ci: add label policy check

[Astro-Han]

Summary

Add a label policy check for issues and pull requests.

Why

PawWork labels are now used as a small MECE taxonomy: one type, one priority, and at least one routing label. Without a check, issues and PRs can silently drift into missing labels, duplicate priority labels, or broad labels such as tech-debt on user-facing bugs.

This PR keeps the first enforcement slice small: it checks hard label-shape rules and does not auto-edit labels or infer business priority.

Related Issue

No dedicated issue. This follows the maintainer-requested label governance cleanup.

Human Review Status

Pending. A human should make the final merge decision after reviewing the final diff and verification evidence.

Review Focus

• Whether the first policy slice is narrow enough.
• Whether ci should be accepted as a primary routing label for workflow/tooling PRs.
• Whether removing automatic documentation path labeling is the right way to avoid type-label conflicts.

Risk Notes

Low. The workflow only validates labels and does not modify issues or PRs. It uses pull_request_target with checkout pinned to the base SHA so it does not execute scripts from an untrusted PR branch.

How To Verify

Label policy tests: 11 passed with node --test .github/scripts/label-policy-check.test.js
Syntax checks: node --check passed for label-policy-check.js and label-policy-check.test.js
Workflow lint: actionlint .github/workflows/label-policy.yml passed
YAML parse: label-policy.yml and labeler.yml parsed successfully
Dry run: current open issues passed, 35 checked
Dry run: current open PRs passed, 1 checked

Screenshots or Recordings

Not applicable. No visible UI changes.

Checklist

• Human review status is stated above as pending, approved, or not required
• I linked the related issue, or stated why there is no issue
• This PR has exactly one type label (bug, enhancement, task, or documentation), at least one primary routing label (app, ui, platform, harness, or ci), and exactly one priority label (P0 to P3), or I requested maintainer labeling
• I described the review focus and any meaningful risks
• I listed the relevant verification steps and the key result for each
• I did not introduce unrelated refactors, dependencies, generated files, or file changes beyond the stated scope
• I manually checked visible UI or copy changes when needed, with screenshots or recordings
• I considered macOS and Windows impact for platform, packaging, updater, signing, paths, shell, or permissions changes
• I called out docs, release notes, dependencies, permissions, credentials, deletion behavior, generated content, or local file changes when relevant
• I reviewed the final diff for unrelated changes and suspicious dependency changes
• I am targeting dev, and my PR title and commit messages use Conventional Commits in English

Summary by CodeRabbit

• Chores
  • Implemented automated label policy validation for pull requests and issues to enforce consistent labeling standards across the repository.

[coderabbitai]

Warning

Rate limit exceeded

@Astro-Han has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 22 minutes and 6 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 81c7f6ec-25ff-4f58-8bf2-1fc38e459c64

📥 Commits

Reviewing files that changed from the base of the PR and between 592fa56 and ed85307.

📒 Files selected for processing (3)

• .github/scripts/label-policy-check.js
• .github/scripts/label-policy-check.test.js
• packages/opencode/test/github/pr-routing-triage.test.ts

📝 Walkthrough

Walkthrough

This PR adds a label policy validation system for GitHub. A new validation script defines and enforces labeling rules (exactly one priority, one type, at least one routing label per item); a GitHub Actions workflow runs the validation on issues and pull requests; comprehensive tests cover all policy scenarios; and the PR template is updated to document the labeling requirements.

Changes

Label Policy Validation System

Layer / File(s)	Summary
Label policy rules and validation function \.github/scripts/label-policy-check.js	Exports POLICY constant defining allowed priority (P0–P3), type (bug, enhancement, task, documentation), and routing (app, ui, platform, harness, ci) label sets, plus forbidden automation labels for issues. Implements validateLabelPolicy({ itemType, labels }) that validates exactly one priority and one type label are present, at least one routing label exists, tech-debt is used only with task type, and forbidden labels are not applied to issues.
Label policy validation tests \.github/scripts/label-policy-check.test.js	Comprehensive test suite verifying validateLabelPolicy accepts valid label combinations for issues and pull requests (including ci routing), rejects missing or multiple priority/type labels with exact error messages, rejects missing routing labels or invalid tech-debt usage, blocks forbidden automation labels on issues, and reports multiple independent failures together.
Workflow automation and PR template \.github/workflows/label-policy.yml, \.github/pull_request_template.md	GitHub Actions workflow triggers on issues and pull_request_target events (dev branch only), conditionally checks out code, imports and executes the validation script, and fails with diagnostic errors if policy violations are detected. PR template checklist updated to require exactly one type label, one primary routing label, and one priority label per PR (or request maintainer labeling).

Sequence Diagram(s)

sequenceDiagram
    participant GitHub as GitHub Event<br/>(issue/PR)
    participant Workflow as label-policy.yml
    participant Script as label-policy-check.js
    participant Validation as validateLabelPolicy
    
    GitHub->>Workflow: Trigger on issues or pull_request_target
    Workflow->>Workflow: Checkout code
    Workflow->>Script: Dynamic import
    Workflow->>Validation: Call validateLabelPolicy(itemType, labels)
    Validation->>Validation: Validate against POLICY rules
    Validation-->>Workflow: Return {ok, errors}
    alt Validation passes
        Workflow->>GitHub: Log success message
    else Validation fails
        Workflow->>GitHub: Fail workflow with error details
    end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Astro-Han/pawwork#573: Both PRs update .github/labeler.yml to define or align the documentation path-label rule for docs/** and **/*.md files.

Suggested labels

github_actions

Poem

🐰 Labels now align with care so true,
Priorities and types in every queue,
A validation script runs with GitHub's might,
Keeping routing rules and tech-debt right,
Hop along with policy checks in flight! 🚀

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci: add label policy check' directly describes the main change: adding a CI workflow and validation script for enforcing label policy on issues and PRs.
Description check	✅ Passed	The pull request description covers all required template sections: summary, why, related issue, human review status, review focus, risk notes, verification steps, screenshots (not applicable), and completed checklist.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/label-policy-check

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Suggested priority: P2 (includes non-doc, non-test paths outside the low-risk bucket).

P1/P0 are reserved for maintainer confirmation. Please relabel manually if this is a release blocker, security issue, data-loss risk, or updater/runtime failure.

[gemini-code-assist]

Code Review

This pull request introduces a label policy enforcement mechanism, including a validation script and corresponding tests, while updating the PR template to reflect the new requirements. Feedback suggests including the missing workflow file to execute the checks in CI, adding a default value for the labels parameter to improve robustness, and refactoring error messages to use defined constants instead of hardcoded strings for better maintainability.