Add notify-failure job to cgo.yml for CGO failure tracking

[Copilot]

Summary

Adds a notify-failure job to .github/workflows/cgo.yml that automatically creates a GitHub issue when any CGO job fails on the main branch.

Changes

• Added notify-failure job at the end of cgo.yml with:
  • if: always() && github.ref == 'refs/heads/main' — runs after all other jobs, only on the main branch
  • needs listing all 16 existing jobs so it runs last
  • permissions: issues: write for issue creation
  • Single actions/github-script step that:
    1. Collects all failed jobs from the needs context
    2. Skips if no jobs failed
    3. Checks for an existing open issue with cgo-failure label — skips creation if one exists (deduplication)
    4. Creates labels cookie and cgo-failure if they don't yet exist
    5. Creates an issue titled [CGO] Workflow failure on main - Run #N with:
       • Table of run metadata (run ID, commit SHA, expiry time)
       • List of failed job names
       • Expiration timestamp set to 4 hours from issue creation time
       • Labels: cookie (for agent investigation) + cgo-failure (for deduplication)

[Copilot]

Pull request overview

Adds automated failure tracking to the CGO GitHub Actions workflow by creating an issue on main when any upstream CGO job fails, with basic deduplication via a cgo-failure label.

Changes:

• Add a notify-failure job that runs after all existing CGO jobs (needs) and only on refs/heads/main.
• Use actions/github-script to detect failed needs jobs and create/deduplicate a labeled GitHub issue.
• Ensure required labels (cookie, cgo-failure) exist before issue creation.

Show a summary per file

File	Description
.github/workflows/cgo.yml	Adds a post-workflow notification job that opens a deduplicated issue when CGO jobs fail on main.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 2

[Copilot]

The getLabel error handling only creates labels on 404, but silently ignores any other API error (rate limit, permissions, transient failures). This can hide the root cause and lead to a later, harder-to-diagnose failure when creating the issue with missing labels. Re-throw or core.setFailed for non-404 errors so the workflow fails with a clear reason.

Suggested change

	await github.rest.issues.createLabel({ owner: context.repo.owner, repo: context.repo.repo, name: label, color });
	await github.rest.issues.createLabel({ owner: context.repo.owner, repo: context.repo.repo, name: label, color });
	} else {
	throw new Error(`Failed to verify label "${label}": ${e.message}`);

[Copilot]

github.rest.issues.listForRepo returns both issues and pull requests. If a PR is ever labeled cgo-failure, this deduplication check will incorrectly suppress issue creation. Filter out items with the pull_request field (or use a search query that excludes PRs) before deciding to skip creating a new issue.

Suggested change

	if (existingIssues.data.length > 0) {
	core.info(`Existing CGO failure issue #${existingIssues.data[0].number} is still open. Skipping.`);
	const existingOpenIssues = existingIssues.data.filter(item => !item.pull_request);
	if (existingOpenIssues.length > 0) {
	core.info(`Existing CGO failure issue #${existingOpenIssues[0].number} is still open. Skipping.`);