From a913516e6e1ae777e1f44c7fb9945237c2e9a332 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 27 Oct 2026 01:18:53 +0000 Subject: [PATCH] CI: re-sync the label workflows to the template (github.token) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit labels.yml and label-triage.yml now match hyperpolymath/rsr-template-repo: GH_TOKEN reads github.token instead of secrets.GITHUB_TOKEN (the same token), the runner is pinned to ubuntu-24.04, and each job has timeout-minutes: 10. Neither workflow gains a uses: step, so actions.lock is unchanged. This clears Hypatia RE001 on both files under the current rule, as hyperpolymath/echo-types#354 did there. RE001 on push-email-notify.yml stays: under standards ADR-009 it is cleared by an (egress …) entry in a repo deed, and this repository has no _chora.deed yet. Checks: scripts/check-repository.mjs passes; RE001 run locally, 3 findings before (old rule), 1 after (push-email-notify only). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01J4QvDithtn5Xk5MbSPm4Px --- .github/workflows/label-triage.yml | 5 +++-- .github/workflows/labels.yml | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 814a192..3b8aa96 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -46,11 +46,12 @@ permissions: jobs: triage: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 10 # Hypatia workflow_audit/missing_timeout_minutes (alert #68) steps: - name: Classify and label env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ github.token }} NUM: ${{ github.event.issue.number || inputs.issue }} run: | set -uo pipefail diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index 83ab941..c496ffd 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -32,11 +32,12 @@ permissions: jobs: sync: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 10 # Hypatia workflow_audit/missing_timeout_minutes (alert #69) steps: - name: Apply canonical labels env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ github.token }} # ⚠ LOAD-BEARING. This workflow deliberately does not check the repo # out (no `uses:`, so no actions.lock entry can drift), which means # `gh label create` / `gh label edit` have no git remote to infer a