feat(labels): add gate-label audit and seed referenced-but-unseeded labels#84
Conversation
…abels A reusable workflow that references a label never added to the seed set fails on repos that lack it. Add a gate-label audit that statically collects every label declared as a *-label/*-labels workflow-input default and fails on any that is not seeded; unreferenced seed labels are informational only. The audit surfaced ci:full, auto-triaged, and doc-orphan as referenced-but-unseeded -- now seeded. Move the seed array into scripts/labels.mjs so the audit can import it without running the setup-repo CLI. Refs #83 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
LABEL_INPUT_RE matches block-style *-label inputs only. Add a comment making the limitation explicit and a test locking that an inline single-line declaration yields no labels, so a future maintainer adding an inline gate label is not lulled into false audit confidence. Refs #83 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a6ac15f027
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for (const file of readdirSync(workflowsDir)) { | ||
| if (!/\.ya?ml$/.test(file)) continue; | ||
| const text = readFileSync(join(workflowsDir, file), 'utf8'); | ||
| for (const name of extractLabelInputDefaults(text)) names.add(name); |
There was a problem hiding this comment.
This live test reads .github/workflows, but I checked .github/workflows/self-test.yml: npm test only triggers for scripts/**, package files, or the self-test workflow itself, while the reusable required gate's workflow-validation lane only runs actionlint. When a PR changes only a reusable workflow and adds or renames a *-label default, this audit will not run, so the exact referenced-but-unseeded label gap this change is meant to prevent can still merge. Please wire workflow-file changes into the self-test/required check that runs this test.
Useful? React with 👍 / 👎.
Expand scripts/labels.mjs with 17 common-default labels on top of the gate-required set #84 already seeded (ci:full, auto-triaged, doc-orphan): - release-note aliases: feature, fix, breaking-change (close categories declared in ArchonVII/.github release.yml that were unseeded) - conventional work types: task, ci, build - GitHub built-in defaults: duplicate, invalid, question, wontfix - contributor onboarding: help wanted, good first issue, contrib-candidate - triage states: needs-info, needs-reproduction, needs-decision, ready New colors use GitHub's canonical default palette where one exists, else reuse an existing seed color; each is sourced in a trailing comment. area:*/platform:* deferred to a future per-repo opt-in. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 participant
Summary
scripts/gate-labels.mjs+gate-labels.test.mjs) that statically collects every label declared as a*-label/*-labelsworkflow-input default and fails if any is not in the seed set. Unreferenced seed labels are reported as informational only, since many are valid manual/triage labels.ci:full,auto-triaged, anddoc-orphan— labels reusable workflows already reference (force-full CI, anomaly auto-triage, doc-orphan detector) but that were never provisioned.setup-repo.mjsintoscripts/labels.mjsso the audit can import it without executing the CLI.This is the GW-B slice of the closeout-contract repair: a gate must never depend on a label that nothing provisions.
Verification
vitest run scripts/gate-labels.mjs
node --check scripts/setup-repo.mjs
Verification Notes
The audit's collector reads
*-label/*-labelsinput defaults across.github/workflows/*.yml, skipping thesync-labelsboolean toggle and${{ }}expressions. Run against the live workflows it foundci:full,no-changelog,anomaly,auto-triaged,doc-orphan,stale, and the stale-exempt list; the three previously-unseeded names are added here so the audit reports zero missing. The full local suite is green except the pre-existingdoc-policy-lint.test.mjsparse issue, which is unrelated to this change and passes on CI.Docs / Changelog
.changelog/unreleased/83-gate-label-audit.mdrecords the audit, the three new seed labels, and the move tolabels.mjs.Refs #83