From cfaedd19876ccf238aabc22ab11b84ad397ff89f Mon Sep 17 00:00:00 2001 From: Antonio Sanchez Date: Wed, 11 Nov 2026 09:18:27 -0800 Subject: [PATCH] Harden model-optimization labeler workflow token permissions. Privileged `pull_request_target` workflows without explicit permission scoping expose a write-capable token to untrusted pull request events. - Restrict `labeler.yml` permissions to `contents: read` and `pull-requests: write`. PiperOrigin-RevId: 1019252156 --- .github/workflows/labeler.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index d8a9596e1..0e0ab7ed1 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -16,6 +16,10 @@ name: "Pull Request Labeler" on: - pull_request_target +permissions: + contents: read + pull-requests: write + jobs: triage: runs-on: ubuntu-latest