andygrove opened a new issue, #2773: URL: https://github.com/apache/datafusion-ballista/issues/2773
**Is your feature request related to a problem or challenge? Please describe what you are trying to do.** GitHub will block the `pull_request_target` trigger by default on public repositories from December 2, 2026, with brownouts before that ([changelog](https://github.blog/changelog/2026-11-02-pull_request_target-blocked-by-default-december-2/)). ASF infra is also disabling the trigger for ASF repositories ([policy](https://infra.apache.org/github-actions-policy.html)). Upstream tracking issue: apache/datafusion#26406. `.github/workflows/dev_pr.yml` (the "Labeler" workflow) runs `actions/labeler` on `pull_request_target`. Once the trigger is blocked, pull requests, including ones from forks, stop getting path labels automatically. **Describe the solution you'd like** Move to the two-workflow pattern that apache/datafusion#26683 uses: 1. A `pull_request` workflow with no write access records the PR number (and the changed paths, if needed) and uploads it as an artifact. 2. A `workflow_run` workflow, triggered when the first one completes, runs in the base repository context with `pull-requests: write`, reads the artifact, and applies the labels from `.github/workflows/dev_pr/labeler.yml`. It treats the artifact as untrusted data and never checks out or runs PR code. **Describe alternatives you've considered** - A GitHub App such as [Boring Cyborg](https://github.com/kaxil/boring-cyborg), which ASF infra suggests for labeling. - Dropping automatic labeling and labeling by hand. **Additional context** - ASF guidance: https://cwiki.apache.org/confluence/spaces/BUILDS/pages/321719166/GitHub+Actions+Security - DataFusion migration PR: apache/datafusion#26683 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
