chore(safe-settings): add refactor, test, ci, dependencies, security labels - #40
Merged
Conversation
yvonnedevlinrh
requested review from
jflowers and
marcusburghardt
as code owners
September 2, 2026 10:25
This was referenced Sep 2, 2026
Contributor
Author
The three CI failures here are pre-existing
|
| Failing check | Root cause | Fixed by |
|---|---|---|
| Dependency Review | Inline actions/dependency-review-action hard-fails: Dependency review is not supported on this repository … Dependency graph … GitHub Advanced Security (not enabled on this repo) |
#44 (fix: migrate ci_dependencies…) |
| OSV-Scanner | Dead SHA: google/osv-scanner-action@e5012758… → unable to find version |
#43 (ci: migrate ci_security and ci_scheduled…) |
| OpenSSF Scorecards | Dead SHA: ossf/scorecard-action@05b42c62… → unable to find version |
#43 |
The checks that actually exercise this PR's change all pass ✅ — Lint, Test, Apply-peribolos, Verify peribolos.
How to get this PR green
The three failures clear once the workflow fixes land on main:
- Merge ci: migrate ci_security and ci_scheduled to org-infra reusable workflows #43 first (restores the OSV-Scanner and OpenSSF Scorecards workflows).
- Merge fix: migrate ci_dependencies to org-infra reusable workflows #44 next (replaces the hard-failing inline dependency review with the soft-gated org-infra reusable).
- Rebase/update this PR (chore(safe-settings): add refactor, test, ci, dependencies, security labels #40) on the new
main— or just re-run its checks — and all three will go green.
No changes are needed in this PR to fix the CI; it's an innocent bystander of the broken main workflows. This is the same breakage that motivated issue #41 (→ #44) and the ci_security migration (→ #43).
jflowers
requested changes
Sep 3, 2026
jflowers
left a comment
jflowers
left a comment
Contributor
There was a problem hiding this comment.
Other than removing the triage file it looks good to me
marcusburghardt
approved these changes
Sep 3, 2026
marcusburghardt
left a comment
marcusburghardt
left a comment
There was a problem hiding this comment.
LGTM. Nice. Probably an option to also manage labels in complytime: https://github.com/complytime/.github/blob/main/safe-settings/settings.yml
…labels Enriches the org-wide label set with 5 labels for code PR categorization. Enables finer release-note grouping in gaze (github-native changelog). - refactor (fbca04): code restructuring with no behavior change - test (0e8a16): test additions, changes, or coverage work - ci (5319e7): CI/CD, GitHub Actions, or release-pipeline changes - dependencies (0366d6): dependency updates or dependency management - security (b60205): security-related work, fixes, or hardening maintenance label excluded: analysis of 50 merged gaze PRs showed chore-prefix PRs span multiple categories with no coherent grouping. Closes #39
yvonnedevlinrh
force-pushed
the
issue-39-enrich-org-labels
branch
from
September 3, 2026 12:47
4e103f5 to
9c1c55a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enriches the org-wide label set in
safe-settings/settings.ymlwith 5 labels for code PR categorization. Purely additive — no existing labels are removed or recolored.Closes #39
Labels added
refactorfbca04test0e8a16ci5319e7dependencies0366d6securityb60205maintenancewas considered and dropped. Analysis of 50 merged gaze PRs showedchore-prefix PRs span refactoring, tests, CI updates, and one-off cleanup with no coherent grouping — amaintenancelabel would be a renamed catch-all with no release-note signal improvement.Motivation
Category grouping in the
gazegithub-native changelog (unbound-force/gaze#249) keys off PR labels. Without these labels,chore/refactor/test/ciPRs collapse into a generic "Other Changes" bucket. These 5 labels unblock finer release-note categories and enable consistent PR triage across all managed repos.Downstream
refactor,test,ci,dependencies,securitycategories to.github/release.ymlcontainerfile,dewey,gaze,homebrew-tap,intake-kit,replicator,unbound-force,websiteTesting
make lint— yamllint passes onsafe-settings/go test -race ./...— all 6 boundary tests passActions > Safe Settings Sync > dry-run=true, repos=dewey)dry-run=false,reposempty)