You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@shiro.apache.org by "lprimak (via GitHub)" <gi...@apache.org> on 2026/10/11 20:23:37 UTC

Re: [PR] [#2905] chore: replace labeler with the one that works like magpie and pull_r… [shiro]

lprimak commented on PR #2908:
URL: https://github.com/apache/shiro/pull/2908#issuecomment-6113354094

   Yes, this is GitHub's recommended split for privileged PR automation (avoiding  pull_request_target )
   
   • GitHub Security Lab: "Preventing pwn requests" – https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
   • Docs,  workflow_run : https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_run
   
   How it works: an unprivileged  pull_request  workflow only signals completion; a  workflow_run  workflow on the default branch (never checking out PR code) finds the PR from the head SHA and applies labels. The same approach is used by other ASF projects (e.g., what you called "magpie"). Note it can only be fully tested after merging, since  workflow_run  runs from the default branch.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@shiro.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org