audit: Label prefix governance enforcement — audit complete - #1591
Conversation
ashleyshaw
added
priority:critical
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds a new ChangesLabel-prefix governance
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Template check passed after update. Thanks for fixing the PR description. |
⏱️ Aging and SLA annotation
Maintained by project-meta-sync workflow. |
📄 README Validation✅ All README checks passed.
|
Fix import of 'fetchCanonicalLabels' and 'formatErrors' which don't have underscore prefix in their export declarations. - Changed: `_fetchCanonicalLabels` → `fetchCanonicalLabels` - Changed: `_formatErrors` → `formatErrors` Fixes labeling workflow failures in PR #1591. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
github-actions
Bot
added
the
meta:needs-changelog
ashleyshaw
added
meta:no-changelog
🔍 Reviewer Summary for PR #1591CI Status: ✅ Recommendations
|
Add missing frontmatter fields (maintainer, status, stability) to ensure proper validation. - README.md: Added maintainer, stability - REMEDIATION_PLAN.md: Added maintainer, status, stability - WORKFLOW_CONSOLIDATION_ANALYSIS.md: Added maintainer, status, stability - LABEL_PREFIX_AUDIT_REPORT.md: Updated status from in-progress to complete, added stability Fixes README validation failures in PR #1591. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR adds a set of audit artefacts documenting label-prefix governance violations (issues #1500–#1600), including workflow overlap analysis and a remediation plan, to support the remediation work tracked in #1592.
Changes:
- Adds a comprehensive label-prefix audit report covering root causes, impact, and recommendations.
- Adds a workflow inventory/conflict analysis to support the workflows-consolidation-2026-q3 effort.
- Adds a step-by-step remediation plan and an index README for the report set.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| .github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md | Workflow inventory and consolidation/conflict analysis for labelling/issue/PR automation. |
| .github/reports/label-prefix-audit/REMEDIATION_PLAN.md | Phased plan with concrete steps and example snippets for stopping and remediating label-prefix violations. |
| .github/reports/label-prefix-audit/README.md | Index/entrypoint for the audit pack and immediate action list. |
| .github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md | Main audit report detailing findings, evidence, and governance gaps. |
Suppressed comments (5)
.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md:365
- The References links use
./.github/...and./docs/..., which resolve relative to this report directory and will be broken in GitHub. Use correct relative paths from.github/reports/label-prefix-audit/.
## References
- [workflows-consolidation-2026-q3 Project](./.github/projects/active/workflows-consolidation-2026-q3/)
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md:503
- The Sign-Off section still says the audit report is “In Progress”, which contradicts the PR’s “audit complete” framing. If the audit is complete, update this status line to match; otherwise the PR/README should not claim completion.
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md:441 - These documentation/governance links are broken because they are relative to this report directory. Update them to correct repo-root relative paths.
- [docs/LABELING.md](./docs/LABELING.md) — Labeling guide and best practices
- [docs/LABEL_STRATEGY.md](./docs/LABEL_STRATEGY.md) — Label taxonomy and strategy
- [docs/LABELING_GOVERNANCE.md](./docs/LABELING_GOVERNANCE.md) — Workflow architecture
- [CLAUDE.md](./CLAUDE.md) — Global AI rules (needs update)
.github/reports/label-prefix-audit/README.md:244
- These canonical source links are broken because they include
./.github/...from within.github/reports/.... They should reference the repo’s.github/directory via../../.
### Canonical Sources (Truth)
- [.github/labels.yml](./.github/labels.yml) — All 158 canonical labels
- [.github/issue-types.yml](./.github/issue-types.yml) — Issue type definitions
.github/reports/label-prefix-audit/README.md:252
- The documentation links under “Reference Files” are broken because they resolve relative to
.github/reports/…. Use repo-root relative paths.
### Documentation
- [docs/LABELING.md](./docs/LABELING.md) — Labeling guide
- [docs/LABEL_STRATEGY.md](./docs/LABEL_STRATEGY.md) — Label taxonomy
- [docs/LABELING_GOVERNANCE.md](./docs/LABELING_GOVERNANCE.md) — Workflow architecture
| author: "Claude Code Audit" | ||
| maintainer: "LightSpeed Team" | ||
| domain: "governance" | ||
| status: "in-progress" |
| - [.github/labels.yml](./.github/labels.yml) — All 158 canonical labels | ||
| - [.github/labeler.yml](./.github/labeler.yml) — Automatic labeling rules | ||
| - [.github/issue-types.yml](./.github/issue-types.yml) — Issue type definitions | ||
| - [.github/label-governance-policy.yml](./.github/label-governance-policy.yml) — Governance policy |
| - **[workflows-consolidation-2026-q3](./.github/projects/active/workflows-consolidation-2026-q3/)** — Main consolidation initiative; recommend adding labeling consolidation to scope | ||
| - **[issue-triage-automation-system](./.github/projects/active/issue-triage-automation-system/)** — Related issue automation work | ||
| - **[issue-type-workflow-automation](./.github/projects/active/issue-type-workflow-automation/)** — Related issue type automation | ||
| - **[template-enforcement-governance](./.github/projects/active/template-enforcement-governance/)** — Template validation (related to label validation) |
| - name: Load Canonical Labels | ||
| id: load-labels | ||
| run: | | ||
| LABELS=$(jq -r '.[] | .name' .github/labels.yml | paste -sd '|' -) |
| console.log( | ||
| "\nFor canonical label list, see: .github/labels.yml or run: npm run list:labels" | ||
| ); |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Tick the box to add this pull request to the merge queue (same as
|
Review Status✅ Audit complete, ready for merge Strengths:
For Merge:
Status: Ready to merge once CI passes. |
✅ Ready for Merge — Workflow StatusCurrent Status
Outstanding:The following checks are QUEUED and need to complete before merge:
Action for Merge:
Status: ⏳ Waiting for CI checks to complete |
bd29728 to
7dc3f41
Compare
Add missing frontmatter fields (maintainer, status, stability) to ensure proper validation. - README.md: Added maintainer, stability - REMEDIATION_PLAN.md: Added maintainer, status, stability - WORKFLOW_CONSOLIDATION_ANALYSIS.md: Added maintainer, status, stability - LABEL_PREFIX_AUDIT_REPORT.md: Updated status from in-progress to complete, added stability Fixes README validation failures in PR #1591. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
7dc3f41 to
cb72d85
Compare
…rom audit Refined OpenSpec RFC incorporates all audit findings: - Root cause: defective code in scripts/agents/includes/labeling-agent.js - Solution: 5-phase remediation plan (Phase 1-5) - Governance: explicit label creation rules in CLAUDE.md/AGENTS.md - Validation: pre-creation checks to prevent bare labels - Timeline: 12-19 hours over 5-7 business days Files: - OPENSPEC_RFC_REFINED.md (v2.0): Governance specification - ACTION_PLAN.md: Phase-by-phase implementation plan - README.md: Project index and quick reference Part of PR #1591: Label Prefix Governance Enforcement Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Commits refined specification from label-prefix-governance-enforcement audit. Includes canonical label family system, validation rules, and enforcement timeline. Addresses governance violations audited in PR #1591, Issue #1592. Foundation for label governance Phase 2-3 enforcement. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Comprehensive audit of label prefix violations in issues #1500-1600 range. ## Findings Summary - Root cause: Code duplication (defective labeling-agent.js applies bare labels) - Impact: 100+ issues with non-canonical labels - Governance gaps: CLAUDE.md/AGENTS.md incomplete ## Audit Reports Created - LABEL_PREFIX_AUDIT_REPORT.md — Complete findings and root cause analysis - WORKFLOW_CONSOLIDATION_ANALYSIS.md — Workflow conflicts and consolidation plan - REMEDIATION_PLAN.md — Step-by-step fixes with code and scripts - README.md — Index and quick reference guide ## Immediate Actions - Update CLAUDE.md with explicit label creation rules - Update AGENTS.md with label governance section - Delete defective scripts/agents/includes/labeling-agent.js - Implement pre-creation label validation Related: #1290 (Phase 1 restructuring), workflows-consolidation-2026-q3 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Add missing frontmatter fields (maintainer, status, stability) to ensure proper validation. - README.md: Added maintainer, stability - REMEDIATION_PLAN.md: Added maintainer, status, stability - WORKFLOW_CONSOLIDATION_ANALYSIS.md: Added maintainer, status, stability - LABEL_PREFIX_AUDIT_REPORT.md: Updated status from in-progress to complete, added stability Fixes README validation failures in PR #1591. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Fixed workflow trigger description for validate-blocking-status-before-close.yml - Corrected relative paths in project links (./.github → ../../../.github) - Replaced jq YAML parsing with grep for label extraction - Removed reference to non-existent npm run list:labels command - Added Global DoD Checklist to PR template Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Changed file_type from 'report' to 'agent-index' for schema compliance - Updated status from 'complete'/'in-progress' to 'active' (allowed values) - Removed unstable/severity fields not in schema - All 4 report files now pass frontmatter validation Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Updated all 4 report files with standard LightSpeed footer format - Uses consistent 'Built with ☕ and 🚀 by Claude Code Audit · LightSpeedWP' format Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- Updated all 4 report files with governance-approved footer - Footer: 'Maintained by the 🤖 LightSpeedWP Automation Team' - Matches footers.config.yaml governance category requirements Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
41f9950 to
568aaa7
Compare
coderabbitai
Bot
added
area:documentation
There was a problem hiding this comment.
Actionable comments posted: 14
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md:
- Around line 436-455: Correct repository-root-relative links in
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md lines 436-455,
.github/reports/label-prefix-audit/README.md lines 242-267, and
.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md lines
362-367 by replacing nested-report ./ prefixes with ../../../, covering
documentation, project, workflow-directory, canonical-source, governance,
script, and correct-code links; update renamed report references as needed.
- Around line 1-17: Apply date-first naming to all four reports: rename
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md, README.md,
REMEDIATION_PLAN.md, and WORKFLOW_CONSOLIDATION_ANALYSIS.md to
YYYY-MM-DD-{descriptor}.md names, then update every internal link referencing
the old paths.
- Around line 218-250: Revise the Claude issue-creation section to avoid stating
the bare-label `gh issue create` flow as fact unless you have direct command
trace evidence. Update the “Claude’s Actual Issue Creation Behavior” content to
clearly label the claim as a hypothesis, or replace it with concrete
trace-backed evidence from the labeling path (for example the
`scripts/agents/includes/labeling-agent.js` audit) before asserting that Claude
issued unprefixed labels.
- Around line 254-294: The Root Cause Analysis confidence rankings lack
supporting evidence and imply false precision. Update the “Primary Causes
(Ranked by Likelihood)” section to either replace percentages with
evidence-backed findings or add a concise scoring methodology with the
supporting queries, logs, or sample basis for each cause; preserve the existing
causes and proposed fixes.
In @.github/reports/label-prefix-audit/README.md:
- Around line 181-207: Define one consistent executable script location and
apply it across all references. In .github/reports/label-prefix-audit/README.md
lines 181-207, align creation paths with the documented execution commands; in
REMEDIATION_PLAN.md lines 296-328, update audit script __dirname paths to
resolve .github/labels.yml and .github/reports/; and in REMEDIATION_PLAN.md
lines 569-574, write remediation results to the documented report directory.
Ensure the creation instructions, embedded paths, output paths, and commands all
use the same contract.
- Around line 295-308: Align the sign-off status across both audit documents: in
.github/reports/label-prefix-audit/README.md lines 295-308, mark the audit as
pending or link the completed evidence; in
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md lines 500-505,
update the sign-off status once issue-range verification is complete.
In @.github/reports/label-prefix-audit/REMEDIATION_PLAN.md:
- Around line 606-634: Update the “Update Template-Enforcement Workflow” plan to
stop describing the issues.opened job as pre-creation enforcement. Either
specify a creation wrapper/API gate that validates labels before issue creation,
or revise the acceptance criteria and workflow description to explicitly treat
label-validation as post-creation detection or cleanup; apply the same
correction to the related sections.
- Around line 235-240: Align the exit-code contract for canonical-label loading
between the documented help text and loadCanonicalLabels(): either make
canonical-set load errors exit with code 2, or update the documented mapping and
related tests to use the implementation’s code 1.
- Around line 509-515: Update the remediation logic around bareLabels so it
processes both bare-label and non-canonical violations recorded by the audit,
rather than filtering only labels without “:”. Ensure the zero-violations check
and related acceptance criteria reflect all violation types, including prefixed
labels that are not canonical.
- Around line 181-182: Update the usage documentation for
validate-labels-before-creation.cjs to match the current process.argv.slice(2)
parsing and validateLabels input: remove the --labels option from the documented
command, including the corresponding usage text referenced around the additional
location, unless the parser is explicitly updated to consume it.
- Around line 48-56: Resolve the inconsistent canonical area label by selecting
either area:docs or area:documentation, then update the valid-label examples in
the remediation plan, the migration mapping, and the related audit tests to use
that same name consistently; ensure all references match the canonical entry in
.github/labels.yml.
- Around line 521-531: Update the remediation script’s completion flow after
processing bare labels so any entries in results.errors cause a non-zero exit
status instead of successful completion. Report the number of failed issues,
while preserving the existing mapping-error collection in the bareLabels loop
and applying the same behavior to the corresponding logic around the additional
referenced section.
In @.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md:
- Around line 27-76: The workflow inventory in
.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md lines
27-76 must use one reconciled count: verify the category entries, add any
missing workflows or correct the category and overall totals, then update all
dependent estimates and consolidation targets. In
.github/reports/label-prefix-audit/README.md lines 39-44, revise the root-cause
summary to match the reconciled inventory and total; both files must report the
same workflow count.
- Around line 204-225: Update the “Current (Actual) Order” section to remove the
unsupported alphabetical/event-time ordering claim and clearly state that
independently triggered workflows have no guaranteed global execution order.
Preserve the unspecified-order and race-condition concerns, and add a
consolidation design or documented cross-workflow coordination mechanism
wherever ordering is required.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: f64ea2b1-748c-4707-8c4d-a6af2cae069e
📒 Files selected for processing (4)
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md.github/reports/label-prefix-audit/README.md.github/reports/label-prefix-audit/REMEDIATION_PLAN.md.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md
📜 Review details
⏰ Context from checks skipped due to timeout. (11)
- GitHub Check: scan / Scan for secrets
- GitHub Check: validate-pr-template
- GitHub Check: Unified Labeling, Status, and Type Assignment
- GitHub Check: lint-and-links
- GitHub Check: coderabbit-gate
- GitHub Check: Mergify Merge Queue
- GitHub Check: Analyze (python)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (ruby)
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
🧰 Additional context used
📓 Path-based instructions (2)
**/.github/reports/**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Name every report under
.github/reports/asYYYY-MM-DD-{descriptor}.md, with the date first.
Files:
.github/reports/label-prefix-audit/README.md.github/reports/label-prefix-audit/REMEDIATION_PLAN.md.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md
**/.github/**
📄 CodeRabbit inference engine (CLAUDE.md)
Keep GitHub-native governance assets under
.github/; place reusable assets in the matching top-level portable folder instead.
Files:
.github/reports/label-prefix-audit/README.md.github/reports/label-prefix-audit/REMEDIATION_PLAN.md.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md
🪛 LanguageTool
.github/reports/label-prefix-audit/README.md
[uncategorized] ~37-~37: The official name of this software platform is spelled with a capital “H”.
Context: ...he canonical labeling system defined in .github/labels.yml (158 labels, all with requi...
(GITHUB)
[style] ~127-~127: Consider using a different verb for a more formal wording.
Context: ...**: Step-by-step instructions on how to fix the problem --- ## Key Findings Summa...
(FIX_RESOLVE)
[misspelling] ~173-~173: The word “Effort” is a noun. Did you mean “afford”?
Context: ...e section - Assignee: You - Effort: 30 min - Files: See Phase 1.2...
(EFFORT_AFFORD)
[misspelling] ~178-~178: The word “Effort” is a noun. Did you mean “afford”?
Context: ...agent.js` - Assignee: You - Effort: 15 min (verify no references first) ...
(EFFORT_AFFORD)
[uncategorized] ~196-~196: The official name of this software platform is spelled with a capital “H”.
Context: ...son 3. [ ] Create remediation script (.github/scripts/validation/remediate-labels.cjs...
(GITHUB)
[uncategorized] ~221-~221: The official name of this software platform is spelled with a capital “H”.
Context: ...ts - **[workflows-consolidation-2026-q3](../../../.github/projects/active/workflows-consolidation...
(GITHUB)
[uncategorized] ~222-~222: The official name of this software platform is spelled with a capital “H”.
Context: ...cope - **[issue-triage-automation-system](../../../.github/projects/active/issue-triage-automation...
(GITHUB)
[uncategorized] ~223-~223: The official name of this software platform is spelled with a capital “H”.
Context: ...work - **[issue-type-workflow-automation](../../../.github/projects/active/issue-type-workflow-aut...
(GITHUB)
[uncategorized] ~224-~224: The official name of this software platform is spelled with a capital “H”.
Context: ...ion - **[template-enforcement-governance](../../../.github/projects/active/template-enforcement-go...
(GITHUB)
[uncategorized] ~242-~242: The official name of this software platform is spelled with a capital “H”.
Context: ...les ### Canonical Sources (Truth) - .github/labels.yml — All...
(GITHUB)
[uncategorized] ~242-~242: The official name of this software platform is spelled with a capital “H”.
Context: ...l Sources (Truth) - .github/labels.yml — All 158 canonical labels ...
(GITHUB)
[uncategorized] ~243-~243: The official name of this software platform is spelled with a capital “H”.
Context: ...els.yml) — All 158 canonical labels - [.github/issue-types.yml](./.github/issue-types....
(GITHUB)
[uncategorized] ~243-~243: The official name of this software platform is spelled with a capital “H”.
Context: ...onical labels - .github/issue-types.yml — Issue type definitio...
(GITHUB)
[uncategorized] ~244-~244: The official name of this software platform is spelled with a capital “H”.
Context: ...types.yml) — Issue type definitions - .github/labeler.yml — L...
(GITHUB)
[uncategorized] ~244-~244: The official name of this software platform is spelled with a capital “H”.
Context: ... type definitions - .github/labeler.yml — Labeling rules - [.githu...
(GITHUB)
[uncategorized] ~245-~245: The official name of this software platform is spelled with a capital “H”.
Context: ...ithub/labeler.yml) — Labeling rules - [.github/label-governance-policy.yml](./.github/...
(GITHUB)
[uncategorized] ~245-~245: The official name of this software platform is spelled with a capital “H”.
Context: ...s - .github/label-governance-policy.yml — Governan...
(GITHUB)
[uncategorized] ~266-~266: The official name of this software platform is spelled with a capital “H”.
Context: ...LETE THIS ### Correct Code (KEEP) - [.github/scripts/agents/labeling.agent.js](./.gi...
(GITHUB)
[uncategorized] ~266-~266: The official name of this software platform is spelled with a capital “H”.
Context: ....github/scripts/agents/labeling.agent.js](./.github/scripts/agents/labeling.agent.js) — ✅ C...
(GITHUB)
[uncategorized] ~267-~267: The official name of this software platform is spelled with a capital “H”.
Context: ...ents/labeling.agent.js) — ✅ Correct - [.github/scripts/agents/issues.agent.js](./.gith...
(GITHUB)
[uncategorized] ~267-~267: The official name of this software platform is spelled with a capital “H”.
Context: ... .github/scripts/agents/issues.agent.js — ✅ Cor...
(GITHUB)
.github/reports/label-prefix-audit/REMEDIATION_PLAN.md
[uncategorized] ~143-~143: The official name of this content management system is spelled with a capital “P”.
Context: ...totype | env: | | Compatibility | 6 | wordpress, php, woocommerce, gutenberg | `compat:...
(WORDPRESS)
[uncategorized] ~157-~157: The official name of this software platform is spelled with a capital “H”.
Context: ...tions) If unsure about a label, search .github/labels.yml or ask the team. ``` **Wh...
(GITHUB)
[uncategorized] ~644-~644: The official name of this software platform is spelled with a capital “H”.
Context: ...dation to Changelog Workflow File: .github/workflows/changelog-automation.yml (or...
(GITHUB)
.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md
[uncategorized] ~70-~70: The official name of this software platform is spelled with a capital “H”.
Context: ...| File | Purpose | |------|---------| | .github/labels.yml | Canonical label definitio...
(GITHUB)
[uncategorized] ~71-~71: The official name of this software platform is spelled with a capital “H”.
Context: ...ical label definitions (158 labels) | | .github/labeler.yml | Automation rules (branch...
(GITHUB)
[uncategorized] ~72-~72: The official name of this software platform is spelled with a capital “H”.
Context: ...ch patterns, file changes → labels) | | .github/issue-types.yml | Issue type definitio...
(GITHUB)
[uncategorized] ~73-~73: The official name of this software platform is spelled with a capital “H”.
Context: ...| Issue type definitions (24 types) | | .github/label-governance-policy.yml | Governan...
(GITHUB)
[uncategorized] ~74-~74: The official name of this software platform is spelled with a capital “H”.
Context: ....yml| Governance/compliance rules | |.github/issue-fields.yml` | Issue field schema ...
(GITHUB)
[uncategorized] ~264-~264: The official name of this software platform is spelled with a capital “H”.
Context: .../includes/labeling-agent.js- [ ] Keep.github/scripts/agents/labeling.agent.js` (corr...
(GITHUB)
[uncategorized] ~367-~367: The official name of this software platform is spelled with a capital “H”.
Context: ....md](./docs/LABELING_GOVERNANCE.md) - .github/workflows/ — All...
(GITHUB)
[uncategorized] ~367-~367: The official name of this software platform is spelled with a capital “H”.
Context: ...ING_GOVERNANCE.md) - .github/workflows/ — All workflow files --- ...
(GITHUB)
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md
[uncategorized] ~61-~61: The official name of this software platform is spelled with a capital “H”.
Context: ...iles Analysis #### ✅ Canonical Labels (.github/labels.yml) - Status: CORRECT - *...
(GITHUB)
[uncategorized] ~81-~81: The official name of this software platform is spelled with a capital “H”.
Context: ...onical and correct #### ✅ Issue Types (.github/issue-types.yml) - Status: CORREC...
(GITHUB)
[uncategorized] ~88-~88: The official name of this software platform is spelled with a capital “H”.
Context: ...labels #### ✅ Label Governance Policy (.github/label-governance-policy.yml) - **Stat...
(GITHUB)
[uncategorized] ~120-~120: The official name of this software platform is spelled with a capital “H”.
Context: ...CLI/API, use only canonical labels from .github/labels.yml with required prefixes" - *...
(GITHUB)
[style] ~233-~233: To form a complete sentence, be sure to include a subject.
Context: ...Issue**: Labels lack required prefixes. Should be: ```bash gh issue create \ --titl...
(MISSING_IT_THERE)
[uncategorized] ~280-~280: The official name of this software platform is spelled with a capital “H”.
Context: ...programmatically, labels MUST come from .github/labels.yml with full family: prefix"...
(GITHUB)
[uncategorized] ~293-~293: The official name of this software platform is spelled with a capital “H”.
Context: ...n validation step (check labels against .github/labels.yml before gh issue create) ...
(GITHUB)
[grammar] ~311-~311: When ‘3-min’ is used as a modifier, it is usually spelled with a hyphen.
Context: ...iation effort**: ~5 hours (100 issues × 3 min avg) - Automation failures: Estimat...
(HOUR_HYPHEN)
[uncategorized] ~323-~323: The official name of this software platform is spelled with a capital “H”.
Context: ...eck in CLAUDE.md: "Use only labels from .github/labels.yml with required prefix when c...
(GITHUB)
[uncategorized] ~339-~339: The official name of this software platform is spelled with a capital “H”.
Context: ...ludes/labeling-agent.js - Keep only.github/scripts/agents/labeling.agent.js` (corr...
(GITHUB)
[uncategorized] ~349-~349: The official name of this software platform is spelled with a capital “H”.
Context: ...with explicit requirements - Link to .github/labels.yml as source of truth - Inc...
(GITHUB)
[uncategorized] ~412-~412: The official name of this software platform is spelled with a capital “H”.
Context: ...rkflow applied bare labels - [ ] Verify .github/scripts/agents/labeling.agent.js is ac...
(GITHUB)
[uncategorized] ~429-~429: The official name of this software platform is spelled with a capital “H”.
Context: ...## References ### Canonical Files - [.github/labels.yml](../../../.github/labels.yml...
(GITHUB)
[uncategorized] ~429-~429: The official name of this software platform is spelled with a capital “H”.
Context: ...# Canonical Files - .github/labels.yml — All 158 canonical labels ...
(GITHUB)
[uncategorized] ~430-~430: The official name of this software platform is spelled with a capital “H”.
Context: ...els.yml) — All 158 canonical labels - [.github/labeler.yml](../../../.github/labeler.y...
(GITHUB)
[uncategorized] ~430-~430: The official name of this software platform is spelled with a capital “H”.
Context: ... canonical labels - .github/labeler.yml — Automatic labeling rules...
(GITHUB)
[uncategorized] ~431-~431: The official name of this software platform is spelled with a capital “H”.
Context: ...ler.yml) — Automatic labeling rules - [.github/issue-types.yml](../../../.github/issue...
(GITHUB)
[uncategorized] ~431-~431: The official name of this software platform is spelled with a capital “H”.
Context: ...abeling rules - .github/issue-types.yml — Issue type definitio...
(GITHUB)
[uncategorized] ~432-~432: The official name of this software platform is spelled with a capital “H”.
Context: ...types.yml) — Issue type definitions - [.github/label-governance-policy.yml](../../../....
(GITHUB)
[uncategorized] ~432-~432: The official name of this software platform is spelled with a capital “H”.
Context: ...s - .github/label-governance-policy.yml — Governan...
(GITHUB)
[uncategorized] ~444-~444: The official name of this software platform is spelled with a capital “H”.
Context: ...ects - [workflows-consolidation-2026-q3](./.github/projects/active/workflows-consolidation...
(GITHUB)
[uncategorized] ~445-~445: The official name of this software platform is spelled with a capital “H”.
Context: ...iative - [issue-triage-automation-system](./.github/projects/active/issue-triage-automation...
(GITHUB)
[uncategorized] ~446-~446: The official name of this software platform is spelled with a capital “H”.
Context: ...mation - [issue-type-workflow-automation](./.github/projects/active/issue-type-workflow-aut...
(GITHUB)
[uncategorized] ~454-~454: The official name of this software platform is spelled with a capital “H”.
Context: ...els (DELETE/FIX) ### Correct Code - [.github/scripts/agents/labeling.agent.js](./.gi...
(GITHUB)
[uncategorized] ~454-~454: The official name of this software platform is spelled with a capital “H”.
Context: ....github/scripts/agents/labeling.agent.js](./.github/scripts/agents/labeling.agent.js) — Cor...
(GITHUB)
[uncategorized] ~455-~455: The official name of this software platform is spelled with a capital “H”.
Context: ...s) — Correct prefixed labels (KEEP) - [.github/scripts/agents/issues.agent.js](./.gith...
(GITHUB)
[uncategorized] ~455-~455: The official name of this software platform is spelled with a capital “H”.
Context: ... .github/scripts/agents/issues.agent.js — Corre...
(GITHUB)
🔇 Additional comments (1)
.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md (1)
116-131: 🔒 Security & Privacy | 🏗️ Heavy liftSecurity Misconfiguration (CWE-829): Inclusion of Functionality from Untrusted Control Sphere
Add a trust-boundary rule before recommending
pull_request_target.
pull_request_targetruns with base-repository permissions. If the consolidated job checks out or executes PR-controlled files, an untrusted PR can access those privileges and secrets. State that privileged jobs must execute only trusted base-branch code, or usepull_requestfor untrusted validation. Verify each proposed merge before adoption.#!/usr/bin/env bash set -euo pipefail workflow_files=$(fd -t f -e yml -e yaml .github/workflows) while IFS= read -r file; do printf '\n### %s\n' "$file" rg -n -C 4 \ 'pull_request_target|pull_request|actions/checkout|run:|secrets\.|GITHUB_TOKEN' \ "$file" || true done <<< "$workflow_files"Also applies to: 267-273
| --- | ||
| title: "Label Prefix Audit Report" | ||
| description: "Comprehensive audit of label prefix violations in issues 1500-1600 range and root cause analysis" | ||
| file_type: "agent-index" | ||
| version: "1.0.0" | ||
| created_date: "2026-08-05" | ||
| last_updated: "2026-08-05" | ||
| author: "Claude Code Audit" | ||
| maintainer: "LightSpeed Team" | ||
| domain: "governance" | ||
| status: "active" | ||
| tags: | ||
| - labeling | ||
| - governance | ||
| - audit | ||
| - issue-creation | ||
| --- |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Apply the date-first naming rule to every report.
All four files violate the same repository rule. Rename each file to YYYY-MM-DD-{descriptor}.md and update internal links.
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md#L1-L17: rename the audit report..github/reports/label-prefix-audit/README.md#L1-L17: rename the index report..github/reports/label-prefix-audit/REMEDIATION_PLAN.md#L1-L17: rename the remediation report..github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md#L1-L17: rename the workflow report.
📍 Affects 4 files
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md#L1-L17(this comment).github/reports/label-prefix-audit/README.md#L1-L17.github/reports/label-prefix-audit/REMEDIATION_PLAN.md#L1-L17.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md#L1-L17
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md around lines
1 - 17, Apply date-first naming to all four reports: rename
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md, README.md,
REMEDIATION_PLAN.md, and WORKFLOW_CONSOLIDATION_ANALYSIS.md to
YYYY-MM-DD-{descriptor}.md names, then update every internal link referencing
the old paths.
Source: Coding guidelines
| ### 5. Claude's Actual Issue Creation Behavior | ||
|
|
||
| #### Problem Identified | ||
|
|
||
| When Claude creates issues via CLI or API, the command likely resembles: | ||
|
|
||
| ```bash | ||
| gh issue create \ | ||
| --title "Issue title" \ | ||
| --body "Issue description" \ | ||
| --label "bug" \ | ||
| --label "feature" \ | ||
| --label "urgent" | ||
| ``` | ||
|
|
||
| **Issue**: Labels lack required prefixes. Should be: | ||
|
|
||
| ```bash | ||
| gh issue create \ | ||
| --title "Issue title" \ | ||
| --body "Issue description" \ | ||
| --label "type:bug" \ | ||
| --label "area:ci" \ | ||
| --label "priority:critical" | ||
| ``` | ||
|
|
||
| #### Evidence Trail | ||
|
|
||
| 1. User reported: "You are creating issues and PRs with incorrect labels" | ||
| 2. User stated: Issues 1500–1600 have labels without family prefix | ||
| 3. Configuration analysis: All canonical labels REQUIRE prefixes | ||
| 4. Code audit: `scripts/agents/includes/labeling-agent.js` applies bare labels | ||
| 5. **Conclusion**: Claude is referencing the wrong labeling logic OR not validating labels against canonical set |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 4 \
'gh issue create|gh pr create|--label|labeling-agent|addLabels|createIssue' \
--glob '*.js' --glob '*.cjs' --glob '*.yml' --glob '*.yaml' --glob '*.md'Repository: lightspeedwp/.github
Length of output: 158
No command trace supports this claim.
The “Evidence Trail” points to a reported issue, label-family policy, and an agent audit, but it does not show a gh issue create call, workflow log, or CLI/API invocation. Mark this section as a hypothesis, or add concrete trace evidence before implying Claude issued bare labels.
🧰 Tools
🪛 LanguageTool
[style] ~233-~233: To form a complete sentence, be sure to include a subject.
Context: ...Issue**: Labels lack required prefixes. Should be: ```bash gh issue create \ --titl...
(MISSING_IT_THERE)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md around lines
218 - 250, Revise the Claude issue-creation section to avoid stating the
bare-label `gh issue create` flow as fact unless you have direct command trace
evidence. Update the “Claude’s Actual Issue Creation Behavior” content to
clearly label the claim as a hypothesis, or replace it with concrete
trace-backed evidence from the labeling path (for example the
`scripts/agents/includes/labeling-agent.js` audit) before asserting that Claude
issued unprefixed labels.
| ## Root Cause Analysis | ||
|
|
||
| ### Primary Causes (Ranked by Likelihood) | ||
|
|
||
| #### 🔴 **Cause 1: Code Duplication & Version Conflict** (90% confidence) | ||
|
|
||
| - **Issue**: Two labeling implementations exist with different formats | ||
| - `.github/scripts/agents/labeling.agent.js` (correct, prefixed) | ||
| - `scripts/agents/includes/labeling-agent.js` (defective, bare labels) | ||
| - **Why This Happened**: Phase 2B script migration split portable/control-plane code without aligning logic | ||
| - **Result**: Claude may reference or call the wrong implementation | ||
| - **Fix**: Consolidate to single labeling logic; delete duplicate | ||
|
|
||
| #### 🟠 **Cause 2: Workflow Precedence Unclear** (70% confidence) | ||
|
|
||
| - **Issue**: 8+ workflows handle labeling with unclear execution order | ||
| - Some workflows may apply labels AFTER template validation | ||
| - Some may skip validation if labels already present | ||
| - Conflicts possible during merge/sync | ||
| - **Why This Happened**: Incremental workflow additions without consolidation | ||
| - **Result**: Correct labels applied by one workflow, but wrong labels persisted from earlier step | ||
| - **Fix**: Consolidate workflows per `workflows-consolidation-2026-q3` project plan | ||
|
|
||
| #### 🟡 **Cause 3: Governance Rules Not Enforced in Instructions** (60% confidence) | ||
|
|
||
| - **Issue**: CLAUDE.md and AGENTS.md do not explicitly state: | ||
| - "When creating issues programmatically, labels MUST come from `.github/labels.yml` with full `family:` prefix" | ||
| - "Validate all labels against canonical set before applying" | ||
| - **Why This Happened**: Governance split between multiple docs; no single authoritative "label creation" instruction | ||
| - **Result**: Claude may not know the rule or see it as optional | ||
| - **Fix**: Add explicit rule to CLAUDE.md and AGENTS.md | ||
|
|
||
| #### 🟡 **Cause 4: Validation Gap at Issue Creation** (50% confidence) | ||
|
|
||
| - **Issue**: No validation enforces label prefixes when creating issues | ||
| - CLI commands like `gh issue create --label "bug"` silently accept bare labels | ||
| - No pre-creation check against canonical set | ||
| - **Why This Happened**: Validation workflows run AFTER issue creation, not before | ||
| - **Result**: Bare labels slip through; templates don't validate until after creation | ||
| - **Fix**: Add pre-creation validation step (check labels against `.github/labels.yml` before `gh issue create`) | ||
|
|
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository files matching report:"
git ls-files '.github/reports/**' | sed -n '1,120p'
echo
echo "Target file line count:"
wc -l .github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md
echo
echo "Target section with line numbers:"
sed -n '1,340p' .github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md | cat -n | sed -n '220,310p'
echo
echo "Nearby methodology/method references:"
rg -n "confidence|evidence|query|log|sample|scoring|percentag|fraction|method" .github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md || trueRepository: lightspeedwp/.github
Length of output: 12095
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path('.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md')
text = p.read_text()
import re
for term in ['query', 'log', 'sample', 'scoring', 'method']:
print(term, len(re.findall(re.escape(term) + r'\b|' + term + r"[A-Za-z0-9_-]*", text, re.I)))
PYRepository: lightspeedwp/.github
Length of output: 200
Support confidence percentages with evidence or a method.
The 90%, 70%, 60%, and 50% cause rankings give false precision. Replace them with evidence-backed findings, or add a scoring table/query/log/sample basis for the confidence score.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~280-~280: The official name of this software platform is spelled with a capital “H”.
Context: ...programmatically, labels MUST come from .github/labels.yml with full family: prefix"...
(GITHUB)
[uncategorized] ~293-~293: The official name of this software platform is spelled with a capital “H”.
Context: ...n validation step (check labels against .github/labels.yml before gh issue create) ...
(GITHUB)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md around lines
254 - 294, The Root Cause Analysis confidence rankings lack supporting evidence
and imply false precision. Update the “Primary Causes (Ranked by Likelihood)”
section to either replace percentages with evidence-backed findings or add a
concise scoring methodology with the supporting queries, logs, or sample basis
for each cause; preserve the existing causes and proposed fixes.
| - [docs/LABELING.md](./docs/LABELING.md) — Labeling guide and best practices | ||
| - [docs/LABEL_STRATEGY.md](./docs/LABEL_STRATEGY.md) — Label taxonomy and strategy | ||
| - [docs/LABELING_GOVERNANCE.md](./docs/LABELING_GOVERNANCE.md) — Workflow architecture | ||
| - [CLAUDE.md](./CLAUDE.md) — Global AI rules (needs update) | ||
| - [AGENTS.md](./AGENTS.md) — Agent governance (needs update) | ||
|
|
||
| ### Related Projects | ||
|
|
||
| - [workflows-consolidation-2026-q3](./.github/projects/active/workflows-consolidation-2026-q3/) — Workflow consolidation initiative | ||
| - [issue-triage-automation-system](./.github/projects/active/issue-triage-automation-system/) — Issue triage automation | ||
| - [issue-type-workflow-automation](./.github/projects/active/issue-type-workflow-automation/) — Issue type automation | ||
|
|
||
| ### Defective Code | ||
|
|
||
| - [scripts/agents/includes/labeling-agent.js](./scripts/agents/includes/labeling-agent.js) — Applies bare labels (DELETE/FIX) | ||
|
|
||
| ### Correct Code | ||
|
|
||
| - [.github/scripts/agents/labeling.agent.js](./.github/scripts/agents/labeling.agent.js) — Correct prefixed labels (KEEP) | ||
| - [.github/scripts/agents/issues.agent.js](./.github/scripts/agents/issues.agent.js) — Correct prefixed labels (KEEP) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Correct repository-root links in all reports.
The affected links use ./ from a nested report directory. Replace them with ../../../ paths, then update any renamed report references.
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md#L436-L455: fix documentation, project, script, and correct-code links..github/reports/label-prefix-audit/README.md#L242-L267: fix canonical-source, governance, and defective-code links..github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md#L362-L367: fix project, documentation, and workflow-directory links.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~444-~444: The official name of this software platform is spelled with a capital “H”.
Context: ...ects - [workflows-consolidation-2026-q3](./.github/projects/active/workflows-consolidation...
(GITHUB)
[uncategorized] ~445-~445: The official name of this software platform is spelled with a capital “H”.
Context: ...iative - [issue-triage-automation-system](./.github/projects/active/issue-triage-automation...
(GITHUB)
[uncategorized] ~446-~446: The official name of this software platform is spelled with a capital “H”.
Context: ...mation - [issue-type-workflow-automation](./.github/projects/active/issue-type-workflow-aut...
(GITHUB)
[uncategorized] ~454-~454: The official name of this software platform is spelled with a capital “H”.
Context: ...els (DELETE/FIX) ### Correct Code - [.github/scripts/agents/labeling.agent.js](./.gi...
(GITHUB)
[uncategorized] ~454-~454: The official name of this software platform is spelled with a capital “H”.
Context: ....github/scripts/agents/labeling.agent.js](./.github/scripts/agents/labeling.agent.js) — Cor...
(GITHUB)
[uncategorized] ~455-~455: The official name of this software platform is spelled with a capital “H”.
Context: ...s) — Correct prefixed labels (KEEP) - [.github/scripts/agents/issues.agent.js](./.gith...
(GITHUB)
[uncategorized] ~455-~455: The official name of this software platform is spelled with a capital “H”.
Context: ... .github/scripts/agents/issues.agent.js — Corre...
(GITHUB)
📍 Affects 3 files
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md#L436-L455(this comment).github/reports/label-prefix-audit/README.md#L242-L267.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md#L362-L367
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md around lines
436 - 455, Correct repository-root-relative links in
.github/reports/label-prefix-audit/LABEL_PREFIX_AUDIT_REPORT.md lines 436-455,
.github/reports/label-prefix-audit/README.md lines 242-267, and
.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md lines
362-367 by replacing nested-report ./ prefixes with ../../../, covering
documentation, project, workflow-directory, canonical-source, governance,
script, and correct-code links; update renamed report references as needed.
Source: Linters/SAST tools
| 4. [ ] Create `.github/scripts/validation/validate-labels-before-creation.cjs` | ||
| - **Assignee**: DevOps/Tooling | ||
| - **Effort**: 1–2 hours | ||
| - **Code**: See Phase 1.3 in REMEDIATION_PLAN.md | ||
|
|
||
| ### 🟠 HIGH — Do Within 24 hours | ||
|
|
||
| 1. [ ] Create `.github/scripts/validation/audit-issue-labels.cjs` | ||
| - **Purpose**: Identify all label violations in issues #1500–#1600 | ||
| - **Code**: See Phase 2.1 in REMEDIATION_PLAN.md | ||
|
|
||
| 2. [ ] Run audit and review results | ||
| - **Assignee**: You | ||
| - **Output**: `.github/reports/labeling/audit-issues-1500-1600.json` | ||
|
|
||
| 3. [ ] Create remediation script (`.github/scripts/validation/remediate-labels.cjs`) | ||
| - **Purpose**: Bulk fix violations | ||
| - **Code**: See Phase 2.3 in REMEDIATION_PLAN.md | ||
|
|
||
| ### 🟡 MEDIUM — Do Within 48–72 hours | ||
|
|
||
| 1. [ ] Run dry-run of remediation (review output carefully) | ||
| - **Command**: `GITHUB_TOKEN=<token> node scripts/agents/includes/remediate-labels.cjs --dry-run` | ||
|
|
||
| 2. [ ] Run actual remediation after approval | ||
| - **Command**: `GITHUB_TOKEN=<token> node scripts/agents/includes/remediate-labels.cjs` | ||
|
|
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Define one executable script path contract.
The README, remediation plan, commands, and embedded relative paths identify different directories. Choose one location and update the creation instructions, __dirname paths, output paths, and run commands together.
.github/reports/label-prefix-audit/README.md#L181-L207: make the creation paths match the execution commands..github/reports/label-prefix-audit/REMEDIATION_PLAN.md#L296-L328: make the audit script paths resolve to.github/labels.ymland.github/reports/..github/reports/label-prefix-audit/REMEDIATION_PLAN.md#L569-L574: write remediation results to the documented report directory.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~196-~196: The official name of this software platform is spelled with a capital “H”.
Context: ...son 3. [ ] Create remediation script (.github/scripts/validation/remediate-labels.cjs...
(GITHUB)
📍 Affects 2 files
.github/reports/label-prefix-audit/README.md#L181-L207(this comment).github/reports/label-prefix-audit/REMEDIATION_PLAN.md#L296-L328.github/reports/label-prefix-audit/REMEDIATION_PLAN.md#L569-L574
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/README.md around lines 181 - 207, Define
one consistent executable script location and apply it across all references. In
.github/reports/label-prefix-audit/README.md lines 181-207, align creation paths
with the documented execution commands; in REMEDIATION_PLAN.md lines 296-328,
update audit script __dirname paths to resolve .github/labels.yml and
.github/reports/; and in REMEDIATION_PLAN.md lines 569-574, write remediation
results to the documented report directory. Ensure the creation instructions,
embedded paths, output paths, and commands all use the same contract.
| const bareLabels = issue.labels | ||
| .map((l) => (typeof l === "string" ? l : l.name)) | ||
| .filter((label) => !label.includes(":")); | ||
|
|
||
| if (bareLabels.length === 0) { | ||
| continue; // Skip issues with no bare labels | ||
| } |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Handle all violation types before claiming zero violations.
The audit records both bare-label and non-canonical violations, but the remediation script filters only labels without :. Prefixed labels that are not canonical remain. Handle both classes or narrow the audit and acceptance criteria.
Also applies to: 728-733
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/REMEDIATION_PLAN.md around lines 509 -
515, Update the remediation logic around bareLabels so it processes both
bare-label and non-canonical violations recorded by the audit, rather than
filtering only labels without “:”. Ensure the zero-violations check and related
acceptance criteria reflect all violation types, including prefixed labels that
are not canonical.
| for (const bareLabel of bareLabels) { | ||
| if (bareToCanonical[bareLabel]) { | ||
| toAdd.push(bareToCanonical[bareLabel]); | ||
| toRemove.push(bareLabel); | ||
| } else { | ||
| results.errors.push({ | ||
| issue: issueNum, | ||
| label: bareLabel, | ||
| error: "No mapping found", | ||
| }); | ||
| } |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Fail the remediation run when mapping errors exist.
The script records unmapped labels in results.errors but still exits successfully. Automation can treat a partial remediation as complete. Exit with a non-zero status when errors exist and report the failed issue count.
Also applies to: 568-583
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/REMEDIATION_PLAN.md around lines 521 -
531, Update the remediation script’s completion flow after processing bare
labels so any entries in results.errors cause a non-zero exit status instead of
successful completion. Report the number of failed issues, while preserving the
existing mapping-error collection in the bareLabels loop and applying the same
behavior to the corresponding logic around the additional referenced section.
| ### 3.1 Update Template-Enforcement Workflow | ||
|
|
||
| **File**: `.github/workflows/template-enforcement.yml` | ||
| **Change**: Add step to validate label prefixes before letting issues proceed | ||
|
|
||
| **Action**: Add new job: | ||
|
|
||
| ```yaml | ||
| label-validation: | ||
| name: Validate Label Prefixes | ||
| runs-on: ubuntu-latest | ||
| if: github.event_name == 'issues' && github.event.action == 'opened' | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Load Canonical Labels | ||
| id: load-labels | ||
| run: | | ||
| LABELS=$(grep -oP "name: \K['\"]?[^'\"]*['\"]?" .github/labels.yml | tr '\n' '|' | sed 's/|$//') | ||
| echo "canonical=$LABELS" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Validate Issue Labels | ||
| env: | ||
| ISSUE_LABELS: ${{ toJSON(github.event.issue.labels) }} | ||
| CANONICAL: ${{ steps.load-labels.outputs.canonical }} | ||
| run: | | ||
| node .github/scripts/validation/validate-issue-labels.cjs | ||
| ``` |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Do not describe post-creation checks as pre-creation enforcement.
The proposed job runs on issues.opened, after GitHub creates the issue. It can report or clean up labels, but it cannot prevent creation. Use a creation wrapper or API gate for blocking, or change the acceptance criteria to post-creation detection.
Also applies to: 709-715, 735-740
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/REMEDIATION_PLAN.md around lines 606 -
634, Update the “Update Template-Enforcement Workflow” plan to stop describing
the issues.opened job as pre-creation enforcement. Either specify a creation
wrapper/API gate that validates labels before issue creation, or revise the
acceptance criteria and workflow description to explicitly treat
label-validation as post-creation detection or cleanup; apply the same
correction to the related sections.
| ## 1. Complete Workflow Inventory | ||
|
|
||
| ### Label Management Workflows (4) | ||
|
|
||
| | Workflow | Trigger | Purpose | Status | | ||
| |----------|---------|---------|--------| | ||
| | `labeling.yml` | Push/PR/issue event | Unified labeling agent for issues, PRs, discussions | Active | | ||
| | `labeling-governance.yml` | Push/PR/issue event | Extended labeling + dependabot security + cleanup | Active | | ||
| | `issue-labeling-automation.yml` | Daily 02:00 UTC / manual | Backfill labels for unlabeled issues (7+ days old) | Active | | ||
| | `manage-blocking-status-labels.yml` | Daily 09:00 UTC / event | Auto-apply/remove `status:blocked` based on blockers | Active | | ||
|
|
||
| ### Issue Management Workflows (7) | ||
|
|
||
| | Workflow | Trigger | Purpose | Status | | ||
| |----------|---------|---------|--------| | ||
| | `issues.yml` | Issue open/edit/reopen | Custom issue processing logic | Active | | ||
| | `issue-create-from-template.yml` | Manual dispatch | Create issues from 24 canonical templates | Active | | ||
| | `issue-create-enhanced.yml` | Manual dispatch? | Enhanced issue creation (details unclear) | Active | | ||
| | `issue-fields-backfill.yml` | Manual dispatch? | Backfill/sync issue field data | Active | | ||
| | `issue-health-audit.yml` | Manual dispatch? | Audit and report issue health/status | Active | | ||
| | `issue-project-field-sync.yml` | Event-driven? | Sync issue fields with project board | Active | | ||
| | `issue-remediation-bulk.yml` | Manual dispatch? | Bulk remediation/cleanup of issues | Active | | ||
|
|
||
| ### Template Enforcement Workflows (5) | ||
|
|
||
| | Workflow | Trigger | Purpose | Status | | ||
| |----------|---------|---------|--------| | ||
| | `template-enforcement.yml` | Issue/PR open/edit, push develop | Multi-job: DoR/DoD validation, label cleanup on close, block incomplete issues | Active | | ||
| | `validate-pr-template.yml` | PR event | PR-specific template validation (DoR/DoD required sections) | Active | | ||
| | `validate-issue-dod-before-close.yml` | Issue close | Prevent closing issues without DoD met | Active | | ||
| | `validate-blocking-issue-before-close.yml` | Issue close | Prevent closing issues with open blockers | Active | | ||
| | `validate-blocking-status-before-close.yml` | Issue close | Guard blocking status on issue close | Active | | ||
|
|
||
| ### AI/Feedback Validation Workflows (1) | ||
|
|
||
| | Workflow | Trigger | Purpose | Status | | ||
| |----------|---------|---------|--------| | ||
| | `ai-feedback-validation.yml` (root) | PR event | Validate AI feedback response tracking + PR-to-issue linkage | Active | | ||
|
|
||
| ### Configuration Files (Non-Workflows) (5) | ||
|
|
||
| | File | Purpose | | ||
| |------|---------| | ||
| | `.github/labels.yml` | Canonical label definitions (158 labels) | | ||
| | `.github/labeler.yml` | Automation rules (branch patterns, file changes → labels) | | ||
| | `.github/issue-types.yml` | Issue type definitions (24 types) | | ||
| | `.github/label-governance-policy.yml` | Governance/compliance rules | | ||
| | `.github/issue-fields.yml` | Issue field schema definitions | | ||
|
|
||
| **Total: 19 workflows + 5 config files = 24 assets managing labels/issues/PRs** |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Use one workflow inventory and one total.
The README reports 19 workflows, while the detailed inventory lists 17. Add the missing workflows or correct every dependent total, estimate, and consolidation target.
.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md#L27-L76: reconcile the category totals and overall count..github/reports/label-prefix-audit/README.md#L39-L44: update the root-cause summary after reconciliation.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~70-~70: The official name of this software platform is spelled with a capital “H”.
Context: ...| File | Purpose | |------|---------| | .github/labels.yml | Canonical label definitio...
(GITHUB)
[uncategorized] ~71-~71: The official name of this software platform is spelled with a capital “H”.
Context: ...ical label definitions (158 labels) | | .github/labeler.yml | Automation rules (branch...
(GITHUB)
[uncategorized] ~72-~72: The official name of this software platform is spelled with a capital “H”.
Context: ...ch patterns, file changes → labels) | | .github/issue-types.yml | Issue type definitio...
(GITHUB)
[uncategorized] ~73-~73: The official name of this software platform is spelled with a capital “H”.
Context: ...| Issue type definitions (24 types) | | .github/label-governance-policy.yml | Governan...
(GITHUB)
[uncategorized] ~74-~74: The official name of this software platform is spelled with a capital “H”.
Context: ....yml| Governance/compliance rules | |.github/issue-fields.yml` | Issue field schema ...
(GITHUB)
📍 Affects 2 files
.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md#L27-L76(this comment).github/reports/label-prefix-audit/README.md#L39-L44
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md around
lines 27 - 76, The workflow inventory in
.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md lines
27-76 must use one reconciled count: verify the category entries, add any
missing workflows or correct the category and overall totals, then update all
dependent estimates and consolidation targets. In
.github/reports/label-prefix-audit/README.md lines 39-44, revise the root-cause
summary to match the reconciled inventory and total; both files must report the
same workflow count.
| ### Current (Actual) Order: UNCLEAR ⚠️ | ||
|
|
||
| - Workflows run in GitHub's default order (alphabetical? by event time?) | ||
| - No documented precedence | ||
| - No explicit sequencing via `needs:` directives (if any) | ||
| - Risk: Race conditions, missing validations, duplicate work | ||
|
|
||
| --- | ||
|
|
||
| ## 4. Root Cause Analysis: Why Conflicts Exist | ||
|
|
||
| ### 1. Incremental Additions Without Consolidation | ||
|
|
||
| - New workflow added for each new requirement (blocking labels, health audit, etc.) | ||
| - No unified architecture defined | ||
| - Each team member adds their own workflow variant | ||
|
|
||
| ### 2. Missing Workflow Orchestration | ||
|
|
||
| - No `needs:` job dependencies to sequence workflows | ||
| - No explicit "this workflow runs AFTER that workflow" rules | ||
| - Workflows run independently without coordination |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
workflow_files=$(fd -t f -e yml -e yaml .github/workflows)
printf '%s\n' "$workflow_files" | sort
while IFS= read -r file; do
printf '\n### %s\n' "$file"
rg -n \
'^(name:|on:| [A-Za-z0-9_-]+:| needs:)|workflow_run|repository_dispatch|workflow_call' \
"$file" || true
done <<< "$workflow_files"Repository: lightspeedwp/.github
Length of output: 532
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf 'repository files under .github/workflows:\n'
find .github/workflows -maxdepth 3 -type f \( -iname '*.yml' -o -iname '*.yaml' \) 2>/dev/null | sort || true
printf '\nReport excerpt:\n'
sed -n '180,240p' .github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md
printf '\nWorkflow triggers, names, needs, and GitHub event hooks:\n'
while IFS= read -r file; do
printf '\n### %s\n' "$file"
rg -n '^(name:|on:| [A-Za-z0-9._-]+:| needs:)|workflow_run|repository_dispatch|workflow_call|workflow_dispatch|pull_request|push|pull_request_target' "$file" || true
done < <(find .github/workflows -maxdepth 3 -type f \( -iname '*.yml' -o -iname '*.yaml' \) 2>/dev/null | sort)Repository: lightspeedwp/.github
Length of output: 4039
🌐 Web query:
GitHub Actions workflows independent runs order event time alphabetical needs applies only jobs within workflow documentation
💡 Result:
In GitHub Actions, there is no guaranteed alphabetical or chronological order for the execution of independent jobs within a workflow [1][2]. By default, all jobs in a workflow run in parallel [3][4][5]. Key details regarding job execution and ordering: - Parallel Execution by Default: Jobs that do not have dependencies defined run concurrently, subject to runner availability and resource limits [3][5]. - Dependencies: To enforce a specific sequence of execution for jobs within a workflow, you must explicitly use the jobs.<job_id>.needs keyword [3][4]. This establishes a dependency chain, ensuring a job only begins after its prerequisite jobs have completed successfully [4]. - Concurrency Groups: When using the concurrency keyword to limit simultaneous runs, GitHub Actions processes queued workflow runs or jobs within that group using a first-in-first-out (FIFO) order, based on the time each one started waiting for the concurrency group [3][6]. This specifically applies to managing concurrency, not to the general scheduling or dispatch order of independent jobs across different workflows or within a single run [3][2]. - Dispatch Order: The order in which jobs are dispatched to runners is influenced by many factors, including runner availability, repository limits, and system load [2]. Consequently, GitHub does not document or guarantee a specific dispatch order based on job ID names (alphabetical) or creation time [1][2]. In summary, the needs keyword is the only documented mechanism for controlling job execution order within a workflow [3][4]. Alphabetical sorting is sometimes observed as an artifact of implementation, but it is not a documented feature or a reliable behavior to depend on for workflow logic [1].
Citations:
- 1: Matrix Jobs - Sorted for start order? actions/runner#483
- 2: Job queue/dispatch order is not described/documented github/docs#26207
- 3: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
- 4: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-jobs
- 5: https://github.github.io/actions-cheat-sheet/actions-cheat-sheet.html
- 6: https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency
Remove unsupported claims about GitHub workflow ordering.
GitHub does not define a global execution order for independently triggered workflows, so the “alphabetical or event time” line can mislead. Keep this section as clearly unsupported/unspecified, and add a consolidation design or documented cross-workflow mechanism if ordering is required.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/reports/label-prefix-audit/WORKFLOW_CONSOLIDATION_ANALYSIS.md around
lines 204 - 225, Update the “Current (Actual) Order” section to remove the
unsupported alphabetical/event-time ordering claim and clearly state that
independently triggered workflows have no guaranteed global execution order.
Preserve the unspecified-order and race-condition concerns, and add a
consolidation design or documented cross-workflow coordination mechanism
wherever ordering is required.
…e paths (#1610) - Fixed all relative paths in audit report files to use correct repo-root relative paths - Changed './.github/...' and './docs/...' to '../../../...' (3 levels up from .github/reports/label-prefix-audit/) - Updated status from '🟡 In Progress' to '✅ Complete' in LABEL_PREFIX_AUDIT_REPORT.md - Fixes: README.md, WORKFLOW_CONSOLIDATION_ANALYSIS.md, LABEL_PREFIX_AUDIT_REPORT.md, REMEDIATION_PLAN.md Resolves Copilot feedback from PR #1591 (5 suppressed comments on broken links and status inconsistency) Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
…e paths (#1610) - Fixed all relative paths in audit report files to use correct repo-root relative paths - Changed './.github/...' and './docs/...' to '../../../...' (3 levels up from .github/reports/label-prefix-audit/) - Updated status from '🟡 In Progress' to '✅ Complete' in LABEL_PREFIX_AUDIT_REPORT.md - Fixes: README.md, WORKFLOW_CONSOLIDATION_ANALYSIS.md, LABEL_PREFIX_AUDIT_REPORT.md, REMEDIATION_PLAN.md Resolves Copilot feedback from PR #1591 (5 suppressed comments on broken links and status inconsistency) Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* docs: Add label creation rules to CLAUDE.md and AGENTS.md Phase 1 remediation: Add explicit label governance to documentation. ## Changes ### CLAUDE.md - Added new "Label Creation Rules (CRITICAL)" section after Key Conventions - Includes valid label examples with required family prefixes - Documents invalid bare label examples - References canonical source (.github/labels.yml) and audit project ### AGENTS.md - Added "Label Creation for Programmatic Issue Creation" section in GitHub Template Governance - Provides step-by-step guidance for creating issues with correct labels - Includes bash example (correct vs incorrect) - References validation checklist and root cause analysis Related: Issue #1592 (Label Prefix Governance Enforcement) Closes: Phase 1 remediation step Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Address Copilot review feedback on PR #1591 — fix broken relative paths (#1610) - Fixed all relative paths in audit report files to use correct repo-root relative paths - Changed './.github/...' and './docs/...' to '../../../...' (3 levels up from .github/reports/label-prefix-audit/) - Updated status from '🟡 In Progress' to '✅ Complete' in LABEL_PREFIX_AUDIT_REPORT.md - Fixes: README.md, WORKFLOW_CONSOLIDATION_ANALYSIS.md, LABEL_PREFIX_AUDIT_REPORT.md, REMEDIATION_PLAN.md Resolves Copilot feedback from PR #1591 (5 suppressed comments on broken links and status inconsistency) Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: Correct label enforcement project link in CLAUDE.md --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Linked issues
Resolves #1592
Relates to Epic #1290
What changed
Changelog
Added
Changed
Fixed
Removed
Summary
Complete audit of label prefix governance violations affecting 100+ issues (#1500–#1600). Root cause: defective code applying bare labels instead of family-prefixed labels. Workflow analysis identified 19 workflows with 5 major conflicts. Deliverables: 4 comprehensive reports with 5-phase remediation plan.
Key Findings:
Checklist (Global DoD / PR)
Generated with Claude Code