enforce-labels.yml

name: Enforce Labels
on:
  # Runs the base branch's copy, so a PR can't weaken its own label gate.
  # Never check out or run PR code here.
  # zizmor: ignore[dangerous-triggers] reads labels only, never checks out PR code
  pull_request_target:
    types: [labeled, unlabeled, opened, synchronize]

permissions:
  # Enough while add_comment stays at its default of false.
  pull-requests: read

jobs:
  docs:
    runs-on: ubuntu-latest
    steps:
      - uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5
        with:
          mode: exactly
          count: 1
          labels: "docs: needed, docs: skip"