[PM-39788] Add workflow to automatically label a PR by change type

[djsmith85]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-39788

Depends on bitwarden/gh-actions#829

📔 Objective

Adds a workflow that gets triggered when a PR is opened, synchronized or re-opened. It calls a composite action living in bitwarden/gh-actions and passes the PR number and any existing labels to it. The composite action looks for a configuration file (.github/label-pr.json) and tries to match the change type via PR title and/or changed files.

It then applies one of the labels t:* to the PR.

These change type labels are then used to create categories for the Github release notes.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR adds a pull_request-triggered workflow that delegates change-type labeling to the bitwarden/gh-actions/auto-label-pr-sdlc composite action (merged in gh-actions#829), plus the repo-specific .github/label-pr.json config. The workflow follows the conventions already used by enforce-pr-labels-sdlc.yml and review-code.yml: empty top-level permissions, job-scoped least privilege, SHA-pinned actions/checkout, and persist-credentials: false. I verified the config against the action's matching semantics (title substring match on <pattern>:/<pattern>(, path prefix match) and against the categories in .github/release.yml. No security or correctness blockers found.

Code Review Details

• ❓ : t:llm may not exist as a repo label; gh pr edit --add-label fails the job for unknown labels, and it has no release.yml category
  • .github/label-pr.json:20

Non-blocking nits (no inline comments posted): auto-label-pr-sdlc.yml is missing a trailing newline (.editorconfig sets insert_final_newline = true, and .prettierignore excludes .github/workflows so nothing will catch it), and the .checkmarx/ path pattern has no matching directory in this repo.

[djsmith85]

@bitwarden/team-admin-console-dev Please feel free to extend the label-pr.json now as needed or just keep it as is and refine it later.

[Copilot]

Pull request overview

Adds SDLC automation to apply change-type labels (t:*) to pull requests so they can be used for GitHub release note categorization.

Changes:

• Introduces a new PR-triggered GitHub Actions workflow to auto-label PRs via bitwarden/gh-actions/auto-label-pr-sdlc.
• Adds .github/label-pr.json configuration for title/path pattern matching to map PRs to t:* labels.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/auto-label-pr-sdlc.yml	New workflow to run the auto-labeling action on PR events.
.github/label-pr.json	Adds the label-matching configuration consumed by the labeling action.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (d625ab6) to head (b2401fa).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@     Coverage Diff      @@
##   main   #1197   +/-   ##
============================
============================

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

.github/label-pr.json:15

• The PR description says the workflow applies one of the t:* change-type labels, but this config includes a non-t: label key (feature-flag). This can lead to inconsistent labeling expectations (and may create/require a label that doesn't fit the documented scheme).

  "path_patterns": {
    "t:feature": [],
    "t:tech-debt": [],

.github/workflows/auto-label-pr-sdlc.yml:6

• Using the pull_request event can prevent this workflow from applying labels on PRs opened from forks because the GITHUB_TOKEN is read-only in that context, even if you request pull-requests: write. If you want auto-labeling to work for fork PRs, switch to pull_request_target and ensure you only use base-repo context (no checkout of untrusted PR code).

on:
  pull_request:
    types: [opened, synchronize, reopened]

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/auto-label-pr-sdlc.yml:6

• This workflow both (1) needs write permissions to apply labels and (2) matches labels using PR title patterns. With pull_request, fork PRs will get a read-only GITHUB_TOKEN so labeling will fail; and without edited, title changes after opening won’t trigger re-labeling. Switching to pull_request_target and adding edited makes labeling work reliably while still avoiding executing untrusted PR code (this workflow only checks out the base repo by default).

on:
  pull_request:
    types: [opened, synchronize, reopened]