chore: remove actions-cool/issues-helper

[Copilot]

actions-cool/issues-helper is potentially compromised and should not be trusted in CI. All usages are replaced with the first-party actions/github-script@v7.0.1 calling GitHub REST API directly.

Changes

• manage-labeled.yml — replaced 8 steps using actions-cool/issues-helper (add-labels, create-comment, close-issue) with inline github-script calls using github.rest.issues.* and github.rest.reactions.*
• mark-duplicate.yml — replaced mark-duplicate action with a github-script step that detects /duplicate comments, applies the duplicate label, strips waiting for maintainer, and closes the issue

[Copilot]

Pull request overview

This PR removes the third-party actions-cool/issues-helper GitHub Action (due to potential supply-chain risk) and replaces its functionality with first-party actions/github-script@v7.0.1 calls to the GitHub REST API.

Changes:

• Replaced the “mark duplicate” helper action with an inline github-script implementation that detects /duplicate, applies labels, and closes the issue.
• Replaced multiple label-management helper steps with inline github-script steps that add labels, create issue comments, add reactions, and close issues.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/mark-duplicate.yml	Replaces the mark-duplicate action with a github-script step that labels/closes on /duplicate.
.github/workflows/manage-labeled.yml	Replaces multiple issues-helper steps with github-script for label/comment/reaction/close automation.

Comments suppressed due to low confidence (2)

.github/workflows/mark-duplicate.yml:28

• issue_comment also fires for PRs; without a guard this will label/close pull requests when someone comments /duplicate. Consider skipping when context.payload.issue.pull_request is present (or otherwise ensure this only targets issues).

            const issueNumber = context.issue.number;
            const owner = context.repo.owner;
            const repo = context.repo.repo;

            // Add 'duplicate' label
            await github.rest.issues.addLabels({ owner, repo, issue_number: issueNumber, labels: ['duplicate'] });

.github/workflows/mark-duplicate.yml:35

• This workflow removes waiting for maintainer and also adds the duplicate label, which triggers manage-labeled.yml (it removes waiting for maintainer when duplicate is added). That other workflow’s removal path isn’t 404-tolerant, so these two can race and make one workflow fail. Consider removing the label-removal from one place (single source of truth) or ensure the other workflow ignores 404s when removing the label.

            // Add 'duplicate' label
            await github.rest.issues.addLabels({ owner, repo, issue_number: issueNumber, labels: ['duplicate'] });

            // Remove 'waiting for maintainer' label if present
            try {
              await github.rest.issues.removeLabel({ owner, repo, issue_number: issueNumber, name: 'waiting for maintainer' });
            } catch (e) {
              if (e.status !== 404) throw e;
            }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.