docs: add shieldcn.dev badge group to README #107
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Labeler | |
| # pull_request_target is required here so the labeler can write labels on fork PRs. | |
| # This usage is considered acceptable because: | |
| # - No code is checked out or executed from the PR branch | |
| # - No dependencies are installed (no pnpm/npm install) | |
| # - No cache writes occur | |
| # - permissions: {} at workflow level; only contents: read + pull-requests: write at job level | |
| # - The action is pinned to a full commit SHA | |
| # If actions/labeler@pinned-sha is ever compromised, it can at most read repo | |
| # contents and write PR labels — it has no access to OIDC tokens or npm secrets. | |
| on: | |
| - pull_request_target | |
| permissions: {} | |
| jobs: | |
| labeler: | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6 | |
| with: | |
| repo-token: '${{ secrets.GITHUB_TOKEN }}' |