From ec143d9477a151d37e5b5b5e2742600fe0319f10 Mon Sep 17 00:00:00 2001 From: Simon Peter Rothgang Date: Sun, 23 Aug 2026 21:54:39 +0200 Subject: [PATCH 1/3] chore(labels): restructure label taxonomy - Rename the feature request template label to `type: feature` and add `status: triage` so both templates triage consistently - Replace the `javascript` Dependabot label with `area: agent-sdk` on both npm ecosystems, since the root package only ships the bridge - Label the Agent SDK monitor issues on creation with `type: dependencies` and `area: agent-sdk` instead of leaving them bare - Document the `type:`/`area:`/`status:` namespaces in CONTRIBUTING.md, including which labels automation depends on --- .github/ISSUE_TEMPLATE/feature_request.yml | 2 +- .github/dependabot.yml | 4 ++-- .github/workflows/dependency-monitor.yml | 2 ++ CONTRIBUTING.md | 19 +++++++++++++++++++ 4 files changed, 24 insertions(+), 3 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml index 98a814da..3db5012e 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.yml +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -1,7 +1,7 @@ name: Feature Request description: Suggest a new feature or improvement title: "[Feature]: " -labels: ["type: enhancement"] +labels: ["type: feature", "status: triage"] body: - type: markdown attributes: diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f3a82c1a..99455ac6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -61,7 +61,7 @@ updates: open-pull-requests-limit: 10 labels: - "type: dependencies" - - "javascript" + - "area: agent-sdk" commit-message: prefix: "chore" include: "scope" @@ -84,7 +84,7 @@ updates: open-pull-requests-limit: 10 labels: - "type: dependencies" - - "javascript" + - "area: agent-sdk" commit-message: prefix: "chore" include: "scope" diff --git a/.github/workflows/dependency-monitor.yml b/.github/workflows/dependency-monitor.yml index 5c5dcedb..ea8dcc4e 100644 --- a/.github/workflows/dependency-monitor.yml +++ b/.github/workflows/dependency-monitor.yml @@ -129,5 +129,7 @@ jobs: gh issue create \ --repo "${REPO}" \ --title "${issue_title}" \ + --label "type: dependencies" \ + --label "area: agent-sdk" \ --body-file "${issue_file}" fi diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e169c18e..274f579b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -46,6 +46,25 @@ By participating, you agree to uphold this code. 7. Push to your fork and open a Pull Request against `main` 8. Fill out the PR summary, validation, and any relevant notes +### Labels + +Labels use a `namespace: value` convention so they group visually and filter cleanly. +Apply at most one `type:` label per issue or pull request. + +| Namespace | Values | Meaning | +| --- | --- | --- | +| `type:` | `bug`, `fix`, `feature`, `docs`, `refactor`, `security`, `dependencies`, `release` | What kind of work it is. Use `bug` for a reported defect and `fix` for the change that resolves one. | +| `area:` | `tui`, `core`, `agent-sdk`, `install`, `ci` | Which part of the project it touches. | +| `status:` | `triage`, `blocked`, `needs-info`, `discussion`, `wontfix` | Where it sits in the workflow. | + +`good first issue` and `help wanted` stay unprefixed because GitHub uses them to +populate the repository contribution page. + +Issue templates apply `type:` and `status: triage` automatically, and Dependabot +applies `type: dependencies` plus the matching `area:` label from +`.github/dependabot.yml`. Renaming any of those labels requires updating that +config in the same change. + ## Development Setup ### Prerequisites From 1fc9572b50a5a092632870f60e9f763925cd66c0 Mon Sep 17 00:00:00 2001 From: Simon Peter Rothgang Date: Sun, 23 Aug 2026 21:57:31 +0200 Subject: [PATCH 2/3] chore(labels): label refreshed Agent SDK monitor issues - Apply `type: dependencies` and `area: agent-sdk` on the `gh issue edit` path too, so an issue opened before this change picks the labels up on its next weekly refresh --- .github/workflows/dependency-monitor.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/dependency-monitor.yml b/.github/workflows/dependency-monitor.yml index ea8dcc4e..8d15d28f 100644 --- a/.github/workflows/dependency-monitor.yml +++ b/.github/workflows/dependency-monitor.yml @@ -123,6 +123,8 @@ jobs: gh issue edit "${existing_issue}" \ --repo "${REPO}" \ --title "${issue_title}" \ + --add-label "type: dependencies" \ + --add-label "area: agent-sdk" \ --body-file "${issue_file}" echo "Updated issue #${existing_issue}." else From 5d84dd26d3aa3a24ceca806ab890d8bd7cc62269 Mon Sep 17 00:00:00 2001 From: Simon Peter Rothgang Date: Sun, 23 Aug 2026 22:06:44 +0200 Subject: [PATCH 3/3] ci(dependency-monitor): open labeled issues for cargo-deny advisories - Replace the log-only advisory step with a cargo-deny run that captures its report and opens or refreshes a `type: security` tracking issue - Close the tracking issue automatically once a later run reports no findings - Restore the advisory notifications lost when `audit.yml` and `actions-rust-lang/audit` were removed in #236, without that action's duplicate issues per run - Use one refreshed issue instead of one per advisory, and truncate the report so the body stays under the 65536 character limit - Note the security exception to the one-`type:`-label rule in CONTRIBUTING.md --- .github/workflows/dependency-monitor.yml | 117 +++++++++++++++++++++-- CONTRIBUTING.md | 11 ++- 2 files changed, 118 insertions(+), 10 deletions(-) diff --git a/.github/workflows/dependency-monitor.yml b/.github/workflows/dependency-monitor.yml index 8d15d28f..da5bcce9 100644 --- a/.github/workflows/dependency-monitor.yml +++ b/.github/workflows/dependency-monitor.yml @@ -12,14 +12,119 @@ jobs: cargo-deny-advisories: name: Cargo Deny Advisories runs-on: ubuntu-latest - continue-on-error: true + permissions: + contents: read + issues: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2 - with: - rust-version: "1.88.0" - command: check advisories - arguments: --all-features + + - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable + + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 + + # The PR gate in pr.yml uses EmbarkStudios/cargo-deny-action, but that action + # runs in a container and only writes findings to the job log. This job needs + # the report as text so it can put it in the tracking issue, so it installs + # cargo-deny directly. Bump this pin by hand when cargo-deny releases. + - name: Install cargo-deny + run: cargo install cargo-deny --version 0.20.2 --locked + + - name: Check advisories + id: advisories + shell: bash + run: | + set -uo pipefail + + report="${RUNNER_TEMP}/cargo-deny-advisories.txt" + if cargo deny --all-features check advisories > "${report}" 2>&1; then + echo "clean=true" >> "$GITHUB_OUTPUT" + else + echo "clean=false" >> "$GITHUB_OUTPUT" + fi + + echo "report=${report}" >> "$GITHUB_OUTPUT" + cat "${report}" + + - name: Sync advisory tracking issue + shell: bash + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + CLEAN: ${{ steps.advisories.outputs.clean }} + REPORT: ${{ steps.advisories.outputs.report }} + run: | + set -euo pipefail + + # One tracking issue that gets refreshed, rather than one issue per + # advisory. The actions-rust-lang/audit setup this replaces opened a + # fresh issue per run and produced duplicates such as #41/#56. + issue_title="Security advisories in the dependency graph" + + existing_issue="$( + gh issue list \ + --repo "${REPO}" \ + --state open \ + --search "\"${issue_title}\" in:title" \ + --json number \ + --jq '.[0].number // empty' + )" + + if [[ "${CLEAN}" == "true" ]]; then + if [[ -n "${existing_issue}" ]]; then + gh issue close "${existing_issue}" \ + --repo "${REPO}" \ + --reason completed \ + --comment "\`cargo deny check advisories\` is clean again as of \`${GITHUB_WORKFLOW}\` run ${GITHUB_RUN_ID}." + echo "Closed issue #${existing_issue}." + else + echo "No advisories reported." + fi + exit 0 + fi + + issue_file="${RUNNER_TEMP}/advisory-issue.md" + cat > "${issue_file}" <cargo-deny report + + \`\`\` + EOF + + # Issue bodies cap at 65536 characters and inclusion graphs get long. + head -c 50000 "${REPORT}" >> "${issue_file}" + if [[ "$(wc -c < "${REPORT}")" -gt 50000 ]]; then + echo "" >> "${issue_file}" + echo "... report truncated, see the workflow run for the full output." >> "${issue_file}" + fi + + cat >> "${issue_file}" < + + This issue was opened or refreshed by \`${GITHUB_WORKFLOW}\`. + EOF + + if [[ -n "${existing_issue}" ]]; then + gh issue edit "${existing_issue}" \ + --repo "${REPO}" \ + --add-label "type: security" \ + --body-file "${issue_file}" + echo "Updated issue #${existing_issue}." + else + gh issue create \ + --repo "${REPO}" \ + --title "${issue_title}" \ + --label "type: security" \ + --body-file "${issue_file}" + fi agent-sdk-update-monitor: name: Check latest Agent SDK diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 274f579b..fa990d8a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -49,7 +49,9 @@ By participating, you agree to uphold this code. ### Labels Labels use a `namespace: value` convention so they group visually and filter cleanly. -Apply at most one `type:` label per issue or pull request. +Apply one `type:` label per issue or pull request. The exception is a dependency +update that also carries a security fix, which takes `type: dependencies` and +`type: security` together. | Namespace | Values | Meaning | | --- | --- | --- | @@ -60,10 +62,11 @@ Apply at most one `type:` label per issue or pull request. `good first issue` and `help wanted` stay unprefixed because GitHub uses them to populate the repository contribution page. -Issue templates apply `type:` and `status: triage` automatically, and Dependabot +Issue templates apply `type:` and `status: triage` automatically, Dependabot applies `type: dependencies` plus the matching `area:` label from -`.github/dependabot.yml`. Renaming any of those labels requires updating that -config in the same change. +`.github/dependabot.yml`, and the weekly `Dependency Monitor` workflow applies +`type: security` to the advisory issue it opens. Renaming any of those labels +requires updating that config in the same change. ## Development Setup