dnskr commented on issue #7456: URL: https://github.com/apache/kyuubi/issues/7456#issuecomment-4640235388
### Review `pull_request_target` usage I have reviewed the [.github/workflows/labeler.yml](https://github.com/apache/kyuubi/blob/de20c20323edeec8e5251873cd7769c775fba706/.github/workflows/labeler.yml) workflow to evaluate its risks against the policy regarding confidential credentials and the `pull_request_target` trigger. ### Conclusion The current configuration is secure and acceptable. It falls safely within the "very limited circumstances" exception outlined in the policy. #### Details Here is a summary from `actions/labeler` [docs](https://github.com/actions/labeler/blob/f27b608878404679385c85cfa523b85ccb86e213/README.md) of why this usage is safe to maintain: - The `actions/labeler` action only interacts with the GitHub REST API to fetch metadata. It does not check out the PR's code or run arbitrary scripts, meaning there is no vector for a malicious PR to exfiltrate the token. - To ensure the workflow remains secure in the future, we need to verify that it continues to use strict job-level permissions (`contents: read` and `pull-requests: write`) and that we never introduce an `actions/checkout` step that pulls the untrusted PR code into this specific run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
