From bfdf3c4acce3ad43ea44025fd9a4b44e0ecd1c2d Mon Sep 17 00:00:00 2001
From: Maximus7474 <the.maximus.7474@gmail.com>
Date: Wed, 16 Sep 2026 22:15:54 +0200
Subject: [PATCH 1/2] ci(pr-labeler): fix permissions for fork PRs with
 pull_request_target

---
 .github/workflows/pr-labeler.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index 937f7041..a9934f64 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -1,7 +1,7 @@
 name: PR Labeler
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
@@ -29,6 +29,8 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
           fetch-depth: 0
 
       - name: Check commits for breaking changes

From 0f3f3cb27635ce57f4dcfa086cb5e33fc34174ab Mon Sep 17 00:00:00 2001
From: Maximus7474 <the.maximus.7474@gmail.com>
Date: Wed, 16 Sep 2026 22:42:32 +0200
Subject: [PATCH 2/2] ci(pr-labeler): fetch commit messages via API to fix
 unsafe fork checkout

---
 .github/workflows/pr-labeler.yml | 44 ++++++++++++++------------------
 1 file changed, 19 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index a9934f64..ae3d07a8 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -26,36 +26,30 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: Fetch PR commit messages
+        id: check-breaking
+        uses: actions/github-script@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          fetch-depth: 0
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const pull_number = context.payload.pull_request.number;
 
-      - name: Check commits for breaking changes
-        id: check-breaking
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          echo "Scanning commits from $BASE_SHA to $HEAD_SHA..."
+            const commits = await github.paginate(
+              github.rest.pulls.listCommits,
+              { owner, repo, pull_number }
+            );
+
+            const commitMessages = commits
+              .map(c => `${c.commit.message}`)
+              .join('\n');
 
-          # Collect all commit messages in the PR
-          COMMITS=$(git log "$BASE_SHA".."$HEAD_SHA" --pretty=format:"%s %b")
+            console.log('PR Commit Messages:\n', commitMessages);
 
-          echo "Commit messages:"
-          echo "$COMMITS"
+            const regex = /BREAKING[ \t]+CHANGE|breaking[ \t]+change|!:|feat!|fix!|refactor!|perf!|chore!/i;
+            const found = regex.test(commitMessages);
 
-          # Check for breaking change indicators (Conventional Commits spec + common patterns)
-          if echo "$COMMITS" | grep -qiE \
-            'BREAKING[[:space:]]+CHANGE|breaking[[:space:]]+change|!:|feat!|fix!|refactor!|perf!|chore!'; then
-            echo "found=true" >> "$GITHUB_OUTPUT"
-            echo "Breaking change detected in commit messages."
-          else
-            echo "found=false" >> "$GITHUB_OUTPUT"
-            echo "No breaking changes detected."
-          fi
+            core.setOutput('found', found ? 'true' : 'false');
 
       - name: Add breaking-change label
         if: steps.check-breaking.outputs.found == 'true'