Files
awesome-copilot/.github/workflows/setup-labels.yml
T
James MontemagnoandCopilot App d6131471b8 Phase 2: submission-gate, risk tiers, and PR status state machine (#4184) (#4190)
* Add submission-gate check, merge-risk tiers, and PR status state machine (#4184)

Phase 2 (enforcement) of github/awesome-copilot#4184:
- submission-gate aggregate required check (reader) with infra vs contribution failure classification
- merge-risk:low/medium/high classification from .github/risk-tiers.yml with tier approval policy
- Submission Gate Writer maintaining state labels and a persistent status comment
- /rerun-checks and /request-review PR commands
- validate-skills and validate-submission-gate workflows, unit tests, and maintainer docs

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Fix codespell findings and add spelling to submission gate checks

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Harden submission gate per review feedback

- Publish the submission-gate check from the trusted writer via the Checks API
  and flag any other submission-gate check run as tampering
- Fail closed on truncated file lists, unscannable diffs, permission lookup
  errors, and skipped required checks
- Discard evaluations when the PR head or reviews change mid-run
- Low tier requires a resource owner approval
- Commands must start the comment, matching the workflow filter

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Address #4190 review: command reader/writer, pools, paths, staleness

- Split /rerun-checks and /request-review into a read-only issue_comment
  reader and a workflow_run writer that re-reads the comment, PR, and
  permission before writing.
- Drop the workflow-security pool; agentic workflows and hooks are
  content (medium unless they add scripts or hook commands); the core
  pool is core-maintainers.
- Include each check's workflow file and eng scripts in its paths.
- Discard evaluations when the base branch or risk labels change; run
  the gate on PR edits (retargeting).
- Correct copies of the writer's check that claim success while the
  evaluation fails.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Fail closed on lost contributor signal; publish gate check before labels

- A contributor check whose pr-check job succeeded but whose result artifact
  is missing or unreadable is now an infrastructure failure, so a lost HIGH
  signal can't lower the approval tier.
- Publish the submission-gate check right after stale-state revalidation;
  label and comment sync are independent and reported afterwards.
- Revert the self-path added to validate-agentic-workflows-pr.yml's trigger:
  that workflow rejects any .github change. Exempt it in the drift test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Fail closed on bad routing config; advisory checks never hold the gate

- loadGateConfig: a missing review-routing.yml still falls back, but a
  file that can't be parsed (or whose pools isn't a mapping) now throws
  instead of silently relaxing approvals.
- Pending required: false checks no longer keep the PR in
  awaiting-automation or the gate check in progress, and the polling loop
  doesn't wait on them. They render as pending (advisory).
- PR commands: 👀 marks a command as claimed; 🚀 is written only after
  the reply is posted and is the only replay guard, so a run that failed
  partway can be retried.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Fix codespell: unparseable -> unparsable

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-10-01 11:39:09 +10:00

180 lines
6.6 KiB
YAML

name: Setup Repository Labels
on:
workflow_dispatch
permissions:
issues: write
jobs:
setup-labels:
runs-on: ubuntu-latest
steps:
- name: Create or update labels
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
with:
script: |
const labels = {
// Intent labels for PR categorization
'skills': {
color: '1D76DB',
description: 'PR touches skills'
},
'plugin': {
color: '5319E7',
description: 'PR touches plugins'
},
'agent': {
color: '0E8A16',
description: 'PR touches agents'
},
'instructions': {
color: 'FBCA04',
description: 'PR touches instructions'
},
'new-submission': {
color: '006B75',
description: 'PR adds at least one new contribution'
},
'website-update': {
color: '0052CC',
description: 'PR touches website content or code'
},
'external-plugin': {
color: 'FEF2C0',
description: 'Public external plugin submission'
},
'external-plugin-canvas': {
color: '1D76DB',
description: 'External plugin submission includes a canvas extension'
},
'hooks': {
color: 'C2E0C6',
description: 'PR touches hooks'
},
'workflow': {
color: 'BFD4F2',
description: 'PR touches workflow automation'
},
// External plugin intake state labels
'awaiting-review': {
color: 'FBCA04',
description: 'Submission is waiting for automated intake validation'
},
'ready-for-review': {
color: '0E8A16',
description: 'Submission passed intake validation and is ready for maintainer review'
},
'requires-submitter-fixes': {
color: 'D93F0B',
description: 'Submission has quality-gate findings that submitter must fix before maintainer review'
},
'approved': {
color: '1D76DB',
description: 'Submission was approved by a maintainer'
},
'rejected': {
color: 'B60205',
description: 'Submission was rejected by a maintainer'
},
// Re-review labels
'removed': {
color: 'B60205',
description: 'External plugin was removed from the marketplace after re-review'
},
're-review-follow-up': {
color: 'D4C5F9',
description: 'Six-month re-review needs maintainer follow-up before a final decision'
},
'awaiting-approval': {
color: 'FBCA04',
description: 'External plugin awaiting maintainer approval'
},
// Submission gate labels (docs/maintainers/submission-gate.md).
// ready-for-review, requires-submitter-fixes, and approved are shared with intake above.
'awaiting-automation': {
color: 'FBCA04',
description: 'PR is waiting for automated checks to finish'
},
'review-in-progress': {
color: '5319E7',
description: 'PR checks passed and a maintainer review is in progress'
},
'merge-risk:low': {
color: 'C2E0C6',
description: 'Merge risk tier: low (docs, metadata, or small resource update)'
},
'merge-risk:medium': {
color: 'FEF2C0',
description: 'Merge risk tier: medium (new or substantially changed resource)'
},
'merge-risk:high': {
color: 'F9D0C4',
description: 'Merge risk tier: high (automation, scripts, MCP, hooks, or review policy)'
},
// Review routing labels (see .github/review-routing.yml)
'needs-reviewer': {
color: 'D4C5F9',
description: 'Request automated reviewer routing for this PR'
},
'review-overdue': {
color: 'E99695',
description: 'First review is past its due date; a backup reviewer was requested'
},
'review-escalated': {
color: 'B60205',
description: 'Review escalated to the core-maintainer pool'
}
};
let created = 0;
let updated = 0;
let failed = 0;
for (const [name, config] of Object.entries(labels)) {
try {
await github.rest.issues.createLabel({
owner: context.repo.owner,
repo: context.repo.repo,
name,
color: config.color,
description: config.description
});
created++;
core.info(`✓ Created label: ${name}`);
} catch (error) {
if (error.status === 422) {
// Label already exists, try to update it
try {
await github.rest.issues.updateLabel({
owner: context.repo.owner,
repo: context.repo.repo,
name,
color: config.color,
description: config.description
});
updated++;
core.info(`✓ Updated label: ${name}`);
} catch (updateError) {
failed++;
core.error(`✗ Failed to update label ${name}: ${updateError.message}`);
}
} else {
failed++;
core.error(`✗ Failed to create label ${name}: ${error.message}`);
}
}
}
core.info(`
Label setup complete:
- Created: ${created}
- Updated: ${updated}
- Failed: ${failed}
- Total: ${Object.keys(labels).length}
`);
if (failed > 0) {
throw new Error(`Failed to setup ${failed} label(s)`);
}