bug: "documentation" tag not being applied to PRs

[c-ehrlich]

Provide environment information

n/a

Describe the bug

Some PRs to the website/docs are not automatically getting the "Documentation" label.

Examples:

• fix: docs TypeError #544
• feat(hero): redesign #528
• fix: docs scrollbar behavior #527

Examples of PRs that do have the tag:

• fix: typo in tailwind docs #539
• docs(vercel): add screenshots for vercel guide #524
• docs(tailwind): change docs for formatting tw classes #521
• docs: update prisma section on why page based on #402 feedback #518

It seems like PRs that include changes to .md files get the tag, but PRs that only touch other parts of the website/docs do not.

To reproduce

Open a PR that changes only non-.md website files (not 100% sure this is the pattern, but based on checking a few PRs it seems so)

Additional information

No response

[juliusmarminge]

I think #551 resolves this

[c-ehrlich]

Still seems bugged, but now in a different way #559

I think this might be a solution, but I don't know if it might break other things. Will give it a try actions/labeler#399

[juliusmarminge]

Still seems bugged, but now in a different way #559

I think this might be a solution, but I don't know if it might break other things. Will give it a try actions/labeler#399

is it something to do with forks? I never have that issue when PRing from local branches?

[c-ehrlich]

Still seems bugged, but now in a different way #559
I think this might be a solution, but I don't know if it might break other things. Will give it a try actions/labeler#399

is it something to do with forks? I never have that issue when PRing from local branches?

Yes, it seems to an issue related to PRs from forks.

Based on my research so far:

• it can be resolved by running the action on pull_request_target instead of pull_request
• however this is a security risk as pull_request_target has full read/write access, which shouldn't be granted when you use actions/checkout (reference: https://nathandavison.com/blog/github-actions-and-the-threat-of-malicious-pull-requests)
• we could split it into two actions groups, one with the labeler on pull_request_target and the other with everything else on pull_request, but we would have to find a way to still make build-t3-app conditional on the labeler

[juliusmarminge]

we could split it into two actions groups, one with the labeler on pull_request_target and the other with everything else on pull_request, but we would have to find a way to still make build-t3-app conditional on the labeler

Yea you can only check steps from the same workflow file right?

[c-ehrlich]

I tried using on: workflow_run in #560 but didnt it to work so far