Adds size labeler GitHub action

[jpmcb]

Adds the size labeler GitHub action.

This helps maintainers eyeball how big a PR is and how much effort should go into reviewing it.

Please see #1603 for more info

[marckhouzam]

For helm, it seemed that there was an issue using the GH action because the token didn't have permissions to modify PRs coming from forks. But I haven't tried it myself.

I've found this issue that seems to confirm the problem although it also hints that using the pull_request_target may be the solution: CodelyTV/pr-size-labeler#8

We may need to test it using a fork from someone that does not have write permissions on Cobra.

[jpmcb]

Ah yes! Good call - I found an example that seems to be working that uses pull_request_target

Updated the PR

[marckhouzam]

I've followed-up with the helm community about this.
There were security concerns in giving a github token with write permissions, as a PR could use that token to do things it shouldn't. Because of those concerns it was chosen to use this bot instead https://github.com/apps/pull-request-size

Opinions?

[jpmcb]

There were security concerns in giving a github token with write permissions

That shouldn't be a concern with the way this PR is written. From the GitHub docs:

This event runs in the context of the base of the pull request, rather than in the context of the merge commit, as the pull_request event does. This prevents execution of unsafe code from the head of the pull request that could alter your repository or steal any secrets you use in your workflow

Warning: For workflows that are triggered by the pull_request_target event, the GITHUB_TOKEN is granted read/write repository permission unless the permissions key is specified and the workflow can access secrets, even when it is triggered from a fork. Although the workflow runs in the context of the base of the pull request, you should make sure that you do not check out, build, or run untrusted code from the pull request with this event.

Reg github docs

I believe this is safe since this action would only modify a label, not checkout code from the head of the remote fork and attempt to build or execute on it.

The only concern would be using an untrustworthy action in this manner. Since we would be giving remote write/read access with the pull_request_target method, we need to vet those actions aren't doing anything suspicious. I've reviewed the codelytv/pr-size-labeler action and it seems fine. Anytime we bump an action version we should make sure to checkup on it so we don't pollute the secure supply chain:

I've pushed to lock our version of this to v1.8.0 (the latest release which I reviewed)

[marckhouzam]

LGTM
Thanks for the explanation