replace labeler action with periodic-labeler

[xchapter7x]

this replaces the default labeler as it
does not label PRs from forks properly.

with periodic-labeler it should apply labels on
a cron to any PR and resolve the below bug:

#1092

[xchapter7x]

@jharshman @jpmcb

Thoughts on this PR as a fix for #1092 ?

[jpmcb]

LGTM 👍

[jharshman]

Not sure what I think about this. It's a Github Action created by a 3rd party. Does this give anyone else pause?

[xchapter7x]

fair point, @jharshman .

It is open source, so we can see exactly what it's doing here: https://github.com/paulfantom/periodic-labeler/blob/master/main.go
Doesn't seem to be leaking anything, just calling the Github API.

Also the container image used is distroless maintained by Google: https://github.com/GoogleContainerTools/distroless

We are pinning to a specific version of this Action, so it changing out from under us and compromising secrets somehow seems unlikely.

I guess we could fork it and maintain our own version of the Action, but that might be more burden than the risk is worth.

Your call :)

[jharshman]

We are pinning to a specific version of this Action, so it changing out from under us and compromising secrets somehow seems unlikely.

It's easy for a pinned version to get updated at some point in the future w/o undergoing another code review.

Can you add a comment in the action right above the image? It should indicate that if the version is to be updated, a code review of the 3rd party software should be performed to ensure that nothing malicious is going to be run.

[xchapter7x]

We are pinning to a specific version of this Action, so it changing out from under us and compromising secrets somehow seems unlikely.

It's easy for a pinned version to get updated at some point in the future w/o undergoing another code review.

Can you add a comment in the action right above the image? It should indicate that if the version is to be updated, a code review of the 3rd party software should be performed to ensure that nothing malicious is going to be run.

latest commit adds the requested comment. @jharshman

Let me know if there are any other concerns we should address :)

[jharshman]

There's still a flaw in this that makes me want to fork it.
There is nothing stopping a person from overwriting a tag. Let me know if I'm being too paranoid about this.
@xchapter7x @jpmcb

[xchapter7x]

There's still a flaw in this that makes me want to fork it.
There is nothing stopping a person from overwriting a tag. Let me know if I'm being too paranoid about this.
@xchapter7x @jpmcb

Agreed, the author of this action could retag and swap out the pinned version from under us.

The same, however, can be said for every go module or open source import.

Granted in go there is a go.sum to check if a modification happened somewhere in the chain, which guards against tag swapping. Which, as you point out, we're lacking here.

There is another aspect to this, in that its on the github marketplace. We can report wrong doing. We can see the code. We can subscribe and be notified when the code changes in the repo we're referencing. We can also see who the maintainers are, and in this case they seem to be associated with reputable companies and contributors to reputable OSS projects.

I see the risk as being rather low.

If tag swapping is a really high concern, we could consider pinning to a specific commit ref. That should work the same as pinning to a tag does, but i don't believe one can as easily swap that out from under us.

i'm guided by what you're comfortable with @jharshman :)

[jharshman]

@xchapter7x alrighty I think I'm good with this.
👍