slachiewicz opened a new pull request, #302: URL: https://github.com/apache/maven-gh-actions-shared/pull/302
Two changes that belong together: the sync becomes safe to run unattended, because by default it now neither creates labels nor needs a credential. ## Creation is opt-in A plain run corrects the colour and description of labels a repository **already has**, and reports the rest without touching them. Creating is behind a new `create-missing` input, off by default. This matters because declaring a label in `labels.js` otherwise creates it everywhere. As the file stands today, a sync would add `security` to **79** repositories and `hacktoberfest-accepted` to **75** that never took part in Hacktoberfest. Adding a label to the canonical set and rolling it out to every repository are two different decisions, and this lets them be taken separately. ## The token is no longer required, and there is a schedule Reading labels from a public repository requires no permissions, so with no token supplied the job runs on the default `GITHUB_TOKEN`, writes nothing, and fails with a list of what drifted. Supplying the token is what turns a run into a reconciliation. That makes an unattended run possible, so there is one: **monthly, on the first at 06:00**. Drift is currently invisible until somebody remembers to dispatch this by hand. That is not hypothetical — `maven-executor` was carrying 11 of the 22 labels, and the only reason anyone noticed was an audit. | run | token | writes | effect | |---|---|---|---| | scheduled, monthly | none | none | reports drift, fails if any | | dispatch, no token | none | none | same, on demand | | dispatch + token | yes | updates | corrects colour and description of existing labels | | dispatch + token + `create-missing` | yes | updates and creates | full reconciliation, the old behaviour | ## One fix along the way `createLabel` and `updateLabel` were called without `await`, so the job could finish before its own writes had been issued. Both are awaited now. I would normally keep an unrelated fix out of a change like this, but these are the exact lines being edited and leaving a known bug in them seemed worse. ## Note on the default This is deliberately a behaviour change: the previous default was to create. Anyone wanting the old behaviour passes `create-missing`. The reason for flipping it is that the destructive-by-omission direction is the one worth requiring a deliberate click — creating a label in 79 repositories is hard to walk back, while not creating one costs a second run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
