}
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ run: |
+ issue_number=$(head -n1 api-diff)
+ exit_code=$(tail -n1 api-diff)
+ toggle=$([ "$exit_code" -eq 0 ] && echo "--remove-label" || echo "--add-label")
+ gh pr edit $issue_number $toggle "API diff"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.