Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions .github/workflows/autolabler.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
name: Auto Label Issues and PRs

on:
pull_request_target:
types: [opened]
issues:
types: [opened]

permissions:
issues: write
pull-requests: write

jobs:
add-labels:
runs-on: ubuntu-latest
steps:
- name: Add labels to PR
if: github.event_name == 'pull_request_target'
uses: actions/github-script@v7
with:
script: |
const prNumber = context.payload.pull_request.number;
await github.rest.issues.addLabels({
...context.repo,
issue_number: prNumber,
labels: ["recode", "level 1"]
});
console.log(`Added labels [recode, level 1] to PR #${prNumber}`);
- name: Add labels to Issue
if: github.event_name == 'issues'
uses: actions/github-script@v7
with:
script: |
const issueNumber = context.payload.issue.number;
await github.rest.issues.addLabels({
...context.repo,
issue_number: issueNumber,
labels: ["recode", "level 1"]
});
console.log(`Added labels [recode, level 1] to Issue #${issueNumber}`);
6 changes: 3 additions & 3 deletions .github/workflows/pr-issue-sync.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Sync PR data from Linked Issues

on:
pull_request:
pull_request_target:
types: [opened, edited, synchronize]

jobs:
Expand All @@ -17,6 +17,7 @@ jobs:
id: extract
uses: actions/github-script@v7
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const body = context.payload.pull_request.body || "";
const issuePattern = /#(\d+)/g;
Expand All @@ -32,8 +33,7 @@ jobs:
uses: actions/github-script@v7
with:
script: |
const issuesInput = core.getInput("issues") || "[]";
const issues = JSON.parse(issuesInput);
const issues = JSON.parse(`${{ steps.extract.outputs.issues }}`);
Copy link

Copilot AI Sep 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Directly interpolating GitHub Actions output into JSON.parse() without proper escaping can lead to code injection vulnerabilities. Consider using fromJSON() function or proper input handling with core.getInput().

Suggested change
const issues = JSON.parse(`${{ steps.extract.outputs.issues }}`);
const issues = fromJSON(steps.extract.outputs.issues);

Copilot uses AI. Check for mistakes.

const prNumber = context.payload.pull_request.number;

let combinedLabels = [];
Expand Down
Loading