[ryanduguid]

Summary

PR labelling fails with Not Found, and the workflow token lacks permission to add labels. Replace the old prefix action with actions/github-script@v9 and grant only pull-requests: write.

The workflow keeps the 13 existing prefix mappings and additive labels. It reads the title as data and runs no PR checkout or code.

Evidence

• Before: both hosted labeler attempts on PR BUG: Use an explicit year offset for XHKG holidays #1 fail after reading its title.
• After: all 33 script probes pass, covering every prefix, unmatched and code-like titles, and API failure propagation. Actionlint, whitespace and all five pre-commit hooks pass.
• All eight hosted build, test, performance and pre-commit jobs pass on head 1cf11133a1f610519a1684049620121f39119d18.
• All 13 destination labels exist in the fork and were read back after provisioning.

Review confirmed that delimiter-free matching preserves the old action's behaviour: index.js:50 also uses title.startsWith(key). This repair retains that contract, including BUGFIX matching BUG. Requiring a colon would be a separate behaviour change.

Merge danger

Door: two-way. Blast radius: PR labels.

pull_request_target runs the workflow from the base branch. The installation PR therefore still uses the old job. Any exception must cover only that installation; subsequent PRs must pass the replacement job.

The action retains the repository's major-version pinning convention. The reference is mutable.

Unverified

The old base-branch labeler fails on this installation PR. After installation, verify a recognised prefix, an unmatched title and preservation of existing labels. All other hosted checks pass.

[qodo-code-review]

PR Summary by Qodo

Restore PR prefix labelling with scoped permissions

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

---

AI Description

• Replace the failing prefix action with GitHub Script while preserving all 13 title mappings and
 additive labels.
• Grant the labeler job only pull-request write permission so it can apply labels.

Diagram

graph TD
  Event["PR event"] --> Job["Scoped labeler"] --> Match{"Prefix match?"}
  Match -- "yes" --> API["GitHub labels API"] --> Labels["PR labels"]
  Match -- "no" --> Unchanged["No change"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Retain the third-party prefix action

• ➕ Smaller workflow change; retains the existing integration.
• ➖ Continues running a third-party action with a write-capable token under pull_request_target.
• ➖ Does not address the reported action failure on its own.

Recommendation: Use the proposed GitHub Script approach: the matching logic is small enough to keep in the workflow, and it avoids a third-party action in a privileged job. After merge, verify labelling on a new PR because pull_request_target uses the base-branch workflow.

Files changed (1) +20 / -3

Bug fix (1) +20 / -3

labeler.ymlReplace the failing labeler and scope its token +20/-3

Replace the failing labeler and scope its token

• Replaces the prefix-labeler action with GitHub Script, retaining all 13 starts-with mappings and adding only the matched label. Grants the job pull-request write permission; unmatched titles make no API call.

.github/workflows/labeler.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

---

🔴 P0

No findings for this group

🟠 P1

1. Unrelated PR titles get mislabeled 🟠 P1 🐞 Bug ≡ Correctness

Description

The title.startsWith(key) check accepts a mapped key at the start of a longer word without
checking where the prefix ends. A title such as BUGFIX: improve parsing therefore receives the
bug label, which is also a release-drafter category, despite not using the BUG: prefix.

Code

.github/workflows/labeler.yml[23]

+          const prefix = Object.keys(labels).find(key => title.startsWith(key));

Evidence

The workflow selects a key using only startsWith and passes its mapped value to addLabels; the
release-drafter configuration categorizes pull requests bearing that label. The former action's
documented prefix examples use a colon after each key, including BUG:.

.github/workflows/labeler.yml[16-29]
.github/release-drafter-config.yml[13-15]
🌐 The former action documents its default prefix conventions with colon-delimited examples such as BUG: bug fix.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Prefix matching accepts longer words such as `BUGFIX:` as `BUG` and adds an unintended label.
## Fix Focus Areas
- .github/workflows/labeler.yml[22-25]
## Recommended Fix
Match a configured prefix only when followed by the intended delimiter, such as `:`, and add a probe confirming `BUGFIX:` remains unmatched.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

🟡 P2

No findings for this group

---

Context sources

✅ Web pages:

  🌐 REST API endpoints for labels

  🌐 Permissions required for fine-grained personal access tokens

  🌐 REST API endpoints for issues

  +7 more

---

Tip of the day

💡 Did you know, you can turn on the rule miner and Qodo learns your standards from review history

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

---

Powered by Qodo

[qodo-code-review]

Code review by qodo was updated up to the latest commit 1cf1113