Merge pull request #495 from zeroclaw-labs/feat/manual-label-governance-dispatch
feat(labels): add manual audit/repair dispatch for managed labels
This commit is contained in:
Chummy
GitHub
commit
ffb6a790ef
5 changed files with 142 additions and 11 deletions
87
.github/workflows/labeler.yml
vendored
87
.github/workflows/labeler.yml
vendored
|
|
@ -3,9 +3,19 @@ name: PR Labeler
|
|||
on:
|
||||
pull_request_target:
|
||||
types: [opened, reopened, synchronize, edited, labeled, unlabeled]
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
mode:
|
||||
description: "Run mode for managed-label governance"
|
||||
required: true
|
||||
default: "audit"
|
||||
type: choice
|
||||
options:
|
||||
- audit
|
||||
- repair
|
||||
|
||||
concurrency:
|
||||
group: pr-labeler-${{ github.event.pull_request.number }}
|
||||
group: pr-labeler-${{ github.event.pull_request.number || github.run_id }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
|
|
@ -19,6 +29,7 @@ jobs:
|
|||
timeout-minutes: 10
|
||||
steps:
|
||||
- name: Apply path labels
|
||||
if: github.event_name == 'pull_request_target'
|
||||
uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
|
||||
continue-on-error: true
|
||||
with:
|
||||
|
|
@ -497,6 +508,80 @@ jobs:
|
|||
return matchedTier ? matchedTier.label : null;
|
||||
}
|
||||
|
||||
if (context.eventName === "workflow_dispatch") {
|
||||
const mode = (context.payload.inputs?.mode || "audit").toLowerCase();
|
||||
const shouldRepair = mode === "repair";
|
||||
const repoLabels = await github.paginate(github.rest.issues.listLabelsForRepo, {
|
||||
owner,
|
||||
repo,
|
||||
per_page: 100,
|
||||
});
|
||||
|
||||
let managedScanned = 0;
|
||||
const drifts = [];
|
||||
|
||||
for (const existingLabel of repoLabels) {
|
||||
const labelName = existingLabel.name || "";
|
||||
if (!isManagedLabel(labelName)) continue;
|
||||
managedScanned += 1;
|
||||
|
||||
const expectedColor = colorForLabel(labelName);
|
||||
const expectedDescription = descriptionForLabel(labelName);
|
||||
const currentColor = (existingLabel.color || "").toUpperCase();
|
||||
const currentDescription = (existingLabel.description || "").trim();
|
||||
if (currentColor !== expectedColor || currentDescription !== expectedDescription) {
|
||||
drifts.push({
|
||||
name: labelName,
|
||||
currentColor,
|
||||
expectedColor,
|
||||
currentDescription,
|
||||
expectedDescription,
|
||||
});
|
||||
if (shouldRepair) {
|
||||
await ensureLabel(labelName, existingLabel);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
core.summary
|
||||
.addHeading("Managed Label Governance", 2)
|
||||
.addRaw(`Mode: ${shouldRepair ? "repair" : "audit"}`)
|
||||
.addEOL()
|
||||
.addRaw(`Managed labels scanned: ${managedScanned}`)
|
||||
.addEOL()
|
||||
.addRaw(`Drifts found: ${drifts.length}`)
|
||||
.addEOL();
|
||||
|
||||
if (drifts.length > 0) {
|
||||
const sample = drifts.slice(0, 30).map((entry) => [
|
||||
entry.name,
|
||||
`${entry.currentColor} -> ${entry.expectedColor}`,
|
||||
`${entry.currentDescription || "(blank)"} -> ${entry.expectedDescription}`,
|
||||
]);
|
||||
core.summary.addTable([
|
||||
[{ data: "Label", header: true }, { data: "Color", header: true }, { data: "Description", header: true }],
|
||||
...sample,
|
||||
]);
|
||||
if (drifts.length > sample.length) {
|
||||
core.summary
|
||||
.addRaw(`Additional drifts not shown: ${drifts.length - sample.length}`)
|
||||
.addEOL();
|
||||
}
|
||||
}
|
||||
|
||||
await core.summary.write();
|
||||
|
||||
if (!shouldRepair && drifts.length > 0) {
|
||||
core.info(`Managed-label metadata drifts detected: ${drifts.length}. Re-run with mode=repair to auto-fix.`);
|
||||
} else if (shouldRepair) {
|
||||
core.info(`Managed-label metadata repair applied to ${drifts.length} labels.`);
|
||||
} else {
|
||||
core.info("No managed-label metadata drift detected.");
|
||||
}
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
const files = await github.paginate(github.rest.pulls.listFiles, {
|
||||
owner,
|
||||
repo,
|
||||
|
|
|
|||
20
.github/workflows/update-notice.yml
vendored
20
.github/workflows/update-notice.yml
vendored
|
|
@ -26,7 +26,7 @@ jobs:
|
|||
# Fetch all contributors (excluding bots)
|
||||
gh api \
|
||||
--paginate \
|
||||
repos/${{ github.repository }}/contributors \
|
||||
"repos/${{ github.repository }}/contributors" \
|
||||
--jq '.[] | select(.type != "Bot") | .login' > /tmp/contributors_raw.txt
|
||||
|
||||
# Sort alphabetically and filter
|
||||
|
|
@ -34,7 +34,7 @@ jobs:
|
|||
|
||||
# Count contributors
|
||||
count=$(wc -l < contributors.txt | tr -d ' ')
|
||||
echo "count=$count" >> $GITHUB_OUTPUT
|
||||
echo "count=$count" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Generate new NOTICE file
|
||||
run: |
|
||||
|
|
@ -71,9 +71,9 @@ jobs:
|
|||
id: check_diff
|
||||
run: |
|
||||
if git diff --quiet NOTICE; then
|
||||
echo "changed=false" >> $GITHUB_OUTPUT
|
||||
echo "changed=false" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "changed=true" >> $GITHUB_OUTPUT
|
||||
echo "changed=true" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Create Pull Request
|
||||
|
|
@ -101,12 +101,12 @@ jobs:
|
|||
|
||||
- name: Summary
|
||||
run: |
|
||||
echo "## NOTICE Update Results" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "## NOTICE Update Results" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||
if [ "${{ steps.check_diff.outputs.changed }}" = "true" ]; then
|
||||
echo "✅ PR created to update NOTICE" >> $GITHUB_STEP_SUMMARY
|
||||
echo "✅ PR created to update NOTICE" >> "$GITHUB_STEP_SUMMARY"
|
||||
else
|
||||
echo "✓ NOTICE file is up to date" >> $GITHUB_STEP_SUMMARY
|
||||
echo "✓ NOTICE file is up to date" >> "$GITHUB_STEP_SUMMARY"
|
||||
fi
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "**Contributors:** ${{ steps.contributors.outputs.count }}" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "**Contributors:** ${{ steps.contributors.outputs.count }}" >> "$GITHUB_STEP_SUMMARY"
|
||||
|
|
|
|||
44
.github/workflows/workflow-sanity.yml
vendored
44
.github/workflows/workflow-sanity.yml
vendored
|
|
@ -63,3 +63,47 @@ jobs:
|
|||
|
||||
- name: Lint GitHub workflows
|
||||
uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
|
||||
|
||||
contributor-tier-consistency:
|
||||
runs-on: blacksmith-2vcpu-ubuntu-2404
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
|
||||
- name: Verify contributor-tier parity across workflows
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
python3 - <<'PY'
|
||||
import re
|
||||
from pathlib import Path
|
||||
|
||||
files = [
|
||||
Path('.github/workflows/labeler.yml'),
|
||||
Path('.github/workflows/auto-response.yml'),
|
||||
]
|
||||
|
||||
parsed = {}
|
||||
for path in files:
|
||||
text = path.read_text(encoding='utf-8')
|
||||
rules = re.findall(r'\{ label: "([^"]+ contributor)", minMergedPRs: (\d+) \}', text)
|
||||
color_match = re.search(r'const contributorTierColor = "([0-9A-Fa-f]{6})"', text)
|
||||
if not color_match:
|
||||
raise SystemExit(f'failed to parse contributorTierColor in {path}')
|
||||
parsed[str(path)] = {
|
||||
'rules': rules,
|
||||
'color': color_match.group(1).upper(),
|
||||
}
|
||||
|
||||
baseline = parsed[str(files[0])]
|
||||
for path in files[1:]:
|
||||
entry = parsed[str(path)]
|
||||
if entry != baseline:
|
||||
raise SystemExit(
|
||||
'contributor-tier mismatch between workflows: '
|
||||
f'{files[0]}={baseline} vs {path}={entry}'
|
||||
)
|
||||
|
||||
print('contributor tier rules/color are consistent across label workflows')
|
||||
PY
|
||||
|
|
|
|||
|
|
@ -35,6 +35,7 @@ Merge-blocking checks should stay small and deterministic. Optional checks are u
|
|||
- Additional behavior: applies contributor tiers on PRs by merged PR count (`trusted` >=5, `experienced` >=10, `principal` >=20, `distinguished` >=50)
|
||||
- Additional behavior: final label set is priority-sorted (`risk:*` first, then `size:*`, then contributor tier, then module/path labels)
|
||||
- Additional behavior: managed label colors follow display order to produce a smooth left-to-right gradient when many labels are present
|
||||
- Manual governance: supports `workflow_dispatch` with `mode=audit|repair` to inspect/fix managed label metadata drift across the whole repository
|
||||
- Additional behavior: risk + size labels are auto-corrected on manual PR label edits (`labeled`/`unlabeled` events); apply `risk: manual` when maintainers intentionally override automated risk selection
|
||||
- High-risk heuristic paths: `src/security/**`, `src/runtime/**`, `src/gateway/**`, `src/tools/**`, `.github/workflows/**`
|
||||
- Guardrail: maintainers can apply `risk: manual` to freeze automated risk recalculation
|
||||
|
|
|
|||
|
|
@ -52,6 +52,7 @@ Maintain these branch protection rules on `main`:
|
|||
- `PR Labeler` applies scope/path labels + size labels + risk labels + module labels (for example `channel:telegram`, `provider:kimi`, `tool:shell`) and contributor tiers by merged PR count (`trusted` >=5, `experienced` >=10, `principal` >=20, `distinguished` >=50), while de-duplicating less-specific scope labels when a more specific module label is present.
|
||||
- For all module prefixes, module labels are compacted to reduce noise: one specific module keeps `prefix:component`, but multiple specifics collapse to the base scope label `prefix`.
|
||||
- Label ordering is priority-first: `risk:*` -> `size:*` -> contributor tier -> module/path labels.
|
||||
- Maintainers can run `PR Labeler` manually (`workflow_dispatch`) in `audit` mode for drift visibility or `repair` mode to normalize managed label metadata repository-wide.
|
||||
- Hovering a label in GitHub shows its auto-managed description (rule/threshold summary).
|
||||
- Managed label colors are arranged by display order to create a smooth gradient across long label rows.
|
||||
- `Auto Response` posts first-time guidance, handles label-driven routing for low-signal items, and auto-applies issue contributor tiers using the same thresholds as `PR Labeler` (`trusted` >=5, `experienced` >=10, `principal` >=20, `distinguished` >=50).
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue