labeler.yml

name: PR Labeler

on:
  pull_request:
    types: [opened, synchronize, reopened]

concurrency:
  group: labeler-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions: {}

jobs:
  label:
    name: Label PR
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      - name: Label PR based on changed paths
        uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"