Skip to content

Fix label-check and auto-assign on fork PRs #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TrevorSchirmer merged 1 commit into from
Jun 12, 2026
Merged

Fix label-check and auto-assign on fork PRs #40

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/autoassign.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,11 @@
name: Auto Assign
# pull_request_target (not pull_request) so assignment works on
# fork-submitted PRs; fork pull_request runs get a read-only token.
# Safe because this workflow never checks out or executes PR code.
on:
issues:
types: [opened]
pull_request:
pull_request_target:
types: [opened]
jobs:
run:
Expand Down
7 changes: 0 additions & 7 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,10 @@ on:
pull_request:

permissions:
# Allow GITHUB_TOKEN to add labels to pull requests
pull-requests: write
issues: write
contents: read
id-token: write

jobs:
label-check:
name: Label Check
uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@main

ci:
name: Building ${{ matrix.file }} / ESPHome ${{ matrix.esphome-version }}
runs-on: ubuntu-latest
Expand Down
20 changes: 20 additions & 0 deletions .github/workflows/label-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
name: Label Check

# pull_request_target (not pull_request) so the job gets a write token on
# fork-submitted PRs too; plain pull_request runs from forks are read-only
# and cannot add labels. Safe because the called workflow only reads the PR
# body and never checks out or executes PR code. The "edited" type re-runs
# the check when the template checkboxes are changed.
on:
pull_request_target:
types: [opened, edited, reopened, synchronize]

permissions:
pull-requests: write
issues: write
contents: read

jobs:
label-check:
name: Label Check
uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@main
Comment on lines +18 to +20

@coderabbitai coderabbitai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# List workflow files
echo "== Workflows =="
ls -la .github/workflows || true
echo

# Show label-check.yml around stated lines
echo "== label-check.yml (head) =="
sed -n '1,120p' .github/workflows/label-check.yml || true
echo
echo "== label-check.yml (lines 1-60 with numbers) =="
nl -ba .github/workflows/label-check.yml | sed -n '1,80p' || true
echo

# Find and show autoassign.yml (if exists)
if [ -f .github/workflows/autoassign.yml ]; then
  echo "== autoassign.yml (head) =="
  sed -n '1,160p' .github/workflows/autoassign.yml
  echo
  echo "== autoassign.yml (lines 1-120 with numbers) =="
  nl -ba .github/workflows/autoassign.yml | sed -n '1,140p'
else
  echo "== autoassign.yml not found =="
  rg -n --hidden "autoassign" .github/workflows || true
fi

# Check for pull_request_target workflows and permissions/write tokens
echo
echo "== pull_request_target workflows =="
rg -n --hidden "pull_request_target:" .github/workflows || true
echo

echo "== permissions blocks under pull_request_target =="
# Print files and nearby lines for permissions
rg -n --hidden -U "pull_request_target:([^\n]*\n){0,30}[[:space:]]*permissions:" .github/workflows || true
echo

# Check external uses refs in those files
echo "== External uses in label-check.yml =="
rg -n --hidden "uses:" .github/workflows/label-check.yml || true
echo
echo "== External uses in autoassign.yml =="
if [ -f .github/workflows/autoassign.yml ]; then
  rg -n --hidden "uses:" .github/workflows/autoassign.yml || true
fi
echo

# Also search any other workflow using pull_request_target with external uses
echo "== Other pull_request_target jobs with uses: (all workflows) =="
rg -n --hidden -U "pull_request_target:[\s\S]*?uses:\s" .github/workflows || true

Repository: ApolloAutomation/PUMP-1

Length of output: 1999

🌐 Web query:

ApolloAutomation/Workflows#24 hardening pin commit SHA label-check reusable workflow

💡 Result:

There is no public GitHub issue #24 in the ApolloAutomation/Workflows repository, as this repository does not appear to exist [1][2]. Apollo Automation is a home automation hardware company [3], and its GitHub organization (ApolloAutomation) focuses on device firmware and integration tools [1][3]. The query appears to conflate a common supply-chain security best practice—hardening reusable workflows by pinning actions and internal references to commit SHAs—with the "Apollo" name. Pinning to full-length commit SHAs is a critical security measure to prevent supply-chain attacks, as it ensures that workflow code is immutable and cannot be altered by force-pushing tags or branches [4][5][6]. If you are implementing this hardening pattern in your own workflows, current industry best practices involve [4][5][6][7]: 1. Pinning all actions and reusable workflows to full 40-character commit SHAs (e.g., uses: actions/checkout@de0fac2e...). 2. Performing audit checks on the call graph to ensure that transitive reusable workflows are also pinned to SHAs [4]. 3. Avoiding mutable references like branches (main, master) or tags (v1, v2) in production CI/CD pipelines [8][5][6]. For context, Apollo Automation's GitHub organization does exist [1], but its repository structure is dedicated to hardware projects like AIR-1, MSR-1, and MSR-2 [1], rather than generic workflow automation libraries [1][3]. Additionally, there is a separate entity/project named "Apollo-Workflows" that focuses on academic or scientific workflow choreography [9][10], but it is unrelated to Apollo Automation's hardware business [3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== pull_request_target workflows using external uses: (all workflows) =="
rg -n --hidden -U "pull_request_target:|uses:" .github/workflows/*.yml || true

echo
echo "== label-check.yml external uses ref =="
rg -n --hidden "uses:" .github/workflows/label-check.yml || true

echo
echo "== autoassign.yml external uses ref =="
rg -n --hidden "uses:" .github/workflows/autoassign.yml || true

Repository: ApolloAutomation/PUMP-1

Length of output: 1020

Pin external uses: refs in pull_request_target workflows to immutable commit SHAs

.github/workflows/label-check.yml uses the external reusable workflow ApolloAutomation/Workflows/.github/workflows/label-check.yml@main, and .github/workflows/autoassign.yml uses pozil/auto-assign-issue@v2, both under pull_request_target with write permissions—pin these uses: references to full commit SHAs (and ensure transitive reusable workflows/actions are pinned too).

🧰 Tools
🪛 zizmor (1.25.2)

[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/label-check.yml around lines 18 - 20, The workflow uses
external reusable actions via the `uses:` keys (e.g., the `label-check` job
referencing `ApolloAutomation/Workflows/.github/workflows/label-check.yml@main`
and the other workflow referencing `pozil/auto-assign-issue@v2`); replace those
branch/tag refs with immutable full commit SHAs (obtain the commit SHA for the
target repo/branch and update the `uses:` values to
`owner/repo/path@<full-sha>`), and audit transitive reusable workflows/actions
referenced by those workflows to ensure any nested `uses:` are also pinned to
full SHAs rather than branches or tags.

Source: Linters/SAST tools

Loading