From f0762b846b49b19aa9b955e51ae56aba531671c8 Mon Sep 17 00:00:00 2001
From: Tony <TonyRL@users.noreply.github.com>
Date: Wed, 20 May 2026 19:13:32 +0800
Subject: [PATCH] chore: replace actions-cool/issues-helper with
 actions/github-script

refs: https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials
---
 .github/workflows/docker-test-cont.yml | 41 +++++++++++++++++---------
 .github/workflows/docker-test.yml      | 14 +++++----
 2 files changed, 36 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/docker-test-cont.yml b/.github/workflows/docker-test-cont.yml
index aa12e7f8da..71de05f45b 100644
--- a/.github/workflows/docker-test-cont.yml
+++ b/.github/workflows/docker-test-cont.yml
@@ -141,12 +141,16 @@ jobs:
 
             - name: Pull Request Labeler
               if: ${{ failure() }}
-              uses: actions-cool/issues-helper@200c78641dbf33838311e5a1e0c31bbdb92d7cf0 # v3.8.0
+              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
               with:
-                  actions: 'add-labels'
-                  token: ${{ secrets.GITHUB_TOKEN }}
-                  issue-number: ${{ steps.source-run-info.outputs.number }}
-                  labels: 'auto: DO NOT merge'
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  script: |
+                      await github.rest.issues.addLabels({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: ${{ steps.source-run-info.outputs.number }},
+                          labels: ['auto: DO NOT merge'],
+                      })
 
             - name: Print Docker container logs
               if: ${{ always() }}
@@ -177,17 +181,26 @@ jobs:
                     >> "${GITHUB_OUTPUT}"
 
             - name: Pull Request Labeler
-              uses: actions-cool/issues-helper@200c78641dbf33838311e5a1e0c31bbdb92d7cf0 # v3.8.0
+              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
               with:
-                  actions: 'add-labels'
-                  token: ${{ secrets.GITHUB_TOKEN }}
-                  issue-number: ${{ steps.source-run-info.outputs.number }}
-                  labels: 'auto: DO NOT merge'
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  script: |
+                      await github.rest.issues.addLabels({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: ${{ steps.source-run-info.outputs.number }},
+                          labels: ['auto: DO NOT merge'],
+                      })
 
             - name: Close broken PR
               if: ${{ steps.source-run-info.outputs.author_association != 'OWNER' && steps.source-run-info.outputs.author_association != 'COLLABORATOR' && steps.source-run-info.outputs.author_association != 'MEMBER' }}
-              uses: actions-cool/issues-helper@200c78641dbf33838311e5a1e0c31bbdb92d7cf0 # v3.8.0
+              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
               with:
-                  actions: 'close-issue'
-                  token: ${{ secrets.GITHUB_TOKEN }}
-                  issue-number: ${{ steps.source-run-info.outputs.number }}
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  script: |
+                      await github.rest.issues.update({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: ${{ steps.source-run-info.outputs.number }},
+                          state: 'closed',
+                      })
diff --git a/.github/workflows/docker-test.yml b/.github/workflows/docker-test.yml
index 9c5f8724a0..470222f3d4 100644
--- a/.github/workflows/docker-test.yml
+++ b/.github/workflows/docker-test.yml
@@ -55,12 +55,16 @@ jobs:
 
             - name: Pull Request Labeler
               if: ${{ failure() }}
-              uses: actions-cool/issues-helper@200c78641dbf33838311e5a1e0c31bbdb92d7cf0 # v3.8.0
+              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
               with:
-                  actions: 'add-labels'
-                  token: ${{ secrets.GITHUB_TOKEN }}
-                  issue-number: ${{ github.event.pull_request.number }}
-                  labels: 'auto: DO NOT merge'
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  script: |
+                      await github.rest.issues.addLabels({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: ${{ github.event.pull_request.number }},
+                          labels: ['auto: DO NOT merge'],
+                      })
 
             - name: Test Docker image
               run: bash scripts/docker/test-docker.sh