[Zhibo Zhang (lindicaphxag-tech)]

Fixes #14438.

The Label pull request job is triggered with pull_request_target, but its github-app-auth environment has protected-branch rules that block fork PR runs before the job starts. The workflow only checks out the base SHA and already requests a narrowly scoped GitHub App token, so this removes that environment binding from the label job only.

The added workflow-level test keeps the pull_request_target trigger and verifies that this job does not regain the protected environment.

Validation:

• node --test .github/tests/*.js
• git diff --check

[Copilot]

🟡 Changes recommended

Removing the environment may hide the credentials and variables still required by the labeling job, leaving fork PRs unable to obtain a token.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Removes the protected environment from pull-request labeling and adds a regression test for the workflow trigger and environment configuration.

Changes:

• Removes github-app-auth from the labeling job.
• Adds a static workflow test.

File summaries

File	Description
.github/workflows/label-pr.yml	Updates the pull-request labeling job.
.github/tests/test_label_pr_workflow.js	Verifies the trigger and environment removal.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Zhibo Zhang (lindicaphxag-tech)]

Thanks for flagging this. The change removes the protected environment together with the GitHub App token-minting step. The remaining labeler uses the workflow-provided github.token, with explicit contents: read and pull-requests: write permissions; it no longer needs environment secrets or variables. The workflow stays on pull_request_target and does not check out or execute PR-head code. GitHub documents this event as the trusted-context option for fork labeling and triage, and recommends least-privilege token permissions: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target. I also confirmed this PR run's add_label check passed with the changed workflow. I therefore do not think a code change is needed for this comment; if you have a failing fork-run token log, please share it.

[Zhibo Zhang (lindicaphxag-tech)]

@microsoft-github-policy-service agree

[Zhibo Zhang (lindicaphxag-tech)]

Security/test follow-up on head a554795a: I fetched the exact PR-head workflow and regression test and ran node --test .github/tests/test_label_pr_workflow.js locally (1/1 passed). The pull_request_target add_label job also passed on this head. The repository GitHub automation tests workflow is currently action_required for this fork PR, so its hosted run needs maintainer approval; it is not a test failure. Could a maintainer approve that run and review the least-privilege token change?