ci: label pull requests with database migrations

[Komzpa]

Summary

• add a db migration path label for Alembic revision changes
• run actions/labeler on pull requests from forks without checking out PR code
• keep manual labels stable by disabling label sync/removal

Why

Merging several green PRs that each add database migrations needs maintainer ordering/oversight even when CI is green.

Test plan

• git diff --check
• Created/updated the db migration repository label
• Manually applied db migration to the currently open migration PRs: feat(accounts): add operator-controlled account aliases #759, feat(accounts): add manual routing policy #761, feat(proxy): route security work to authorized accounts #762

[Soju06]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Soju06]

확인했습니다. 전체 방향은 맞고 CI/merge 상태도 좋습니다.

• PR 상태: MERGEABLE, mergeStateStatus=CLEAN
• CI: all green, CI Required pass
• Codex: 🤖 codex: ok
• git diff --check: pass
• .github/labeler.yml / .github/workflows/pr-labeler.yml YAML parse: pass
• db migration repo label 존재 확인
• 본문에 적힌 feat(accounts): add operator-controlled account aliases #759 / feat(accounts): add manual routing policy #761 / feat(proxy): route security work to authorized accounts #762 모두 db migration 라벨 적용 확인
• actions/labeler@v6 문서상 pull_request_target + contents: read + pull-requests: write 구성 자체는 fork PR labeling 용도와 맞습니다.

다만 merge 전에 한 가지는 고치는 게 좋겠습니다.

Blocker / 수정 권장

.github/workflows/pr-labeler.yml:16

uses: actions/labeler@v6.0.1

이 repo의 기존 workflow들은 대부분 third-party Actions를 SHA로 pin하고 있고, 이 workflow는 pull_request_target + pull-requests: write 권한을 갖습니다. 그래서 tag pin보다는 immutable SHA pin이 맞습니다. zizmor도 high로 잡습니다:

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pr-labeler.yml:16:15
   |
16 |         uses: actions/labeler@v6.0.1
   |               ^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)

현재 v6.0.1 tag SHA는 아래로 확인했습니다:

uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b

그 외 caveat: pull_request_target workflow를 새로 추가하는 PR이라 이 PR 자체에서는 새 labeler workflow가 base branch에 아직 없어 실제 동작 검증이 어렵고, merge 후 다음 PR부터 검증됩니다.

[Komzpa]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Soju06]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Soju06]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".