Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions
What the developer wrote
Authored by Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions
715f2bd62fe093c5a01a28b84cf60a6ada9e9756 ci: fix labeller permissions (Nick Johnson)
Pull request description:
The labeller runs in a separate workflow for security reasons, but this forces the `download-artifact` action to need an explicit token.
Here is a test end to end run on my remote: https://github.com/nyonson/rust-bitcoin/pull/5
ACKs for top commit:
apoelstra:
ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756; successfully ran local tests; sure, whatever
satsfy:
ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756
tcharding:
ACK 715f2bd62fe093c5a01a28b84cf60a6ada9e9756
Tree-SHA512: 3572cf7f92a1869192cbb3300b72bc2922e56e4529482d5baaddc66a47d46e42929e04ec9f0dd5b74a9f20fd72088e2f4b27a0f462ad9579016392027bf5c1e2
What changed, and why it matters
This is a routine GitHub Actions workflow fix. The change gives the automated PR labeler workflow permission to download artifacts and explicitly tells the GitHub CLI which repository to act on. It does not change the Bitcoin library code, user-facing behavior, or introduce a security vulnerability.
No action required; this is a benign CI maintenance patch.
Security signals we found
CI workflow permission fix
No source code changes
No cryptographic or consensus changes
Evidence from the diff
The commit modifies .github/workflows/ci-labeller.yml. It adds github-token to actions/download-artifact, sets merge-multiple: true, and adds GH_REPO environment variables to two gh CLI invocations. These are configuration hardening/permission fixes for a CI labeller that runs in the restricted workflow_run context. There is no change to Rust source code, cryptography, parsing, serialization, or consensus logic.
Changed components
.github/workflows/ci-labeller.ymlInspect captured patch +5 / −0
### .github/workflows/ci-labeller.yml
@@ -29,12 +29,16 @@ jobs:
with:
# The workflow which completed a CI run and needs PR labels.
run-id: ${{ github.event.workflow_run.id }}
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+ # Assume labeller artifacts are single files.
+ merge-multiple: true
# The API diff label artifact must have the PR number on the first line,
# and the exit code of the diff detection on the second line.
- name: "Toggle API diff Label"
if: ${{ hashFiles('api-diff') != '' }}
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ GH_REPO: ${{ github.repository }}
run: |
issue_number=$(head -n1 api-diff)
exit_code=$(tail -n1 api-diff)
@@ -46,6 +50,7 @@ jobs:
if: ${{ hashFiles('semver-break') != '' }}
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ GH_REPO: ${{ github.repository }}
run: |
issue_number=$(head -n1 semver-break)
exit_code=$(tail -n1 semver-break)Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.