chore(deps): bump release-drafter/release-drafter/autolabeler from 7.4.0 to 7.5.1

[dependabot]

Bumps release-drafter/release-drafter/autolabeler from 7.4.0 to 7.5.1.

Release notes

Sourced from release-drafter/release-drafter/autolabeler's releases.

v7.5.1

What's Changed

Bug Fixes

• fix: use PR changed files as the source of truth for path filtering (#1640) @​cchanche

Full Changelog: release-drafter/release-drafter@v7.5.0...v7.5.1

v7.5.0

What's Changed

New

• feat: align increments to semver lib from 0.0.0 (#1636) @​cchanche

Bug Fixes

• fix: require actual matches for category mode only (#1639) @​cchanche

Dependency Updates

• build(deps): bump undici from 6.24.1 to 6.27.0 (#1637) @dependabot[bot]

Full Changelog: release-drafter/release-drafter@v7.4.0...v7.5.0

Commits

• 4d75298 chore: release v7.5.1
• 87be2bf fix: use PR changed files as the source of truth for path filtering (#1640)
• 73b95fa chore: release v7.5.0
• 46fd415 Fix/align increments to semver lib from 0.0.0 (#1636)
• ee02572 chore: upgrade various deps
• cd91445 build(deps): bump undici from 6.24.1 to 6.27.0 (#1637)
• 33c969b fix: require actual matches for category mode only (#1639)
• 5d6d314 ci: support label 'dependencies' for dependabot
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 8, 2026, 2:14 PM ET / 18:14 UTC.

Summary
The PR updates the release-drafter autolabeler GitHub Action pin in .github/workflows/release-drafter.yml from the v7.4.0 commit to the v7.5.1 commit.

Reproducibility: not applicable. this is a Dependabot GitHub Actions update, not a reported bug. The relevant checks are the workflow diff, upstream compare, and a future autolabel run after merge.

Review metrics: 2 noteworthy metrics.

• Workflow files changed: 1 workflow changed. The only repository file touched controls PR autolabeling automation.
• Upstream commits included: 8 commits ahead of current pin. The one-line repo diff still pulls in bundled Action code and dependency updates from upstream.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Have a workflow owner review the upstream v7.5.1 Action changes, ideally alongside chore(deps): bump release-drafter/release-drafter from 7.4.0 to 7.5.1 #56.

Risk before merge

• [P1] The bumped Action will execute new upstream bundled JavaScript for future pull_request_target autolabel runs with pull-requests: write; current green checks do not prove the post-merge workflow revision.
• [P1] chore(deps): bump release-drafter/release-drafter from 7.4.0 to 7.5.1 #56 updates adjacent release-drafter Action references to the same upstream release, so maintainers may want the two bumps reviewed or landed together intentionally.

Maintainer options:

1. Accept the autolabeler Action bump (recommended)
   A workflow owner can accept the updated upstream Action code because the ref remains SHA-pinned and workflow permissions do not expand.
2. Coordinate with the adjacent release-drafter update
   Review and land this with chore(deps): bump release-drafter/release-drafter from 7.4.0 to 7.5.1 #56 if maintainers want the workflow to avoid a mixed release-drafter version state.

Next step before merge

• [P2] A workflow-owner review is needed to accept the third-party Action update under pull_request_target; there is no mechanical code repair for ClawSweeper to make.

Maintainer decision needed

• Question: Should the workflow code owner accept this v7.5.1 autolabeler Action bump under the existing pull_request_target workflow?
• Rationale: The patch is mechanically narrow, but it changes executed third-party automation code; green checks and ClawSweeper cannot decide repository risk tolerance for that workflow surface.
• Likely owner: openclaw/openclaw-secops — CODEOWNERS assigns workflow and release automation changes to this owner handle.
• Options:
  • Approve the pinned autolabeler bump (recommended): Accept the verified upstream v7.5.1 commit under the existing permissions and merge after normal workflow-owner review.
  • Review with the sibling release-drafter bump: Evaluate this together with chore(deps): bump release-drafter/release-drafter from 7.4.0 to 7.5.1 #56 so all release-drafter references move to the same upstream release intentionally.
  • Hold or recreate as a grouped update: Pause this one-off bump if maintainers prefer a single coordinated dependency update for all release-drafter references.

Security
Cleared: No concrete supply-chain defect was found: the Action ref remains SHA-pinned, workflow permissions are unchanged, and the upstream v7.5.1 tag verifies to the target commit.

Review details

Best possible solution:

Have openclaw/openclaw-secops review the upstream v7.5.1 release and land this SHA-pinned autolabeler bump, preferably coordinated with #56 if maintainers want all release-drafter references aligned.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a Dependabot GitHub Actions update, not a reported bug. The relevant checks are the workflow diff, upstream compare, and a future autolabel run after merge.

Is this the best way to solve the issue?

Yes, for the dependency-maintenance goal: updating the existing SHA-pinned autolabeler reference is the narrowest repo change, with maintainer acceptance of the upstream automation change still required.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 7754b9d416df.

Label changes

Label justifications:

• P3: This is a small dependency-maintenance PR for repository automation rather than a user-facing runtime change.
• merge-risk: 🚨 automation: The bumped third-party Action runs future PR autolabeling, and current green checks do not execute the post-merge workflow revision.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: Dependabot-authored GitHub Actions dependency PRs are bot maintenance updates, so contributor real-behavior proof is not required.

Evidence reviewed

What I checked:

• Current workflow pin: Current main still pins the autolabeler step to ed4bc48ec97379be2258e7b7ac2624a3e26ab809, so the requested bump is not already implemented. (.github/workflows/release-drafter.yml:30, 7754b9d416df)
• PR diff: The PR changes only the autolabeler uses: line to release-drafter/release-drafter/autolabeler@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e. (.github/workflows/release-drafter.yml:30, d622f6701655)
• Workflow execution context: The autolabeler runs on pull_request_target with pull-requests: write, so the dependency bump changes automation that will execute on future PR events. (.github/workflows/release-drafter.yml:8, 7754b9d416df)
• Upstream tag verification: The upstream v7.5.1 tag dereferences to commit 4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e and GitHub reports the tag verification as valid. (4d75298e00d9)
• Upstream compare scope: The upstream compare from the current pin to v7.5.1 is eight commits ahead and includes bundled dist/actions/autolabeler/run.js changes plus dependency updates. (4d75298e00d9)
• Workflow ownership: CODEOWNERS routes .github/workflows/ changes to @openclaw/openclaw-secops. (.github/CODEOWNERS:5, 7754b9d416df)

Likely related people:

• openclaw/openclaw-secops: CODEOWNERS explicitly routes .github/workflows/ changes to this owner handle. (role: workflow code owner; confidence: high; commits: 5637c35da08a; files: .github/CODEOWNERS, .github/workflows/release-drafter.yml)
• steipete: The release-drafter workflow and CODEOWNERS routing appear in the release-preparation commit that introduced this automation surface. (role: introduced workflow; confidence: high; commits: 5637c35da08a; files: .github/workflows/release-drafter.yml, .github/CODEOWNERS)
• vincentkoc: Authored the recent commit that narrowed permissions and hardened the release-drafter workflow area. (role: recent workflow hardening contributor; confidence: high; commits: ad9246b8c9dc; files: .github/workflows/release-drafter.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-01T03:02:14.447Z sha d622f67 :: needs maintainer review before merge. :: none