chore(ci): Restrict perms in pr labeler, 'persist-credentials: false'…

… in checkout step
mdn · Jan 16, 2024 · 9e866dd · 9e866dd
1 parent 7617c4b
commit 9e866dd
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
@@ -3,6 +3,10 @@ name: Pull request labeler
 on:
   - pull_request_target
 
+permissions:
+  pull-requests: write
+  contents: read
+
 jobs:
   # Docs: https://github.com/actions/labeler
   label-by-path:
@@ -23,6 +27,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Label PR based on size
         uses: cbrgm/pr-size-labeler-action@main