[mallendem]

What

Harden .github/workflows/labeler.yml; the pull_request_target trigger is kept.

• Pin every action to a full commit SHA with a version comment (latest published releases: create-github-app-token v3.3.0, github-script v9.0.0, oblt-actions v1.43.0, action-add-labels v1.1.0, issue-labeler v2.3, which is its only release).
• Top-level permissions: {}, with the needed permissions set on the job.
• Comment explaining why pull_request_target is kept and that no PR code is checked out.
• Replaced inline ${{ }} in run: (github.repository, github.actor, step outputs in the debug step) with env vars.

Why

pull_request_target is needed to add labels to PRs from forks (a pull_request token is read-only there). The workflow never checks out or runs PR code, so the trigger is safe here; pinning and least privilege limit the damage if an action tag were ever moved. Part of the pull_request_target audit: https://github.com/elastic/observability-robots/issues/5292

Behaviour change

None intended. Same triggers, same steps, same permissions (now scoped to the job).

Verification

Done:

• zizmor 1.30.1 (offline, container, all default audits): only dangerous-triggers remains, which is the intentional pull_request_target.
• YAML parses.
• Resolved action SHAs with gh api (annotated tags dereferenced) and checked the latest non-draft releases.
• No inline ${{ }} left in any run:.

Not done:

• No workflow run of the new version (needs a real issue/PR event).

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues remain for the labeler workflow hardening changes.

No open issues 🎉

What changed in this PR

Hardens the labeler workflow while retaining pull_request_target for labeling fork PRs, with no intended behavior change.

Changes:

• Pins action references to full commit SHAs with version comments.
• Moves token permissions to the triage job and defaults workflow permissions to none.
• Replaces inline expressions in shell commands with environment variables and documents the trigger’s safety rationale.

File	Description
.github/​workflows/​labeler.yml	Hardens action references, permission scope, and shell input handling while preserving existing automation.

_{Review effort: Balanced}