ci: update of files from global .github repo

[asyncapi-bot]

Summary by CodeRabbit

• Chores
  • Improved GitHub Actions workflow security by restricting permissions to minimum required scopes.
  • Enhanced bot detection logic in automated approval workflow for more accurate identification.

[coderabbitai]

📝 Walkthrough

Walkthrough

Two GitHub workflow files are updated: the label removal workflow is hardened with trigger change from pull_request to pull_request_target and permission tightening at workflow and job levels; the automerge workflow's bot detection logic is fixed to identify bots via github.event.pull_request.user.login instead of github.actor.

Changes

Automerge Automation Updates

Layer / File(s)	Summary
Label removal workflow security hardening .github/workflows/automerge-for-humans-remove-ready-to-merge-label-on-edit.yml	Trigger switched from pull_request to pull_request_target with synchronize and edited events. Workflow-level permissions: {} added for zero default scopes, then job-level permissions narrowed to only pull-requests: write (removed issues: write).
Bot detection logic fix .github/workflows/automerge.yml	Autoapprove-for-bot job condition now uses github.event.pull_request.user.login instead of github.actor to identify PR author as a bot, preserving the released label exclusion.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Suggested labels

autoapproved, autoupdate

Suggested reviewers

• lorenzsimon
• gimlet2
• asyncapi-bot-eve

Poem

🐰 The workflows now dance with tighter reins,
pull_request_target brings security gains,
Permissions trimmed, bot logic refined,
Automation flows smoother, so well-designed!
Merges and labels, all orchestrated true,
Here's to safe automation—hop-hop-hooray! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main changes—updating CI workflow files from a global repository with security and permission improvements.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bot/update-files-from-global-repo

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/automerge-for-humans-remove-ready-to-merge-label-on-edit.yml (1)

20-21: ⚠️ Potential issue | 🟠 Major

Add issues: write alongside pull-requests: write for issues.removeLabel on PRs

.github/workflows/automerge-for-humans-remove-ready-to-merge-label-on-edit.yml grants only pull-requests: write (lines 20-21) but calls github.rest.issues.removeLabel() (around lines 32-35) to remove a label from a PR. Other workflows in this repo that use the same github.rest.issues.removeLabel() endpoint grant both issues: write and pull-requests: write (e.g., microgrant-program-commands.yml remove-label-microgrant and bounty-program-commands.yml remove-label-bounty). Add issues: write here to avoid permission failures at runtime.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
@.github/workflows/automerge-for-humans-remove-ready-to-merge-label-on-edit.yml
around lines 20 - 21, The workflow file is missing the required `issues: write`
permission for the `github.rest.issues.removeLabel()` call that removes a label
from the PR. In the permissions section (around lines 20-21), add `issues:
write` alongside the existing `pull-requests: write` permission to ensure the
workflow has sufficient permissions to execute the label removal operation at
runtime.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In
@.github/workflows/automerge-for-humans-remove-ready-to-merge-label-on-edit.yml:
- Around line 20-21: The workflow file is missing the required `issues: write`
permission for the `github.rest.issues.removeLabel()` call that removes a label
from the PR. In the permissions section (around lines 20-21), add `issues:
write` alongside the existing `pull-requests: write` permission to ensure the
workflow has sufficient permissions to execute the label removal operation at
runtime.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e1719bfe-79df-482e-849f-70d67254cc98

📥 Commits

Reviewing files that changed from the base of the PR and between 752cff9 and eb7bbcd.

📒 Files selected for processing (2)

• .github/workflows/automerge-for-humans-remove-ready-to-merge-label-on-edit.yml
• .github/workflows/automerge.yml

💤 Files with no reviewable changes (1)

• .github/workflows/automerge.yml