Skip to content

OSAC-3734: add label-gate workflow for merge queue #204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
omer-vishlitzky merged 2 commits into from
Aug 7, 2026
Merged

OSAC-3734: add label-gate workflow for merge queue #204

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bd5ba2c
OSAC-3734: add label-gate workflow for merge queue
omer-vishlitzky Aug 7, 2026
76d7812
Merge branch 'main' into feat/OSAC-3734-label-gate
omer-vishlitzky Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions .github/workflows/label-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
---
name: label-gate

permissions:
contents: read
Comment on lines +4 to +5

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Workflow file:"
cat -n .github/workflows/label-gate.yml

echo
echo "Search for GitHub API usage / contents references in workflow:"
rg -n "contents|pulls/|issues/|repos/|api\.github\.com|curl|gh |jq|github\.event|uses:" .github/workflows/label-gate.yml || true

Repository: osac-project/osac

Length of output: 2067

Remove the unused contents: read permission.

This workflow only reads GitHub event data with github.event and jq; it does not checkout the repository or call the GitHub API. Set contents: none or omit the explicit permission block to keep GITHUB_TOKEN permissions minimal.

Proposed permission change 
 permissions:
-  contents: read
+  contents: none
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
contents: read
permissions:
contents: none
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/label-gate.yml around lines 4 - 5, Update the permissions
configuration in the label-gate workflow by removing the unused contents: read
permission; either set contents to none or omit the explicit permissions block,
while preserving the workflow’s existing event-data processing.

Source: Path instructions


on:
pull_request:
types: [opened, labeled, unlabeled, synchronize, reopened]
branches: [main]
merge_group:

jobs:
check-labels:
runs-on: ubuntu-latest
Comment on lines +13 to +15

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Repository files matching label-gate:"
fd -a 'label-gate\.yml$|label-gate\.yaml$' .github/workflows || true

if [ -f .github/workflows/label-gate.yml ]; then
  echo
  echo "File outline/stat:"
  wc -l .github/workflows/label-gate.yml
  echo
  echo "Workflow contents:"
  cat -n .github/workflows/label-gate.yml
fi

echo
echo "All workflow labels and concurrency settings nearby:"
rg -n "label-gate|pull_request|pull_request_target|concurrency|labels|GITHUB_TOKEN|permissions:" .github/workflows || true

Repository: osac-project/osac

Length of output: 28462

Serialize label-gate runs per pull request.

.github/workflows/label-gate.yml triggers on multiple pull_request events and uses github.event.pull_request.labels without a concurrency group. Add a pull-request-scoped concurrency block with cancel-in-progress: true, and compare labels from a current PR query if label delivery can be out of order.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/label-gate.yml around lines 13 - 15, Add a
pull-request-scoped concurrency block to the check-labels job in label-gate.yml,
using the pull request identifier as the group and enabling cancel-in-progress.
Update label evaluation to query the current pull request labels rather than
relying on github.event.pull_request.labels, so out-of-order events use current
state.

steps:
- name: Auto-pass for merge queue
if: github.event_name == 'merge_group'
run: echo "Labels already validated on PR"
- name: Check required Prow labels
if: github.event_name == 'pull_request'
env:
LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
run: |
missing=()
for label in lgtm approved jira/valid-reference; do
if ! echo "$LABELS" | jq -e "index(\"$label\")" > /dev/null 2>&1; then
missing+=("$label")
fi
done
if [[ ${#missing[@]} -gt 0 ]]; then
echo "::error::Missing required labels: ${missing[*]}"
echo ""
echo "Required labels are set by Prow plugins via OWNERS files:"
echo " lgtm - reviewer types /lgtm"
echo " approved - approver types /approve"
echo " jira/valid-reference - PR title has valid Jira key"
exit 1
fi
echo "All required labels present"
Loading