ci(labels): run the labels-sync test suite on tooling changes#470
Merged
Conversation
Closes #469. No workflow executed scripts/, so test-labels-dry-run.sh only ran when someone remembered to invoke it. That suite caught two real defects in #466 — an in-use legacy label queued for deletion, and a migration deleting the legacy label before relabelling the items carrying it — either of which would have destroyed label associations org-wide. Runs on pushes and pull requests touching the label tooling or lib/labels.yml. The suite makes read-only preview calls against this repository, so the job takes contents: read and issues: read and passes GH_TOKEN; it never supplies a --confirm-* flag, and the script refuses every destructive path without one. Verified the job is not a no-op: the same invocation exits 1 against a deliberately broken script and 0 against the restored one.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a dedicated GitHub Actions workflow to ensure the label-sync tooling’s dry-run test suite actually runs in CI when the relevant scripts or label definitions change (closing #469).
Changes:
- Introduces a new
labels-sync-test.ymlworkflow that runs onpush/pull_request(path-filtered) and supportsworkflow_call. - Runs
sh scripts/test-labels-dry-run.shwith read-only permissions (contents: read,issues: read) and concurrency control. - Pins
actions/checkoutto a full commit SHA.
|
|
||
| - name: "🧪 Run labels-sync smoke tests" | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #469.
Why
No workflow in this repository executes
scripts/, soscripts/test-labels-dry-run.shran only when someone remembered to. That suite caught two real defects during #466:Either would have destroyed label associations across the organization. A third — a race between planning and deletion — was found in review and is now covered too.
An untriggered test suite is the same failure #464 documented: a control that exists in the repo but not in reality.
What
Runs the suite on pushes and pull requests touching
scripts/labels-sync.rb,scripts/labels-dry-run.rb,scripts/test-labels-dry-run.sh, orlib/labels.yml.Permissions
The suite makes read-only preview calls against this repository (it resolves live labels and issues to compute drift), so the job takes
contents: readandissues: readand passesGH_TOKEN. It never supplies a--confirm-*flag, and the script refuses every destructive path without one — the guardrail tests in the suite assert exactly that.Verification
Not assumed to work:
sh scripts/test-labels-dry-run.shfrom repo root)actions/checkoutis pinned todf4cb1c069e1874edd31b4311f1884172cec0e10, verified against the API as v6.0.3 rather than copied on trust.Noted, not changed
Two existing workflows in this repo pin that same SHA but comment it
# v4, while nine comment it# v6.0.3. The API confirms v6.0.3, so those two comments are stale and misleading. Out of scope here.