What the developer wrote
Authored by Nick Johnson
ci: fix labeller permissions
The labeller runs in a separate workflow for security reasons, but this
forces the download-artifact actoin to need an explicit token.
What changed, and why it matters
This commit adjusts a GitHub Actions workflow that automatically labels pull requests based on CI results. It adds a built-in repository token, tells the artifact download step to merge single-file artifacts, and explicitly sets the repository for command-line GitHub operations. There is no change to the Rust Bitcoin library code that end users or applications depend on.
No security action required for downstream users. Repository maintainers may review the workflow_run trigger and labeler permissions as part of routine CI hardening, but the commit itself is a routine CI fix.
Security signals we found
Workflow-only change with no library code modifications
Uses the default GITHUB_TOKEN rather than a custom secret
Runs in workflow_run context, which already has elevated repository access by design
No new external inputs, no shell injection, no secret exfiltration pattern in the diff
Evidence from the diff
The patch modifies .github/workflows/ci-labeller.yml only. It supplies github-token to actions/download-artifact, adds merge-multiple: true, and sets GH_REPO in two steps that invoke the gh CLI. These are configuration fixes for a workflow that runs in the context of workflow_run (a privileged context) and applies labels to PRs. No cryptographic, consensus, parsing, or network code in the rust-bitcoin crate is touched.
Changed components
.github/workflows/ci-labeller.ymlInspect captured patch +5 / −0
diff --git a/.github/workflows/ci-labeller.yml b/.github/workflows/ci-labeller.yml
index 9cf670a0..52fbd635 100644
--- a/.github/workflows/ci-labeller.yml
+++ b/.github/workflows/ci-labeller.yml
@@ -29,12 +29,16 @@ jobs:
with:
# The workflow which completed a CI run and needs PR labels.
run-id: ${{ github.event.workflow_run.id }}
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+ # Assume labeller artifacts are single files.
+ merge-multiple: true
# The API diff label artifact must have the PR number on the first line,
# and the exit code of the diff detection on the second line.
- name: "Toggle API diff Label"
if: ${{ hashFiles('api-diff') != '' }}
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ GH_REPO: ${{ github.repository }}
run: |
issue_number=$(head -n1 api-diff)
exit_code=$(tail -n1 api-diff)
@@ -46,6 +50,7 @@ jobs:
if: ${{ hashFiles('semver-break') != '' }}
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ GH_REPO: ${{ github.repository }}
run: |
issue_number=$(head -n1 semver-break)
exit_code=$(tail -n1 semver-break)
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.