Test: full-circle submission (please close) #1

	# §8.6 — the labeler. It runs on `pull_request_target` because a plain `pull_request`
	# trigger gets a READ-ONLY token on fork PRs and cannot label them, which would leave every
	# community PR unlabelled and therefore ungated.
	#
	# THIS IS THE ONE SAFE USE OF pull_request_target: it checks out NOTHING and runs NO
	# repository code. It reads the PR author from the event payload and calls the labels API.
	# Never add a checkout step to this file.
	name: labeler

	on:
	pull_request_target:
	types: [opened, reopened]

	permissions:
	pull-requests: write
	contents: read

	jobs:
	label:
	runs-on: ubuntu-latest
	steps:
	- name: apply via-agent or community
	uses: actions/github-script@v7
	with:
	script: \|
	const AGENT_ALLOWLIST = ['grokbot-agent'];
	const author = context.payload.pull_request.user.login;
	const labels = AGENT_ALLOWLIST.includes(author)
	? ['via-agent']
	: ['community', 'needs-verification'];
	await github.rest.issues.addLabels({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: context.payload.pull_request.number,
	labels,
	});
	core.info(`labelled ${author} PR: ${labels.join(', ')}`);

Navigation Menu