chore: make labels.yml enforceable and reconcile it with reality

[jan-kubica]

labels.yml opened with # Sync to repos using: gh workflow run label-sync.yml. That workflow does not exist in this repository and never has, so the manifest has only ever been applied to stella/stella, by hand.

Measured drift before the change:

repo	labels	missing from manifest
stella	42	3
stella-infra, marketing, folio, ai-shared, tooling, cla, provenance, skillguard	9	21
anonymize, text-search	10	20

Ten active repos carry nothing but the GitHub defaults.

Design: no stored credentials

A reusable workflow that a repo opts into with a thin caller, matching pr-lint and audit-branch-protection. Each run uses the calling repo's own GITHUB_TOKEN with issues: write, which is minted per job, expires with it, and cannot reach outside that repository.

This deliberately avoids an org-wide dispatcher holding a GitHub App private key. A stored key is a long-lived credential with org-wide write reach, kept to make a convenience feature work; the blast radius of a leak is every repository. Here there is no secret to leak and no way for a run to touch a repo that did not invoke it. audit-branch-protection needs an App because reading org rulesets requires org-level permission. Label sync only ever writes to its own repo, so it does not.

The manifest is fetched from this repository, which is public, so that read needs no authentication either. Sparse checkout pulls only labels.yml and the script.

Modes

A mode input rather than a boolean, since the choice is not yes/no:

• plan (default) reports the diff and writes nothing
• apply creates missing labels and corrects colors and descriptions
• apply-with-prune additionally deletes labels absent from the manifest

Prune skips any label still applied to an issue or pull request. The manifest is a floor, not a whitelist: repos legitimately carry labels beyond the baseline (react-doctor: *, 📝 docx-editor, agent-feedback), and those must survive. Without that guard a prune run would have stripped roughly 900 label applications from stella/stella alone.

Opt-in per repo also solves scoping: the manifest still mixes org-wide labels with app-specific ones (📬 outlook plugin, 🧮 table), and pushing those into the Rust package repos would be noise. Splitting the manifest into a baseline plus overlays is the follow-up; until then a repo only gets labels if it asks.

Manifest corrections

pr-lint.yml labels every PR in the org from its conventional-commit type (feat/refactor → enhancement, fix → bug, plus docs, chore, perf). None of those five were declared, so ytanikin/PRConventionalCommits created them ad hoc wherever it ran. That is why stella/stella ended up with bug at #747e01 and docs at #3b222f. They are now declared with deliberate colors, and the sync corrects the existing ones in place.

Also drops the three priority labels and documentation, superseded by org issue fields and by docs. Both are already removed from stella/stella; declaring the removal stops the sync recreating them.

Verification

plan run locally against stella/stella:

=== stella/stella
  + create  💬 chat
  + create  📝 word plugin
  ~ update  🧮 table (description "Tabular review" -> "Table view feature")
  ~ update  enhancement (description "" -> "New feature or improvement")
  ~ update  bug (color #747e01 -> #d73a4a, description "" -> "Something is not working")
  ~ update  docs (color #3b222f -> #0075ca, description "" -> "Documentation only")
  ~ update  chore (description "" -> "Maintenance work with no user-facing change")
  ~ update  perf (description "" -> "Performance work")

create=2 update=6 prune=0 keep=0 mode=plan

shellcheck clean. No secrets to provision before merge.

Once this is on main, repos opt in with:

name: Label Sync
on:
  workflow_dispatch:
    inputs:
      mode: { type: string, default: plan }
jobs:
  sync:
    uses: stella/.github/.github/workflows/label-sync.yml@main
    with:
      mode: ${{ inputs.mode }}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.