From c76e0f4f8496f1b98b4f73011c408bfa98cfe381 Mon Sep 17 00:00:00 2001
From: Ronit Sabhaya <ronitsabhaya75@gmail.com>
Date: Wed, 19 Nov 2025 17:17:35 -0600
Subject: [PATCH] Added the split method for labeler workflow (#788)

- This can basically Help teams know what changes are made in pr
- Added the split approach @katiewasnothere suggested using openssf
- Added additional feature for colors
- Currently this is for CLI only later we can add multiple
- Labeling flow
  - TRIGGER: Pull Request Opened (untrusted code)
  - READ-ONLY stage: just save job number to artifact
  - WRITE: load job number artifact, use GH labeler
    action with `labeler.yml` from repo
---
 .github/labeler.yml                     |  5 +++
 .github/workflows/pr-label-analysis.yml | 26 ++++++++++++
 .github/workflows/pr-label-apply.yml    | 55 +++++++++++++++++++++++++
 3 files changed, 86 insertions(+)
 create mode 100644 .github/labeler.yml
 create mode 100644 .github/workflows/pr-label-analysis.yml
 create mode 100644 .github/workflows/pr-label-apply.yml

diff --git a/.github/labeler.yml b/.github/labeler.yml
new file mode 100644
index 00000000..130e4c69
--- /dev/null
+++ b/.github/labeler.yml
@@ -0,0 +1,5 @@
+cli:
+  - changed-files:
+    - any-glob-to-any-file:
+      - 'Sources/CLI/**'
+      - 'Sources/ContainerCommands/**'
\ No newline at end of file
diff --git a/.github/workflows/pr-label-analysis.yml b/.github/workflows/pr-label-analysis.yml
new file mode 100644
index 00000000..e8b20738
--- /dev/null
+++ b/.github/workflows/pr-label-analysis.yml
@@ -0,0 +1,26 @@
+name: PR Label Analysis
+
+on:
+  pull_request:
+    types: [opened]
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze PR for labeling
+    runs-on: ubuntu-latest
+    
+    steps:
+      - name: Save PR metadata
+        run: |
+          mkdir -p ./pr-metadata
+          echo "${{ github.event.pull_request.number }}" > ./pr-metadata/pr-number.txt
+      
+      - name: Upload PR metadata as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: pr-metadata-${{ github.event.pull_request.number }}
+          path: pr-metadata/
+          retention-days: 1
\ No newline at end of file
diff --git a/.github/workflows/pr-label-apply.yml b/.github/workflows/pr-label-apply.yml
new file mode 100644
index 00000000..a68f8bff
--- /dev/null
+++ b/.github/workflows/pr-label-apply.yml
@@ -0,0 +1,55 @@
+name: PR Label Apply
+
+on:
+  workflow_run:
+    workflows: ["PR Label Analysis"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+
+jobs:
+  apply-labels:
+    name: Apply labels to PR
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    permissions:
+      contents: read
+      pull-requests: write
+    
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download PR metadata artifact
+        uses: actions/download-artifact@v4
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          pattern: pr-metadata-*
+          merge-multiple: false
+        continue-on-error: true
+        id: download-artifact
+      
+      - name: Read PR number
+        id: pr-number
+        run: |
+          METADATA_DIR=$(find . -type d -name "pr-metadata-*" 2>/dev/null | head -n 1)
+          
+          if [ -z "$METADATA_DIR" ]; then
+            echo "No metadata found"
+            exit 1
+          fi
+          
+          PR_NUMBER=$(cat "${METADATA_DIR}/pr-number.txt")
+          echo "number=${PR_NUMBER}" >> $GITHUB_OUTPUT
+          echo "PR Number: ${PR_NUMBER}"
+      
+      - name: Apply labels using labeler
+        uses: actions/labeler@v5
+        with:
+          pr-number: ${{ steps.pr-number.outputs.number }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          configuration-path: .github/labeler.yml
+          sync-labels: true
\ No newline at end of file