pr-labeler.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Pull Request Labeler

on:
  workflow_dispatch:
  pull_request_target:
    branches:
      - main
    types:
      - opened
      - synchronize

jobs:
  labeler:
    name: Pull Request Labeler
    runs-on: ubuntu-latest
    steps:
      # https://github.com/marketplace/actions/harden-runner
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit

      # https://github.com/marketplace/actions/create-github-app-token
      - name: Generate Token
        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
        id: app-token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

      # https://github.com/marketplace/actions/labeler
      - name: Labeler
        uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
        with:
          configuration-path: .github/labeler.yaml
          repo-token: "${{ steps.app-token.outputs.token }}"