ci: standardize issue labels across org via central sync workflow by thiras · Pull Request #1 · decdn/.github

thiras · 2026-05-11T16:58:37Z

Summary

Adds a declarative label manifest in .github/labels/ (one _core.yml shared across repos + one overlay per repo) and a sync-labels workflow that pushes the composed set to all five decdn org repos via EndBug/label-sync@v2.
First-run is purely additive (delete-other-labels: false) — adds blocked/security/dependencies to repos missing them, fills four empty descriptions on decdn/decdn, normalizes two color cases.
Updates CLAUDE.md to point future agents at the manifest as the source of truth.

Dry-run diff (per repo, names only)

Repo	Current	After	Added	Removed
decdn/decdn	29	29	—	— (plus desc fills for ADR/architecture/high/medium)
decdn/website	13	15	`blocked`, `security`	—
decdn/finance	9	15	`blocked`, `dependencies`, `economics`, `notebooks`, `parameters`, `security`	—
decdn/internal	10	16	`blocked`, `branding`, `dependencies`, `fundraising`, `legal`, `security`	—
decdn/.github	9	12	`blocked`, `dependencies`, `security`	—

Prerequisite: `LABEL_SYNC_TOKEN` secret

GITHUB_TOKEN is scoped to this repo only and cannot mutate labels on the other four repos. Before merging:

Create a fine-grained PAT (or GitHub App token) with issues:write + metadata:read on decdn/decdn, decdn/website, decdn/finance, decdn/internal, decdn/.github.
Store as a repo secret named LABEL_SYNC_TOKEN on decdn/.github.
Merge this PR. The workflow runs automatically on push to main affecting .github/labels/**.

If the secret is missing, the EndBug/label-sync step will fail with an auth error — safe to retry after adding the secret via gh workflow run sync-labels.yml.

Follow-ups (deliberately not in this PR)

PR 2: flip delete-other-labels: true once orphans have been spot-checked on each repo.
ADR label cleanup:decdn/decdn has both ADR (no description) and adr-review (described). They look redundant; consolidate after PR 2.
Color clashes on decdn/decdn (preserved from current state):critical/blocked both #b60205; adr-review/cli both #0e8a16; rust/github_actions both #000000; ADR/architecture/high/medium all #ededed. Not addressed here to keep the diff purely additive.
Priority prefix scheme (priority:critical/high/medium/low) deferred — would require relabeling existing issues.

Test plan

Add LABEL_SYNC_TOKEN secret (see above)
Merge PR
Verify the Sync issue labels workflow run shows green for all five matrix legs
Spot-check gh label list -R decdn/<repo> on at least three repos and confirm only the additions listed above appear
Open PR 2 flipping delete-other-labels: true

🤖 Generated with Claude Code

Currently each decdn org repo has its own ad-hoc label set: decdn has 29 labels (ADR, priority, scope, ...), website has 13, finance/internal/.github sit at the GH defaults. Cross-cutting concerns (security, blocked, dependencies) exist only on decdn even though they apply org-wide. Define labels declaratively in .github/labels/: a shared _core.yml and one overlay per repo. A new sync-labels workflow runs on push to labels paths or via workflow_dispatch, composing the manifest with yq and pushing to each repo via EndBug/label-sync@v2. First-run safety: delete-other-labels is false, so this PR is purely additive — adds blocked/security/dependencies to repos missing them, fills four empty descriptions on decdn (ADR/architecture/high/medium), and normalizes two label colors to lowercase. A follow-up PR flips delete-other-labels to true once orphans have been reviewed. Requires LABEL_SYNC_TOKEN repo secret with issues:write + metadata:read on all five org repos before the workflow can run. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gemini-code-assist

Code Review

This pull request introduces a centralized label management system for the organization, defining a core set of labels and repository-specific overlays in YAML format. It also updates CLAUDE.md with instructions for the label synchronization process. The review feedback highlights that the sync-labels.yml workflow file mentioned in the documentation is missing from the PR. Additionally, several suggestions were made to improve consistency in label naming conventions and the capitalization of language names in descriptions.

gemini-code-assist · 2026-05-11T16:59:58Z

 | `.github/ISSUE_TEMPLATE/`, `.github/PULL_REQUEST_TEMPLATE.md` | Default issue/PR templates for repos without their own. |
 | `workflow-templates/` | Starter workflows offered to org members in the Actions UI (these are *templates*, not workflows that run). |
+| `.github/labels/*.yml` | Source of truth for issue labels org-wide. `_core.yml` applies to all repos; each `<repo>.yml` (or `dotgithub.yml` for this repo) is an overlay. |
+| `.github/workflows/sync-labels.yml` | Org-management workflow that pushes the composed label manifest to each repo. Not repo-specific CI — runs from here because it operates org-wide. |


The workflow file .github/workflows/sync-labels.yml mentioned here is not included in this pull request. Since the PR description states that this workflow is responsible for propagating the labels to all repositories, its absence will prevent the synchronization from working as intended. Please ensure the workflow file is added to the commit.

gemini-code-assist · 2026-05-11T16:59:58Z

+- name: github_actions
+ color: '000000'
+ description: Pull requests that update GitHub Actions code


The label name github_actions uses an underscore as a separator, which is inconsistent with other custom multi-word labels in this manifest that use hyphens (e.g., adr-review, missing-decision, poc-blocking). For consistency with the established naming convention for custom labels in this repository, consider using a hyphen.
- name: github-actionscolor: '000000'description: Pull requests that update GitHub Actions code

gemini-code-assist · 2026-05-11T16:59:58Z

+ description: Medium priority issue
+- name: rust
+ color: '000000'
+ description: Pull requests that update rust code


For consistency with GitHub Actions (line 47) and general professional formatting, the language name rust should be capitalized in the description.
description: Pull requests that update Rust code

gemini-code-assist · 2026-05-11T16:59:58Z

+# Merged on top of _core.yml.
+- name: javascript
+ color: '168700'
+ description: Pull requests that update javascript code


The language name javascript should be capitalized in the description for consistency and clarity.
description: Pull requests that update JavaScript code

Copilot

Pull request overview

This PR introduces an org-wide “source of truth” for GitHub issue labels in this .github repository and adds an automation workflow to sync those labels to the decdn organization’s repos.

Changes:

Added a core label manifest plus per-repo overlay manifests under .github/labels/.
Added a sync-labels GitHub Actions workflow that composes core+overlay and syncs labels to each target repo via EndBug/label-sync@v2.
Updated CLAUDE.md to document the label manifests/workflow and the required LABEL_SYNC_TOKEN secret.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`CLAUDE.md`	Documents the new label manifest source-of-truth and the sync workflow/secret.
`.github/workflows/sync-labels.yml`	New workflow to compose core+overlay manifests and sync labels to each org repo.
`.github/labels/_core.yml`	New org-wide core label set applied to all repos.
`.github/labels/decdn.yml`	New label overlay for `decdn/decdn`.
`.github/labels/website.yml`	New label overlay for `decdn/website`.
`.github/labels/finance.yml`	New label overlay for `decdn/finance`.
`.github/labels/internal.yml`	New label overlay for `decdn/internal`.
`.github/labels/dotgithub.yml`	Empty overlay for `decdn/.github` to compose with core labels only.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+permissions: {}
+
+jobs:
+ sync:
+ runs-on: ubuntu-latest
+ strategy:
+ fail-fast: false
+ matrix:
+ repo:
+ - decdn
+ - website
+ - finance
+ - internal
+ - '.github'
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4


+ sudo wget -qO /usr/local/bin/yq \
+ https://github.com/mikefarah/yq/releases/download/v4.52.4/yq_linux_amd64
+ sudo chmod +x /usr/local/bin/yq


+To change labels on any repo in the org, edit the relevant file under `.github/labels/` — never edit labels directly in the GitHub UI, they will be reverted on the next sync.
+
+- Cross-cutting labels go in `_core.yml` (applied everywhere).
+- Stack/topic labels specific to one repo go in that repo's overlay (`decdn.yml`, `website.yml`, `finance.yml`, `internal.yml`, `dotgithub.yml`).
+- The sync workflow runs `EndBug/label-sync@v2` on push to `main` affecting `.github/labels/**`, or manually via the Actions tab (`workflow_dispatch`).
+- **Required secret:** `LABEL_SYNC_TOKEN` — a PAT or GitHub App token with `issues:write` and `metadata:read` on all five org repos. `GITHUB_TOKEN` is scoped to this repo only and cannot mutate other repos' labels.
+- `delete-other-labels` is currently `false` (additive sync). Flip to `true` only after verifying no important orphan labels remain on any target repo.


CopilotAI review requested due to automatic review settings May 11, 2026 16:58

Copilotstarted reviewing on behalf of thiras May 11, 2026 16:59 View session

gemini-code-assistBot reviewed May 11, 2026
View reviewed changes

CopilotAI reviewed May 11, 2026
View reviewed changes

thiras marked this pull request as draft May 11, 2026 17:59

Navigation Menu

Uh oh!

ci: standardize issue labels across org via central sync workflow - #1

ci: standardize issue labels across org via central sync workflow#1
thiras wants to merge 1 commit into
mainfrom
standardize-issue-labels

thiras commented May 11, 2026

Uh oh!

gemini-code-assistBot left a comment

Uh oh!

gemini-code-assistBotMay 11, 2026

Uh oh!

gemini-code-assistBotMay 11, 2026

Uh oh!

gemini-code-assistBotMay 11, 2026

Uh oh!

gemini-code-assistBotMay 11, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

thiras commented May 11, 2026

Summary

Dry-run diff (per repo, names only)

Prerequisite: LABEL_SYNC_TOKEN secret

Follow-ups (deliberately not in this PR)

Test plan

Uh oh!

gemini-code-assistBot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assistBotMay 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assistBotMay 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assistBotMay 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assistBotMay 11, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Prerequisite: `LABEL_SYNC_TOKEN` secret