triage.yml

name: Triaging
on:
  # pull_request_target is needed so that actions/labeler can write labels on PRs
  # from forks (pull_request lacks write access in that case). No PR code is ever
  # checked out here, so the privileged context is not exposed to untrusted input.
  pull_request_target: # zizmor: ignore[dangerous-triggers]
  issues:
    types:
      - labeled
      - unlabeled

permissions:
  contents: read

jobs:
  label:
    if: github.event.pull_request
    permissions:
      contents: read  # for actions/labeler to determine modified files
      pull-requests: write  # for actions/labeler to add labels to PRs
    name: PR labels
    runs-on: ubuntu-slim
    steps:
      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
          sync-labels: true