Florian Greinacher
16e86125e9
Explicitely stating required permissions is considered best practice. This case was detected by Poutine, see https://github.com/boostsecurityio/poutine/blob/main/docs/content/en/rules/default_permissions_on_risky_events.md. Signed-off-by: Florian Greinacher <[email protected]>
20 lines
487 B
YAML
20 lines
487 B
YAML
---
|
|
name: "Enforce PR labels"
|
|
|
|
on: # yamllint disable-line rule:truthy
|
|
pull_request_target:
|
|
types: [labeled, unlabeled, opened, edited, synchronize]
|
|
|
|
permissions:
|
|
contents: read # to read configuration file
|
|
pull-requests: write # to label PRs
|
|
|
|
jobs:
|
|
enforce-label:
|
|
if: github.repository == 'dev-sec/ansible-collection-hardening'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/[email protected]
|
|
with:
|
|
repo-token: "${{ secrets.GITHUB_TOKEN }}"
|