feat: use custom JS script for PR labeling

.github/scripts/pr-labeler.js

@@ -0,0 +1,55 @@
+module.exports = async ({ github, context }) => {
+  const pull_number = context.payload.pull_request?.number;
+  if (!pull_number) {
+    console.log("No pull request number found in context. Skipping labeler.");
+    return;
+  }
+
+  const { owner, repo } = context.repo;
+
+  console.log(`Fetching files for PR #${pull_number}`);
+
+  // Fetch list of files changed in the PR
+  // For PRs with more than 100 files, we just use the first 100 for simplicity
+  const { data: files } = await github.rest.pulls.listFiles({
+    owner,
+    repo,
+    pull_number,
+    per_page: 100
+  });
+
+  const labelsToAdd = new Set();
+
+  files.forEach(file => {
+    const filename = file.filename;
+
+    // Rule: documentation
+    if (filename.startsWith('docs/') || filename.endsWith('.md')) {
+      labelsToAdd.add('documentation');
+    }
+
+    // Rule: frontend
+    if (filename.startsWith('src/') || filename.startsWith('public/')) {
+      labelsToAdd.add('frontend');
+    }
+
+    // Rule: ci/cd
+    if (filename.startsWith('.github/workflows/')) {
+      labelsToAdd.add('ci/cd');
+    }
+  });
+
+  if (labelsToAdd.size > 0) {
+    const labelsArray = Array.from(labelsToAdd);
+    console.log(`Adding labels: ${labelsArray.join(', ')}`);
+
+    await github.rest.issues.addLabels({
+      owner,
+      repo,
+      issue_number: pull_number,
+      labels: labelsArray
+    });
+  } else {
+    console.log("No matching rules found for the changed files. No labels added.");
+  }
+};

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 name: "Pull Request Labeler"
 on:
-  # Safe to use pull_request_target: no code checkout, API-only labeler, minimal permissions
+  # Safe to use pull_request_target: we only checkout the base branch and do not execute any PR code
   pull_request_target:
     types: [opened, synchronize, reopened]
 
@@ -12,7 +12,12 @@ jobs:
   label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Run JS Labeler Bot
+        uses: actions/github-script@v7
         with:
-          repo-token: "${{ secrets.GITHUB_TOKEN }}"
-          configuration-path: ".github/labeler.yml"
+          script: |
+            const script = require('./.github/scripts/pr-labeler.js');
+            await script({ github, context });