fix: harden repo maintenance workflows

[keito4]

Summary

• add missing label-sync checkout permission and self-create Dependabot labels before applying them
• skip Claude Code Review when no OAuth, API key, or OIDC federation auth is configured
• add workflow contract tests so these cases stay covered

Verification

• actionlint .github/workflows/dependabot-auto-merge.yml .github/workflows/label-sync.yml .github/workflows/claude-code-review.yml templates/workflows/dependabot-auto-merge.yml templates/workflows/label-sync.yml
• npm run format:check
• npm run lint
• npm test -- --runTestsByPath test/template-workflows.test.js test/claude-workflow-contract.test.js

Summary by CodeRabbit

• New Features

  • Added dependabot-minor label to better categorize minor dependency updates separately.
  • Enhanced Claude code review workflow with authentication validation before running reviews.

• Chores

  • Improved workflow permission configurations for better security and clarity.
  • Updated dependency update workflow to handle minor and major updates with improved label management.

• Tests

  • Added comprehensive test coverage for Claude authentication workflow checks.
  • Strengthened workflow permission and label-handling contract tests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 172fb587-1d7f-4608-b95e-5a9b9d70a124

📥 Commits

Reviewing files that changed from the base of the PR and between 7edac26 and 532c733.

📒 Files selected for processing (9)

• .github/labels.yml
• .github/workflows/claude-code-review.yml
• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/label-sync.yml
• templates/github/labels.yml
• templates/workflows/dependabot-auto-merge.yml
• templates/workflows/label-sync.yml
• test/claude-workflow-contract.test.js
• test/template-workflows.test.js

---

📝 Walkthrough

Walkthrough

Adds a dependabot-minor label to both the repository and template label files. Updates the Dependabot auto-merge workflow (and its template) to explicitly create labels before assigning them and adds issues: write permission. Adds a Claude authentication pre-check step to conditionally gate the review action. Adds contents: read to the label-sync workflow permissions.

Changes

Dependabot labeling, Claude auth gating, and permissions hardening

Layer / File(s)	Summary
New dependabot-minor label definition templates/github/labels.yml, .github/labels.yml	Adds the dependabot-minor label with color 0366d6 and description "Minor dependency update" to both the template and repository label configuration files.
Dependabot auto-merge: permissions, label creation, and minor/major flow templates/workflows/dependabot-auto-merge.yml, .github/workflows/dependabot-auto-merge.yml	Adds issues: write to job-level permissions. Introduces explicit gh label create --force calls for dependabot-minor (minor flow) and needs-review/breaking-change (major flow) before the corresponding PR label-add operations. Sets continue-on-error: true on the minor auto-approve step.
label-sync workflow: add contents: read permission templates/workflows/label-sync.yml, .github/workflows/label-sync.yml	Adds an explicit contents: read permission entry to the label-sync workflow in both the template and the repository instance.
Claude review: secret-availability pre-check and conditional execution .github/workflows/claude-code-review.yml	Adds a "Check Claude authentication" step that inspects the four relevant secrets and writes an available boolean to $GITHUB_OUTPUT; the "Run Claude Code Review" step is updated to gate on that output and passes federation rule ID and organization ID as additional inputs.
Contract tests for auth pre-check, label creation, and permissions test/claude-workflow-contract.test.js, test/template-workflows.test.js	New and updated Jest assertions cover the Claude auth pre-check step, issues: write presence in dependabot-auto-merge permissions, gh label create ordering for all three label names, and contents: read in label-sync.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• keito4/config#167: Introduces the .github/workflows/claude-code-review.yml workflow that this PR extends with the authentication pre-check and federation inputs.
• keito4/config#832: Also modifies .github/workflows/dependabot-auto-merge.yml and its template to harden token scopes and job-level permissions, directly overlapping with the issues: write and label-step changes here.
• keito4/config#578: Touches the same GitHub-labels and Dependabot automation area, including labels.yml and the label-sync/dependabot-auto-merge workflow logic that applies labels to Dependabot PRs.

Suggested labels

released

🐇 A label called dependabot-minor hops into view,
With secrets checked before Claude starts its review.
Permissions granted, issues: write now in place,
Labels created before they're added with grace.
Hop hop hooray, the workflows run true! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix: harden repo maintenance workflows' directly and accurately summarizes the main objective of the changeset—improving security and robustness of repository maintenance workflows.
Description check	✅ Passed	The PR description covers the main changes (labels, authentication, testing) and verification steps, though it omits most template sections like 'Why', 'How to test', and 'Checklist' from the specified template.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/repo-maintenance-workflow-hardening

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

test/claude-workflow-contract.test.js

Oops! Something went wrong! :(

ESLint: 10.5.0

ReferenceError: describe is not defined
at Object. (/test/eslint-config.test.js:4:1)
at Module._compile (node:internal/modules/cjs/loader:1830:14)
at Object..js (node:internal/modules/cjs/loader:1961:10)
at Module.load (node:internal/modules/cjs/loader:1553:32)
at Module._load (node:internal/modules/cjs/loader:1355:12)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at loadCJSModuleWithModuleLoad (node:internal/modules/esm/translators:326:3)
at ModuleWrap. (node:internal/modules/esm/translators:231:7)
at ModuleJob.run (node:internal/modules/esm/module_job:437:25)
at async node:internal/modules/esm/loader:639:26

test/template-workflows.test.js

Oops! Something went wrong! :(

ESLint: 10.5.0

ReferenceError: describe is not defined
at Object. (/test/eslint-config.test.js:4:1)
at Module._compile (node:internal/modules/cjs/loader:1830:14)
at Object..js (node:internal/modules/cjs/loader:1961:10)
at Module.load (node:internal/modules/cjs/loader:1553:32)
at Module._load (node:internal/modules/cjs/loader:1355:12)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at loadCJSModuleWithModuleLoad (node:internal/modules/esm/translators:326:3)
at ModuleWrap. (node:internal/modules/esm/translators:231:7)
at ModuleJob.run (node:internal/modules/esm/module_job:437:25)
at async node:internal/modules/esm/loader:639:26

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 532c73361f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pass only one Claude auth method

When a repository has both the existing CLAUDE_CODE_OAUTH_TOKEN secret and the newly supported ANTHROPIC_API_KEY/federation secrets configured, this step now passes multiple Claude authentication methods to the action after the guard reports available=true. The action treats the OAuth token as an alternative to the API key, so repos that kept both secrets around can start failing or using the wrong auth path instead of being safely skipped. Please choose a single auth path in the auth-check step and only pass inputs for that selected path.

Useful? React with 👍 / 👎.

[github-actions]

🎉 This PR is included in version 1.116.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀