Update milestone and label workflows for maintainers, developers, and bots#3342
Update milestone and label workflows for maintainers, developers, and bots#3342mergify[bot] merged 3 commits intomainfrom
Conversation
Co-authored-by: BornToBeRoot <16019165+BornToBeRoot@users.noreply.github.com>
|
@copilot Can you also add a workflow for transifex, dependabot, imgbot to add the label |
Co-authored-by: BornToBeRoot <16019165+BornToBeRoot@users.noreply.github.com>
Done in c115055. Added |
There was a problem hiding this comment.
Pull request overview
Updates GitHub Actions automation so PRs from trusted maintainers/developers and common bots get consistent milestone/label management, and removes duplicated Dependabot label configuration.
Changes:
- Broaden
milestone.ymlto assign thenext-releasemilestone for maintainer/developer PRs in addition to bot PRs. - Add a new
label.ymlworkflow to apply the:heavy_check_mark: dependencieslabel to bot-authored PRs. - Remove Dependabot
labelsconfiguration now that labeling is handled via workflow.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/milestone.yml | Expands author filter and updates workflow name for milestone assignment. |
| .github/workflows/label.yml | New workflow to apply the dependencies label to bot PRs. |
| .github/dependabot.yml | Removes duplicate label settings now handled by label.yml. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if: contains(fromJSON('["dependabot[bot]", "transifex-integration[bot]", "imgbot[bot]", "Copilot", "BornToBeRoot"]'), github.event.pull_request.user.login) | ||
| permissions: | ||
| issues: write | ||
| pull-requests: write |
There was a problem hiding this comment.
The job requests both issues: write and pull-requests: write, but the script only calls the Issues API (listMilestones / issues.update). Consider dropping pull-requests: write here to follow least-privilege permissions.
| pull-requests: write |
| @@ -0,0 +1,25 @@ | |||
| name: Assign label to PRs | |||
There was a problem hiding this comment.
This workflow name is quite generic, but the workflow only assigns a single, specific label (dependencies). Renaming it to something like "Assign dependencies label" would make it easier to identify in the Actions UI and in audit logs.
| name: Assign label to PRs | |
| name: Assign dependencies label |
| if: contains(fromJSON('["dependabot[bot]", "transifex-integration[bot]", "imgbot[bot]"]'), github.event.pull_request.user.login) | ||
| permissions: | ||
| issues: write | ||
| pull-requests: write |
There was a problem hiding this comment.
The job grants pull-requests: write, but the step only uses github.rest.issues.addLabels (Issues API). Consider removing pull-requests: write and keeping only issues: write to minimize the token’s scope.
| pull-requests: write |
The
milestone.ymlworkflow only auto-assigned thenext-releasemilestone for bot-authored PRs. This extends it to also trigger for PRs opened by project maintainers/developers. Additionally, a newlabel.ymlworkflow centralizes dependency label assignment for bot PRs, replacing the duplicate label configuration independabot.yml.Changes proposed in this pull request
"Assign milestone to automated PRs"→"Assign milestone to PRs"to reflect the broader scopeBornToBeRootto the allowed PR authors list inmilestone.ymlso thenext-releasemilestone is also assigned to maintainer/developer PRs.github/workflows/label.ymlworkflow that assigns the:heavy_check_mark: dependencieslabel to PRs opened bydependabot[bot],transifex-integration[bot], andimgbot[bot]labelsentries from all three package ecosystems (nuget,dotnet-sdk,npm) in.github/dependabot.ymlsince label assignment is now handled by the new workflowRelated issue(s)
Copilot generated summary
Copilot summary
Three GitHub configuration files were updated.
milestone.ymlwas renamed from "Assign milestone to automated PRs" to "Assign milestone to PRs" and extended to includeBornToBeRootin its author filter, so thenext-releasemilestone is automatically assigned to maintainer PRs as well as bot PRs. A newlabel.ymlworkflow was added that triggers onpull_request_targetfor opened/reopened events and usesactions/github-script@v7to add the:heavy_check_mark: dependencieslabel to PRs fromdependabot[bot],transifex-integration[bot], andimgbot[bot]. Correspondingly, thelabelsfield was removed from all three package ecosystem entries independabot.ymlto eliminate the now-duplicate label configuration.To-Do
Contributing
By submitting this pull request, I confirm the following:
🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.