From 3fae367617bfa27e0ac30e6055a7db30e327e7b4 Mon Sep 17 00:00:00 2001
From: Rob Aiken <6567647+robaiken@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:26:28 +0100
Subject: [PATCH 1/4] Label allowlist pull requests

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 817c1703-3814-47a6-a9ea-41092ac242af
---
 .github/workflows/label-allowlist-prs.yml | 33 +++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/label-allowlist-prs.yml

diff --git a/.github/workflows/label-allowlist-prs.yml b/.github/workflows/label-allowlist-prs.yml
new file mode 100644
index 0000000..b592b77
--- /dev/null
+++ b/.github/workflows/label-allowlist-prs.yml
@@ -0,0 +1,33 @@
+---
+name: Label allowlist pull requests
+
+on:  # yamllint disable-line rule:truthy
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+    paths:
+      - internal/handlers/egress_allowlist_defaults.yaml
+
+permissions: {}
+
+jobs:
+  label:
+    name: Add allowlist label
+    runs-on: ubuntu-latest
+
+    permissions:
+      issues: write
+
+    steps:
+      - name: Add allowlist label
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPOSITORY: ${{ github.repository }}
+        run: >-
+          gh api
+          --method POST
+          "repos/${REPOSITORY}/issues/${PR_NUMBER}/labels"
+          -f "labels[]=allowlist"

From 9fb8c9dcd5218053002ae310e7a510ed7b98ba20 Mon Sep 17 00:00:00 2001
From: Rob Aiken <6567647+robaiken@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:30:06 +0100
Subject: [PATCH 2/4] Use GitHub issue labeler

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 817c1703-3814-47a6-a9ea-41092ac242af
---
 .github/allowlist-labeler.yml             |  3 +++
 .github/workflows/label-allowlist-prs.yml | 15 ++++++---------
 2 files changed, 9 insertions(+), 9 deletions(-)
 create mode 100644 .github/allowlist-labeler.yml

diff --git a/.github/allowlist-labeler.yml b/.github/allowlist-labeler.yml
new file mode 100644
index 0000000..9d44be8
--- /dev/null
+++ b/.github/allowlist-labeler.yml
@@ -0,0 +1,3 @@
+---
+allowlist:
+  - '/.*/'
diff --git a/.github/workflows/label-allowlist-prs.yml b/.github/workflows/label-allowlist-prs.yml
index b592b77..6130f67 100644
--- a/.github/workflows/label-allowlist-prs.yml
+++ b/.github/workflows/label-allowlist-prs.yml
@@ -18,16 +18,13 @@ jobs:
     runs-on: ubuntu-latest
 
     permissions:
+      contents: read
       issues: write
 
     steps:
       - name: Add allowlist label
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPOSITORY: ${{ github.repository }}
-        run: >-
-          gh api
-          --method POST
-          "repos/${REPOSITORY}/issues/${PR_NUMBER}/labels"
-          -f "labels[]=allowlist"
+        uses: github/issue-labeler@ccca1e16fcb66762200e616fc29b57b940c1cb67 # v3.5
+        with:
+          configuration-path: .github/allowlist-labeler.yml
+          enable-versioned-regex: 0
+          repo-token: ${{ github.token }}

From d426d432df965cc88d54e2eed8d5f28b83e7c2ee Mon Sep 17 00:00:00 2001
From: Rob Aiken <6567647+robaiken@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:32:23 +0100
Subject: [PATCH 3/4] Match existing workflow YAML style

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 817c1703-3814-47a6-a9ea-41092ac242af
---
 .github/allowlist-labeler.yml             | 1 -
 .github/workflows/label-allowlist-prs.yml | 3 +--
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/allowlist-labeler.yml b/.github/allowlist-labeler.yml
index 9d44be8..66c60d6 100644
--- a/.github/allowlist-labeler.yml
+++ b/.github/allowlist-labeler.yml
@@ -1,3 +1,2 @@
----
 allowlist:
   - '/.*/'
diff --git a/.github/workflows/label-allowlist-prs.yml b/.github/workflows/label-allowlist-prs.yml
index 6130f67..c142d28 100644
--- a/.github/workflows/label-allowlist-prs.yml
+++ b/.github/workflows/label-allowlist-prs.yml
@@ -1,7 +1,6 @@
----
 name: Label allowlist pull requests
 
-on:  # yamllint disable-line rule:truthy
+on: # yamllint disable-line rule:truthy
   pull_request_target:
     types:
       - opened

From 8f9e8d495ef3a8c8e0356e72544b93d437ac11ac Mon Sep 17 00:00:00 2001
From: Rob Aiken <6567647+robaiken@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:35:13 +0100
Subject: [PATCH 4/4] Match dependabot-core issue labeler setup

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 817c1703-3814-47a6-a9ea-41092ac242af
---
 .github/allowlist-labeler.yml             |  2 --
 .github/issue-labeler.yml                 |  2 ++
 .github/workflows/issue-labeler.yml       | 19 +++++++++++++++
 .github/workflows/label-allowlist-prs.yml | 29 -----------------------
 4 files changed, 21 insertions(+), 31 deletions(-)
 delete mode 100644 .github/allowlist-labeler.yml
 create mode 100644 .github/issue-labeler.yml
 create mode 100644 .github/workflows/issue-labeler.yml
 delete mode 100644 .github/workflows/label-allowlist-prs.yml

diff --git a/.github/allowlist-labeler.yml b/.github/allowlist-labeler.yml
deleted file mode 100644
index 66c60d6..0000000
--- a/.github/allowlist-labeler.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-allowlist:
-  - '/.*/'
diff --git a/.github/issue-labeler.yml b/.github/issue-labeler.yml
new file mode 100644
index 0000000..1e3a136
--- /dev/null
+++ b/.github/issue-labeler.yml
@@ -0,0 +1,2 @@
+allowlist:
+  - '/allow-?list/i'
diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml
new file mode 100644
index 0000000..aaaecf4
--- /dev/null
+++ b/.github/workflows/issue-labeler.yml
@@ -0,0 +1,19 @@
+name: "Issue Labeler"
+on: # yamllint disable-line rule:truthy
+  pull_request_target:
+    types: [opened, edited]
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: github/issue-labeler@ccca1e16fcb66762200e616fc29b57b940c1cb67 # v3.5
+        with:
+          configuration-path: .github/issue-labeler.yml
+          enable-versioned-regex: 0
+          repo-token: ${{ github.token }}
+          include-title: 1
diff --git a/.github/workflows/label-allowlist-prs.yml b/.github/workflows/label-allowlist-prs.yml
deleted file mode 100644
index c142d28..0000000
--- a/.github/workflows/label-allowlist-prs.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: Label allowlist pull requests
-
-on: # yamllint disable-line rule:truthy
-  pull_request_target:
-    types:
-      - opened
-      - reopened
-      - synchronize
-    paths:
-      - internal/handlers/egress_allowlist_defaults.yaml
-
-permissions: {}
-
-jobs:
-  label:
-    name: Add allowlist label
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      issues: write
-
-    steps:
-      - name: Add allowlist label
-        uses: github/issue-labeler@ccca1e16fcb66762200e616fc29b57b940c1cb67 # v3.5
-        with:
-          configuration-path: .github/allowlist-labeler.yml
-          enable-versioned-regex: 0
-          repo-token: ${{ github.token }}