To be honest, I'm not sure what the point of the labeler action is considering labels often have to be added/updated manually. I'd just drop it and keep Dependabot to make it easier to keep track of the dependencies :-)

Turns out GHActions where pull_request_target is used are capable of pwning repositories: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

labeler doesn't check out the source code or build anything so it's safe in its current form but to avoid surprises let's just pin it to the latest version. It's annoying to manage dependencies like this manually so additionally dependabot.yml is introduced to make it easier to keep GHActions up to date more or less automatically: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot

Hah. I didn't know you can use Dependabot for GH Actions, nice! That's definitely something we should have.

To be honest, I'm not sure what the point of the labeler action is considering labels often have to be added/updated manually. I'd just drop it and keep Dependabot to make it easier to keep track of the dependencies :-)

It mostly gets things right for categorization, although with occasional mishaps. So I'd like to keep it, as it's nice to have things labelled for later easy searches

So I'd like to keep it, as it's nice to have things labelled for later easy searches

@bluca got it. Let's keep it then.