ci: auto-apply prod-review label to dev-base PRs - #49
Merged
Conversation
Add an actions/labeler workflow that tags any PR touching a dev-base manifest (k8s/app-manifest/**) with `prod-review`, so dev changes that can flow to prod via the overlays are never missed for a prod-carry decision. The `-prod` overlay dir and argocd/ changes are excluded (they don't need carrying). Uses pull_request_target (so it can write labels) but only reads the changed- file list — it never checks out or runs PR code. sync-labels: false keeps the label until it's deliberately removed after triage. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds automated PR labeling to ensure changes to the dev-base Kubernetes manifests are surfaced for a “carry to prod?” triage decision, reducing the chance that inherited dev changes reach prod unnoticed.
Changes:
- Adds a GitHub Actions workflow that runs on PR open/sync/reopen to apply labels.
- Introduces
actions/labeler@v5configuration to applyprod-reviewwhenk8s/app-manifest/**is modified.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/prod-review-label.yml | New workflow to run actions/labeler@v5 on pull_request_target PR events and apply labels. |
| .github/labeler.yml | Labeler rules to add prod-review when PRs touch k8s/app-manifest/**. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address Copilot on #49: the comment implied an explicit exclusion list. Rewrite it to state that the rule matches only `k8s/app-manifest/**` and that sibling/unrelated paths (`k8s/app-manifest-prod/**`, `k8s/argocd/**`, `k8s/infra-manifest/**`) are simply outside the glob, not explicitly excluded. Comment-only; the rule is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
hakan-persson
added a commit
that referenced
this pull request
Jul 4, 2026
Address Copilot on #49: the comment implied an explicit exclusion list. Rewrite it to state that the rule matches only `k8s/app-manifest/**` and that sibling/unrelated paths (`k8s/app-manifest-prod/**`, `k8s/argocd/**`, `k8s/infra-manifest/**`) are simply outside the glob, not explicitly excluded. Comment-only; the rule is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a small GitHub Actions workflow that tags any PR touching a dev-base manifest (
k8s/app-manifest/**) with theprod-reviewlabel — so dev changes that can flow to prod through the overlays are never missed for a "carry to prod?" decision.Why
Prod overlays inherit the dev base, so a dev-side manifest change can reach prod on the next ArgoCD sync. Today catching those relies on remembering to check merged dev PRs (this is how #44–#47 were caught by hand). This makes it automatic: the label becomes a self-maintaining triage queue (
is:pr label:prod-review).What
.github/labeler.yml— rule: labelprod-reviewwhen a PR changesk8s/app-manifest/**. The-prodoverlay dir andargocd/changes are excluded (they're prod-side / don't need carrying)..github/workflows/prod-review-label.yml— runsactions/labeler@v5on PR open/sync/reopen.Notes
pull_request_targetso it has permission to write the label, but the job only reads the changed-file list and applies a label — it never checks out or runs PR code, so there's no code-execution risk from forks.sync-labels: false— the label is only added; it stays until deliberately removed after triage (it means "needs a prod decision", not "currently touches a base").prod-reviewlabel already exists.Part of the dev→prod coupling safety work (companion to the self-contained conversions in #39/#48).
🤖 Generated with Claude Code