Refactor slash-commands workflow for improved clarity and security

[riaankleinhans]

• Updated comments for better understanding of the workflow structure.
• Adjusted permissions to explicitly define access levels for contents, issues, and pull requests.
• Simplified the condition for dispatching slash commands.
• Updated the labeler action reference to use the latest version from cncf/automation.
• Enhanced the handling of repository and issue details for better accuracy.

This change aligns with recent updates to improve workflow security and maintainability.

[kusari-inspector]

Kusari Analysis Results:

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

The dependency analysis found no issues. However, the code analysis identified a least-privilege violation in .github/workflows/slash-commands.yml: 'issues: write' and 'pull-requests: write' permissions are declared at the workflow level rather than scoped to the specific job that requires them. This unnecessarily exposes all jobs in the workflow to broad write permissions. If any job in this workflow were compromised (e.g., via a malicious dependency or injected input), an attacker could leverage these inherited write permissions to tamper with issues or pull requests. The fix is straightforward: move the write permissions down to the specific job (dispatch-slash-command) that needs them, and set the top-level permissions block to read-only (contents: read). This must be addressed before merging.

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Code Mitigations

Move write permissions from the workflow level to the specific job level. Keep the top-level permissions block minimal (read-only) and add the required write permissions directly under the job that needs them.

• Location: .github/workflows/slash-commands.yml:23

• Potential Code Fix:

permissions:
  contents: read

jobs:
  dispatch-slash-command:
    name: Dispatch Slash Command
    permissions:
      issues: write
      pull-requests: write

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 7548223, performed at: 2026-05-02T20:29:12Z

Found this helpful? Give it a 👍 or 👎 reaction!

[kusari-inspector]

Issue: Move write permissions from the workflow level to the specific job level. Keep the top-level permissions block minimal (read-only) and add the required write permissions directly under the job that needs them.

Recommended Code Changes:

permissions:
  contents: read

jobs:
  dispatch-slash-command:
    name: Dispatch Slash Command
    permissions:
      issues: write
      pull-requests: write