security-review/.github/workflows/labeler.yml

name: Labeler
on:
  pull_request:
    branches: [main]

# Temporary outage smoke test (PLAT-87): inlined on repo self-hosted runner.

permissions:
  contents: read
  pull-requests: write
  issues: write

concurrency:
  group: labeler-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  label:
    runs-on: self-hosted
    steps:
      - name: Write central label rules
        run: |
          mkdir -p "${{ runner.temp }}"
          cat > "${{ runner.temp }}/labeler.yml" <<'EOF'
          infra:
            - changed-files:
                - any-glob-to-any-file:
                    - 'lib/**'
                    - 'bin/**'
                    - 'cdk/**'
                    - 'cdk.json'
                    - 'template.yaml'
                    - 'template.yml'
                    - '**/template.yaml'
                    - 'samconfig.toml'
                    - 'infra/**'
          app:
            - changed-files:
                - any-glob-to-any-file:
                    - 'src/**'
                    - 'functions/**'
                    - 'lambdas/**'
                    - 'api/**'
                    - 'services/**'
                    - 'web/**'
                    - 'mobile/**'
                    - 'shared/**'
          content:
            - changed-files:
                - any-glob-to-any-file:
                    - '**/*.html'
                    - '**/*.css'
                    - 'assets/**'
                    - 'sitemap.xml'
                    - 'robots.txt'
          ci:
            - changed-files:
                - any-glob-to-any-file:
                    - '.github/workflows/**'
                    - '.github/actions/**'
          docs:
            - changed-files:
                - any-glob-to-any-file:
                    - '**/*.md'
          dependencies:
            - changed-files:
                - any-glob-to-any-file:
                    - '**/requirements.txt'
                    - '**/package.json'
                    - '**/package-lock.json'
                    - '**/*.csproj'
                    - '**/packages.lock.json'
                    - '**/Directory.Packages.props'
                    - '**/yarn.lock'
                    - '**/pnpm-lock.yaml'
                    - '**/Podfile'
                    - '**/Podfile.lock'
                    - '.github/dependabot.yml'
          tests:
            - changed-files:
                - any-glob-to-any-file:
                    # directory conventions (covers Java src/test, Ruby test/spec, etc.)
                    - '**/tests/**'
                    - '**/test/**'
                    - '**/spec/**'
                    - '**/__tests__/**'
                    # JS / TS
                    - '**/*.test.js'
                    - '**/*.test.jsx'
                    - '**/*.test.ts'
                    - '**/*.test.tsx'
                    - '**/*.spec.js'
                    - '**/*.spec.jsx'
                    - '**/*.spec.ts'
                    - '**/*.spec.tsx'
                    # Python
                    - '**/*_test.py'
                    - '**/test_*.py'
                    - '**/conftest.py'
                    # .NET
                    - '**/*Tests.cs'
                    - '**/*Test.cs'
                    - '**/*.Tests/**'
                    # Java / JVM
                    - '**/*Test.java'
                    - '**/*Tests.java'
                    - '**/*IT.java'
                    # Go
                    - '**/*_test.go'
                    # Ruby
                    - '**/*_spec.rb'
                    - '**/*_test.rb'
          EOF
      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13  # v7.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          configuration-path: ${{ runner.temp }}/labeler.yml
          sync-labels: false