chore(labels): restructure label taxonomy and wire advisory issues

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,7 +1,7 @@
 name: Feature Request
 description: Suggest a new feature or improvement
 title: "[Feature]: "
-labels: ["type: enhancement"]
+labels: ["type: feature", "status: triage"]
 body:
   - type: markdown
     attributes:

.github/dependabot.yml

@@ -61,7 +61,7 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "type: dependencies"
-      - "javascript"
+      - "area: agent-sdk"
     commit-message:
       prefix: "chore"
       include: "scope"
@@ -84,7 +84,7 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "type: dependencies"
-      - "javascript"
+      - "area: agent-sdk"
     commit-message:
       prefix: "chore"
       include: "scope"

.github/workflows/dependency-monitor.yml

@@ -12,14 +12,119 @@ jobs:
   cargo-deny-advisories:
     name: Cargo Deny Advisories
     runs-on: ubuntu-latest
-    continue-on-error: true
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
-        with:
-          rust-version: "1.88.0"
-          command: check advisories
-          arguments: --all-features
+
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+
+      # The PR gate in pr.yml uses EmbarkStudios/cargo-deny-action, but that action
+      # runs in a container and only writes findings to the job log. This job needs
+      # the report as text so it can put it in the tracking issue, so it installs
+      # cargo-deny directly. Bump this pin by hand when cargo-deny releases.
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --version 0.20.2 --locked
+
+      - name: Check advisories
+        id: advisories
+        shell: bash
+        run: |
+          set -uo pipefail
+
+          report="${RUNNER_TEMP}/cargo-deny-advisories.txt"
+          if cargo deny --all-features check advisories > "${report}" 2>&1; then
+            echo "clean=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "clean=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          echo "report=${report}" >> "$GITHUB_OUTPUT"
+          cat "${report}"
+
+      - name: Sync advisory tracking issue
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          CLEAN: ${{ steps.advisories.outputs.clean }}
+          REPORT: ${{ steps.advisories.outputs.report }}
+        run: |
+          set -euo pipefail
+
+          # One tracking issue that gets refreshed, rather than one issue per
+          # advisory. The actions-rust-lang/audit setup this replaces opened a
+          # fresh issue per run and produced duplicates such as #41/#56.
+          issue_title="Security advisories in the dependency graph"
+
+          existing_issue="$(
+            gh issue list \
+              --repo "${REPO}" \
+              --state open \
+              --search "\"${issue_title}\" in:title" \
+              --json number \
+              --jq '.[0].number // empty'
+          )"
+
+          if [[ "${CLEAN}" == "true" ]]; then
+            if [[ -n "${existing_issue}" ]]; then
+              gh issue close "${existing_issue}" \
+                --repo "${REPO}" \
+                --reason completed \
+                --comment "\`cargo deny check advisories\` is clean again as of \`${GITHUB_WORKFLOW}\` run ${GITHUB_RUN_ID}."
+              echo "Closed issue #${existing_issue}."
+            else
+              echo "No advisories reported."
+            fi
+            exit 0
+          fi
+
+          issue_file="${RUNNER_TEMP}/advisory-issue.md"
+          cat > "${issue_file}" <<EOF
+          \`cargo deny check advisories\` reported findings against the policy in \`deny.toml\`.
+
+          Suggested next steps:
+
+          - Bump or replace the affected crates, or record a scoped exception in \`deny.toml\`.
+          - Yanked crates and unmaintained advisories are in scope because \`deny.toml\` sets \`yanked = "deny"\` and \`unmaintained = "workspace"\`.
+          - This issue closes itself once a later run reports no findings.
+
+          <details><summary>cargo-deny report</summary>
+
+          \`\`\`
+          EOF
+
+          # Issue bodies cap at 65536 characters and inclusion graphs get long.
+          head -c 50000 "${REPORT}" >> "${issue_file}"
+          if [[ "$(wc -c < "${REPORT}")" -gt 50000 ]]; then
+            echo "" >> "${issue_file}"
+            echo "... report truncated, see the workflow run for the full output." >> "${issue_file}"
+          fi
+
+          cat >> "${issue_file}" <<EOF
+          \`\`\`
+
+          </details>
+
+          This issue was opened or refreshed by \`${GITHUB_WORKFLOW}\`.
+          EOF
+
+          if [[ -n "${existing_issue}" ]]; then
+            gh issue edit "${existing_issue}" \
+              --repo "${REPO}" \
+              --add-label "type: security" \
+              --body-file "${issue_file}"
+            echo "Updated issue #${existing_issue}."
+          else
+            gh issue create \
+              --repo "${REPO}" \
+              --title "${issue_title}" \
+              --label "type: security" \
+              --body-file "${issue_file}"
+          fi
 
   agent-sdk-update-monitor:
     name: Check latest Agent SDK
@@ -123,11 +228,15 @@ jobs:
             gh issue edit "${existing_issue}" \
               --repo "${REPO}" \
               --title "${issue_title}" \
+              --add-label "type: dependencies" \
+              --add-label "area: agent-sdk" \
               --body-file "${issue_file}"
             echo "Updated issue #${existing_issue}."
           else
             gh issue create \
               --repo "${REPO}" \
               --title "${issue_title}" \
+              --label "type: dependencies" \
+              --label "area: agent-sdk" \
               --body-file "${issue_file}"
           fi

CONTRIBUTING.md

@@ -46,6 +46,28 @@ By participating, you agree to uphold this code.
 7. Push to your fork and open a Pull Request against `main`
 8. Fill out the PR summary, validation, and any relevant notes
 
+### Labels
+
+Labels use a `namespace: value` convention so they group visually and filter cleanly.
+Apply one `type:` label per issue or pull request. The exception is a dependency
+update that also carries a security fix, which takes `type: dependencies` and
+`type: security` together.
+
+| Namespace | Values | Meaning |
+| --- | --- | --- |
+| `type:` | `bug`, `fix`, `feature`, `docs`, `refactor`, `security`, `dependencies`, `release` | What kind of work it is. Use `bug` for a reported defect and `fix` for the change that resolves one. |
+| `area:` | `tui`, `core`, `agent-sdk`, `install`, `ci` | Which part of the project it touches. |
+| `status:` | `triage`, `blocked`, `needs-info`, `discussion`, `wontfix` | Where it sits in the workflow. |
+
+`good first issue` and `help wanted` stay unprefixed because GitHub uses them to
+populate the repository contribution page.
+
+Issue templates apply `type:` and `status: triage` automatically, Dependabot
+applies `type: dependencies` plus the matching `area:` label from
+`.github/dependabot.yml`, and the weekly `Dependency Monitor` workflow applies
+`type: security` to the advisory issue it opens. Renaming any of those labels
+requires updating that config in the same change.
+
 ## Development Setup
 
 ### Prerequisites