Files
classroomio/.github/workflows/apply-issue-labels-to-pr.yml
T
Cursor AgentandRotimi Best 9adc38bd8a chore(ci): harden supply-chain controls before reopening PRs
Isolate npm publish from PR CI, enforce frozen lockfiles and a 24h
minimumReleaseAge, and document safe pull_request_target usage so fork
PRs cannot reach publish credentials.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
2026-08-10 21:00:29 +01:00

79 lines
2.3 KiB
YAML

name: 'Apply issue labels to PR'
# pull_request_target is used so labeling works for fork PRs.
# SAFE ONLY because this workflow never checks out or executes PR code.
# Do not add actions/checkout, pnpm install, build, or cache steps here.
on:
pull_request_target:
types:
- opened
permissions:
contents: none
issues: read
pull-requests: write
jobs:
label_on_pr:
runs-on: ubuntu-latest
steps:
- name: Apply labels from linked issue to PR
uses: actions/github-script@v5
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
async function getLinkedIssues(owner, repo, prNumber) {
const query = `query GetLinkedIssues($owner: String!, $repo: String!, $prNumber: Int!) {
repository(owner: $owner, name: $repo) {
pullRequest(number: $prNumber) {
closingIssuesReferences(first: 10) {
nodes {
number
labels(first: 10) {
nodes {
name
}
}
}
}
}
}
}`;
const variables = {
owner: owner,
repo: repo,
prNumber: prNumber,
};
const result = await github.graphql(query, variables);
return result.repository.pullRequest.closingIssuesReferences.nodes;
}
const pr = context.payload.pull_request;
const linkedIssues = await getLinkedIssues(
context.repo.owner,
context.repo.repo,
pr.number
);
const labelsToAdd = new Set();
for (const issue of linkedIssues) {
if (issue.labels && issue.labels.nodes) {
for (const label of issue.labels.nodes) {
labelsToAdd.add(label.name);
}
}
}
if (labelsToAdd.size) {
await github.rest.issues.addLabels({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: pr.number,
labels: Array.from(labelsToAdd),
});
}