forked from heavy-duty/ceremony
d0a0989a21
Label definitions need write; the agents team is triage on purpose, and the Actions GITHUB_TOKEN is how the family converges label taxonomies without granting any agent identity write (box/rig/cast labels.yml precedent). Deletable the day #10 lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
61 lines
3.4 KiB
YAML
61 lines
3.4 KiB
YAML
name: labels-bootstrap
|
|
# INTERIM — delete when #10 (the reusable labels workflow) lands: its
|
|
# bootstrap dispatch carries this same table and replaces this file.
|
|
#
|
|
# Why a job at all (the family's pattern — box/rig/cast labels.yml): label
|
|
# DEFINITIONS (create/edit) need write, and the agents team is deliberately
|
|
# triage-only — "only humans merge" as permission model, not doctrine. The
|
|
# Actions GITHUB_TOKEN is the repo's own token, so this workflow converges
|
|
# the taxonomy without granting any agent identity write. Run it from the
|
|
# Actions tab (workflow_dispatch needs write — the maintainer's click).
|
|
#
|
|
# The table is LABELS.md made executable; --force makes every row an
|
|
# upsert, so re-runs converge names, colors AND descriptions idempotently.
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
issues: write
|
|
|
|
jobs:
|
|
bootstrap:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: converge the label taxonomy (LABELS.md)
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
while IFS='|' read -r name color desc; do
|
|
[ -n "$name" ] || continue
|
|
gh label create "$name" -R "$GITHUB_REPOSITORY" --color "$color" --description "$desc" --force
|
|
done <<'EOF'
|
|
state:building|FBCA04|PR is a draft — the builder is still building
|
|
state:bots-reviewing|1D76DB|Waiting on the reviewer panel to finish the round
|
|
state:addressing|D93F0B|Round complete without full approval — builder owes the single reply + fixes
|
|
state:needs-human|8250DF|Zero blockers, panel approved the current head — a human could merge now
|
|
blocker:conflict|B60205|Does not merge — the builder owes a rebase
|
|
blocker:ci-red|B60205|A check is failing — the builder owes a fix (not a rebase)
|
|
blocker:unrequested|E99695|Somebody still owes a verdict and nobody was asked
|
|
blocker:drill-pending|B60205|A release PR whose version has no drills/X.Y.Z.md record — correct but unevidenced
|
|
stale|B60205|No activity for 48h — sweep-managed, never hand-applied
|
|
blocked|6A737D|Waiting on another issue or PR to land first
|
|
release|0E8A16|Release flow, versioning, packaging work
|
|
merge-next|0E8A16|Head of the merge queue — merge this one next
|
|
needs-triage|FBCA04|Did not come through triage — owes normalization or conversion to a discussion
|
|
ready|0E8A16|Triaged, spec complete, unblocked — a builder can start now and succeed
|
|
claimed|1D76DB|A builder owns it: assignee set, draft PR expected shortly
|
|
epic|5319E7|Organizes other issues via a dependency-ordered task list — builders never pick it
|
|
scope:release-flow|C5DEF5|The reusable release workflow, decide, the doors
|
|
scope:guards|C5DEF5|changelog-armed / changelog-monotonic / drill-recorded
|
|
scope:labels|C5DEF5|The labels workflow, reconciler, the taxonomy
|
|
scope:docs|C5DEF5|README doctrine, CONSUMERS.md, the role files
|
|
EOF
|
|
- name: default labels that are not part of the taxonomy are deleted
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
# delete is not an upsert: already-gone exits non-zero — swallow it
|
|
# so re-runs converge instead of erroring after first success.
|
|
for L in duplicate invalid question wontfix "help wanted" "good first issue"; do
|
|
gh label delete "$L" -R "$GITHUB_REPOSITORY" --yes 2>/dev/null || true
|
|
done
|