andygrove opened a new issue, #273: URL: https://github.com/apache/datafusion-sandbox/issues/273
### Is your feature request related to a problem or challenge? GitHub will block the `pull_request_target` trigger by default on public repositories from December 2, 2026, with brownouts before that ([changelog](https://github.blog/changelog/2026-11-02-pull_request_target-blocked-by-default-december-2/)). ASF infra is also disabling the trigger for ASF repositories ([policy](https://infra.apache.org/github-actions-policy.html)). Upstream tracking issue: apache/datafusion#26406. `.github/workflows/labeler.yml` runs `actions/labeler` on `pull_request_target`. Once the trigger is blocked, pull requests, including ones from forks, stop getting path labels automatically. ### Describe the solution you'd like Mirror whatever apache/datafusion adopts, since this repository's labeler matches DataFusion's. apache/datafusion#26683 moves to the two-workflow pattern: 1. A `pull_request` workflow with no write access records the PR number and uploads it as an artifact. 2. A `workflow_run` workflow, triggered when the first one completes, runs in the base repository context with `pull-requests: write`, reads the artifact, and applies the labels from `.github/workflows/labeler/labeler-config.yml`. It treats the artifact as untrusted data and never checks out or runs PR code. ### Describe alternatives you've considered - A GitHub App such as [Boring Cyborg](https://github.com/kaxil/boring-cyborg), which ASF infra suggests for labeling. - Removing the labeler from the sandbox. ### Additional context - ASF guidance: https://cwiki.apache.org/confluence/spaces/BUILDS/pages/321719166/GitHub+Actions+Security - DataFusion migration PR: apache/datafusion#26683 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
