fix(ci): implement issue #419 labeler hardening#427
Conversation
|
Warning Review limit reached
More reviews will be available in 49 minutes and 7 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Note
|
| Layer / File(s) | Summary |
|---|---|
Configuration schema validator implementation scripts/validation/validate-labeling-configs.cjs |
New CLI script validates .github/labels.yml, .github/issue-types.yml, and .github/labeler.yml schemas: labels and issue-types require specific array shapes with name/label fields; labeler.yml enforces each rule set contains at least one of head-branch or changed-files. Fails with exit code 1 on parse or validation errors. |
Workflow validation gate and labeler cleanup .github/workflows/labeling.yml |
Adds a "Validate labeling config schema" step that runs the new validator after npm ci, establishing a fail-fast CI gate. Removes the previously disabled actions/labeler@v5 step, leaving only the unified labeling.agent.js for label assignment. |
Documentation of workflow hardening and migration notes docs/WORKFLOWS.md, docs/AUTOMATION_GOVERNANCE.md, docs/MIGRATION.md |
WORKFLOWS.md documents the pre-label validation guardrail. AUTOMATION_GOVERNANCE.md removes the actions/labeler@v5 reference. MIGRATION.md adds a dated entry (2026-05-27) explaining the retirement of actions/labeler@v5, unified runtime location, and new CI validation gate. |
Estimated code review effort
🎯 2 (Simple) | ⏱️ ~10 minutes
Possibly related issues
- [Build/CI] Re-enable actions/labeler with canonical schema-compatible config #419: This PR directly addresses the labeler hardening and schema validation concerns by retiring actions/labeler, adding runtime schema validation for the three canonical YAML files, and centralizing label assignment to labeling.agent.js.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check | The PR description covers key changes and validation steps but lacks critical sections from the template like Risk Assessment, How to Test, and Checklist items required for release automation. | Add Risk Assessment (level and impact), How to Test section with prerequisites and test steps, and complete the global DoD checklist to meet template requirements. |
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title accurately reflects the main change: implementing issue #419 labeler hardening by removing the dormant actions/labeler step and adding schema validation. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
codex/issue-419-labeler-hardening
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands and usage tips.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request retires the native actions/labeler@v5 in favor of a unified labeling agent runtime, and introduces a fail-fast validation script (validate-labeling-configs.cjs) to verify configuration schemas before execution. The feedback suggests strengthening the validation script by adding type checks for optional label fields (such as color, description, and aliases) and verifying that head-branch and changed-files are strings or arrays of strings to prevent runtime issues.
| function assertLabelConfig(labels) { | ||
| if (!Array.isArray(labels)) { | ||
| fail(".github/labels.yml must be an array"); | ||
| } | ||
| labels.forEach((item, index) => { | ||
| if (typeof item === "string") return; | ||
| if (!item || typeof item !== "object" || typeof item.name !== "string") { | ||
| fail(`Invalid labels.yml entry at index ${index}`); | ||
| } | ||
| }); | ||
| } |
There was a problem hiding this comment.
The current validation for labels.yml only checks the presence of the name field. However, label definitions can also include color, description, and aliases (as seen in docs/AUTOMATION_GOVERNANCE.md).
Adding type checks for these fields prevents runtime issues in the labeling agent. Specifically, validating that color is a string is crucial because unquoted numeric hex colors (e.g., 123456) are parsed as numbers by js-yaml, which can corrupt the hex value.
function assertLabelConfig(labels) {
if (!Array.isArray(labels)) {
fail(".github/labels.yml must be an array");
}
labels.forEach((item, index) => {
if (typeof item === "string") return;
if (!item || typeof item !== "object" || typeof item.name !== "string") {
fail("Invalid labels.yml entry at index " + index);
}
if (item.color !== undefined && typeof item.color !== "string") {
fail("color in labels.yml entry at index " + index + " must be a string (wrap in quotes if numeric)");
}
if (item.description !== undefined && typeof item.description !== "string") {
fail("description in labels.yml entry at index " + index + " must be a string");
}
if (item.aliases !== undefined) {
if (!Array.isArray(item.aliases) || item.aliases.some(a => typeof a !== "string")) {
fail("aliases in labels.yml entry at index " + index + " must be an array of strings");
}
}
});
}
| function assertLabelerConfig(labeler) { | ||
| if (!labeler || typeof labeler !== "object" || Array.isArray(labeler)) { | ||
| fail(".github/labeler.yml must be an object map"); | ||
| } | ||
|
|
||
| for (const [label, rules] of Object.entries(labeler)) { | ||
| if (!rules || typeof rules !== "object" || Array.isArray(rules)) { | ||
| fail(`Rule for '${label}' must be an object`); | ||
| } | ||
|
|
||
| const hasHeadBranch = Object.prototype.hasOwnProperty.call( | ||
| rules, | ||
| "head-branch", | ||
| ); | ||
| const hasChangedFiles = Object.prototype.hasOwnProperty.call( | ||
| rules, | ||
| "changed-files", | ||
| ); | ||
|
|
||
| if (!hasHeadBranch && !hasChangedFiles) { | ||
| fail( | ||
| `Rule for '${label}' must include at least one of 'head-branch' or 'changed-files'`, | ||
| ); | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
The current validation for labeler.yml only checks for the presence of head-branch or changed-files keys, but does not validate their types. If these fields are misconfigured (e.g., set to a boolean, number, or an array containing non-string values), it could cause runtime errors or unexpected behavior in the labeling agent.
Adding type validation ensures that both fields are either a string or an array of strings.
function assertLabelerConfig(labeler) {
if (!labeler || typeof labeler !== "object" || Array.isArray(labeler)) {
fail(".github/labeler.yml must be an object map");
}
for (const [label, rules] of Object.entries(labeler)) {
if (!rules || typeof rules !== "object" || Array.isArray(rules)) {
fail("Rule for '" + label + "' must be an object");
}
const hasHeadBranch = Object.prototype.hasOwnProperty.call(
rules,
"head-branch"
);
const hasChangedFiles = Object.prototype.hasOwnProperty.call(
rules,
"changed-files"
);
if (!hasHeadBranch && !hasChangedFiles) {
fail(
"Rule for '" + label + "' must include at least one of 'head-branch' or 'changed-files'"
);
}
if (hasHeadBranch) {
const val = rules["head-branch"];
if (typeof val !== "string" && !Array.isArray(val)) {
fail("head-branch in rule for '" + label + "' must be a string or an array");
}
if (Array.isArray(val) && val.some(v => typeof v !== "string")) {
fail("head-branch array in rule for '" + label + "' must contain only strings");
}
}
if (hasChangedFiles) {
const val = rules["changed-files"];
if (typeof val !== "string" && !Array.isArray(val)) {
fail("changed-files in rule for '" + label + "' must be a string or an array");
}
if (Array.isArray(val) && val.some(v => typeof v !== "string")) {
fail("changed-files array in rule for '" + label + "' must contain only strings");
}
}
}
}
🔍 Reviewer Summary for PR #427CI Status: ❌ Recommendations
|
github-actions
Bot
added
status:needs-review
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/MIGRATION.md`:
- Around line 94-95: Update the prose to UK English by replacing the phrase
"labeling workflow" with "labelling workflow" while keeping code identifiers
unchanged (leave `actions/labeler@v5`, `labeler.yml` and filenames like
`labeling.agent.js` intact); edit the sentence containing "actions/labeler@v5
execution was retired from the labeling workflow..." so it reads "...retired
from the labelling workflow..." and ensure no other code tokens are modified.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: da8d6596-8c03-4180-9c43-7007fb267a1d
📒 Files selected for processing (5)
.github/workflows/labeling.ymldocs/AUTOMATION_GOVERNANCE.mddocs/MIGRATION.mddocs/WORKFLOWS.mdscripts/validation/validate-labeling-configs.cjs
| - `actions/labeler@v5` execution was retired from the labeling workflow due to | ||
| persistent schema incompatibility with the canonical `labeler.yml` structure. |
There was a problem hiding this comment.
Use UK English in prose for consistency.
Please change “labeling workflow” to “labelling workflow” in this sentence (keep code identifiers like labeling.agent.js unchanged).
As per coding guidelines, "Keep wording in UK English."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/MIGRATION.md` around lines 94 - 95, Update the prose to UK English by
replacing the phrase "labeling workflow" with "labelling workflow" while keeping
code identifiers unchanged (leave `actions/labeler@v5`, `labeler.yml` and
filenames like `labeling.agent.js` intact); edit the sentence containing
"actions/labeler@v5 execution was retired from the labeling workflow..." so it
reads "...retired from the labelling workflow..." and ensure no other code
tokens are modified.
🔍 Reviewer Summary for PR #427CI Status: ✅ Recommendations
|
🔍 Reviewer Summary for PR #427CI Status: ❌ Recommendations
|
🔍 Reviewer Summary for PR #427CI Status: ❌ Recommendations
|
github-actions
Bot
added
the
meta:needs-changelog
1 participant
Closes #419
What changed
actions/labeler@v5execution path from.github/workflows/labeling.ymlscripts/validation/validate-labeling-configs.cjsforlabels.yml,issue-types.yml, andlabeler.ymlValidation
node scripts/validation/validate-labeling-configs.cjsnpx spectral lint .github/workflows/labeling.yml --ruleset .spectral-workflows.cjsnpx markdownlint-cli2 docs/WORKFLOWS.md docs/AUTOMATION_GOVERNANCE.md docs/MIGRATION.mdSummary by CodeRabbit
Chores
Documentation