🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

1. 🔵 Untrusted issue events can trigger GitHub App token to create repository labels (label sync)

Description

The Auto response workflow runs on untrusted, user-controlled events (issues opened/edited and issue_comment created) while minting a GitHub App installation token from repository secrets and using it to perform repo-wide write operations.

With the newly added label-sync logic, any user who can open/edit an issue can cause the workflow to attempt repository label creation (not just labeling that issue):

• Triggers include issues (opened, edited) and issue_comment (created), which can be initiated by arbitrary GitHub users in public repos.
• The workflow creates a GitHub App token using secrets.GH_APP_PRIVATE_KEY* and passes it to actions/github-script.
• New helper ensureLabelExists() calls github.rest.issues.createLabel(...) when a label is missing.

While the label names/descriptions are currently hard-coded (limiting impact), this still expands the attack surface for privileged automation on untrusted events and enables label/metadata pollution if labels are absent, without any actor trust/authorization check.

Vulnerable code (repo label creation on untrusted events):

on:
  issues:
    types: [opened, edited, labeled]
  issue_comment:
    types: [created]

await github.rest.issues.createLabel({
  owner: context.repo.owner,
  repo: context.repo.repo,
  name,
  color,
  description,
});

Recommendation

Mitigate by removing repo-global mutation from untrusted triggers, or gate it behind trusted actors.

Options (choose one or combine):

1. Do not auto-create labels on issue events. Pre-create labels manually and remove createLabel fallback:

​// Instead of createLabel, just return if missing.
try {
  await github.rest.issues.getLabel({ owner, repo, name });
} catch (e) {
  if (e?.status === 404) return; // don't create from untrusted event
  throw e;
}

2. Gate label creation/sync to trusted users only, e.g. only if the issue author is a collaborator/member/owner:

const assoc = context.payload.issue?.author_association;
const trusted = ["OWNER","MEMBER","COLLABORATOR"].includes(assoc);
if (!trusted) return;

3. Split workflows: keep issue_comment auto-responses in a workflow that does not mint an App token and has minimal permissions; run label-sync in a separate workflow triggered only by maintainers (e.g., workflow_dispatch or issues.labeled with a maintainer-only label).

Also consider reducing job permissions to the minimum needed (e.g., drop pull-requests: write if not required in this job) and avoid using long-lived App private keys on events that any user can trigger.

Analyzed PR: #30733 at commit fbcf724

Greptile Summary

This PR consolidates bug reporting into a single issue template with a required Bug type dropdown (Regression/Crash/Behavior bug) and adds GitHub Actions automation to normalize bug subtype labels. The changes eliminate the separate regression template, reducing template fragmentation and ensuring consistent labeling for triage workflows.

Key changes:

• Merged regression template into the main bug template with a required bug-type dropdown
• Added syncBugSubtypeLabel automation that extracts the dropdown value, maps it to the correct label (regression, bug:crash, or bug:behavior), and ensures mutual exclusivity by removing conflicting subtype labels
• Workflow creates missing labels with proper colors/descriptions and handles edge cases safely (no-op for invalid/missing values)

Implementation notes:

• Label sync runs on issue opened and edited events, not on labeled events—manual label changes won't auto-correct until the next edit, which appears intentional to avoid fighting manual corrections
• Error handling is defensive with proper 404 checks for missing labels
• The form value extraction uses robust regex with proper escaping and returns the first non-empty line from the markdown section

Confidence Score: 5/5

• This PR is safe to merge with minimal risk—it's infrastructure-only automation for issue templates and labeling
• Score reflects well-structured defensive code with proper error handling, limited scope (GitHub issue forms and workflows only), no runtime/product changes, safe no-op behavior for invalid input, and thorough PR documentation. The automation is backward compatible and the logic correctly maps dropdown values to labels with mutual exclusivity enforcement.
• No files require special attention

_{Last reviewed commit: 869243d}

PR #30733 - Issues: unify bug form and subtype auto-labeling (#30733)

Merged via squash.

• Merge commit: ff563ee
• Verified: pnpm build, pnpm check, pnpm test:macmini
• Changes made:
  M .github/ISSUE_TEMPLATE/bug_report.yml
  D .github/ISSUE_TEMPLATE/regression_bug_report.yml
  M .github/workflows/auto-response.yml
  M CHANGELOG.md
• Why these changes were made:
  Consolidate bug intake into a single form with explicit bug type selection and deterministic subtype labels to improve issue triage/filter accuracy and reduce regression misrouting.
• Changelog: CHANGELOG.md updated=true required=true opt_out=false

Thanks @Takhoffman!