mirror of
https://github.com/immich-app/immich.git
synced 2025-05-24 01:12:58 -04:00
64000d9d76
* fix: set persist-credentials explicitly for checkout https://woodruffw.github.io/zizmor/audits/#artipacked * fix: minimize permissions scope for workflows https://woodruffw.github.io/zizmor/audits/#excessive-permissions * fix: remove potential template injections https://woodruffw.github.io/zizmor/audits/#template-injection * fix: only pass needed secrets in workflow_call https://woodruffw.github.io/zizmor/audits/#secrets-inherit * fix: push perm for single-arch build jobs I hadn't realised these push to the registry too :x * chore: fix formatting * fix: $ * fix: retag job quoting * feat: static analysis job for gha workflows * chore: fix formatting * fix: clear last zizmor checks * fix: broken merge --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
25 lines
773 B
YAML
25 lines
773 B
YAML
name: PR Label Validation
|
|
|
|
on:
|
|
pull_request_target: # zizmor: ignore[dangerous-triggers] no attacker inputs are used here
|
|
types: [opened, labeled, unlabeled, synchronize]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
validate-release-label:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
issues: write
|
|
pull-requests: write
|
|
steps:
|
|
- name: Require PR to have a changelog label
|
|
uses: mheap/github-action-required-labels@388fd6af37b34cdfe5a23b37060e763217e58b03 # v5
|
|
with:
|
|
mode: exactly
|
|
count: 1
|
|
use_regex: true
|
|
labels: 'changelog:.*'
|
|
add_comment: true
|
|
message: 'Label error. Requires {{errorString}} {{count}} of: {{ provided }}. Found: {{ applied }}. A maintainer will add the required label.'
|