From 5476badbbfaa6d36f9bc3bfbfaa357ad44979d70 Mon Sep 17 00:00:00 2001
From: Sall <ss-o@users.noreply.github.com>
Date: Wed, 22 Jul 2026 00:12:06 +0100
Subject: [PATCH] ci(labels): run the labels-sync test suite on tooling changes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #469.

No workflow executed scripts/, so test-labels-dry-run.sh only ran when
someone remembered to invoke it. That suite caught two real defects in
#466 — an in-use legacy label queued for deletion, and a migration
deleting the legacy label before relabelling the items carrying it —
either of which would have destroyed label associations org-wide.

Runs on pushes and pull requests touching the label tooling or
lib/labels.yml. The suite makes read-only preview calls against this
repository, so the job takes contents: read and issues: read and passes
GH_TOKEN; it never supplies a --confirm-* flag, and the script refuses
every destructive path without one.

Verified the job is not a no-op: the same invocation exits 1 against a
deliberately broken script and 0 against the restored one.
---
 .github/workflows/labels-sync-test.yml | 46 ++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/labels-sync-test.yml

diff --git a/.github/workflows/labels-sync-test.yml b/.github/workflows/labels-sync-test.yml
new file mode 100644
index 000000000..e60693987
--- /dev/null
+++ b/.github/workflows/labels-sync-test.yml
@@ -0,0 +1,46 @@
+---
+name: Labels Sync Tests
+on:
+  workflow_call: {}
+  push:
+    paths:
+      - "scripts/labels-sync.rb"
+      - "scripts/labels-dry-run.rb"
+      - "scripts/test-labels-dry-run.sh"
+      - "lib/labels.yml"
+      - ".github/workflows/labels-sync-test.yml"
+  pull_request:
+    paths:
+      - "scripts/labels-sync.rb"
+      - "scripts/labels-dry-run.rb"
+      - "scripts/test-labels-dry-run.sh"
+      - "lib/labels.yml"
+      - ".github/workflows/labels-sync-test.yml"
+  workflow_dispatch: {}
+
+# The suite runs read-only previews against this repository, so it needs to read
+# labels and issues. It never passes a --confirm-* flag, and the script refuses
+# every destructive path without one.
+permissions:
+  contents: read
+  issues: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  labels-sync-test:
+    name: Labels Sync Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: "⤵️ Check out code from GitHub"
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: "⚙️ Report Ruby version"
+        run: ruby --version
+
+      - name: "🧪 Run labels-sync smoke tests"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: sh scripts/test-labels-dry-run.sh