Skip to content

revert-oracle renders capability gaps as findings about the PR (umbrella: #4050, #4085, #4104, #4107, #4108) #182

revert-oracle renders capability gaps as findings about the PR (umbrella: #4050, #4085, #4104, #4107, #4108)

revert-oracle renders capability gaps as findings about the PR (umbrella: #4050, #4085, #4104, #4107, #4108) #182

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
name: Label authority
# GitHub rulesets protect branches and Git tags, not issue/PR labels. This
# trusted-base workflow supplies the missing per-label ACL for the two labels
# that steer the issue queue. `pull_request_target` is safe here because it
# checks out and executes only the default branch and never PR code.
on:
issues:
types: [labeled]
pull_request_target:
types: [labeled]
permissions:
contents: read
# BOTH SCOPES, and `pull-requests: write` is not redundant with `issues:
# write`. Measured on this repo 2026-08-31: `issues: write` alone returns 403
# when the target is a PULL REQUEST, on the REST
# `DELETE /repos/{o}/{r}/issues/{n}/labels/{name}` endpoint this script uses
# as well as through GraphQL. A label is an issue resource; a pull request is
# not enough of an issue for it. GitHub's
# `x-accepted-github-permissions: issues=write; pull_requests=write` reads
# like OR and does not behave like it.
#
# This matters most where the job matters most: `escapeLabel` (`unqueued`) is
# applied to PULL REQUESTS to waive the queue, so without this line the
# enforcer 403s on precisely the label with the highest blast radius, reports
# REMOVE_FAILED, and leaves the label attached.
issues: write
pull-requests: write
concurrency:
group: label-authority-${{ github.event.issue.number || github.event.pull_request.number }}
cancel-in-progress: false
jobs:
enforce:
name: Label authority
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.repository.default_branch }}
persist-credentials: false
lfs: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 22
- name: Test the guard
run: node --test scripts/enforce-pipeline-labels.test.mjs
- name: Enforce protected-label authority
env:
GH_TOKEN: ${{ github.token }}
run: node scripts/enforce-pipeline-labels.mjs