ci: add PR auto-labeler

[hasansezertasan]

Description

Adds automatic PR labeling via fuxingloh/multi-labeler plus a template-appropriate .github/labeler.yml. Adapted from #16, which shipped a 306-line config tailored to the litestar monorepo.

.github/labeler.yml

• type/* from the Conventional Commit PR title: feat, fix, docs, refactor, test, ci/build, chore, plus Breaking from a ! bang. (Pairs with ci: add PR title linting (Conventional Commits) #41's title linting.)
• area/* from changed paths: docs, src, tests, ci — generic to the template's src/-layout structure.

distinguish-pr-origin job

Labels each PR pr/internal or pr/external + triage required. Uses the PR's author_association (OWNER/MEMBER/COLLABORATOR = internal) instead of #16's hard-coded maintainer list — so it needs no maintenance and works for any repo using this template.

Labels

The referenced labels have been created in the repo (type/*, area/*, Breaking, pr/internal, pr/external); triage required already existed. Colors/descriptions are easy to tune.

Hardening (zizmor gate, #22/#39)

• SHA-pinned multi-labeler@b15a544 # v4 and github-script@3a2844b # v9.0.0.
• permissions: {} top-level; jobs get only contents: read+pull-requests: write / issues: write+pull-requests: write.
• pull_request_target is required to label fork PRs; safe (no PR code checked out) and justified-suppressed for zizmor's dangerous-triggers.

Verified: zizmor → No findings (1 justified ignore).

Closes

• Closes ci: add PR auto-labeler #43

Summary by Sourcery

Introduce automated pull request labeling based on conventional commit titles, changed paths, and PR origin (internal vs external).

Build:

• Add a repository-wide labeler configuration mapping conventional commit-style PR titles and file path changes to type/* and area/* labels.

CI:

• Add a PR labeler workflow that applies type/area labels using multi-labeler on pull_request_target events.
• Label PRs as internal or external based on author_association, adding triage required for external contributions.

[sourcery-ai]

Reviewer's Guide

Adds a hardened GitHub Actions workflow that auto-labels pull requests based on conventional-commit-style titles, changed file paths, and PR author association, using a template-appropriate labeler configuration and secure permissions suitable for forked PRs.

Sequence diagram for PR auto-labeling workflow

sequenceDiagram
  actor Contributor
  participant GitHub
  participant pr_labeler_workflow
  participant apply_labels_job
  participant multi_labeler
  participant distinguish_pr_origin_job
  participant github_script
  participant GitHub_API

  Contributor->>GitHub: open/edit/synchronize/reopen PR
  GitHub->>pr_labeler_workflow: trigger pull_request_target

  pr_labeler_workflow->>apply_labels_job: start job Apply labels from title and paths
  apply_labels_job->>multi_labeler: fuxingloh/multi-labeler (github-token)
  multi_labeler->>GitHub_API: add labels from title and files (.github/labeler.yml)

  pr_labeler_workflow->>distinguish_pr_origin_job: start job Label internal vs external contributions
  distinguish_pr_origin_job->>github_script: actions/github-script
  github_script->>GitHub_API: read pull_request.author_association
  github_script->>GitHub_API: issues.addLabels(pr/internal | pr/external + triage required)

Loading

Flow diagram for internal vs external PR origin labeling

flowchart TD
  A[author_association] --> B{Is association in
OWNER / MEMBER / COLLABORATOR?}
  B -->|Yes| C[Set labels: pr/internal]
  B -->|No| D[Set labels: pr/external,
triage required]
  C --> E[github.rest.issues.addLabels]
  D --> E[github.rest.issues.addLabels]

Loading

File-Level Changes

Change	Details	Files
Introduce multi-labeler configuration to map conventional commit titles and changed paths to type/* and area/* labels.	Create .github/labeler.yml with v1 multi-labeler configuration. Add regex-based title matchers for feat, fix, docs, refactor, test, ci/build, chore, and breaking changes. Add path-based matchers that assign area/docs, area/src, area/tests, and area/ci based on modified files. Enable sync behavior so labels are kept consistent with current title and paths.	.github/labeler.yml
Add a PR labeling workflow that runs on pull_request_target, applies labels via multi-labeler, and classifies PR origin as internal or external with minimal permissions.	Define Pull Request Labeler workflow triggered on common pull_request_target events without checking out PR code. Add apply-labels job using fuxingloh/multi-labeler pinned to a specific commit, with read-only contents and write pull-requests permissions. Add distinguish-pr-origin job that always runs after label application and uses actions/github-script pinned to a specific commit. Implement author_association-based logic to tag PRs as pr/internal or pr/external and add triage required for external contributors. Set top-level workflow permissions to {} and grant only the job-scoped permissions needed for labeling issues and pull requests. Annotate pull_request_target trigger with a justified zizmor dangerous-triggers ignore comment to satisfy security scanning.	.github/workflows/pr-labeler.yml

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#43	Add a PR auto-labeling workflow and configuration using fuxingloh/multi-labeler, with safe permissions, pull_request_target usage, and passing the zizmor gate.	✅
#43	Provide a template-appropriate .github/labeler.yml that assigns type/* labels from Conventional Commit-style PR titles, area/* labels from generic paths (src, tests, docs, ci), and a Breaking label from a '!' in the title.	✅
#43	Implement an internal vs external PR labeling approach that does not rely on a hardcoded maintainer list (or otherwise resolve the internal/external job decision), and ensure referenced labels exist in the repo.	✅

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• The Breaking label regex only matches titles with a bang on standard type prefixes (e.g. feat!, fix!) and will miss other valid Conventional Commit types like perf or build!; consider broadening the pattern or documenting the expected subset of types.
• Using sync: true on all labels means they are removed whenever titles or paths stop matching, which could surprise maintainers (e.g. manual label adjustments); consider disabling sync for labels that may be curated manually over time.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `Breaking` label regex only matches titles with a bang on standard type prefixes (e.g. `feat!`, `fix!`) and will miss other valid Conventional Commit types like `perf` or `build!`; consider broadening the pattern or documenting the expected subset of types.
- Using `sync: true` on all labels means they are removed whenever titles or paths stop matching, which could surprise maintainers (e.g. manual label adjustments); consider disabling sync for labels that may be curated manually over time.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}