Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
222 changes: 114 additions & 108 deletions .github/labeler.yml
Original file line number Diff line number Diff line change
@@ -1,108 +1,114 @@
# Commit prefix regexes
type:Compiler:
title: "^COMP:.*"

type:Bug:
title: "^BUG:.*"

type:Documentation:
title: "^DOC:.*"

type:Enhancement:
title: "^ENH:.*"

type:Performance:
title: "^PERF:.*"

type:Style:
title: "^STYLE:.*"

type:Coverage:
title: "coverage"

type:Design:
title: "design"

# Filename regexes
area:Bridge:
files:
- "Modules/Bridge/*"

area:Core:
files:
- "Modules/Core/*"

area:Documentation:
files:
- "Documentation/*"
- "Utilities/Doxygen/*"

area:Examples:
files:
- "Examples/*"

area:Filtering:
files:
- "Modules/Filtering/*"

area:IO:
files:
- "Modules/IO/*"

area:Numerics:
files:
- "Modules/Numerics/*"

area:Nonunit:
files:
- "src/Nonunit/*"

area:Python wrapping:
files:
- "Modules/Generators/Python/*"
- "Modules/.*/wrapping/*"
- ".*.notwrapped"
- ".*.py.*"
- ".*.wrap"

area:Registration:
files:
- "Modules/Registration/*"

area:Remotes:
files:
- "Modules/Remote/*"

area:Segmentation:
files:
- "Modules/Segmentation/*"

area:ThirdParty:
files:
- "Modules/ThirdParty/*"

area:Video:
files:
- "Modules/Video/*"

type:Data:
files:
- ".*.jpeg"
- ".*.jpg"
- ".*.md5"
- ".*.png"
- ".*.sha512"

type:Testing:
files:
- "Testing/*"
- ".*Test.*.cxx"
- ".*Test.*.h.*"
- ".*Test.*.py"

type:Infrastructure:
files:
- ".github/*"
- "CMake/*"
- "Testing/ContinuousIntegration/*"
- "Utilities/*"
# srvaroa/labeler v1.x configuration. See
# https://github.com/srvaroa/labeler#configuration for schema details.
# Patterns under `files:` are Go RE2 regexes matched unanchored against
# every file path in the PR; `title:` is matched against the PR title.
version: 1
labels:
# Commit prefix regexes
- label: "type:Compiler"
title: "^COMP:.*"

- label: "type:Bug"
title: "^BUG:.*"

- label: "type:Documentation"
title: "^DOC:.*"

- label: "type:Enhancement"
title: "^ENH:.*"

- label: "type:Performance"
title: "^PERF:.*"

- label: "type:Style"
title: "^STYLE:.*"

- label: "type:Coverage"
title: "coverage"

- label: "type:Design"
title: "design"

# Filename regexes
- label: "area:Bridge"
files:
- "Modules/Bridge/*"

- label: "area:Core"
files:
- "Modules/Core/*"

- label: "area:Documentation"
files:
- "Documentation/*"
- "Utilities/Doxygen/*"

- label: "area:Examples"
files:
- "Examples/*"

- label: "area:Filtering"
files:
- "Modules/Filtering/*"

- label: "area:IO"
files:
- "Modules/IO/*"

- label: "area:Numerics"
files:
- "Modules/Numerics/*"

- label: "area:Nonunit"
files:
- "src/Nonunit/*"

- label: "area:Python wrapping"
files:
- "Modules/Generators/Python/*"
- "Modules/.*/wrapping/*"
- ".*.notwrapped"
- ".*.py.*"
- ".*.wrap"

- label: "area:Registration"
files:
- "Modules/Registration/*"

- label: "area:Remotes"
files:
- "Modules/Remote/*"

- label: "area:Segmentation"
files:
- "Modules/Segmentation/*"

- label: "area:ThirdParty"
files:
- "Modules/ThirdParty/*"

- label: "area:Video"
files:
- "Modules/Video/*"

- label: "type:Data"
files:
- ".*.jpeg"
- ".*.jpg"
- ".*.md5"
- ".*.png"
- ".*.sha512"

- label: "type:Testing"
files:
- "Testing/*"
- ".*Test.*.cxx"
- ".*Test.*.h.*"
- ".*Test.*.py"

- label: "type:Infrastructure"
files:
- ".github/*"
- "CMake/*"
- "Testing/ContinuousIntegration/*"
- "Utilities/*"
2 changes: 1 addition & 1 deletion .github/workflows/label-pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,6 @@ jobs:
pull-requests: write

steps:
- uses: srvaroa/labeler@v0.8
- uses: srvaroa/labeler@v1
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Floating tag with pull_request_target is a supply chain risk

The workflow is triggered by pull_request_target, which runs with write access to the base repository and has access to GITHUB_TOKEN. A floating @v1 tag means any new commit pushed under that tag by the upstream maintainer is automatically trusted and executed with those privileges. Pinning to a specific commit SHA (e.g., srvaroa/labeler@<sha>) eliminates silent tag-overwrite risk. The PR description already notes this trade-off, and the permissions scope is limited to pull-requests: write, which meaningfully reduces blast radius — but pinning the SHA is the common defense-in-depth recommendation for pull_request_target workflows.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the v1 tag is what we want to minimize future maintenance burden.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@blowekamp @dzenanz @thewtex I don't think that the floating tag is a sufficient enough concern to justify the added burden. NOTE: All PR's (including this one) will fail (or be really flakey) the Labeler CI until this (or similar) is merged into the main branch.

env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
Loading