labeler.yml

name: Labeler

# Auto-label PRs by which paths they touch. Uses pull_request_target
# so labels can be applied on PRs from forks too — the action runs no
# user code and only consumes the changed-files list, which is safe
# under the elevated token.
on:
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write
  issues: write

concurrency:
  group: labeler-${{ github.ref }}
  cancel-in-progress: true

jobs:
  label:
    runs-on: ubuntu-latest
    steps:
      - name: Ensure label set exists
        # gh label create --force is idempotent: creates if missing,
        # updates colour/description if already present. Keeping label
        # provisioning inside the workflow means the repo doesn't need
        # any manual setup before the action starts firing.
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
        run: |
          ensure() {
            gh label create "$1" --repo "$REPO" --force \
              --color "$2" --description "$3" >/dev/null 2>&1 || true
          }
          ensure 'area:ci'      '0e8a16' 'CI workflows, hooks, lint config'
          ensure 'area:docs'    '0075ca' 'Documentation, README, governance'
          ensure 'area:vmm'     'd93f0b' 'VMM core: boot, control, main loop'
          ensure 'area:virtio'  'fbca04' 'virtio devices (block/net/vsock/fs/balloon)'
          ensure 'area:net'     '5319e7' 'Networking, NAT, bridge, iptables'
          ensure 'area:storage' '1d76db' 'Block storage, qcow2, image handling'
          ensure 'area:tests'   'c5def5' 'Unit/integration tests'
          ensure 'area:e2e'     'c2e0c6' 'End-to-end test harness'
          ensure 'area:deps'    'f9d0c4' 'Dependencies, Cargo.toml, Cargo.lock'
          ensure 'area:build'   'bfd4f2' 'Build system, toolchain, mise'

      - uses: actions/labeler@v6
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          configuration-path: .github/labeler.yml
          sync-labels: true