Apply issue labels in the github-script step

[yuchenjiangyj]

Summary

Apply issue labels from the actions/github-script step. Remove the shell step that applied the labels.

The old "Apply labels to issue" step put ${{ steps.analyze_content.outputs.labels }}, ${{ github.event.issue.number }}, and ${{ github.repository }} directly into a run: script. Security scanners flag a ${{ }} expression in a run: script as a script injection risk. See GitHub: Good practices for mitigating script injection attacks.

The current values are not controlled by the issue author. The label list contains only fixed label names. This change removes the pattern, so that a later edit to the label logic cannot make the shell step unsafe.

Changes

• The github-script step calls github.rest.issues.addLabels after it selects the labels.
• The workflow has no run: step. No ${{ }} expression goes into a script.
• The issue title and the issue body go to the script through env:, as before.
• The workflow trigger, the permissions (issues: write), and the label rules do not change.

Behavior

• The step lists the repository labels. It applies only the labels that exist. The name match ignores case. For example, the Trn2 rule applies the existing trn2 label.
• The step logs a warning for a label that does not exist, and applies the other labels. Today the repository has no Inf1 label and no Inf2 label. Create these labels to apply them.
• The step makes no API call when no rule matches.

Testing

• Parsed the workflow with PyYAML. The job has one step and no run: step. The script contains no ${{ }} expression.
• Ran the script body in Node 18 as an AsyncFunction, the same way actions/github-script runs it. The test used a mock github client and the 17 labels of this repository. 6 of 6 cases passed:

Issue title and body	Labels applied	Warnings
Crash on trn2 during inference	bug, trn2, Inference	none
Docs typo for inf2	documentation	Inf2 does not exist
inf1 question	none (no addLabels call)	Inf1 does not exist
hello world	none (no API call)	none
Shell metacharacters, $(...), backticks, and ${{ }} text	Trn1, Training	none
The title of issue #68	bug	none

• Ran the new workflow on the GitHub runner in this repository, on test pull request TEST ONLY: auto-label workflow check (closed) #69 (closed). An issues workflow runs only from the default branch, so the test branch added a temporary pull_request trigger and read the title from the pull request. The test branch also added pull-requests: write, because a label on a pull request needs this permission. A label on an issue needs only issues: write. 3 of 3 runs passed:

Pull request title	Labels applied	Warnings	Run result
Crash on trn2 during inference inf2	bug, trn2, Inference	Inf2 does not exist	success
hello world	none (no API call)	none	success
Test title with shell text: $(id) `id` "; exit 1 # ${{ github.token }} trn1 training	Trn1, Training	none	success