ci: add /kind, /area, /milestone label sync for issues by hickeyma · Pull Request #2157 · llm-d/llm-d-router

hickeyma · 2026-07-23T11:17:37Z

What type of PR is this?
/kind feature

What this PR does / why we need it:
Mirrors pr-kind-label.yaml so directive based labeling works on issues just like PRs. prow-github.yml is still the only thing handling these commands on issues. Removing it (in #2114) would otherwise regress issue triage.

Implementation: Body only trigger for now and no issue_comment handling. There is therefore no new comment triggered attack surface.

Note for reviewers:
An alternative implementation is body plus issue_comment: [created] which gives full Prow parity and is gated on author_association in OWNER/MEMBER/COLLABORATOR. Adds an issue_comment triggered workflow holding issues: write which is precisely the surface area #2114 is trying to reduce (increases potential attack surface). Gated comment commands can be added later if maintainers are missing their use in practice. For this implementation it is worth re-evaluating the marketplace slash-command action because comment triggers are what those actions are built for (ref: #2113 (comment)).

/cc @elevran

Which issue(s) this PR fixes:
Partial: #956

Raised in review on #2113:

Release note (write NONE if no user-facing change):

NONE

Mirrors pr-kind-label.yaml so directive based labeling works on issues just like PRs. prow-github.yml is still the only thing handling these commands on issues. Removing it (a separate change) would otherwise regress issue triage. Body only trigger for now and no issue_comment handling. There is therefore no new comment triggered attack surface. Ref: llm-d#956 Signed-off-by: Martin Hickey <martin.hickey@ie.ibm.com>

Copilot

Pull request overview

Adds an issue-focused GitHub Actions workflow to mirror the existing PR body directive label sync, so /kind, /area, and /milestone directives in issue bodies can drive labels/milestone without relying on the prow-github.yml chat-ops integration.

Changes:

Introduces a new issues-triggered workflow that parses /kind, /area, and /milestone directives from the issue body.
Applies/removes kind/* and area/* labels and sets the issue milestone via gh issue edit with issues: write permissions.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Martin Hickey <martin.hickey@ie.ibm.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

.github/workflows/issue-kind-label.yaml:55

Same failure mode for /area: if the directive contains a non-existent area/* label, the workflow will remove all existing area/* labels and then fail to add the requested one(s), effectively wiping area triage. Consider validating requested area/* labels exist before removing current labels; otherwise no-op and warn.

          # Remove existing area/* labels
          gh issue view "$ISSUE_NUMBER" --repo "$REPO" --json labels \
            -q '.labels[].name | select(startswith("area/"))' | \
            while IFS= read -r label; do
              gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --remove-label "$label" || echo "::warning::Failed to remove label '$label'"

The label sync steps removed all kind/* and area/* labels before adding the ones named in the body. A mistyped directive made the add fail while the removal had already happened, leaving the issue or PR unlabeled with only a warning in the Actions log. Issue templates do not scaffold these directives and the repository defines just two area/* labels, so an unrecognised value is easy to hit. Check every requested label against the repository label list first and skip the sync entirely when any is unknown. Review comment from co=pilot: - llm-d#2157 (review) Signed-off-by: Martin Hickey <martin.hickey@ie.ibm.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

An empty /kind extraction still removed existing kind/* labels which wiped labels maintainers set through the UI on any body edit. Exit early when no directive is present matching the /area step and issue-kind-label.yaml. Review comment from Copilot: - llm-d#2157 (review) Signed-off-by: Martin Hickey <martin.hickey@ie.ibm.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (2)

.github/workflows/pr-kind-label.yaml:72

The value printed in this workflow command comes from the PR body and is not escaped. GitHub Actions workflow commands interpret percent-encoded sequences (e.g. %0A), so a crafted directive value could inject additional workflow commands into logs/annotations. Escape % (and ideally other control chars) before interpolating untrusted text into ::warning:: messages.

          if [ -n "$unknown" ]; then
            echo "::warning::Unknown label(s) ${unknown% }, skipping area sync"
            exit 0
          fi

.github/workflows/issue-kind-label.yaml:69

The value printed in this workflow command comes from the issue body and is not escaped. GitHub Actions workflow commands interpret percent-encoded sequences (e.g. %0A), so a crafted directive value could inject additional workflow commands into logs/annotations. Escape % (and ideally other control chars) before interpolating untrusted text into ::warning:: messages.

          if [ -n "$unknown" ]; then
            echo "::warning::Unknown label(s) ${unknown% }, skipping area sync"
            exit 0
          fi

Values pulled from the PR/issue body were echoed into ::warning:: workflow commands unescaped. GitHub decodes percent sequences in command data, so escape %, CR and LF before emitting untrusted text. This commit hardens the workflows. Review comment: - llm-d#2157 (review) Signed-off-by: Martin Hickey <martin.hickey@ie.ibm.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

elevran

One minor consistency nit below.

elevran · 2026-07-27T07:15:15Z

+
+on:
+  issues:
+    types: [opened, edited]


nit:
types: [opened, edited] omits reopened, which pr-kind-label.yaml includes for the same trigger. If reopening an issue can leave a stale label state, add reopened for parity; otherwise fine as is.

hickeyma requested a review from a team as a code owner July 23, 2026 11:17

hickeyma requested review from ahg-g, Copilot and elevran July 23, 2026 11:17

github-actions Bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. kind/feature Categorizes issue or PR as related to a new feature. labels Jul 23, 2026

Copilot started reviewing on behalf of hickeyma July 23, 2026 11:18 View session

hickeyma mentioned this pull request Jul 23, 2026

[wip] ci: Remove obsolete Prow GitHub Actions integration #2114

Draft

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread .github/workflows/issue-kind-label.yaml

Potential fix for pull request finding

4e776c7

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Martin Hickey <martin.hickey@ie.ibm.com>

hickeyma requested a review from Copilot July 23, 2026 14:08

Copilot started reviewing on behalf of hickeyma July 23, 2026 14:11 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread .github/workflows/issue-kind-label.yaml

hickeyma requested a review from Copilot July 23, 2026 15:42

Copilot started reviewing on behalf of hickeyma July 23, 2026 15:42 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread .github/workflows/issue-kind-label.yaml

github-actions Bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 23, 2026

hickeyma requested a review from Copilot July 23, 2026 16:09

Copilot started reviewing on behalf of hickeyma July 23, 2026 16:09 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread .github/workflows/pr-kind-label.yaml Outdated

hickeyma requested a review from Copilot July 24, 2026 10:43

Copilot started reviewing on behalf of hickeyma July 24, 2026 10:44 View session

github-actions Bot added kind/feature Categorizes issue or PR as related to a new feature. and removed kind/feature Categorizes issue or PR as related to a new feature. labels Jul 24, 2026

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Comment thread .github/workflows/pr-kind-label.yaml

Comment thread .github/workflows/issue-kind-label.yaml

Comment thread .github/workflows/issue-kind-label.yaml Outdated

github-actions Bot removed the kind/feature Categorizes issue or PR as related to a new feature. label Jul 24, 2026

github-actions Bot added the kind/feature Categorizes issue or PR as related to a new feature. label Jul 24, 2026

hickeyma requested a review from Copilot July 24, 2026 11:17

Copilot started reviewing on behalf of hickeyma July 24, 2026 11:18 View session

Copilot AI reviewed Jul 24, 2026

View reviewed changes

elevran approved these changes Jul 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: add /kind, /area, /milestone label sync for issues#2157

ci: add /kind, /area, /milestone label sync for issues#2157
hickeyma wants to merge 5 commits into
llm-d:mainfrom
hickeyma:ci-add-labels-issues

hickeyma commented Jul 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

elevran left a comment

Uh oh!

elevran Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

hickeyma commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

elevran left a comment

Choose a reason for hiding this comment

Uh oh!

elevran Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hickeyma commented Jul 23, 2026 •

edited

Loading