Activity

1. iccir

   added

   Maintenance

   on Sep 25, 2026
2. QuLogic commented on Sep 25, 2026

   

   QuLogic

   on Sep 25, 2026

   Member

   More actions

   I looked over the workflows and AFAICT, they are following best practices and should be secure. Unfortunately, though those docs say that the policy is now running in evaluate mode, we can't actually see those insights withou an Enterprise subscription.

   But we still have a bit of time to fully investigate the workflows before the restrictions are in place
3. greglucas commented on Oct 17, 2026

   

   greglucas

   on Oct 17, 2026

   Contributor

   More actions

   I think the action is for someone with admin rights on the repo to create an event policy allowing pull_request_target for the 4 workflows: labeler.py, conflictcheck.py, pr_welcome.py, autoclose_comment.py.

   I looked over the workflows and AFAICT, they are following best practices and should be secure.

   I agree, we have removed all permissions on those workflows and the issue is if we pull the actual PR code and run it which those aren't interacting with rather just labeling things based on the trigger itself.

   👍React with 👍1Reacted by Ricci Adams
4. iccir commented on Oct 17, 2026

   

   iccir

   on Oct 17, 2026

   ContributorAuthor

   More actions

   3. I think the action is for someone with admin rights on the repo to create an event policy allowing pull_request_target for the 4 workflows: labeler.py, conflictcheck.py, pr_welcome.py, autoclose_comment.py.

   That was my understanding from the linked document. I believe that these 4 workflows should be secure per the comment in zizmor.yml:

         # These workflows use pull_request_target solely to obtain write access
         # for API operations (labeling, commenting) on fork PRs. None of them
         # check out or execute any PR-supplied code.
   

   However, someone should double-check that before making the explicit policies.