Skip to content

Remove unnecessary auto-close-issue.yml workflow that uses unmaintained action #810

@assignUser

Description

@assignUser

Hello,

I work with ASF Infra on managing the GitHub Actions allow list and came across an issue in your repo.

The workflow uses an unmaintained action and is not required. Additionally the workflow does not limit the permissions of the GITHUB_TOKEN which is a considerable security issue, especially with an unmaintained action.

Github provides functionality that makes this workflow superflous, just use one of the documented keywords to link a PR to an issue and GitHub will close it when the PR is merged.

Due to the security issue I will remove the peter-evans/close-issue action from the allow list today. (you are it's only user in apache/)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions