FYI: Using the action like in the example would make you vulnerable to pwn requests

[ST-DDT]

The current run-nothing example is safe, but running anything in there that uses the source code is dangerous as it uses elevated permissions.
I'll recommend removing the example or raising awareness by adding a comment.

superset/.github/workflows/labeler.yml

Lines 20 to 21 in 6378ec5

	# echo "Running translation scripts"
	# # Generate .pot -> .po -> .json files

• https://securitylab.github.com/research/github-actions-preventing-pwn-requests
• Description seems dangerous actions/labeler#755 (comment)