From 37caac78cb9a5313a4513dd87259667ed7f1cd7e Mon Sep 17 00:00:00 2001 From: Nikolas de Hor Date: Sun, 22 Feb 2026 22:25:31 -0300 Subject: [PATCH 1/2] fix(ci): use pull_request_target so labeler works on fork PRs The pull_request event gives read-only GITHUB_TOKEN for fork PRs, blocking the labeler action regardless of the permissions block. Switch to pull_request_target (runs in base-repo context with write access) and replace the shell git diff squad check with a GitHub API call that works without access to the fork's commits. Closes #479 --- .github/workflows/pr-labeling.yml | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/.github/workflows/pr-labeling.yml b/.github/workflows/pr-labeling.yml index 1097f705a0..7ce36ca32b 100644 --- a/.github/workflows/pr-labeling.yml +++ b/.github/workflows/pr-labeling.yml @@ -1,8 +1,10 @@ name: PR Labeling # Story 6.1 - Added concurrency +# Fix #479 - use pull_request_target so the GITHUB_TOKEN has write +# permissions even for PRs from forks. on: - pull_request: + pull_request_target: types: [opened, synchronize] concurrency: @@ -28,12 +30,16 @@ jobs: - name: Check for squad changes id: check-squad - run: | - if git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -q "^squads/"; then - echo "has_squad=true" >> $GITHUB_OUTPUT - else - echo "has_squad=false" >> $GITHUB_OUTPUT - fi + uses: actions/github-script@v7 + with: + script: | + const { data: files } = await github.rest.pulls.listFiles({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: context.payload.pull_request.number, + }); + const hasSquad = files.some(f => f.filename.startsWith('squads/')); + core.setOutput('has_squad', hasSquad ? 'true' : 'false'); - name: Add needs-po-review label for squad PRs if: steps.check-squad.outputs.has_squad == 'true' @@ -41,9 +47,8 @@ jobs: with: script: | github.rest.issues.addLabels({ - issue_number: context.issue.number, + issue_number: context.payload.pull_request.number, owner: context.repo.owner, repo: context.repo.repo, labels: ['needs-po-review'] }) - From aa07445a77210569c53b253214438098185cec19 Mon Sep 17 00:00:00 2001 From: Nikolas de Hor Date: Tue, 24 Feb 2026 20:06:08 -0300 Subject: [PATCH 2/2] =?UTF-8?q?fix:=20address=20CodeRabbit=20review=20?= =?UTF-8?q?=E2=80=94=20await=20addLabels,=20add=20issues:write?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - await the addLabels API call so rejections propagate - add issues: write permission (needed to create labels) - add comment clarifying checkout uses base ref, not PR head --- .github/workflows/pr-labeling.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-labeling.yml b/.github/workflows/pr-labeling.yml index 7ce36ca32b..0ab9f7166f 100644 --- a/.github/workflows/pr-labeling.yml +++ b/.github/workflows/pr-labeling.yml @@ -2,6 +2,7 @@ name: PR Labeling # Story 6.1 - Added concurrency # Fix #479 - use pull_request_target so the GITHUB_TOKEN has write # permissions even for PRs from forks. +# SECURITY: checkout uses the base ref (default), never the PR head. on: pull_request_target: @@ -17,6 +18,7 @@ jobs: permissions: contents: read pull-requests: write + issues: write steps: - name: Checkout code uses: actions/checkout@v4 @@ -46,7 +48,7 @@ jobs: uses: actions/github-script@v7 with: script: | - github.rest.issues.addLabels({ + await github.rest.issues.addLabels({ issue_number: context.payload.pull_request.number, owner: context.repo.owner, repo: context.repo.repo,