Add PR vouch workflow with trust-status labels

[t3dotgg]

Summary

• Add a new PR Vouch GitHub Actions workflow to classify PR authors as trusted, unvouched, or denounced.
• Introduce managed vouch:* PR labels and keep them in sync automatically (vouch:trusted, vouch:unvouched, vouch:denounced).
• Add .github/VOUCHED.td as the repository trust/denouncement list for external contributors.
• Support rechecks via issue comments containing /recheck-vouch and bulk relabeling when vouch config changes on main.
• Document the new trust-label behavior in CONTRIBUTING.md for contributor clarity.

Testing

• Not run (workflow behavior validated by code inspection of trigger paths and label sync logic).
• Confirmed workflow triggers cover:
• pull_request_target on opened, reopened, synchronize, ready_for_review
• issue_comment on created with /recheck-vouch
• push to main when .github/VOUCHED.td or workflow file changes
• Confirmed labeling logic preserves non-managed labels and applies exactly one managed vouch:* label per PR.

Note

Add PR vouch workflow to auto-label pull requests with trust-status labels using .github/VOUCHED.td

Introduce a GitHub Actions workflow that selects PRs from events and labels them as vouch:trusted, vouch:unvouched, or vouch:denounced using mitchellh/vouch/action/check-user@v1; add a trust list in .github/VOUCHED.td and document labeling in CONTRIBUTING.md.

📍Where to Start

Start with collect-targets and label jobs in .github/workflows/pr-vouch.yml to see event handling and label application logic.

^{Macroscope summarized 83741e3.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: aafded34-fc84-49dc-b7a9-c14c060b78e8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch t3code/implement-vouch-pr-labeling

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[binbandit]

Would it be worth pre-filling with everyone who has already contributed?