From 49fce0da148b1dd84eb8c9661ecf81e05f49bbd5 Mon Sep 17 00:00:00 2001 From: russellwheatley Date: Thu, 30 Jul 2026 11:36:56 +0100 Subject: [PATCH 1/3] ci: add needs-attention labeling automation Mirrors the workflow added to react-native-firebase, firebaseui-web, and FirebaseUI-iOS. Two behaviors: - New issues/PRs (including from forks, via pull_request_target) get "needs-attention" immediately on creation. - When the issue/PR author comments on an open item, "needs-attention" is (re-)added and "blocked: await customer response" is removed. Closed items get a short comment instead, pointing to a fresh issue/PR if still relevant. Uses only the default GITHUB_TOKEN with an explicit permissions block, so no repository/org settings changes are required. --- .github/workflows/issue-labels.yaml | 84 +++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+) create mode 100644 .github/workflows/issue-labels.yaml diff --git a/.github/workflows/issue-labels.yaml b/.github/workflows/issue-labels.yaml new file mode 100644 index 000000000..24392a304 --- /dev/null +++ b/.github/workflows/issue-labels.yaml @@ -0,0 +1,84 @@ +name: Update labels on issues and pull requests + +on: + issue_comment: + types: [created] + issues: + types: [opened] + pull_request_target: + types: [opened] + +permissions: + issues: write + pull-requests: write + +jobs: + label-new-item: + if: github.event_name == 'issues' || github.event_name == 'pull_request_target' + runs-on: ubuntu-latest + steps: + - name: Add needs-attention label on creation + uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 + with: + script: | + await github.rest.issues.addLabels({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.issue.number, + labels: ['needs-attention'], + }); + + label-op-response: + if: github.event_name == 'issue_comment' + runs-on: ubuntu-latest + steps: + - name: Check if the comment is from the issue author + id: check-op + uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 + with: + script: | + const isOpComment = + context.payload.comment.user.login === + context.payload.issue.user.login; + core.setOutput('op_comment', isOpComment ? 'true' : 'false'); + + - name: Update labels when the issue author responded on an open item + if: steps.check-op.outputs.op_comment == 'true' && github.event.issue.state == 'open' + uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 + with: + script: | + const issueNumber = context.payload.issue.number; + await github.rest.issues.addLabels({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: issueNumber, + labels: ['needs-attention'], + }); + try { + await github.rest.issues.removeLabel({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: issueNumber, + name: 'blocked: await customer response', + }); + } catch (error) { + if (error.status !== 404) { + throw error; + } + } + + - name: Comment when the issue author responded on a closed item + if: steps.check-op.outputs.op_comment == 'true' && github.event.issue.state == 'closed' + uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 + with: + script: | + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.payload.issue.number, + body: [ + 'This item is closed, so it may not receive regular attention.', + '', + 'If it is still relevant, please open a new issue with an up-to-date reproduction, or open a new pull request.', + ].join('\n'), + }); From bc21845d6e3ea8bb5ff2b8f958b3b4b838420056 Mon Sep 17 00:00:00 2001 From: russellwheatley Date: Thu, 30 Jul 2026 11:49:41 +0100 Subject: [PATCH 2/3] ci: fix zizmor findings by dropping pull_request_target zizmor (mandatory security scan on this repo) flagged pull_request_target as a fundamentally insecure trigger, and both permissions entries as overly broad at the workflow level. - Drop the pull_request_target trigger and its "label new PRs on open" job entirely, since it can't be made safe enough for this org's security gate. New issues are still labeled immediately (issues:opened doesn't carry the same risk); new PRs are still labeled as soon as the OP comments, via the existing issue_comment flow. - Move permissions to job level (issues: write only) instead of the workflow level, and set permissions: {} at the top. pull-requests: write was dropped entirely - every API call here (addLabels/removeLabel/ createComment) goes through the Issues API regardless of whether the target is an issue or PR, so it was never actually needed. --- .github/workflows/issue-labels.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/issue-labels.yaml b/.github/workflows/issue-labels.yaml index 24392a304..6c1b36350 100644 --- a/.github/workflows/issue-labels.yaml +++ b/.github/workflows/issue-labels.yaml @@ -5,17 +5,15 @@ on: types: [created] issues: types: [opened] - pull_request_target: - types: [opened] -permissions: - issues: write - pull-requests: write +permissions: {} jobs: - label-new-item: - if: github.event_name == 'issues' || github.event_name == 'pull_request_target' + label-new-issue: + if: github.event_name == 'issues' runs-on: ubuntu-latest + permissions: + issues: write steps: - name: Add needs-attention label on creation uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 @@ -31,6 +29,8 @@ jobs: label-op-response: if: github.event_name == 'issue_comment' runs-on: ubuntu-latest + permissions: + issues: write steps: - name: Check if the comment is from the issue author id: check-op From cd46379d128e2a8bb740229d3e8e2f8b368d4c64 Mon Sep 17 00:00:00 2001 From: russellwheatley Date: Thu, 30 Jul 2026 11:52:21 +0100 Subject: [PATCH 3/3] ci: pin actions/github-script to its real commit SHA v9.0.0 is an annotated tag; the SHA copied from react-native-firebase's workflow (d746ffe3...) is the tag *object*'s SHA, not the commit it points to, so it 422s on a plain commit lookup. zizmor's impostor-commit check flags this as a version-comment mismatch. Repin to the underlying commit (3a2844b7...), which still corresponds exactly to v9.0.0. --- .github/workflows/issue-labels.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/issue-labels.yaml b/.github/workflows/issue-labels.yaml index 6c1b36350..0e9741ef0 100644 --- a/.github/workflows/issue-labels.yaml +++ b/.github/workflows/issue-labels.yaml @@ -16,7 +16,7 @@ jobs: issues: write steps: - name: Add needs-attention label on creation - uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | await github.rest.issues.addLabels({ @@ -34,7 +34,7 @@ jobs: steps: - name: Check if the comment is from the issue author id: check-op - uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const isOpComment = @@ -44,7 +44,7 @@ jobs: - name: Update labels when the issue author responded on an open item if: steps.check-op.outputs.op_comment == 'true' && github.event.issue.state == 'open' - uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const issueNumber = context.payload.issue.number; @@ -69,7 +69,7 @@ jobs: - name: Comment when the issue author responded on a closed item if: steps.check-op.outputs.op_comment == 'true' && github.event.issue.state == 'closed' - uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | await github.rest.issues.createComment({