t295: Issue-sync label passthrough — replace hardcoded allowlist#1154
t295: Issue-sync label passthrough — replace hardcoded allowlist#1154marcusquinn merged 1 commit intomainfrom
Conversation
- map_tags_to_labels() now passes all #tags through as GitHub labels instead of silently dropping unrecognised ones (~20 were allowlisted, dozens were dropped including supervisor, self-improvement, shell, etc.) - Small alias map normalises synonyms (bugfix->bug, feat->enhancement, etc.) - auto-dispatch meta-tag is skipped (not useful as a label) - New ensure_labels_exist() creates missing labels on-the-fly via gh label create --force (idempotent, neutral grey colour) - cmd_push() now calls ensure_labels_exist() before issue creation - cmd_enrich() now syncs labels alongside body updates, so existing issues get their missing labels added
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @marcusquinn, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the issue synchronization script by transitioning from a restrictive hardcoded label allowlist to a flexible passthrough system. The changes ensure that all relevant tags from Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Wed Feb 11 20:02:29 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request significantly improves label management by replacing a hardcoded allowlist with a dynamic passthrough system for syncing TODO.md tags to GitHub issues. However, it introduces security risks due to improper gh CLI invocation, specifically argument injection and unauthorized label modification via the --force flag. Additionally, the use of 2>/dev/null suppresses critical error messages, hindering debuggability and violating style guidelines. Addressing these concerns will enhance both security and maintainability.
| for label in $labels; do | ||
| [[ -z "$label" ]] && continue | ||
| # --force is idempotent: updates if exists, creates if not | ||
| gh label create "$label" --repo "$repo_slug" --color "EDEDED" \ | ||
| --description "Auto-created from TODO.md tag" --force 2>/dev/null || true |
There was a problem hiding this comment.
The ensure_labels_exist function is vulnerable to argument injection and unauthorized label metadata modification. The $label variable, derived from user-controlled tags, is passed without a -- separator, allowing attackers to inject flags. The unquoted $labels variable in the loop also allows shell globbing. Furthermore, the --force flag enables unauthorized modification of existing labels. Additionally, the use of 2>/dev/null to suppress stderr violates the repository's style guide, hiding potentially useful error messages from gh and hindering debugging.
| for label in $labels; do | |
| [[ -z "$label" ]] && continue | |
| # --force is idempotent: updates if exists, creates if not | |
| gh label create "$label" --repo "$repo_slug" --color "EDEDED" \ | |
| --description "Auto-created from TODO.md tag" --force 2>/dev/null || true | |
| for label in "$labels"; do | |
| [[ -z "$label" ]] && continue | |
| gh label create -- "$label" --repo "$repo_slug" --color "EDEDED" \ | |
| --description "Auto-created from TODO.md tag" 2>/dev/null || true | |
| done |
| done | ||
| unset IFS | ||
| if [[ ${#label_args[@]} -gt 0 ]]; then | ||
| gh issue edit "$issue_number" --repo "$repo_slug" "${label_args[@]}" 2>/dev/null || true |
There was a problem hiding this comment.
Similar to the ensure_labels_exist function, this use of 2>/dev/null violates the repository's style guide (Line 50). Suppressing stderr from gh issue edit can hide important errors, like problems with permissions or invalid labels, making troubleshooting harder. The || true guard is sufficient to prevent script termination on error.
| gh issue edit "$issue_number" --repo "$repo_slug" "${label_args[@]}" 2>/dev/null || true | |
| gh issue edit "$issue_number" --repo "$repo_slug" "${label_args[@]}" || true |
References
- Line 50:
2>/dev/nullis acceptable ONLY when redirecting to log files, not blanket suppression. (link)
1 participant
Summary
map_tags_to_labels()with a passthrough approach#tagsfrom TODO.md now become GitHub issue labels automaticallyauto-dispatchmeta-tag is skipped (not useful as a label)ensure_labels_exist()creates missing labels on-the-fly viagh label create --forcecmd_enrich()now syncs labels alongside body updates, so existing issues get their missing labelsProblem
Tags like
#supervisor,#self-improvement,#shell,#ci,#memory,#release,#reliability,#issue-sync, and many others were silently dropped because they weren't in the hardcoded allowlist. Only ~20 of dozens of tags were synced.Testing
map_tags_to_labels():auto-dispatchcorrectly skipped#prefix strippedRef #1153