github: PR triage and issue templates, matching redstamp - #213
Conversation
deepdive labelled nothing it authored. Dependabot tagged its own PRs; everything else arrived bare, and issues had no shape to arrive in either. Ports redstamp's pr-triage.yml rather than inventing a second pattern: path labels, a size label measured on hand-written lines, self-assignment, and issue linking from the branch name. Bare-noun labels matching the family vocabulary, so a reader moving between the Own Your Stack repos meets the same words. The path map is this repo's own shape — see .github/labeler.yml. Labels say what a PR TOUCHES, never how urgent it is or whether it is ready; bug, enhancement and blocked stay judgement calls. pull_request_target, because a fork PR gets a read-only token on pull_request and labelling would silently no-op on exactly the contributions that most need triage. That event is the fork-RCE vector ONLY when a workflow checks out and runs the fork's code; this one checks out nothing. sync-labels stays false so a maintainer's manual label survives the next push.
redstamp's gating review caught that the label test was named "labels named in
the config exist in the repo label set" while never reading the repo's labels —
it parsed the config and checked lowercase, a count, and that `tests` appeared.
Delete a label, or add a rule for one nobody created, and it still passed while
actions/labeler quietly minted an undescribed default: the exact outcome its own
comment claimed to prevent.
Another session had already fixed it in redstamp, and better than my first
attempt (which only narrowed the claim). This adopts that shape rather than
shipping two answers to one question:
.github/labels.json the declared label set, generated from the live labels
labeler-config test every label labeler.yml applies is declared, and every
label an ISSUE TEMPLATE applies is declared too — the
half I had missed entirely
.github/workflows/ declared-vs-live, one `gh label list` call with a
labels.yml read-only token
The offline test checks declared-vs-applied; the workflow checks
declared-vs-live. Between them "every label this repo applies actually exists"
is proven rather than asserted, and the manifest cannot rot in silence.
Two deliberate differences from redstamp's version:
- The live check is its OWN workflow, not a job inside ci.yml. It is one API
call unrelated to building or testing the product, and a standalone file drops
into every repo in the family regardless of what that repo's ci.yml looks like.
- The issue-form count floor is 2, not 3. Every repo ships a bug and a feature
form; only a repo whose product is a DETECTOR ships the third, false-positive
form. Asserting 3 fails on every repo that has nothing to be wrong about —
caught by running it, on four repos at once.
hybrid's gating review caught that I renamed the product in the copied templates and left the content. It listed the damage precisely: a Python inference router shipped a bug form routing reporters to a false-positive template that does not exist, demanding a Node version unrelated to running it, and a PR checklist asking for `npm test` and `support/watch-accept.mjs` output in a repo with neither. Every contributor following it would be following instructions that cannot be followed. That was not one repo's slip. It was in seven of the nine PR templates and eight of the nine bug forms — find-and-replace produced files that READ fine and INSTRUCT badly, which is the failure mode of adapting a template by sed. Fixed per repo rather than by another blanket copy: - pull_request_template.md is rewritten generic: what changed, why, and how it was verified, with one checklist line naming THIS repo's actual command. Repos that already had their own template keep it. - The false-positive routing note is dropped everywhere it points at a form the repo does not have. Where the repo IS a detector it stays, reworded for what that detector actually detects — a trajectory score for plumbline, over-redaction for cordon, not "a missed injection". - The runtime field asks for what the thing runs on: Python for hybrid, the runner OS for a composite action, Node where Node is right. Verified: no `watch-accept`, `Detection change` or `missed injection` text survives outside the two repos where it belongs, and every template still parses.
sprayberry-redline
left a comment
sprayberry-redline
left a comment
There was a problem hiding this comment.
Automated review from the Sprayberry Labs fleet code reviewer.
Reviewed by GPT-5.6 (gating review).
No blocking issues found — approved.
I reviewed the complete 480-line diff, focusing on the pull_request_target trust boundary, workflow permissions, size-label and issue-link behavior, label/path consistency, and the new configuration tests. The workflow does not check out or execute contributor-controlled code, actions are SHA-pinned, API pagination and generated-file exclusions are handled, and the issue-link path validates that the referenced object is an open issue before editing the PR body.
What's good: The offline declared-vs-applied checks complement the live manifest check well, and all current CI checks are green (including actionlint, CodeQL, builds, and the live label-manifest check). The additive path-label behavior also preserves manually or Dependabot-applied labels.
sprayberry-secondread
left a comment
sprayberry-secondread
left a comment
There was a problem hiding this comment.
Automated review from the Sprayberry Labs fleet code reviewer.
Reviewed by Claude Sonnet 5 (second opinion — non-gating; the gating review is posted separately).
Verdict: no blocking issues found in this independent review.
I reviewed the 480-line GitHub triage/template addition, including the privileged pull_request_target path, its API-only execution model and scoped permissions, label-manifest reconciliation, and the configuration tests. I also ran node --test test/labeler-config.test.mjs successfully (5/5) at 6cb727b and checked that the declared labels match the current repository label set.
What's good: the triage workflow deliberately does not check out or execute pull-request code, the action references are commit-pinned, and the manifest test covers both labels applied by the path labeler and labels applied by issue forms. The template corrections also make the contributor instructions specific to this Node-based repository.
3 participants
deepdivelabelled nothing it authored. Ports redstamp'spr-triage.yml— path labels, size on hand-written lines, self-assignment, issue linking — plus issue templates, which the repo had none of.The path map follows the pipeline rather than the directory:
browser(browsing, extraction, domain filtering),llm(model calls, streaming, formatting),agent(the loop itself, confidence, citations), pluscli,bench.Splitting
llmfromagentis the useful line here — a change to prompt formatting and a change to the research loop want different reviewers' attention, and they live in adjacent files.Verified: all six YAML files parse;
node --test test/labeler-config.test.mjs→ 3/3. 12 labels created with colours and descriptions up front.Inherent: this PR won't label itself —
pull_request_targetruns the workflow from the BASE branch. The next PR is the proof.