Dependency Dashboard #52718
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Purpose: Centralize issue keyword labeling, metadata initialization, managed | |
| # contribution comments, and Bob's preliminary Bug assessment in one workflow. | |
| name: Issue Triage | |
| on: | |
| issues: | |
| types: [opened, edited, labeled, unlabeled, typed] | |
| workflow_call: | |
| secrets: | |
| CARBON_AUTOMATION_APP_CLIENT_ID: | |
| required: true | |
| APP_PRIVATE_KEY: | |
| required: true | |
| BOB_AUTOMATION_APP_CLIENT_ID: | |
| required: true | |
| BOB_AUTOMATION_APP_PRIVATE_KEY: | |
| required: true | |
| BOB_INFERENCE_API_KEY: | |
| required: true | |
| permissions: | |
| contents: read | |
| issues: write | |
| concurrency: | |
| # Label mutations emit more issue events. Serialize by issue so idempotent | |
| # plugins see the result of earlier runs instead of racing one another. Keep | |
| # every pending delivery because GitHub otherwise replaces an older pending | |
| # opened/typed/labeled run when another event arrives for the same issue. | |
| group: issue-triage-${{ github.event.issue.number || github.run_id }} | |
| cancel-in-progress: false | |
| queue: max | |
| jobs: | |
| label-issues: | |
| # Run keyword labeling first so the main triage job starts after labels have | |
| # been evaluated for newly opened issues. | |
| name: Label issue based on keywords in title and body | |
| if: | |
| github.repository == 'carbon-design-system/carbon' && (github.event.action | |
| == 'opened' || github.event.action == 'edited') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Generate Carbon Automation token | |
| # Keyword labels are not Bob output, so they use Carbon Automation. | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: generate_token | |
| with: | |
| client-id: ${{ secrets.CARBON_AUTOMATION_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4 | |
| with: | |
| configuration-path: .github/labeler.yml | |
| not-before: 2025-08-14T00:00:00Z | |
| enable-versioned-regex: 0 | |
| include-title: 1 | |
| repo-token: '${{ steps.generate_token.outputs.token }}' | |
| triage-issue: | |
| name: Triage issue and manage automated comments | |
| needs: label-issues | |
| if: | |
| always() && github.repository == 'carbon-design-system/carbon' && | |
| github.event.action != 'edited' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Bob can read the checkout, so never leave a GitHub credential in | |
| # the repository's local Git configuration. | |
| persist-credentials: false | |
| - name: Log issue triage event | |
| env: | |
| EVENT_ACTION: ${{ github.event.action }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| ISSUE_NUMBER: ${{ github.event.issue.number }} | |
| ISSUE_TYPE: ${{ github.event.issue.type.name }} | |
| run: | | |
| echo "Event: ${EVENT_NAME}" | |
| echo "Action: ${EVENT_ACTION}" | |
| echo "Issue: ${ISSUE_NUMBER}" | |
| echo "Issue type: ${ISSUE_TYPE:-none}" | |
| - name: Generate Carbon Automation token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: generate_token | |
| with: | |
| client-id: ${{ secrets.CARBON_AUTOMATION_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| - name: Generate Bob Automation token | |
| # Only formal Bug events eligible for Bob need this separate identity. | |
| # A token failure must not prevent Carbon-backed metadata plugins from | |
| # running; the action will still report Bob's missing token afterward. | |
| if: | |
| github.event.issue.type.name == 'Bug' && (github.event.action == | |
| 'opened' || github.event.action == 'typed') | |
| continue-on-error: true | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: generate_bob_token | |
| with: | |
| client-id: ${{ secrets.BOB_AUTOMATION_APP_CLIENT_ID }} | |
| private-key: ${{ secrets.BOB_AUTOMATION_APP_PRIVATE_KEY }} | |
| permission-issues: write | |
| - name: Log unavailable Bob Automation token | |
| # Make the recovery path obvious in the job log without exposing secret | |
| # values. Independent plugins continue under Carbon Automation. | |
| if: steps.generate_bob_token.outcome == 'failure' | |
| run: | | |
| echo "::warning::Bob Automation token creation failed. Carbon-backed issue triage will continue, then the eligible Bob plugin will report its missing dedicated token." | |
| - name: Run issue triage plugins | |
| uses: carbon-design-system/carbon/actions/issues@main | |
| with: | |
| # This remains the default for labels, fields, projects, and every | |
| # managed comment except Bob's preliminary triage comment. | |
| GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }} | |
| # Only the Bob plugin receives this GitHub client, so only Bob's output | |
| # comment is attributed to the Bob Automation app. | |
| BOB_GITHUB_TOKEN: ${{ steps.generate_bob_token.outputs.token }} | |
| # The Bob CLI uses this API key only to generate text; neither GitHub | |
| # token is included in the Bob subprocess environment. | |
| BOB_INFERENCE_API_KEY: ${{ secrets.BOB_INFERENCE_API_KEY }} | |
| enabled: true |