feat(labels): estate label tooling + auto-triage for new issues

[hyperpolymath]

Ships the canonical label set and the classifier that labels newly-filed issues.

Additive only — never removes a label, never overrides a human's classification, silent when unsure, never fails an issue.

Also adds this repo's two new workflows to .github/workflows/actions.lock as []. That lock is keyed by workflow path and refuses any workflow it does not list — a startup_failure, which produces no check run and is therefore silent. gh actions-lock cannot add these: it records action versions, and both workflows deliberately use none.

See docs/LABELS.adoc in hyperpolymath/.git-private-farm.

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR implements a canonical estate label taxonomy and automated triage system using jq and GitHub Actions. While the solution is 'up to standards' according to Codacy and complies with strict architectural constraints, there are significant gaps in verification. None of the required test scenarios for classification logic (such as conventional commit prefixes or keyword inflections) were addressed.

Two technical risks stand out: the shell-based parsing of label data is fragile and will fail if label descriptions contain tab characters, and the label application logic is prone to word-splitting issues. Although the implementation is additive and non-disruptive, these scripting issues should be resolved to ensure the long-term stability of the tooling.

About this PR

• No test suite was included to verify the complex regex and precedence logic in the jq classifier. Consider adding a validation step or a set of test cases to ensure the classification works as expected for different issue titles and bodies.

Test suggestions

• Missing: Classification of issue titles with conventional commit prefixes (e.g., 'feat:', 'fix:')
• Missing: Classification of issue titles with bracketed tags (e.g., '[security]', '[gov]')
• Missing: Keyword matching with inflections (e.g., matching 'theorems' via 'theorem' stem)
• Missing: Enforcement of 'max: 1' tier constraints (preventing multiple type or priority labels)
• Missing: Human classification protection (staying out of tiers already labeled by humans)
• Missing: Label synchronization workflow creating missing labels
• Missing: Label synchronization workflow updating drifting colors and descriptions
• Missing: Protection of 'frozen' label definitions during synchronization

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Missing: Classification of issue titles with conventional commit prefixes (e.g., 'feat:', 'fix:')
2. Missing: Classification of issue titles with bracketed tags (e.g., '[security]', '[gov]')
3. Missing: Keyword matching with inflections (e.g., matching 'theorems' via 'theorem' stem)
4. Missing: Enforcement of 'max: 1' tier constraints (preventing multiple type or priority labels)
5. Missing: Human classification protection (staying out of tiers already labeled by humans)
6. Missing: Label synchronization workflow creating missing labels
7. Missing: Label synchronization workflow updating drifting colors and descriptions
8. Missing: Protection of 'frozen' label definitions during synchronization

Low confidence findings

• The triage and sync workflows rely on fetching raw file content via the GitHub API. While this avoids external dependencies, it makes the workflows dependent on API availability and commit propagation speeds.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

The command expansion here is brittle. Use a Bash array to accumulate arguments to ensure spaces or special characters in label names are handled correctly by the shell.

Try running the following prompt in your coding agent:

Refactor the label application logic in the triage workflow to use a Bash array for --add-label arguments instead of printf %q to avoid potential word splitting issues with label names.

[codacy-production]

_{⚪ LOW RISK}

Parsing existing labels using awk or TSV with a tab delimiter is fragile because label descriptions are free-form text and may contain tab characters. Since the source data is already JSON, it is safer to iterate over the labels and extract properties directly using jq within the loop, or use a null-delimited format.

Refactor the label sync loop to be more robust against special characters. Instead of using @tsv, consider using jq -c '.labels[]' to iterate over JSON objects and then extracting fields inside the loop.

[codacy-production]

_{⚪ LOW RISK}

Nitpick: The temporary directory $work is created via mktemp -d but is not removed at the end of the script. Although GitHub-hosted runners are destroyed after the job, cleaning up temporary files is a good practice.

Suggested change

	work=$(mktemp -d); RULES=$work/rules.json; SCRIPT=$work/classify.jq
	work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
	RULES=$work/rules.json; SCRIPT=$work/classify.jq

[gitar-bot]

Gitar is working

_Gitar

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud