* Phase 1: distributed CODEOWNERS and automated reviewer routing (#4184)
- Replace the individual default CODEOWNERS owner with the core-maintainer
team and add domain team ownership for extensions, plugins, content,
hooks, workflows, .github, and eng.
- Add .github/review-routing.yml as the single source of truth for reviewer
pools, routes, labels, and SLA settings (ships in dry-run mode).
- Add eng/review-routing.mjs (+ unit tests) with business-day math,
least-loaded reviewer selection, routing and escalation planning, and
workflow_run artifact validation.
- Add Review Routing (workflow_run/dispatch/schedule), Review Routing Request
(read-only needs-reviewer reader), and Review Escalation (weekday schedule)
workflows.
- Add needs-reviewer, review-overdue, review-escalated to setup-labels.
- Document the model in docs/maintainers/review-routing.md.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address review feedback on reviewer routing and escalation
- Escalate at routedOn + escalation business days (Mon -> Fri)
- Leave labels untouched when requestReviewers fails and fail the job
- Serialize read/plan/apply per PR across routing and escalation
- Treat Label PR Intent artifact labels as authoritative
- Re-route to an uncovered pool on head changes without restarting SLA
- Use the due-label timestamp as the review boundary
- Fall back to pool/escalation teams and report what was requested
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address second-round review feedback on review routing (#4184)
- CODEOWNERS: route /hooks/ and /workflows/ to content reviewers, drop the
separate /.github/workflows/ rule, and leave per-resource owner lines as on
main (their removal is deferred to a separate cleanup).
- Routing: ignore pending requests for unavailable reviewers when checking
coverage; needs-reviewer excludes prior reviewers and changes nothing when no
new reviewer can be requested.
- Escalation comments show the actual routing date.
- Cap sweep matrices at 256 targets and defer the remainder.
- Docs: best-effort load balancing, matrix cap, and needs-reviewer semantics.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Route workflow and hooks labels to the content pool (#4184)
Drop the workflow-security reviewer pool per maintainer feedback: agentic
workflows and hooks are reviewed like other content, and the repository's
own GitHub Actions workflows stay with core maintainers.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Pin routing contract in tests; make CONTRIBUTING routing note dry-run aware
- Assert the exact label-to-pool mapping and priority order, pool set, and default/escalation pools for the shipped config.
- CONTRIBUTING.md: describe automatic routing as active only once dry_run is turned off.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Simplify dry_run validation condition
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Aaron Powell <me@aaron-powell.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: Allow label operations on pull requests in external plugin approval workflow
The sync-merged-pr-labels job needs pull-requests: write permission to
add/remove labels on merged PRs. Previously it only had issues: write which
is for issues, not pull requests. This fixes the permission error when
workflows try to modify PR labels from a non-contributor account.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: Handle 403 permission errors when creating external plugin intake labels
When running on PRs from fork contributors, the GitHub token may not have
permission to create labels in the repository. This is expected and should
not cause the workflow to fail. Allow the ensureLabel function to gracefully
handle 403 Forbidden errors in addition to 422 (label already exists) errors.
This fixes the sync-pr-state job failure in external-plugin-pr-quality-gates.yml
when run on PRs from external contributors.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* refactor: Centralize label management into a single workflow_dispatch workflow
Create a new 'setup-labels' workflow that is manually dispatched and handles
all label creation and updates. This workflow:
- Creates all labels used by the repository
- Updates descriptions if labels already exist
- Reports success/failure counts
- Fails if any labels cannot be created
All individual workflows now assume labels exist and will fail (loudly) if
they don't. This makes it clear to maintainers when the setup-labels workflow
needs to be dispatched:
- label-pr-intent.yml
- skill-check-comment.yml
- external-plugin-approval-command.yml
- external-plugin-command-router.yml
- external-plugin-rereview.yml
- external-plugin-rereview-command.yml
- eng/external-plugin-intake-state.mjs
This approach is better because:
- Single source of truth for label definitions
- Avoids permission issues with fork contributors
- Clear failure modes when labels are missing
- Easier to maintain consistent label configuration
- No more scattered label creation logic across workflows
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove unused ensureLabel methods and managedLabels constants
Labels are now centrally managed by the setup-labels workflow and
assumed to exist in all other workflows. Removed:
- ensureLabel() methods from all 6 workflows and 1 JS module
- managedLabels constants that were only used by ensureLabel
- Promise.all() calls that invoked ensureLabel for each label
- Updated syncManagedLabels in skill-check-comment.yml to remove ensureLabel call
All workflows now assume labels exist and will fail if they don't,
which is the desired behavior—it signals maintainers to dispatch the
setup-labels workflow when new labels need to be created.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
