Re: [I] [Umbrella] Ensure GitHub Actions compliance with ASF Policy [kyuubi]

["dnskr (via GitHub)" <gi...@apache.org>]

dnskr commented on issue #7456:
URL: https://github.com/apache/kyuubi/issues/7456#issuecomment-4640235388

   ### Review `pull_request_target` usage
   I have reviewed the [.github/workflows/labeler.yml](https://github.com/apache/kyuubi/blob/de20c20323edeec8e5251873cd7769c775fba706/.github/workflows/labeler.yml) workflow to evaluate its risks against the policy regarding confidential credentials and the `pull_request_target` trigger.
   
   ### Conclusion
   The current configuration is secure and acceptable.
   It falls safely within the "very limited circumstances" exception outlined in the policy.
   
   #### Details
   Here is a summary from `actions/labeler` [docs](https://github.com/actions/labeler/blob/f27b608878404679385c85cfa523b85ccb86e213/README.md) of why this usage is safe to maintain:
   -  The `actions/labeler` action only interacts with the GitHub REST API to fetch metadata. It does not check out the PR's code or run arbitrary scripts, meaning there is no vector for a malicious PR to exfiltrate the token.
   - To ensure the workflow remains secure in the future, we need to verify that it continues to use strict job-level permissions (`contents: read` and `pull-requests: write`) and that we never introduce an `actions/checkout` step that pulls the untrusted PR code into this specific run.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org