Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests | GitHub Security Lab

    # Only as a temporary fix.
    on:
      pull_request_target:
        types: [labeled]

    jobs:
      build:
        name: Build and test
        runs-on: ubuntu-latest
        if: contains(github.event.pull_request.labels.*.name, 'safe to test')