[PM-22159] ci: Add automated PR labelling based on file paths and title patterns

[vvolkgang]

🎟️ Tracking

PM-22159

📔 Objective

Note

Mostly a copypaste from bitwarden/android#6157 with the exception of label-pr.json

Automate pull request labelling based on changed file paths and PR title patterns following conventional commits format, as a first step towards release notes with automated ✨ categories ✨ !

• JSON configuration: Label patterns defined in .github/label-pr.json - planned using yaml initially but it would require an external dependency, introducing the need for python environment and dependency management. Python supports json deserialization out of the box. File based config will allow us to centralise these scripts in our gh-actions repo later down the line.
• Labeling modes (add or replace) - In order to keep labels up-to-date in our PRs we'll replace them when they're updated, with the exception of Community PRs and our automated PRs where we'll add instead, preserving labels set by other automations.
• Raw python script without additional dependencies - faster workflows and easier local testing.

Labels

App Labels (from file paths):

• app:password-manager - Password manager app changes
• app:authenticator - Authenticator app changes

Change Type Labels:

• t:feature-app - Addition or improvement of Product features
• t:feature-tool - Addition or improvement of Tool features (e.g. Test Harness)
• t:bug - Bug fixes
• t:tech-debt - Technical debt, refactoring, cleanup
• t:docs - Documentation changes
• t:ci - CI/CD changes
• t:deps - Dependency updates
• t:breaking-change - Breaking changes
• t:misc - Miscellaneous (catch-all)

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – b9e42b0f-080e-4547-b6f6-324f3de8f728

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.27%. Comparing base (5d9e92d) to head (3fe7646).
⚠️ Report is 16 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2225      +/-   ##
==========================================
- Coverage   85.47%   84.27%   -1.20%     
==========================================
  Files        1746     1989     +243     
  Lines      147479   163714   +16235     
==========================================
+ Hits       126055   137973   +11918     
- Misses      21424    25741    +4317     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[claude]

Claude finished @vvolkgang's task in 4m 26s —— View job

---

Overall Assessment: APPROVE ✅

This PR adds automated PR labeling based on file paths and title patterns, implementing a Python script with GitHub Actions workflow. The implementation follows established patterns from the Android repository with appropriate adaptations for the iOS codebase structure.

Code Review Details

Security:

• ✅ Proper subprocess usage (list form, no shell injection risk)
• ✅ Appropriate permission scoping (pull-requests: write, contents: read)
• ✅ Token handling via environment variables (no exposure risk)

Correctness:

• ✅ Configuration paths accurately match iOS repository structure
• ✅ Intentional error handling strategy (fail-fast for writes, graceful for reads)
• ✅ Workflow parameter handling (parse_known_args for empty string edge case)
• ✅ Label logic correctly converts app:shared to both PM and Auth labels

Configuration:

• ✅ All directory paths in label-pr.json exist in the codebase
• ✅ All referenced .yml files are present
• ✅ release.yml label references use OR logic correctly (multiple labels per category)

Maintainability:

• ✅ Clear documentation in script docstrings
• ✅ Validation logic for config file structure
• ✅ Workflow supports both automated and manual dispatch modes

No findings to report.

---

Test Recommendations:

1. Test with workflow_dispatch before enabling pull_request trigger (as noted in Android PR)
2. Verify labels are created in the repository before first run:
   • app:password-manager, app:authenticator
   • t:feature-app, t:feature-tool, t:bug, t:tech-debt, t:docs, t:ci, t:deps, t:breaking-change, t:misc
3. Test edge cases:
   • PR with no matching file paths (should get t:misc)
   • PR with no matching title pattern (should get t:misc)
   • Bot PR (Renovate/bw-ghapp) - should use --add mode
   • Fork PR - should use --add mode

Clean implementation that maintains consistency with the Android repository while properly adapting to iOS codebase structure. Ready to merge after testing.

[KatherineInCode]

🤔 Should this include swiftgen-bwth.yml as well?

[vvolkgang]

Added!

[KatherineInCode]

🤔 If we're including test helpers here, should we also include all the tests?

[vvolkgang]

Wasn't sure about it honestly, just wanted to assign most of the top level folders and files to something as a starting point and we can fine-tune later.