From: Evgeny Vereshchagin <evvers@ya.ru>
Date: Thu, 11 Nov 2021 01:56:02 +0000 (+0000)
Subject: ci: pin labeler
X-Git-Tag: v250-rc1~291^2~1
X-Git-Url: http://git-history.diyao.me/?a=commitdiff_plain;h=5570313421a27bd8a7a7e04de975e64769df8cf8;p=systemd%2F.git

ci: pin labeler

Turns out GHActions where `pull_request_target` is used are capable
of pwning repositories: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

labeler doesn't check out the source code or build anything so
it's safe in its current form but to avoid surprises let's just pin
it to the latest version. It's annoying to manage dependencies like this
manually so additionally dependabot.yml is introduced to make it
easier to keep GHActions up to date more or less automatically:
https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot
---

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..123014908b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index aad5d2157f..ee238c2fa7 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -11,7 +11,7 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@main
+    - uses: actions/labeler@69da01b8e0929f147b8943611bee75ee4175a49e
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         configuration-path: .github/labeler.yml