labeler.yml

name: PR Labeler

on:
  pull_request:
    types: [opened, synchronize, reopened]

concurrency:
  group: labeler-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions: {}

jobs:
  label:
    name: Label PR
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Label PR based on changed paths
        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"