Use wrapper script for label operations in issue triage#968
Merged
OctavianGuzu merged 2 commits intomainfrom Feb 23, 2026
Merged
Use wrapper script for label operations in issue triage#968OctavianGuzu merged 2 commits intomainfrom
OctavianGuzu merged 2 commits intomainfrom
Conversation
Updates /label-issue command and examples to use a dedicated edit-issue-labels.sh script for label operations instead of raw gh issue edit. The script validates labels against the repo's existing labels before applying them. Also tightens gh search permission to gh search issues.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Contributor
Review SummaryGood change -- wrapping gh issue edit behind a validation script that checks labels against the repo actual label list is a solid defensive measure, and tightening gh search to gh search issues follows least-privilege nicely. The ISSUE_NUMBER colon fix is a welcome bug fix too. Main feedback centers on the script error reporting. Since Claude is the primary consumer, silent exit 1 calls and silently dropped labels make it harder for the agent to diagnose and recover from mistakes. See inline comments for specifics. |
ddworken
approved these changes
Feb 23, 2026
pleb
pushed a commit
to Kipp-Sandbox/claude-code-action
that referenced
this pull request
Feb 25, 2026
* Use wrapper script for label operations in issue triage Updates /label-issue command and examples to use a dedicated edit-issue-labels.sh script for label operations instead of raw gh issue edit. The script validates labels against the repo's existing labels before applying them. Also tightens gh search permission to gh search issues. * Show multiple --add-label flags in label-issue example
mergify bot
added a commit
to robfrank/linklift
that referenced
this pull request
Feb 26, 2026
…updates [skip ci] Bumps the github-actions group with 3 updates in the / directory: [github/codeql-action](http://github.com/github/codeql-action), [anthropics/claude-code-action](http://github.com/anthropics/claude-code-action) and [updatecli/updatecli-action](http://github.com/updatecli/updatecli-action). Updates `github/codeql-action` from 4.32.1 to 4.32.4 Release notes *Sourced from [github/codeql-action's releases](http://github.com/github/codeql-action/releases).* > v4.32.4 > ------- > > * Update default CodeQL bundle version to [2.24.2](http://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://redirect.github.com/github/codeql-action/pull/3493) > * Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://redirect.github.com/github/codeql-action/pull/3473) > * When the CodeQL Action is run [with debugging enabled in Default Setup](https://docs.github.com/en/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup) and [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries), the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. [#3486](https://redirect.github.com/github/codeql-action/pull/3486) > * Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://redirect.github.com/github/codeql-action/pull/3485) > * Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](http://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://redirect.github.com/github/codeql-action/pull/3484) > > v4.32.3 > ------- > > * Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://redirect.github.com/github/codeql-action/pull/3466) > > v4.32.2 > ------- > > * Update default CodeQL bundle version to [2.24.1](http://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://redirect.github.com/github/codeql-action/pull/3460) Changelog *Sourced from [github/codeql-action's changelog](http://github.com/github/codeql-action/blob/main/CHANGELOG.md).* > CodeQL Action Changelog > ======================= > > See the [releases page](http://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. > > [UNRELEASED] > ------------ > > No user facing changes. > > 4.32.4 - 20 Feb 2026 > -------------------- > > * Update default CodeQL bundle version to [2.24.2](http://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://redirect.github.com/github/codeql-action/pull/3493) > * Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://redirect.github.com/github/codeql-action/pull/3473) > * When the CodeQL Action is run [with debugging enabled in Default Setup](https://docs.github.com/en/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup) and [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries), the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. [#3486](https://redirect.github.com/github/codeql-action/pull/3486) > * Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://redirect.github.com/github/codeql-action/pull/3485) > * Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](http://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://redirect.github.com/github/codeql-action/pull/3484) > > 4.32.3 - 13 Feb 2026 > -------------------- > > * Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://redirect.github.com/github/codeql-action/pull/3466) > > 4.32.2 - 05 Feb 2026 > -------------------- > > * Update default CodeQL bundle version to [2.24.1](http://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://redirect.github.com/github/codeql-action/pull/3460) > > 4.32.1 - 02 Feb 2026 > -------------------- > > * A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://redirect.github.com/github/codeql-action/pull/3422) > * Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://redirect.github.com/github/codeql-action/pull/3421) > > 4.32.0 - 26 Jan 2026 > -------------------- > > * Update default CodeQL bundle version to [2.24.0](http://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://redirect.github.com/github/codeql-action/pull/3425) > > 4.31.11 - 23 Jan 2026 > --------------------- > > * When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://redirect.github.com/github/codeql-action/pull/3409) > * Improved error handling throughout the CodeQL Action. [#3415](https://redirect.github.com/github/codeql-action/pull/3415) > * Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://redirect.github.com/github/codeql-action/pull/3318) > * The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://redirect.github.com/github/codeql-action/pull/3403) > > 4.31.10 - 12 Jan 2026 > --------------------- > > * Update default CodeQL bundle version to 2.23.9. [#3393](https://redirect.github.com/github/codeql-action/pull/3393) > > 4.31.9 - 16 Dec 2025 > -------------------- > > No user facing changes. > > 4.31.8 - 11 Dec 2025 > -------------------- ... (truncated) Commits * [`89a39a4`](github/codeql-action@89a39a4) Merge pull request [#3494](https://redirect.github.com/github/codeql-action/issues/3494) from github/update-v4.32.4-39ba80c47 * [`e5d84c8`](github/codeql-action@e5d84c8) Apply remaining review suggestions * [`0c20209`](github/codeql-action@0c20209) Apply suggestions from code review * [`314172e`](github/codeql-action@314172e) Fix typo * [`cdda72d`](github/codeql-action@cdda72d) Add changelog entries * [`cfda84c`](github/codeql-action@cfda84c) Update changelog for v4.32.4 * [`39ba80c`](github/codeql-action@39ba80c) Merge pull request [#3493](https://redirect.github.com/github/codeql-action/issues/3493) from github/update-bundle/codeql-bundle-v2.24.2 * [`00150da`](github/codeql-action@00150da) Add changelog note * [`d97dce6`](github/codeql-action@d97dce6) Update default bundle to codeql-bundle-v2.24.2 * [`50fdbb9`](github/codeql-action@50fdbb9) Merge pull request [#3492](https://redirect.github.com/github/codeql-action/issues/3492) from github/henrymercer/new-repository-properties-ff * Additional commits viewable in [compare view](github/codeql-action@6bc82e0...89a39a4) Updates `anthropics/claude-code-action` from 1.0.43 to 1.0.62 Release notes *Sourced from [anthropics/claude-code-action's releases](http://github.com/anthropics/claude-code-action/releases).* > v1.0.62 > ------- > > What's Changed > -------------- > > * Add gh.sh wrapper for gh CLI commands in issue triage workflows by [`@OctavianGuzu`](http://github.com/OctavianGuzu) in [anthropics/claude-code-action#975](https://redirect.github.com/anthropics/claude-code-action/pull/975) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.62> > > v1.0.61 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.61> > > v1.0.60 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.60> > > v1.0.59 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.59> > > v1.0.58 > ------- > > What's Changed > -------------- > > * Add non-write users check workflow by [`@OctavianGuzu`](http://github.com/OctavianGuzu) in [anthropics/claude-code-action#973](https://redirect.github.com/anthropics/claude-code-action/pull/973) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.58> > > v1.0.57 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.57> > > v1.0.56 > ------- > > What's Changed > -------------- > > * Use wrapper script for label operations in issue triage by [`@OctavianGuzu`](http://github.com/OctavianGuzu) in [anthropics/claude-code-action#968](https://redirect.github.com/anthropics/claude-code-action/pull/968) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.56> > > v1.0.55 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.55> > > v1.0.54 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.54> > > v1.0.53 > ------- > > What's Changed > -------------- > > * fix: grant write permissions and use [`@main`](http://github.com/main) in claude workflow by [`@ashwin-ant`](http://github.com/ashwin-ant) in [anthropics/claude-code-action#950](https://redirect.github.com/anthropics/claude-code-action/pull/950) > * feat: add display\_report option to disable step summary by [`@ashwin-ant`](http://github.com/ashwin-ant) in [anthropics/claude-code-action#952](https://redirect.github.com/anthropics/claude-code-action/pull/952) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.53> > > v1.0.52 > ------- > > What's Changed > -------------- > > * Fix stale claudeCodeVersion and update bump script to keep run.ts in sync by [`@ashwin-ant`](http://github.com/ashwin-ant) in [anthropics/claude-code-action#943](https://redirect.github.com/anthropics/claude-code-action/pull/943) ... (truncated) Commits * [`273fe82`](anthropics/claude-code-action@273fe82) chore: bump Claude Code to 2.1.59 and Agent SDK to 0.2.59 * [`e750645`](anthropics/claude-code-action@e750645) Add gh.sh wrapper for gh CLI commands in workflows ([#975](https://redirect.github.com/anthropics/claude-code-action/issues/975)) * [`cd4b150`](anthropics/claude-code-action@cd4b150) chore: bump Claude Code to 2.1.58 and Agent SDK to 0.2.58 * [`ade221f`](anthropics/claude-code-action@ade221f) chore: bump Claude Code to 2.1.56 and Agent SDK to 0.2.56 * [`48fe7dd`](anthropics/claude-code-action@48fe7dd) chore: bump Claude Code to 2.1.55 and Agent SDK to 0.2.55 * [`6ae1b29`](anthropics/claude-code-action@6ae1b29) chore: bump Claude Code to 2.1.53 and Agent SDK to 0.2.53 * [`7af3506`](anthropics/claude-code-action@7af3506) Add non-write users check workflow ([#973](https://redirect.github.com/anthropics/claude-code-action/issues/973)) * [`35a9e02`](anthropics/claude-code-action@35a9e02) chore: bump Claude Code to 2.1.52 and Agent SDK to 0.2.52 * [`fa3312a`](anthropics/claude-code-action@fa3312a) chore: bump Claude Code to 2.1.51 and Agent SDK to 0.2.51 * [`dd85416`](anthropics/claude-code-action@dd85416) Use wrapper script for label operations in issue triage ([#968](https://redirect.github.com/anthropics/claude-code-action/issues/968)) * Additional commits viewable in [compare view](anthropics/claude-code-action@6867bb3...273fe82) Updates `updatecli/updatecli-action` from 2.99.0 to 2.100.0 Commits * [`4b17f4e`](updatecli/updatecli-action@4b17f4e) Delete .github/dependabot.yaml ([#1025](https://redirect.github.com/updatecli/updatecli-action/issues/1025)) * [`3c23c92`](updatecli/updatecli-action@3c23c92) deps(github/action): bump all dependencies ([#1021](https://redirect.github.com/updatecli/updatecli-action/issues/1021)) * [`c2089c3`](updatecli/updatecli-action@c2089c3) deps(updatecli/policies): bump all policies ([#1024](https://redirect.github.com/updatecli/updatecli-action/issues/1024)) * [`bd1f44f`](updatecli/updatecli-action@bd1f44f) Fix cron schedule in updatecli workflow * [`fcfb1a5`](updatecli/updatecli-action@fcfb1a5) deps: run updatecli daily on monitored pipelines ([#1023](https://redirect.github.com/updatecli/updatecli-action/issues/1023)) * [`7368dba`](updatecli/updatecli-action@7368dba) Bump "`@types/node`" package version ([#1020](https://redirect.github.com/updatecli/updatecli-action/issues/1020)) * [`ee59da1`](updatecli/updatecli-action@ee59da1) deps: update updatecli version to v0.114.0 ([#1022](https://redirect.github.com/updatecli/updatecli-action/issues/1022)) * [`f9208e5`](updatecli/updatecli-action@f9208e5) Bump "eslint-plugin-jest" package version ([#1019](https://redirect.github.com/updatecli/updatecli-action/issues/1019)) * [`29049bc`](updatecli/updatecli-action@29049bc) Add daily schedule to updatecli workflow ([#1017](https://redirect.github.com/updatecli/updatecli-action/issues/1017)) * See full diff in [compare view](updatecli/updatecli-action@4fd2c16...4b17f4e) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Open
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates /label-issue command and examples to use a dedicated edit-issue-labels.sh script for label operations instead of raw gh issue edit. The script validates labels against the repo's existing labels before applying them. Also tightens gh search permission to gh search issues.