chore: Refactor Sync Linked Issue Labels Worflow by manishdait · Pull Request #2095 · hiero-ledger/hiero-sdk-python

manishdait · 2026-04-09T19:44:23Z

Description:
This PR refactor sync issue labels two-stage workflow to securely synchronize labels from linked issues to Pull Requests. also skip the automated bots PR.

Changes Made:

Remove dependency on PAT token.
Skip the apply action on Bot PR.

Related issue(s):

Fixes #2094

Notes for reviewer:

Note this will not apply the label for this PR as it need dispatch the workflow that should be present on main
Test case Update sync-issue-labels-compute.yml manishdait/hiero-sdk-python#13

Checklist

Documented (Code comments, README, etc.)
Tested (unit, integration, etc.)

codacy-production · 2026-04-09T19:45:26Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

codecov · 2026-04-09T19:45:57Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##             main    #2095   +/-   ##
=======================================
  Coverage   93.70%   93.70%           
=======================================
  Files         145      145           
  Lines        9452     9452           
=======================================
  Hits         8857     8857           
  Misses        595      595

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

coderabbitai · 2026-04-09T19:51:06Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

The changes refactor two GitHub Actions workflows that manage linked issue labels on pull requests. The compute workflow now triggers automatically on PR events (instead of manual dispatch), reads the PR number from the GitHub context payload, and uses simplified linked-issue and label extraction logic. The add workflow converts to an automatic trigger that runs after compute succeeds, downloading artifacts and applying labels directly via the GitHub API without manual dispatch intervention.

Changes

Cohort / File(s)	Summary
Workflow Automation Refactoring `.github/workflows/sync-issue-labels-compute.yml`, `.github/workflows/sync-issue-labels-add.yml`	Restructured workflows from manual `workflow_dispatch` triggers to automatic event-driven execution. Compute workflow now triggers on PR events and simplified linked-issue detection (single regex pattern, no truncation), label extraction (issues only, deduplicated via Set), and artifact payload (removed `is_fork_pr`, `dry_run`, `source_event` fields; renamed artifact to `pr-labels-data`). Add workflow now auto-triggers after compute succeeds, replacing `actions-ecosystem/action-add-labels` with `actions/github-script` for direct GitHub API label application. Both workflows skip bot-authored PRs.
Documentation `CHANGELOG.md`	Added changelog entry documenting the refactoring of sync-issue-labels workflows to properly handle label syncing and skip bot PRs.

Sequence Diagram

sequenceDiagram
    participant PR as Pull Request Event
    participant Compute as Compute Job
    participant Artifact as Artifact Storage
    participant Add as Add Job
    participant API as GitHub API

    PR->>Compute: PR opened/edited/reopened/synchronized
    Compute->>Compute: Read PR number from context.payload
    Compute->>Compute: Extract linked issues (regex: fix/close/resolve `#N`)
    Compute->>Compute: Gather labels from linked issues
    Compute->>Compute: Calculate new labels (not already on PR)
    Compute->>Artifact: Upload pr-labels-data artifact<br/>(pr_number, labels)
    
    Compute-->>Add: Workflow completion signal (success)
    Add->>Artifact: Download pr-labels-data artifact
    Add->>Add: Read labels.json from workspace
    Add->>API: Call github.rest.issues.addLabels<br/>(pr_number, labels)
    API-->>Add: Labels applied

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Refactor Sync Linked Issue Labels Worflow' is directly related to the main changes; however, it contains a typo ('Worflow' should be 'Workflow').
Description check	✅ Passed	The description clearly relates to the changeset, explaining the refactoring of the two-stage workflow, removal of PAT token dependency, and skipping bot PRs, which matches the code changes.
Linked Issues check	✅ Passed	The PR addresses the linked issue `#2094` by implementing bot PR detection and skipping; the compute workflow now returns early for bot-authored PRs without setting outputs.
Out of Scope Changes check	✅ Passed	All changes are in scope: the workflow refactoring, removal of PAT dependency, bot PR skipping logic, and CHANGELOG update directly support the objective in issue `#2094`.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 3

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d037c487-d836-4260-ae2d-41b0a269f402

📥 Commits

Reviewing files that changed from the base of the PR and between 7571b15 and 06f5101.

📒 Files selected for processing (3)

.github/workflows/sync-issue-labels-add.yml
.github/workflows/sync-issue-labels-compute.yml
CHANGELOG.md

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1aab695e-902d-4fbc-8bb7-25be2285662a

📥 Commits

Reviewing files that changed from the base of the PR and between 06f5101 and 0a9b649.

📒 Files selected for processing (3)

.github/workflows/sync-issue-labels-add.yml
.github/workflows/sync-issue-labels-compute.yml
CHANGELOG.md

exploreriii · 2026-04-11T12:21:56Z

rebase please @manishdait

coderabbitai

Actionable comments posted: 5

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1c949005-e2ee-4db9-9954-fb78cff99ad8

📥 Commits

Reviewing files that changed from the base of the PR and between 0a9b649 and 74dc2cc.

📒 Files selected for processing (3)

.github/workflows/sync-issue-labels-add.yml
.github/workflows/sync-issue-labels-compute.yml
CHANGELOG.md

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

coderabbitai

Actionable comments posted: 1

♻️ Duplicate comments (2)

.github/workflows/sync-issue-labels-add.yml (1)
27-32: ⚠️ Potential issue | 🟠 Major

Guard the artifact download for expected no-op runs.

sync-issue-labels-compute.yml returns early for bot-authored PRs, for PRs with no linked issues, and when there are no new labels, and it only uploads pr-labels-data when labels.json exists. This step still downloads the artifact unconditionally, so those normal skip paths fail here before Line 39 can short-circuit on a missing file.
🔧 One way to gate the download
+      - name: Check Artifact Exists
+        id: artifact
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { data } = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: context.payload.workflow_run.id,
+            });
+            core.setOutput(
+              'exists',
+              data.artifacts.some((artifact) => artifact.name === 'pr-labels-data') ? 'true' : 'false',
+            );
+
       - name: Download Artifact
+        if: steps.artifact.outputs.exists == 'true'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pr-labels-data
.github/workflows/sync-issue-labels-compute.yml (1)
7-9: ⚠️ Potential issue | 🔴 Critical

Declare pull-requests: read for the retained pulls.get() call.

The script still calls github.rest.pulls.get(...) on Lines 32-34, but this workflow only grants issues: read and contents: read. Once permissions: is declared, the token is scoped to those entries, and GitHub documents GET /repos/{owner}/{repo}/pulls/{pull_number} as a pull-request read endpoint. On repositories using restricted workflow permissions, this can turn the compute step into a 403. (docs.github.com)
🔧 Minimal fix
 permissions:
   issues: read
+  pull-requests: read
   contents: read
As per coding guidelines, permissions: must be explicitly declared and scoped to the minimum needed.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d11a74a0-9589-4cdc-91eb-270ad7f76324

📥 Commits

Reviewing files that changed from the base of the PR and between 7c5c0c8 and beed2b6.

📒 Files selected for processing (3)

.github/workflows/sync-issue-labels-add.yml
.github/workflows/sync-issue-labels-compute.yml
CHANGELOG.md

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

exploreriii · 2026-04-11T18:42:45Z

Thanks @manishdait and @AntonioCeppellini !

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

manishdait marked this pull request as ready for review April 9, 2026 19:47

manishdait requested review from a team as code owners April 9, 2026 19:47

manishdait requested review from exploreriii, jeromy-cannon and nadineloepfe April 9, 2026 19:47

coderabbitai Bot reviewed Apr 9, 2026

View reviewed changes

Comment thread .github/workflows/sync-issue-labels-add.yml

Comment thread .github/workflows/sync-issue-labels-compute.yml

Comment thread CHANGELOG.md Outdated

coderabbitai Bot reviewed Apr 9, 2026

View reviewed changes

Comment thread .github/workflows/sync-issue-labels-compute.yml

manishdait force-pushed the fix/sync_issue_wf branch from 0a9b649 to 15fadd9 Compare April 9, 2026 20:01

manishdait force-pushed the fix/sync_issue_wf branch from 15fadd9 to 74dc2cc Compare April 11, 2026 12:28

exploreriii previously approved these changes Apr 11, 2026

View reviewed changes

coderabbitai Bot reviewed Apr 11, 2026

View reviewed changes

exploreriii added the status: needs developer revision label Apr 11, 2026

manishdait dismissed exploreriii’s stale review via 7c5c0c8 April 11, 2026 13:09

manishdait added 4 commits April 11, 2026 20:11

chore: updated the sync issue workflow

5eea336

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

chore: updated changelog

8de30ba

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

chore: updated sync label compute

2200363

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

chore: adde step security to spply workflow

beed2b6

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

manishdait force-pushed the fix/sync_issue_wf branch from 7c5c0c8 to beed2b6 Compare April 11, 2026 14:45

coderabbitai Bot reviewed Apr 11, 2026

View reviewed changes

Comment thread .github/workflows/sync-issue-labels-add.yml

chore: fix rebase

9d8b817

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

manishdait added status: needs committer review reviewer: maintainer PR needs a review from the maintainer team and removed status: needs developer revision labels Apr 11, 2026

exploreriii approved these changes Apr 11, 2026

View reviewed changes

exploreriii removed the reviewer: maintainer PR needs a review from the maintainer team label Apr 11, 2026

exploreriii added the step: 2nd second stage of the review approval process label Apr 11, 2026

AntonioCeppellini approved these changes Apr 11, 2026

View reviewed changes

exploreriii merged commit 9360ad4 into hiero-ledger:main Apr 11, 2026
15 checks passed

MonaaEid pushed a commit to MonaaEid/hiero-sdk-python that referenced this pull request Apr 16, 2026

chore: Refactor Sync Linked Issue Labels Worflow (hiero-ledger#2095)

fb59cca

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

AntonioCeppellini pushed a commit to AntonioCeppellini/hiero-sdk-python that referenced this pull request Apr 22, 2026

chore: Refactor Sync Linked Issue Labels Worflow (hiero-ledger#2095)

9a2d9d2

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

parvninama pushed a commit to parvninama/hiero-sdk-python that referenced this pull request Apr 25, 2026

chore: Refactor Sync Linked Issue Labels Worflow (hiero-ledger#2095)

5ea0464

Signed-off-by: Manish Dait <daitmanish88@gmail.com>

manishdait deleted the fix/sync_issue_wf branch June 5, 2026 08:53

Uh oh!

Conversation

manishdait commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codacy-production Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

codecov Bot commented Apr 9, 2026

Codecov Report

Uh oh!

coderabbitai Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

exploreriii commented Apr 11, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

exploreriii commented Apr 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

manishdait commented Apr 9, 2026 •

edited

Loading

codacy-production Bot commented Apr 9, 2026 •

edited

Loading

coderabbitai Bot commented Apr 9, 2026 •

edited

Loading