triage.yml

name: Triage PR

on:
  # `pull_request_target` is required so the labeler/title-validator can
  # write labels and statuses on PRs from forks (under `pull_request`,
  # GitHub forces GITHUB_TOKEN to read-only for fork PRs). Safe here
  # because this workflow:
  #   - never checks out PR code (no actions/checkout),
  #   - has no `run:` steps that interpolate PR fields,
  #   - only invokes SHA-pinned actions that read PR metadata via the API,
  #   - is locked behind required code-owner review (see .github/CODEOWNERS)
  #     so future edits cannot quietly add privileged execution surface.
  pull_request_target: # zizmor: ignore[dangerous-triggers]
    branches:
      - main
    types:
      - opened
      - reopened
      - edited
      - synchronize
      - ready_for_review

permissions: {}

jobs:
  pr-title:
    name: Validate PR title
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    steps:
      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  pr-labeler:
    name: Auto-label PR
    runs-on: ubuntu-latest
    permissions:
      contents: read # the config file
      pull-requests: write # for labeling pull requests
      statuses: write # to generate status
      checks: write # to generate status
    steps:
      - uses: fuxingloh/multi-labeler@bcd50af464202999e57f556b4aefcf05a34abf85 # v5.0.0