chore: label pull requests by changed files

[chaim0m]

Summary

• label root documentation, dependency, release, packaging, and automation changes
• avoid labeling shipped skill Markdown as documentation
• remove the low-signal catch-all Go label
• use pull_request, per-PR concurrency, and pinned actions/labeler v7.0.0

Jira: https://doitintl.atlassian.net/browse/CMP-48969

Why

Automatic labels make the PR list filterable while focusing on changes where metadata adds signal. Release tooling, packaging, workflow automation, dependencies, and root documentation now have distinct labels.

This remains independent from author assignment by design so each automation can be reviewed, disabled, or rolled back separately.

Test methods

• parsed the workflow and label configuration as YAML
• ran git diff --check
• verified the pinned SHA resolves to v7.0.0
• confirmed the configured paths and labels exist
• GitHub Actions label-files check passed and applied automation to this pull request

Could this break things?

Risk: low. The workflow only adds existing or explicitly created PR labels. It checks out no code, executes no PR-controlled scripts, and does not remove manually applied labels.

[Copilot]

Pull request overview

Adds automated pull request labeling based on changed file paths, using a pinned actions/labeler workflow so PRs can be filtered by area without manual label upkeep.

Changes:

• Introduces a pull_request_target workflow that applies labels via actions/labeler with least-necessary permissions.
• Adds labeler configuration to apply existing go, documentation, and dependencies labels based on file globs (**/*.go, **/*.md, go.mod/go.sum).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/pr-labels.yml	Adds a PR-targeted workflow that runs the pinned labeler action and applies labels to PRs.
.github/labeler.yml	Defines label-to-file-glob rules for Go, Markdown documentation, and Go dependency files.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[apgiorgi]

Technically the cleanest of the three hygiene PRs. I checked the things that usually break here and they're all fine:

• Config syntax is correct v5 (changed-files / any-glob-to-any-file), and the pinned SHA 8558fd7 really is tag v5.0.0 — no v4/v5 mismatch.
• All three labels exist: documentation (#0075ca), dependencies (#0366d6), go (#16e2e2). Nothing will no-op on a missing label.
• Globs match the real layout, no dead entries: **/*.md covers 11 tracked files including root README.md (minimatch **/ matches zero segments), go.mod/go.sum both exist, **/*.go hits all four Go files.
• No security issue. pull_request_target with pull-requests: write is GitHub's documented labeler pattern, and both the workflow and config are read from the base branch, so a fork PR can't alter them.

What gives me pause is value rather than correctness. This is a four-Go-file repo, so go will land on nearly every PR and carry almost no signal. Meanwhile the coverage is thin in the places where a label would actually help: PRs touching only .goreleaser.yaml, packaging/*.tmpl, .github/workflows/, Formula/, or bucket/ get zero labels. If we keep this, those are the categories worth adding — release-tooling and packaging are exactly the changes I'd want flagged at a glance.

Nits

• Pinned two majors behind (v5.0.0, current v7), and with no .github/dependabot.yml nothing will bump it. Also the SHA pin diverges from house style — ci.yml:15,18,40 all use mutable major tags.
• No concurrency: block, so synchronize bursts will race redundant runs (cf. release.yml:12-14).
• pr-labels.yml:18 repo-token: is the v5 default — redundant.
• **/*.md labels skills/dci-cli/** as documentation, but that's shipped skill content, not docs.
• Given CONTRIBUTING.md discourages outside PRs, plain pull_request would be strictly least-privilege and sufficient for same-repo branches.
• The body lists "GitHub CI on this pull request" as a test method, but pull_request_target workflows run from the base branch — this can't run on its own PR, and it's absent from gh pr checks 51. Untested until merged.

Holding off on merging any of #48/#50/#51 until I decide whether to take them as one pr-hygiene.yml instead of three separate workflows.

[chaim0m]

Addressed the signal and maintenance findings: removed the catch-all Go label, restricted documentation to root Markdown, added release/packaging/automation categories, switched to pull_request, updated the pin to labeler v7, removed redundant inputs, and added per-PR concurrency. The missing release and packaging labels were created, automation now has a description, and this PR’s own label-files check passed and applied the label.

I kept this independent from author assignment for focused ownership/rollback. I also retained immutable full-SHA pinning; recurring Dependabot PRs are a separate repository policy rather than part of this labeler change.