[mallendem]

harden labeler workflow

What

.github/workflows/labeler.yml, trigger unchanged.

• Pinned every action to a full commit SHA with a version comment.
• Moved permissions to the job (permissions: {} at workflow level).
• Added a comment explaining why pull_request_target is kept and that no PR code is checked out.
• AlexanderWert/issue-labeler v2.3 pinned to 32be4a3c (latest release).

Why

pull_request_target is needed to label fork PRs (the pull_request token is read-only for forks). The workflow checks out nothing and runs no PR code. AlexanderWert/issue-labeler loads its config through the contents API at github.context.sha, which for pull_request_target is the base branch commit, so a PR cannot change the labeling rules. Hardening is limited to supply chain (mutable tags), token scope and script injection. Part of the pull_request_target audit: https://github.com/elastic/observability-robots/issues/5292

Behaviour change

None.

Verification

Done:

• zizmor 1.30.1 (offline, container): only dangerous-triggers on the kept pull_request_target trigger (expected, covered by the org Actions policy allowlist); no template-injection, unpinned-uses or excessive-permissions findings.
• YAML parses.
• SHAs resolved with gh api repos/<o>/<r>/git/ref/tags/<tag> (annotated tags dereferenced); each is the latest published non-draft release. AlexanderWert/issue-labeler has no release newer than v2.3 (2020, node12 action).
• Read the labeler source (src/main.ts): config is fetched with repos.getContents at ref: github.context.sha.

Not done:

• No workflow run (nothing pushed): a real issue/PR event is needed to confirm.

🤖 Generated with Claude Code

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[Copilot]

🟢 Approval recommended

The issue-labeling workflow changes have no active review issues.

No open issues 🎉

What changed in this PR

Hardens the issue-labeling workflow as part of the pull_request_target audit while preserving its existing triggers and labeling behavior.

Changes:

• Pins AlexanderWert/issue-labeler to a full commit SHA with a v2.3 comment.
• Moves token permissions to the triage job and disables workflow-level permissions.
• Documents why pull_request_target is retained and how the workflow avoids running PR code.

File	Description
.github/​workflows/​labeler.yml	Pins the action, scopes permissions to the job, and documents the trigger’s security rationale.

_{Review effort: Balanced}