From 4c98572f2b37bc8debe20fc0d51ee8e13a282b42 Mon Sep 17 00:00:00 2001 From: Antonio Sanchez Date: Thu, 29 Oct 2026 14:51:43 -0700 Subject: [PATCH] Harden model-optimization labeler workflow token permissions. Privileged `pull_request_target` workflows without explicit permission scoping expose a write-capable token to untrusted pull request events. - Restrict `labeler.yml` permissions to `contents: read` and `pull-requests: write`. PiperOrigin-RevId: 1009984670 --- .github/workflows/labeler.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index d8a9596e1..0e0ab7ed1 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -16,6 +16,10 @@ name: "Pull Request Labeler" on: - pull_request_target +permissions: + contents: read + pull-requests: write + jobs: triage: runs-on: ubuntu-latest