revert-oracle renders capability gaps as findings about the PR (umbrella: #4050, #4085, #4104, #4107, #4108) #182
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This Source Code Form is subject to the terms of the Mozilla Public | |
| # License, v. 2.0. If a copy of the MPL was not distributed with this | |
| # file, You can obtain one at https://mozilla.org/MPL/2.0/. | |
| name: Label authority | |
| # GitHub rulesets protect branches and Git tags, not issue/PR labels. This | |
| # trusted-base workflow supplies the missing per-label ACL for the two labels | |
| # that steer the issue queue. `pull_request_target` is safe here because it | |
| # checks out and executes only the default branch and never PR code. | |
| on: | |
| issues: | |
| types: [labeled] | |
| pull_request_target: | |
| types: [labeled] | |
| permissions: | |
| contents: read | |
| # BOTH SCOPES, and `pull-requests: write` is not redundant with `issues: | |
| # write`. Measured on this repo 2026-08-31: `issues: write` alone returns 403 | |
| # when the target is a PULL REQUEST, on the REST | |
| # `DELETE /repos/{o}/{r}/issues/{n}/labels/{name}` endpoint this script uses | |
| # as well as through GraphQL. A label is an issue resource; a pull request is | |
| # not enough of an issue for it. GitHub's | |
| # `x-accepted-github-permissions: issues=write; pull_requests=write` reads | |
| # like OR and does not behave like it. | |
| # | |
| # This matters most where the job matters most: `escapeLabel` (`unqueued`) is | |
| # applied to PULL REQUESTS to waive the queue, so without this line the | |
| # enforcer 403s on precisely the label with the highest blast radius, reports | |
| # REMOVE_FAILED, and leaves the label attached. | |
| issues: write | |
| pull-requests: write | |
| concurrency: | |
| group: label-authority-${{ github.event.issue.number || github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| jobs: | |
| enforce: | |
| name: Label authority | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.repository.default_branch }} | |
| persist-credentials: false | |
| lfs: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Test the guard | |
| run: node --test scripts/enforce-pipeline-labels.test.mjs | |
| - name: Enforce protected-label authority | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: node scripts/enforce-pipeline-labels.mjs |