pull-request-labels.yml

# Recommend and apply labels for new pull requests.
name: "Pull request labels"

on:
  workflow_dispatch:
    inputs:
      pull_request:
        description: "A pull request number"
        required: true
        type: number
      head_sha:
        description: "The pull request head SHA at dispatch time"
        required: false
        type: string

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ inputs.pull_request }}
  cancel-in-progress: true

env:
  UV_LOCKED: 1

jobs:
  labels:
    if: github.repository == 'astral-sh/uv' || github.repository == 'astral-sh/uv-dev'
    runs-on: ${{ github.repository_owner == 'astral-sh' && 'github-ubuntu-24.04-x86_64-4' || 'ubuntu-latest' }}
    environment:
      name: automations
      deployment: false
    timeout-minutes: 15
    permissions:
      contents: read
      issues: read
      pull-requests: read
    outputs:
      result: ${{ steps.labels.outputs.final-message }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          persist-credentials: false

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.head_sha || format('refs/pull/{0}/head', inputs.pull_request) }}
          path: pull-request
          persist-credentials: false

      - name: "Collect pull request context"
        working-directory: pull-request
        run: |
          # Remove potential PR-controlled paths for label configuration.
          rm -f .pull-request-labels-event.json .pull-request-labels.json
          gh pr view "$PULL_REQUEST_NUMBER" \
            --repo "$GITHUB_REPOSITORY" \
            --json number,title,body,author,baseRefName,headRefName,isDraft,labels,files,additions,deletions,changedFiles \
            > .pull-request-labels-event.json
          gh label list \
            --repo "$GITHUB_REPOSITORY" \
            --limit 1000 \
            --json name,description \
            | jq --slurpfile allowed "$GITHUB_WORKSPACE/.github/allowed-pull-request-labels.json" \
              '[.[] | select(.name as $label | $allowed[0] | index($label))]' \
            > .pull-request-labels.json
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PULL_REQUEST_NUMBER: ${{ inputs.pull_request }}

      - name: "Determine pull request labels"
        id: labels
        uses: openai/codex-action@c05cfd74ad95c626cdf05c6685e62becc3bf7813
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          codex-version: "0.157.1"
          working-directory: "${{ github.workspace }}/pull-request"
          codex-home: "${{ github.workspace }}/agents/codex"
          permission-profile: "pull-request-labels"
          safety-strategy: drop-sudo
          allow-bot-users: "astral-automations-bot[bot]"
          prompt-file: "${{ github.workspace }}/agents/prompts/pull-request-labels.md"
          output-schema-file: "${{ github.workspace }}/agents/schemas/pull-request-labels.json"

  report:
    needs: labels
    if: needs.labels.outputs.result != ''
    runs-on: ${{ github.repository_owner == 'astral-sh' && 'github-ubuntu-24.04-x86_64-4' || 'ubuntu-latest' }}
    permissions: {}
    steps:
      - name: "Write label recommendations"
        run: printf '%s\n' "$LABEL_RESULT" >> "$GITHUB_STEP_SUMMARY"
        env:
          LABEL_RESULT: ${{ needs.labels.outputs.result }}

  validate:
    needs: labels
    if: >-
      github.repository == 'astral-sh/uv-dev' &&
      needs.labels.outputs.result != ''
    runs-on: ${{ github.repository_owner == 'astral-sh' && 'github-ubuntu-24.04-x86_64-4' || 'ubuntu-latest' }}
    permissions: {}
    outputs:
      labels: ${{ steps.validate.outputs.labels }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          persist-credentials: false

      - name: "Validate recommended labels"
        id: validate
        run: |
          if ! labels=$(jq --exit-status --compact-output --slurp \
            --slurpfile allowed .github/allowed-pull-request-labels.json '
              select(length == 1)
              | .[0]
              | select(type == "object")
              | .labels
              | select(type == "array" and length <= 3)
              | select(length == (unique | length))
              | select(all(.[];
                  type == "string"
                  and (. as $label | $allowed[0] | index($label) != null)))
            ' <<< "$LABEL_RESULT"); then
            echo "Codex recommended an invalid or disallowed pull request label." >&2
            exit 1
          fi

          echo "labels=$labels" >> "$GITHUB_OUTPUT"
        env:
          LABEL_RESULT: ${{ needs.labels.outputs.result }}

  apply:
    needs: validate
    if: >-
      needs.validate.outputs.labels != '' &&
      fromJSON(needs.validate.outputs.labels)[0] != null
    runs-on: ${{ github.repository_owner == 'astral-sh' && 'github-ubuntu-24.04-x86_64-2' || 'ubuntu-slim' }}
    environment:
      name: automations
      deployment: false
    timeout-minutes: 5
    permissions:
      id-token: write # for the repository label credential broker
    steps:
      - name: "Get repository label token"
        id: token
        uses: astral-sh/github-actions/simple-token-service@eb81cf4d13127c3f9539f621c17e4c65327636c8
        with:
          exchange-url: ${{ secrets.STS_API_URL }}/exchange
          audience: ${{ secrets.STS_API_URL }}
          repository: ${{ github.repository }}
          permissions: |
            pull_requests: write

      - name: "Apply recommended labels"
        run: |
          # POST adds labels without removing any labels already on the pull request.
          jq --null-input --argjson labels "$LABELS" '{labels: $labels}' \
            | gh api \
                --method POST \
                "repos/$GITHUB_REPOSITORY/issues/$PULL_REQUEST_NUMBER/labels" \
                --input - \
                --silent
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
          LABELS: ${{ needs.validate.outputs.labels }}
          PULL_REQUEST_NUMBER: ${{ inputs.pull_request }}