Improve Labeler Action Documentation and Error Handling for Permissions (#897)

* Update README.md and labeler.ts to clarify permissions for GitHub Labeler Action

* Update dist/index.js with latest build changes

* Update README.md to clarify manual label creation as an alternative to granting issues write permission

* Fix labeler error handling to ensure case-insensitive check for unauthorized access

* Refactor error handling in labeler to throw an error for unauthorized access instead of logging

* Add tests for labeler error handling and improve error reporting

.eslintignore

@@ -0,0 +1,7 @@
+# Ignore list
+/*
+
+# Do not ignore these folders:
+!__tests__/
+!__mocks__/
+!src/

.eslintrc.js

@@ -0,0 +1,51 @@
+// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
+module.exports = {
+  extends: [
+    'eslint:recommended',
+    'plugin:@typescript-eslint/recommended',
+    'plugin:eslint-plugin-jest/recommended',
+    'eslint-config-prettier'
+  ],
+  parser: '@typescript-eslint/parser',
+  plugins: ['@typescript-eslint', 'eslint-plugin-node', 'eslint-plugin-jest'],
+  rules: {
+    '@typescript-eslint/no-require-imports': 'error',
+    '@typescript-eslint/no-non-null-assertion': 'off',
+    '@typescript-eslint/no-explicit-any': 'off',
+    '@typescript-eslint/no-empty-function': 'off',
+    '@typescript-eslint/ban-ts-comment': [
+      'error',
+      {
+        'ts-ignore': 'allow-with-description'
+      }
+    ],
+    'no-console': 'error',
+    'yoda': 'error',
+    'prefer-const': [
+      'error',
+      {
+        destructuring: 'all'
+      }
+    ],
+    'no-control-regex': 'off',
+    'no-constant-condition': ['error', {checkLoops: false}],
+    'node/no-extraneous-import': 'error'
+  },
+  overrides: [
+    {
+      files: ['**/*{test,spec}.ts'],
+      rules: {
+        '@typescript-eslint/no-unused-vars': 'off',
+        'jest/no-standalone-expect': 'off',
+        'jest/no-conditional-expect': 'off',
+        'no-console': 'off',
+
+      }
+    }
+  ],
+  env: {
+    node: true,
+    es6: true,
+    'jest/globals': true
+  }
+};

.gitattributes

@@ -1,4 +1,4 @@
-* text=auto
+* text=auto eol=lf
 .licenses/** -diff linguist-generated=true
 
 # don't diff machine generated files

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,35 @@
+---
+name: Bug report
+about: Create a bug report
+title: ''
+labels: bug, needs triage
+assignees: ''
+
+---
+
+<!--- Please direct any generic questions related to actions to our support community forum at https://github.community/c/code-to-cloud/github-actions/41 --->
+<!--- Before opening up a new bug report, please make sure to check for similar existing issues -->
+
+**Description:**
+A clear and concise description of what the bug is.
+
+**Action version:**
+Specify the action version
+
+**Platform:**
+- [ ] Ubuntu
+- [ ] macOS
+- [ ] Windows
+
+**Runner type:**
+- [ ] Hosted
+- [ ] Self-hosted
+
+**Repro steps:**  
+A description with steps to reproduce the issue. If your have a public example or repo to share, please provide the link.
+
+**Expected behavior:**
+A description of what you expected to happen.
+
+**Actual behavior:**
+A description of what is actually happening.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: feature request, needs triage
+assignees: ''
+---
+<!--- Please direct any generic questions related to actions to our support community forum at https://github.community/c/code-to-cloud/github-actions/41 --->
+<!--- Before opening up a new feature request, please make sure to check for similar existing issues and pull requests -->
+
+**Description:**
+Describe your proposal.
+
+**Justification:**
+Justification or a use case for your proposal.
+
+**Are you willing to submit a PR?**
+<!--- We accept contributions! -->

.github/pull_request_template.md

@@ -0,0 +1,9 @@
+**Description:**
+Describe your changes.
+
+**Related issue:**
+Add link to the related issue.
+
+**Check list:**
+- [ ] Mark if documentation changes are required.
+- [ ] Mark if tests were added or updated to cover the changes.

.github/workflows/basic-validation.yml

@@ -0,0 +1,19 @@
+name: Basic validation
+
+on:
+  pull_request:
+    paths-ignore:
+      - '**.md'
+  push:
+    branches:
+      - main
+      - releases/*
+    paths-ignore:
+      - '**.md'
+
+jobs:
+  call-basic-validation:
+    name: Basic validation
+    uses: actions/reusable-workflows/.github/workflows/basic-validation.yml@main
+    with:
+      node-version: '24.x'

.github/workflows/build_test.yml

@@ -1,28 +0,0 @@
-name: Build & Test
-
-on:
-  pull_request:
-    paths-ignore:
-      - '**.md'
-  push:
-    branches:
-      - main
-      - releases/*
-    paths-ignore:
-      - '**.md'
-
-jobs:
-  build:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    steps:
-      - uses: actions/checkout@v2
-      - name: Setup node 16
-        uses: actions/setup-node@v2
-        with:
-          node-version: 16.x
-      - run: npm install
-      - run: npm run build
-      - run: npm test

.github/workflows/check-dist.yml

@@ -0,0 +1,19 @@
+name: Check dist/
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+  workflow_dispatch:
+
+jobs:
+  call-check-dist:
+    name: Check dist/
+    uses: actions/reusable-workflows/.github/workflows/check-dist.yml@main
+    with:
+      node-version: '24.x'

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,14 @@
+name: CodeQL analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 3 * * 0'
+
+jobs:
+  call-codeQL-analysis:
+    name: CodeQL analysis
+    uses: actions/reusable-workflows/.github/workflows/codeql-analysis.yml@main

.github/workflows/licensed.yml

@@ -0,0 +1,15 @@
+name: Licensed
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  call-licensed:
+    name: Licensed
+    uses: actions/reusable-workflows/.github/workflows/licensed.yml@main

.github/workflows/publish-immutable-actions.yml

@@ -0,0 +1,20 @@
+name: 'Publish Immutable Action Version'
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+
+    steps:
+      - name: Checking out
+        uses: actions/checkout@v5
+      - name: Publish
+        id: publish
+        uses: actions/publish-immutable-action@0.0.3

.github/workflows/release-new-action-version.yml

@@ -0,0 +1,28 @@
+name: Release new action version
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      TAG_NAME:
+        description: 'Tag name that the major tag will point to'
+        required: true
+
+env:
+  TAG_NAME: ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }}
+permissions:
+  contents: write
+
+jobs:
+  update_tag:
+    name: Update the major tag to include the ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }} changes
+    environment:
+      name: releaseNewActionVersion
+    runs-on: ubuntu-latest
+    steps:
+      - name: Update the ${{ env.TAG_NAME }} tag
+        uses: actions/publish-action@v0.4.0
+        with:
+          source-tag: ${{ env.TAG_NAME }}
+          slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/update-config-files.yml

@@ -0,0 +1,11 @@
+name: Update configuration files
+
+on:
+  schedule:
+    - cron: '0 3 * * 0'
+  workflow_dispatch:
+
+jobs:
+  call-update-configuration-files:
+    name: Update configuration files
+    uses: actions/reusable-workflows/.github/workflows/update-config-files.yml@main

.github/workflows/update_and_check_licenses.yml

@@ -1,50 +0,0 @@
-name: Licenses
-
-on:
-  push:
-    branches: [main]
-    paths: [package.json, package-lock.json]
-  pull_request:
-    branches: [main]
-    paths: [package.json, package-lock.json]
-  workflow_dispatch:
-
-jobs:
-  # Updates our cache of license files in response to changes to our dependencies
-  # declared in package-lock.json. Automatically commits the changes and pushes
-  # them to your branch. NB `check_license_status` should always run *after* this
-  #
-  # see https://github.com/actions/labeler/pull/155 for more context
-  update_licenses:
-    runs-on: ubuntu-latest
-    name: Update Licenses
-    steps:
-      - uses: actions/checkout@v1
-      - uses: jonabc/setup-licensed@v1
-        with:
-          version: '3.x'
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-      - run: npm install --production
-      - uses: jonabc/licensed-ci@v1
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-  # Fails if any of our dependencies have licenses that our incompatible with our
-  # requirements (see .licensed.yml) OR if any of our dependencies have been
-  # upgraded to a new version without us having updated their corresponding
-  # license metadata file in .licenses/
-  #
-  # see https://github.com/actions/labeler/pull/91 for more context
-  check_licenses:
-    needs: update_licenses
-    if: always() # always run after we update the license cache. if it failed, we will probably just fail as well
-    runs-on: ubuntu-latest
-    name: Check Licenses
-    steps:
-      - uses: actions/checkout@v2
-      - uses: jonabc/setup-licensed@v1.0.2
-        with:
-          version: '3.x'
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-      - run: npm install
-      - run: licensed status

.gitignore

@@ -1,3 +1,4 @@
 .DS_Store
 node_modules/
-lib/
+lib/
+.idea

.licenses/npm/@actions/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/core"
-version: 1.10.0
+version: 1.11.1
 type: npm
 summary: Actions core lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/core

.licenses/npm/@actions/exec.dep.yml

@@ -0,0 +1,20 @@
+---
+name: "@actions/exec"
+version: 1.1.1
+type: npm
+summary: Actions exec lib
+homepage: https://github.com/actions/toolkit/tree/main/packages/exec
+license: mit
+licenses:
+- sources: LICENSE.md
+  text: |-
+    The MIT License (MIT)
+
+    Copyright 2019 GitHub
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+notices: []

.licenses/npm/@actions/github.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/github"
-version: 5.0.0
+version: 6.0.0
 type: npm
 summary: Actions github lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/github

.licenses/npm/@actions/http-client-1.0.11.dep.yml

@@ -1,32 +0,0 @@
----
-name: "@actions/http-client"
-version: 1.0.11
-type: npm
-summary: Actions Http Client
-homepage: https://github.com/actions/http-client#readme
-license: mit
-licenses:
-- sources: LICENSE
-  text: |
-    Actions Http Client for Node.js
-
-    Copyright (c) GitHub, Inc.
-
-    All rights reserved.
-
-    MIT License
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
-    associated documentation files (the "Software"), to deal in the Software without restriction,
-    including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
-    and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
-    subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
-    LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-    NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-    WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-    SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []

.licenses/npm/@actions/http-client.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/http-client"
-version: 2.0.1
+version: 2.2.0
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client

.licenses/npm/@actions/io.dep.yml

@@ -1,20 +1,20 @@
 ---
-name: uuid
-version: 8.3.2
+name: "@actions/io"
+version: 1.1.3
 type: npm
-summary: RFC4122 (v1, v4, and v5) UUIDs
-homepage: 
+summary: Actions io lib
+homepage: https://github.com/actions/toolkit/tree/main/packages/io
 license: mit
 licenses:
 - sources: LICENSE.md
-  text: |
+  text: |-
     The MIT License (MIT)
 
-    Copyright (c) 2010-2020 Robert Kieffer and other contributors
+    Copyright 2019 GitHub
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
     The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []
+notices: []

.licenses/npm/@fastify/busboy.dep.yml

@@ -0,0 +1,30 @@
+---
+name: "@fastify/busboy"
+version: 2.0.0
+type: npm
+summary: A streaming parser for HTML form data for node.js
+homepage: 
+license: mit
+licenses:
+- sources: LICENSE
+  text: |-
+    Copyright Brian White. All rights reserved.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to
+    deal in the Software without restriction, including without limitation the
+    rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+    sell copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+    IN THE SOFTWARE.
+notices: []

.licenses/npm/@octokit/auth-token.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/auth-token"
-version: 2.4.5
+version: 4.0.0
 type: npm
 summary: GitHub API token authentication for browsers and Node.js
-homepage: https://github.com/octokit/auth-token.js#readme
+homepage: 
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/core"
-version: 3.5.1
+version: 5.0.1
 type: npm
 summary: Extendable client for GitHub's REST & GraphQL APIs
 homepage: 

.licenses/npm/@octokit/endpoint.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/endpoint"
-version: 6.0.12
+version: 9.0.1
 type: npm
 summary: Turns REST API endpoints into generic request options
 homepage: 

.licenses/npm/@octokit/graphql.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/graphql"
-version: 4.6.4
+version: 7.0.2
 type: npm
 summary: GitHub GraphQL API client for browsers and Node
 homepage: 

.licenses/npm/@octokit/openapi-types-19.0.1.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/openapi-types"
-version: 7.3.2
+version: 19.0.1
 type: npm
-summary: Generated TypeScript definitions based on GitHub's OpenAPI spec
-homepage: 
+summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
+homepage:
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/openapi-types-23.0.1.dep.yml

@@ -0,0 +1,20 @@
+---
+name: "@octokit/openapi-types"
+version: 23.0.1
+type: npm
+summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |-
+    Copyright 2020 Gregor Martynus
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+- sources: README.md
+  text: "[MIT](LICENSE)"
+notices: []

.licenses/npm/@octokit/plugin-paginate-rest.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-paginate-rest"
-version: 2.13.5
+version: 9.1.0
 type: npm
 summary: Octokit plugin to paginate REST API endpoint responses
 homepage: 

.licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-rest-endpoint-methods"
-version: 5.3.1
+version: 10.1.0
 type: npm
 summary: Octokit plugin adding one method for all of api.github.com REST API endpoints
 homepage: 

.licenses/npm/@octokit/plugin-retry.dep.yml

@@ -1,15 +1,17 @@
 ---
-name: tr46
-version: 0.0.3
+name: "@octokit/plugin-retry"
+version: 6.0.1
 type: npm
-summary: An implementation of the Unicode TR46 spec
-homepage: https://github.com/Sebmaster/tr46.js#readme
+summary: Automatic retry plugin for octokit
+homepage: 
 license: mit
 licenses:
-- sources: Auto-generated MIT license text
+- sources: LICENSE
   text: |
     MIT License
 
+    Copyright (c) 2018 Octokit contributors
+
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal
     in the Software without restriction, including without limitation the rights
@@ -27,4 +29,6 @@ licenses:
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE.
+- sources: README.md
+  text: "[MIT](LICENSE)"
 notices: []

.licenses/npm/@octokit/request-error.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/request-error"
-version: 2.1.0
+version: 5.1.1
 type: npm
 summary: Error class for Octokit request errors
-homepage: 
+homepage:
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/request.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/request"
-version: 5.6.0
+version: 8.1.4
 type: npm
-summary: "Send parameterized requests to GitHubâ\x80\x99s APIs with sensible defaults
-  in browsers and Node"
+summary: Send parameterized requests to GitHub's APIs with sensible defaults in browsers
+  and Node
 homepage: 
 license: mit
 licenses:

.licenses/npm/@octokit/types-12.1.0.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/types"
-version: 6.16.4
+version: 12.1.0
 type: npm
 summary: Shared TypeScript definitions for Octokit projects
-homepage: 
+homepage:
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/types-13.8.0.dep.yml

@@ -0,0 +1,20 @@
+---
+name: "@octokit/types"
+version: 13.8.0
+type: npm
+summary: Shared TypeScript definitions for Octokit projects
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License Copyright (c) 2019 Octokit contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+- sources: README.md
+  text: "[MIT](LICENSE)"
+notices: []

.licenses/npm/balanced-match.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: balanced-match
-version: 1.0.0
+version: 1.0.2
 type: npm
 summary: Match balanced character pairs, like "{" and "}"
 homepage: https://github.com/juliangruber/balanced-match

.licenses/npm/before-after-hook.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: before-after-hook
-version: 2.2.2
+version: 2.2.3
 type: npm
 summary: asynchronous before/error/after hooks for internal functionality
 homepage: 

.licenses/npm/bottleneck.dep.yml

@@ -1,14 +1,16 @@
 ---
-name: concat-map
-version: 0.0.1
+name: bottleneck
+version: 2.19.5
 type: npm
-summary: concatenative mapdashery
-homepage: 
-license: other
+summary: Distributed task scheduler and rate limiter
+homepage:
+license: mit
 licenses:
 - sources: LICENSE
   text: |
-    This software is released under the MIT license:
+    The MIT License (MIT)
+
+    Copyright (c) 2014 Simon Grondin
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of
     this software and associated documentation files (the "Software"), to deal in
@@ -26,6 +28,4 @@ licenses:
     COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
     IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
     CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.markdown
-  text: MIT
 notices: []

.licenses/npm/brace-expansion.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 1.1.11
+version: 2.0.2
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion

.licenses/npm/lodash.isequal.dep.yml

@@ -0,0 +1,58 @@
+---
+name: lodash.isequal
+version: 4.5.0
+type: npm
+summary: The Lodash method `_.isEqual` exported as a module.
+homepage: https://lodash.com/
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    Copyright JS Foundation and other contributors <https://js.foundation/>
+
+    Based on Underscore.js, copyright Jeremy Ashkenas,
+    DocumentCloud and Investigative Reporters & Editors <http://underscorejs.org/>
+
+    This software consists of voluntary contributions made by many
+    individuals. For exact contribution history, see the revision history
+    available at https://github.com/lodash/lodash
+
+    The following license applies to all parts of this software except as
+    documented below:
+
+    ====
+
+    Permission is hereby granted, free of charge, to any person obtaining
+    a copy of this software and associated documentation files (the
+    "Software"), to deal in the Software without restriction, including
+    without limitation the rights to use, copy, modify, merge, publish,
+    distribute, sublicense, and/or sell copies of the Software, and to
+    permit persons to whom the Software is furnished to do so, subject to
+    the following conditions:
+
+    The above copyright notice and this permission notice shall be
+    included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+    NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+    LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+    WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+    ====
+
+    Copyright and related rights for sample code are waived via CC0. Sample
+    code is defined as all source code displayed within the prose of the
+    documentation.
+
+    CC0: http://creativecommons.org/publicdomain/zero/1.0/
+
+    ====
+
+    Files located in the node_modules and vendor directories are externally
+    maintained libraries used by this software which have their own
+    licenses; we recommend you read them, as their terms may differ from the
+    terms above.
+notices: []

.licenses/npm/minimatch.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: minimatch
-version: 3.0.4
+version: 10.0.1
 type: npm
 summary: a glob matcher in javascript
 homepage: 
@@ -10,7 +10,7 @@ licenses:
   text: |
     The ISC License
 
-    Copyright (c) Isaac Z. Schlueter and Contributors
+    Copyright (c) 2011-2022 Isaac Z. Schlueter and Contributors
 
     Permission to use, copy, modify, and/or distribute this software for any
     purpose with or without fee is hereby granted, provided that the above

.licenses/npm/node-fetch.dep.yml

@@ -1,56 +0,0 @@
----
-name: node-fetch
-version: 2.6.7
-type: npm
-summary: A light-weight module that brings window.fetch to node.js
-homepage: https://github.com/bitinn/node-fetch
-license: mit
-licenses:
-- sources: LICENSE.md
-  text: |+
-    The MIT License (MIT)
-
-    Copyright (c) 2016 David Frank
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE.
-
-- sources: README.md
-  text: |-
-    MIT
-
-    [npm-image]: https://flat.badgen.net/npm/v/node-fetch
-    [npm-url]: https://www.npmjs.com/package/node-fetch
-    [travis-image]: https://flat.badgen.net/travis/bitinn/node-fetch
-    [travis-url]: https://travis-ci.org/bitinn/node-fetch
-    [codecov-image]: https://flat.badgen.net/codecov/c/github/bitinn/node-fetch/master
-    [codecov-url]: https://codecov.io/gh/bitinn/node-fetch
-    [install-size-image]: https://flat.badgen.net/packagephobia/install/node-fetch
-    [install-size-url]: https://packagephobia.now.sh/result?p=node-fetch
-    [discord-image]: https://img.shields.io/discord/619915844268326952?color=%237289DA&label=Discord&style=flat-square
-    [discord-url]: https://discord.gg/Zxbndcm
-    [opencollective-image]: https://opencollective.com/node-fetch/backers.svg
-    [opencollective-url]: https://opencollective.com/node-fetch
-    [whatwg-fetch]: https://fetch.spec.whatwg.org/
-    [response-init]: https://fetch.spec.whatwg.org/#responseinit
-    [node-readable]: https://nodejs.org/api/stream.html#stream_readable_streams
-    [mdn-headers]: https://developer.mozilla.org/en-US/docs/Web/API/Headers
-    [LIMITS.md]: https://github.com/bitinn/node-fetch/blob/master/LIMITS.md
-    [ERROR-HANDLING.md]: https://github.com/bitinn/node-fetch/blob/master/ERROR-HANDLING.md
-    [UPGRADE-GUIDE.md]: https://github.com/bitinn/node-fetch/blob/master/UPGRADE-GUIDE.md
-notices: []

.licenses/npm/undici.dep.yml

@@ -1,16 +1,16 @@
 ---
-name: whatwg-url
-version: 5.0.0
+name: undici
+version: 5.29.0
 type: npm
-summary: An implementation of the WHATWG URL Standard's URL API and parsing machinery
-homepage: 
+summary: An HTTP/1.1 client, written from scratch for Node.js
+homepage: https://undici.nodejs.org
 license: mit
 licenses:
-- sources: LICENSE.txt
+- sources: LICENSE
   text: |
-    The MIT License (MIT)
+    MIT License
 
-    Copyright (c) 2015–2016 Sebastian Mayr
+    Copyright (c) Matteo Collina and Undici contributors
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal
@@ -19,14 +19,16 @@ licenses:
     copies of the Software, and to permit persons to whom the Software is
     furnished to do so, subject to the following conditions:
 
-    The above copyright notice and this permission notice shall be included in
-    all copies or substantial portions of the Software.
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
     AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-    THE SOFTWARE.
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: MIT
 notices: []

.licenses/npm/webidl-conversions.dep.yml

@@ -1,23 +0,0 @@
----
-name: webidl-conversions
-version: 3.0.1
-type: npm
-summary: Implements the WebIDL algorithms for converting to and from JavaScript values
-homepage: 
-license: bsd-2-clause
-licenses:
-- sources: LICENSE.md
-  text: |
-    # The BSD 2-Clause License
-
-    Copyright (c) 2014, Domenic Denicola
-    All rights reserved.
-
-    Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-
-    2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-
-    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-notices: []

.prettierignore

@@ -0,0 +1,8 @@
+# Ignore list
+/*
+
+# Do not ignore these folders:
+!__tests__/
+!__mocks__/
+!.github/
+!src/

.prettierrc.js

@@ -0,0 +1,11 @@
+// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
+module.exports = {
+  printWidth: 80,
+  tabWidth: 2,
+  useTabs: false,
+  semi: true,
+  singleQuote: true,
+  trailingComma: 'none',
+  bracketSpacing: false,
+  arrowParens: 'avoid'
+};

CODEOWNERS

@@ -1 +1 @@
-* @actions/actions-runtime
+* @actions/setup-actions-team

README.md

@@ -1,92 +1,161 @@
 # Pull Request Labeler
 
-<p align="left">
-  <a href="https://github.com/actions/labeler/actions?query=workflow%3A%22Build+%26+Test%22++">
-    <img alt="build and test status" src="https://github.com/actions/labeler/actions/workflows/build_test.yml/badge.svg">
-  </a>
-  <a href="https://david-dm.org/actions/labeler">
-    <img alt="dependencies" src="https://status.david-dm.org/gh/actions/labeler.svg">
-  </a>
-</p>
+[![Basic validation](https://github.com/actions/labeler/actions/workflows/basic-validation.yml/badge.svg?branch=main)](https://github.com/actions/labeler/actions/workflows/basic-validation.yml)
 
-Automatically label new pull requests based on the paths of files being changed.
+Automatically label new pull requests based on the paths of files being changed or the branch name.
+
+## Breaking changes in V6
+
+- Upgraded action from node20 to node24.
+  > Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1)
+
+For more details, see the full release notes on the [release page](https://github.com/actions/labeler/releases/tag/v6.0.0)
+
+## Breaking changes in V5
+1) The ability to apply labels based on the names of base and/or head branches was added ([#186](https://github.com/actions/labeler/issues/186) and [#54](https://github.com/actions/labeler/issues/54)). The match object for changed files was expanded with new combinations in order to make it more intuitive and flexible ([#423](https://github.com/actions/labeler/issues/423) and [#101](https://github.com/actions/labeler/issues/101)). As a result, the configuration file structure was significantly redesigned and is not compatible with the structure of the previous version. Please read the documentation below to find out how to adapt your configuration files for use with the new action version.
+
+2) The bug related to the `sync-labels` input was fixed ([#112](https://github.com/actions/labeler/issues/112)). Now the input value is read correctly.
+
+3) By default, `dot` input is set to `true`. Now, paths starting with a dot (e.g. `.github`) are matched by default.
+
+4) Version 5 of this action updated the [runtime to Node.js 20](https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions). All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.
+
+> [!IMPORTANT]
+> Before the update to the v5, please check out [this information](#notes-regarding-pull_request_target-event) about the `pull_request_target` event trigger.
 
 ## Usage
 
 ### Create `.github/labeler.yml`
 
-Create a `.github/labeler.yml` file with a list of labels and [minimatch](https://github.com/isaacs/minimatch) globs to match to apply the label.
+Create a `.github/labeler.yml` file with a list of labels and config options to match and apply the label.
 
-The key is the name of the label in your repository that you want to add (eg: "merge conflict", "needs-updating") and the value is the path (glob) of the changed files (eg: `src/**/*`, `tests/*.spec.js`) or a match object.
+The key is the name of the label in your repository that you want to add (eg: "merge conflict", "needs-updating") and the value is a match object.
 
 #### Match Object
 
-For more control over matching, you can provide a match object instead of a simple path glob. The match object is defined as:
+The match object allows control over the matching options. You can specify the label to be applied based on the files that have changed or the name of either the base branch or the head branch. For the changed files options you provide a [path glob](https://github.com/isaacs/minimatch#minimatch), and for the branches you provide a regexp to match against the branch name.
 
+The base match object is defined as:
 ```yml
-- any: ['list', 'of', 'globs']
-  all: ['list', 'of', 'globs']
+- changed-files: 
+  - any-glob-to-any-file: ['list', 'of', 'globs']
+  - any-glob-to-all-files: ['list', 'of', 'globs']
+  - all-globs-to-any-file: ['list', 'of', 'globs']
+  - all-globs-to-all-files: ['list', 'of', 'globs']
+- base-branch: ['list', 'of', 'regexps']
+- head-branch: ['list', 'of', 'regexps']
 ```
 
-One or both fields can be provided for fine-grained matching. Unlike the top-level list, the list of path globs provided to `any` and `all` must ALL match against a path for the label to be applied.
-
-The fields are defined as follows:
-* `any`: match ALL globs against ANY changed path
-* `all`: match ALL globs against ALL changed paths
-
-A simple path glob is the equivalent to `any: ['glob']`. More specifically, the following two configurations are equivalent:
+There are two top-level keys, `any` and `all`, which both accept the same configuration options:
 ```yml
-label1:
-- example1/*
+- any:
+  - changed-files:
+    - any-glob-to-any-file: ['list', 'of', 'globs']
+    - any-glob-to-all-files: ['list', 'of', 'globs']
+    - all-globs-to-any-file: ['list', 'of', 'globs']
+    - all-globs-to-all-files: ['list', 'of', 'globs']
+  - base-branch: ['list', 'of', 'regexps']
+  - head-branch: ['list', 'of', 'regexps']
+- all:
+  - changed-files:
+    - any-glob-to-any-file: ['list', 'of', 'globs']
+    - any-glob-to-all-files: ['list', 'of', 'globs']
+    - all-globs-to-any-file: ['list', 'of', 'globs']
+    - all-globs-to-all-files: ['list', 'of', 'globs']
+  - base-branch: ['list', 'of', 'regexps']
+  - head-branch: ['list', 'of', 'regexps']
+```
+
+From a boolean logic perspective, top-level match objects, and options within `all` are `AND`-ed together and individual match rules within the `any` object are `OR`-ed.
+
+One or all fields can be provided for fine-grained matching.
+The fields are defined as follows:
+- `all`: ALL of the provided options must match for the label to be applied
+- `any`: if ANY of the provided options match then the label will be applied
+  - `base-branch`: match regexps against the base branch name
+  - `head-branch`: match regexps against the head branch name
+  - `changed-files`: match glob patterns against the changed paths
+    - `any-glob-to-any-file`: ANY glob must match against ANY changed file
+    - `any-glob-to-all-files`: ANY glob must match against ALL changed files
+    - `all-globs-to-any-file`: ALL globs must match against ANY changed file
+    - `all-globs-to-all-files`: ALL globs must match against ALL changed files
+
+If a base option is provided without a top-level key, then it will default to `any`. More specifically, the following two configurations are equivalent:
+```yml
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: 'docs/*'
 ```
 and
 ```yml
-label1:
-- any: ['example1/*']
+Documentation:
+- any:
+  - changed-files:
+    - any-glob-to-any-file: 'docs/*'
 ```
 
-From a boolean logic perspective, top-level match objects are `OR`-ed together and individual match rules within an object are `AND`-ed. Combined with `!` negation, you can write complex matching rules.
+ If path globs are combined with `!` negation, you can write complex matching rules. See the examples below for more information.
 
 #### Basic Examples
 
 ```yml
-# Add 'label1' to any changes within 'example' folder or any subfolders
-label1:
-- example/**/*
+# Add 'root' label to any root file changes
+# Quotation marks are required for the leading asterisk
+root:
+- changed-files:
+  - any-glob-to-any-file: '*'
 
-# Add 'label2' to any file changes within 'example2' folder
-label2: example2/*
-```
+# Add 'AnyChange' label to any changes within the entire repository
+AnyChange:
+- changed-files:
+  - any-glob-to-any-file: '**'
 
-#### Common Examples
+# Add 'Documentation' label to any changes within 'docs' folder or any subfolders
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: docs/**
 
-```yml
-# Add 'repo' label to any root file changes
-repo:
-- '*'
+# Add 'Documentation' label to any file changes within 'docs' folder
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: docs/*
 
-# Add '@domain/core' label to any change within the 'core' package
-@domain/core:
-- package/core/*
-- package/core/**/*
+# Add 'Documentation' label to any file changes within 'docs' or 'guides' folders
+Documentation:
+- changed-files:
+  - any-glob-to-any-file:
+    - docs/*
+    - guides/*
 
-# Add 'test' label to any change to *.spec.js files within the source dir
-test:
-- src/**/*.spec.js
+## Equivalent of the above mentioned configuration using another syntax
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: ['docs/*', 'guides/*']
+
+# Add 'Documentation' label to any change to .md files within the entire repository 
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: '**/*.md'
 
 # Add 'source' label to any change to src files within the source dir EXCEPT for the docs sub-folder
 source:
-- any: ['src/**/*', '!src/docs/*']
+- all:
+  - changed-files:
+    - any-glob-to-any-file: 'src/**/*'
+    - all-globs-to-all-files: '!src/docs/*'
 
-# Add 'frontend` label to any change to *.js files as long as the `main.js` hasn't changed
-frontend:
-- any: ['src/**/*.js']
-  all: ['!src/main.js']
+# Add 'feature' label to any PR where the head branch name starts with `feature` or has a `feature` section in the name
+feature:
+ - head-branch: ['^feature', 'feature']
+
+# Add 'release' label to any PR that is opened against the `main` branch
+release:
+ - base-branch: 'main'
 ```
 
 ### Create Workflow
 
-Create a workflow (eg: `.github/workflows/labeler.yml` see [Creating a Workflow file](https://help.github.com/en/articles/configuring-a-workflow#creating-a-workflow-file)) to utilize the labeler action with content:
+Create a workflow (e.g. `.github/workflows/labeler.yml` see [Creating a Workflow file](https://docs.github.com/en/actions/writing-workflows/quickstart#creating-your-first-workflow)) to utilize the labeler action with content:
 
 ```yml
 name: "Pull Request Labeler"
@@ -94,29 +163,160 @@ on:
 - pull_request_target
 
 jobs:
-  triage:
+  labeler:
     permissions:
       contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v4
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+    - uses: actions/labeler@v6
 ```
 
-_Note: This grants access to the `GITHUB_TOKEN` so the action can make calls to GitHub's rest API_
-
 #### Inputs
 
 Various inputs are defined in [`action.yml`](action.yml) to let you configure the labeler:
 
-| Name | Description | Default |
-| - | - | - |
-| `repo-token` | Token to use to authorize label changes. Typically the GITHUB_TOKEN secret, with `contents:read` and `pull-requests:write` access | N/A |
-| `configuration-path` | The path to the label configuration file | `.github/labeler.yml` |
-| `sync-labels` | Whether or not to remove labels when matching files are reverted or no longer changed by the PR | `false`
+| Name                 | Description                                                                                                                                                              | Default               |
+|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------|
+| `repo-token`         | Token to use to authorize label changes. Typically the GITHUB_TOKEN secret                                                                                               | `github.token`        |
+| `configuration-path` | The path to the label configuration file. If the file doesn't exist at the specified path on the runner, action will read from the source repository via the Github API. | `.github/labeler.yml` |
+| `sync-labels`        | Whether or not to remove labels when matching files are reverted or no longer changed by the PR                                                                          | `false`               |
+| `dot`                | Whether or not to auto-include paths starting with dot (e.g. `.github`)                                                                                                  | `true`               |
+| `pr-number`          | The number(s) of pull request to update, rather than detecting from the workflow context                                                                                 | N/A                   |
 
-# Contributions
+##### Using `configuration-path` input together with the `@actions/checkout` action
+You might want to use action called [@actions/checkout](https://github.com/actions/checkout) to upload label configuration file onto the runner from the current or any other repositories. See usage example below:
 
-Contributions are welcome! See the [Contributor's Guide](CONTRIBUTING.md).
+```yml
+    steps:
+    - uses: actions/checkout@v5 # Uploads repository content to the runner
+      with:
+        repository: "owner/repositoryName" # The one of the available inputs, visit https://github.com/actions/checkout#readme to find more
+    - uses: actions/labeler@v6
+      with:
+        configuration-path: 'path/to/the/uploaded/configuration/file'
+
+```
+
+##### Example workflow specifying pull request numbers
+
+```yml
+name: "Label Previous Pull Requests"
+on:
+  schedule:
+    - cron: "0 1 * * 1"
+
+jobs:
+  labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    
+    # Label PRs 1, 2, and 3
+    - uses: actions/labeler@v6
+      with:        
+        pr-number: |
+          1
+          2
+          3
+```
+
+**Note:** in normal usage the `pr-number` input is not required as the action will detect the PR number from the workflow context.
+
+#### Outputs 
+
+Labeler provides the following outputs:  
+
+| Name         | Description                                               |
+|--------------|-----------------------------------------------------------|
+| `new-labels` | A comma-separated list of all new labels                  |
+| `all-labels` | A comma-separated list of all labels that the PR contains |
+
+The following example performs steps based on the output of labeler:
+```yml
+name: "Pull Request Labeler"
+on:
+- pull_request_target
+
+jobs:
+  labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    - id: label-the-PR
+      uses: actions/labeler@v6
+      
+    - id: run-frontend-tests
+      if: contains(steps.label-the-PR.outputs.all-labels, 'frontend')
+      run: |
+        echo "Running frontend tests..."
+        # Put your commands for running frontend tests here
+  
+    - id: run-backend-tests
+      if: contains(steps.label-the-PR.outputs.all-labels, 'backend')
+      run: |
+        echo "Running backend tests..."
+        # Put your commands for running backend tests here
+```
+
+## Recommended Permissions
+
+To successfully add labels to pull requests using the GitHub Labeler Action, specific permissions must be granted based on your use case:
+
+1. **Adding Existing Labels**:
+   - Requires: `pull-requests: write`
+   - Use this if all labels already exist in the repository (i.e., pre-defined in `.github/labeler.yml`).
+
+2. **Creating New Labels**:
+   - Requires: `issues: write`
+   - This is necessary if the action needs to create labels that do not already exist in the repository.
+
+However, when the action runs on a pull request from a forked repository, GitHub only grants read access tokens for `pull_request` events, at most. If you encounter an `Error: HttpError: Resource not accessible by integration`, it's likely due to these permission constraints. To resolve this issue, you can modify the `on:` section of your workflow to use
+[`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) instead of `pull_request` (see example [above](#create-workflow)). This change allows the action to have write access, because `pull_request_target` alters the [context of the action](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) and safely grants additional permissions.
+
+There exists a potentially dangerous misuse of the `pull_request_target` workflow trigger that may lead to malicious PR authors (i.e. attackers) being able to obtain repository write permissions or stealing repository secrets. Hence, it is advisable that `pull_request_target` should only be used in workflows that are carefully designed to avoid executing untrusted code and to also ensure that workflows using `pull_request_target` limit access to sensitive resources. Refer to the [GitHub token permissions documentation](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) for more details about access levels and event contexts.
+
+### Example Workflow Permissions
+
+To ensure the action works correctly, include the following permissions in your workflow file:
+
+```yml
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+```
+
+### Manual Label Creation as an Alternative to Granting issues write Permission 
+
+If you prefer not to grant the `issues: write` permission in your workflow, you can manually create all required labels in the repository before the action runs.
+
+## Notes regarding `pull_request_target` event
+
+Using the `pull_request_target` event trigger involves several peculiarities related to initial set up of the labeler or updating version of the labeler.
+
+### Initial set up of the labeler action
+
+When submitting an initial pull request to a repository using the `pull_request_target` event, the labeler workflow will not run on that pull request because the `pull_request_target` execution runs off the base branch instead of the pull request's branch. Unfortunately this means the introduction of the labeler can not be verified during that pull request and it needs to be committed blindly.
+
+### Updating major version of the labeler
+
+When submitting a pull request that includes updates of the labeler action version and associated configuration files, using the `pull_request_target` event may result in a failed workflow. This is due to the nature of `pull_request_target`, which uses the code from the base branch rather than the branch linked to the pull request — so, potentially outdated configuration files may not be compatible with the updated labeler action.
+
+To prevent this issue, you can switch to using the `pull_request` event temporarily, before merging. This event execution draws from the code within the branch of your pull request, allowing you to verify the new configuration's compatibility with the updated labeler action.
+
+```yml
+name: "Pull Request Labeler"
+on:
+- pull_request
+```
+
+Once you confirm that the updated configuration files function as intended, you can then revert to using the `pull_request_target` event before merging the pull request. Following this step ensures that your workflow is robust and free from disruptions.
+
+## Contributions
+
+Contributions are welcome! See the [Contributor's Guide](CONTRIBUTING.md).

__mocks__/@actions/github.ts

@@ -2,33 +2,42 @@ export const context = {
   payload: {
     pull_request: {
       number: 123,
-    },
+      head: {
+        ref: 'head-branch-name'
+      },
+      base: {
+        ref: 'base-branch-name'
+      }
+    }
   },
   repo: {
-    owner: "monalisa",
-    repo: "helloworld",
-  },
+    owner: 'monalisa',
+    repo: 'helloworld'
+  }
 };
 
 const mockApi = {
   rest: {
     issues: {
-      addLabels: jest.fn(),
-      removeLabel: jest.fn(),
+      setLabels: jest.fn()
     },
     pulls: {
-      get: jest.fn().mockResolvedValue({}),
+      get: jest.fn().mockResolvedValue({
+        data: {
+          labels: []
+        }
+      }),
       listFiles: {
         endpoint: {
-          merge: jest.fn().mockReturnValue({}),
-        },
-      },
+          merge: jest.fn().mockReturnValue({})
+        }
+      }
     },
     repos: {
-      getContent: jest.fn(),
-    },
+      getContent: jest.fn()
+    }
   },
-  paginate: jest.fn(),
+  paginate: jest.fn()
 };
 
 export const getOctokit = jest.fn().mockImplementation(() => mockApi);

__tests__/branch.test.ts

@@ -0,0 +1,210 @@
+import {
+  getBranchName,
+  checkAnyBranch,
+  checkAllBranch,
+  toBranchMatchConfig,
+  BranchMatchConfig
+} from '../src/branch';
+import * as github from '@actions/github';
+
+jest.mock('@actions/core');
+jest.mock('@actions/github');
+
+describe('getBranchName', () => {
+  describe('when the pull requests base branch is requested', () => {
+    it('returns the base branch name', () => {
+      const result = getBranchName('base');
+      expect(result).toEqual('base-branch-name');
+    });
+  });
+
+  describe('when the pull requests head branch is requested', () => {
+    it('returns the head branch name', () => {
+      const result = getBranchName('head');
+      expect(result).toEqual('head-branch-name');
+    });
+  });
+});
+
+describe('checkAllBranch', () => {
+  beforeEach(() => {
+    github.context.payload.pull_request!.head = {
+      ref: 'test/feature/123'
+    };
+    github.context.payload.pull_request!.base = {
+      ref: 'main'
+    };
+  });
+
+  describe('when a single pattern is provided', () => {
+    describe('and the pattern matches the head branch', () => {
+      it('returns true', () => {
+        const result = checkAllBranch(['^test'], 'head');
+        expect(result).toBe(true);
+      });
+    });
+
+    describe('and the pattern does not match the head branch', () => {
+      it('returns false', () => {
+        const result = checkAllBranch(['^feature/'], 'head');
+        expect(result).toBe(false);
+      });
+    });
+  });
+
+  describe('when multiple patterns are provided', () => {
+    describe('and not all patterns matched', () => {
+      it('returns false', () => {
+        const result = checkAllBranch(['^test/', '^feature/'], 'head');
+        expect(result).toBe(false);
+      });
+    });
+
+    describe('and all patterns match', () => {
+      it('returns true', () => {
+        const result = checkAllBranch(['^test/', '/feature/'], 'head');
+        expect(result).toBe(true);
+      });
+    });
+
+    describe('and no patterns match', () => {
+      it('returns false', () => {
+        const result = checkAllBranch(['^feature/', '/test$'], 'head');
+        expect(result).toBe(false);
+      });
+    });
+  });
+
+  describe('when the branch to check is specified as the base branch', () => {
+    describe('and the pattern matches the base branch', () => {
+      it('returns true', () => {
+        const result = checkAllBranch(['^main$'], 'base');
+        expect(result).toBe(true);
+      });
+    });
+  });
+});
+
+describe('checkAnyBranch', () => {
+  beforeEach(() => {
+    github.context.payload.pull_request!.head = {
+      ref: 'test/feature/123'
+    };
+    github.context.payload.pull_request!.base = {
+      ref: 'main'
+    };
+  });
+
+  describe('when a single pattern is provided', () => {
+    describe('and the pattern matches the head branch', () => {
+      it('returns true', () => {
+        const result = checkAnyBranch(['^test'], 'head');
+        expect(result).toBe(true);
+      });
+    });
+
+    describe('and the pattern does not match the head branch', () => {
+      it('returns false', () => {
+        const result = checkAnyBranch(['^feature/'], 'head');
+        expect(result).toBe(false);
+      });
+    });
+  });
+
+  describe('when multiple patterns are provided', () => {
+    describe('and at least one pattern matches', () => {
+      it('returns true', () => {
+        const result = checkAnyBranch(['^test/', '^feature/'], 'head');
+        expect(result).toBe(true);
+      });
+    });
+
+    describe('and all patterns match', () => {
+      it('returns true', () => {
+        const result = checkAnyBranch(['^test/', '/feature/'], 'head');
+        expect(result).toBe(true);
+      });
+    });
+
+    describe('and no patterns match', () => {
+      it('returns false', () => {
+        const result = checkAnyBranch(['^feature/', '/test$'], 'head');
+        expect(result).toBe(false);
+      });
+    });
+  });
+
+  describe('when the branch to check is specified as the base branch', () => {
+    describe('and the pattern matches the base branch', () => {
+      it('returns true', () => {
+        const result = checkAnyBranch(['^main$'], 'base');
+        expect(result).toBe(true);
+      });
+    });
+  });
+});
+
+describe('toBranchMatchConfig', () => {
+  describe('when there are no branch keys in the config', () => {
+    const config = {'changed-files': [{any: ['testing']}]};
+
+    it('returns an empty object', () => {
+      const result = toBranchMatchConfig(config);
+      expect(result).toEqual({});
+    });
+  });
+
+  describe('when the config contains a head-branch option', () => {
+    const config = {'head-branch': ['testing']};
+
+    it('sets headBranch in the matchConfig', () => {
+      const result = toBranchMatchConfig(config);
+      expect(result).toEqual<BranchMatchConfig>({
+        headBranch: ['testing']
+      });
+    });
+
+    describe('and the matching option is a string', () => {
+      const stringConfig = {'head-branch': 'testing'};
+
+      it('sets headBranch in the matchConfig', () => {
+        const result = toBranchMatchConfig(stringConfig);
+        expect(result).toEqual<BranchMatchConfig>({
+          headBranch: ['testing']
+        });
+      });
+    });
+  });
+
+  describe('when the config contains a base-branch option', () => {
+    const config = {'base-branch': ['testing']};
+    it('sets baseBranch in the matchConfig', () => {
+      const result = toBranchMatchConfig(config);
+      expect(result).toEqual<BranchMatchConfig>({
+        baseBranch: ['testing']
+      });
+    });
+
+    describe('and the matching option is a string', () => {
+      const stringConfig = {'base-branch': 'testing'};
+
+      it('sets baseBranch in the matchConfig', () => {
+        const result = toBranchMatchConfig(stringConfig);
+        expect(result).toEqual<BranchMatchConfig>({
+          baseBranch: ['testing']
+        });
+      });
+    });
+  });
+
+  describe('when the config contains both a base-branch and head-branch option', () => {
+    const config = {'base-branch': ['testing'], 'head-branch': ['testing']};
+    it('sets headBranch and baseBranch in the matchConfig', () => {
+      const result = toBranchMatchConfig(config);
+      expect(result).toEqual<BranchMatchConfig>({
+        baseBranch: ['testing'],
+        headBranch: ['testing']
+      });
+    });
+  });
+});

__tests__/changedFiles.test.ts

@@ -0,0 +1,270 @@
+import {
+  ChangedFilesMatchConfig,
+  checkAllChangedFiles,
+  checkAnyChangedFiles,
+  toChangedFilesMatchConfig,
+  checkIfAnyGlobMatchesAnyFile,
+  checkIfAllGlobsMatchAnyFile,
+  checkIfAnyGlobMatchesAllFiles,
+  checkIfAllGlobsMatchAllFiles
+} from '../src/changedFiles';
+
+jest.mock('@actions/core');
+jest.mock('@actions/github');
+
+describe('checkAllChangedFiles', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when all given glob pattern configs matched', () => {
+    const globPatternsConfigs = [
+      {anyGlobToAnyFile: ['foo.txt']},
+      {anyGlobToAllFiles: ['*.txt']},
+      {allGlobsToAllFiles: ['**']}
+    ];
+
+    it('returns true', () => {
+      const result = checkAllChangedFiles(
+        changedFiles,
+        globPatternsConfigs,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe(`when some given glob pattern config did not match`, () => {
+    const globPatternsConfigs = [
+      {anyGlobToAnyFile: ['*.md']},
+      {anyGlobToAllFiles: ['*.txt']},
+      {allGlobsToAllFiles: ['**']}
+    ];
+
+    it('returns false', () => {
+      const result = checkAllChangedFiles(
+        changedFiles,
+        globPatternsConfigs,
+        false
+      );
+      expect(result).toBe(false);
+    });
+  });
+});
+
+describe('checkAnyChangedFiles', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when any given glob pattern config matched', () => {
+    const globPatternsConfigs = [
+      {anyGlobToAnyFile: ['*.md']},
+      {anyGlobToAllFiles: ['*.txt']}
+    ];
+
+    it('returns true', () => {
+      const result = checkAnyChangedFiles(
+        changedFiles,
+        globPatternsConfigs,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('when none of the given glob pattern configs matched', () => {
+    const globPatternsConfigs = [
+      {anyGlobToAnyFile: ['*.md']},
+      {anyGlobToAllFiles: ['!*.txt']}
+    ];
+
+    it('returns false', () => {
+      const result = checkAnyChangedFiles(
+        changedFiles,
+        globPatternsConfigs,
+        false
+      );
+      expect(result).toBe(false);
+    });
+  });
+});
+
+describe('toChangedFilesMatchConfig', () => {
+  describe(`when there is no 'changed-files' key in the config`, () => {
+    const config = {'head-branch': 'test'};
+
+    it('returns an empty object', () => {
+      const result = toChangedFilesMatchConfig(config);
+      expect(result).toEqual<ChangedFilesMatchConfig>({});
+    });
+  });
+
+  describe(`when there is a 'changed-files' key in the config`, () => {
+    describe('but the glob pattern config key is not provided', () => {
+      const config = {'changed-files': ['bar']};
+
+      it('throws the error', () => {
+        expect(() => {
+          toChangedFilesMatchConfig(config);
+        }).toThrow(
+          `The "changed-files" section must have a valid config structure. Please read the action documentation for more information`
+        );
+      });
+    });
+
+    describe('but the glob pattern config key is not valid', () => {
+      const config = {'changed-files': [{NotValidConfigKey: ['bar']}]};
+
+      it('throws the error', () => {
+        expect(() => {
+          toChangedFilesMatchConfig(config);
+        }).toThrow(
+          `Unknown config options were under "changed-files": NotValidConfigKey`
+        );
+      });
+    });
+
+    describe('and the glob pattern config key is provided', () => {
+      describe('and the value is an array of strings', () => {
+        const config = {
+          'changed-files': [{'any-glob-to-any-file': ['testing']}]
+        };
+
+        it('sets the value in the config object', () => {
+          const result = toChangedFilesMatchConfig(config);
+          expect(result).toEqual<ChangedFilesMatchConfig>({
+            changedFiles: [{anyGlobToAnyFile: ['testing']}]
+          });
+        });
+      });
+
+      describe('and the value is a string', () => {
+        const config = {'changed-files': [{'any-glob-to-any-file': 'testing'}]};
+
+        it(`sets the string as an array in the config object`, () => {
+          const result = toChangedFilesMatchConfig(config);
+          expect(result).toEqual<ChangedFilesMatchConfig>({
+            changedFiles: [{anyGlobToAnyFile: ['testing']}]
+          });
+        });
+      });
+    });
+  });
+});
+
+describe('checkIfAnyGlobMatchesAnyFile', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when any given glob pattern matched any file', () => {
+    const globPatterns = ['*.md', 'foo.txt'];
+
+    it('returns true', () => {
+      const result = checkIfAnyGlobMatchesAnyFile(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('when none of the given glob pattern matched any file', () => {
+    const globPatterns = ['*.md', '!*.txt'];
+
+    it('returns false', () => {
+      const result = checkIfAnyGlobMatchesAnyFile(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(false);
+    });
+  });
+});
+
+describe('checkIfAllGlobsMatchAnyFile', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when all given glob patterns matched any file', () => {
+    const globPatterns = ['**/bar.txt', 'bar.txt'];
+
+    it('returns true', () => {
+      const result = checkIfAllGlobsMatchAnyFile(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('when some of the given glob patterns did not match any file', () => {
+    const globPatterns = ['*.txt', '*.md'];
+
+    it('returns false', () => {
+      const result = checkIfAllGlobsMatchAnyFile(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(false);
+    });
+  });
+});
+
+describe('checkIfAnyGlobMatchesAllFiles', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when any given glob pattern matched all files', () => {
+    const globPatterns = ['*.md', '*.txt'];
+
+    it('returns true', () => {
+      const result = checkIfAnyGlobMatchesAllFiles(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('when none of the given glob patterns matched all files', () => {
+    const globPatterns = ['*.md', 'bar.txt', 'foo.txt'];
+
+    it('returns false', () => {
+      const result = checkIfAnyGlobMatchesAllFiles(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(false);
+    });
+  });
+});
+
+describe('checkIfAllGlobsMatchAllFiles', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when all given glob patterns matched all files', () => {
+    const globPatterns = ['*.txt', '**'];
+
+    it('returns true', () => {
+      const result = checkIfAllGlobsMatchAllFiles(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('when some of the given glob patterns did not match all files', () => {
+    const globPatterns = ['**', 'foo.txt'];
+
+    it('returns false', () => {
+      const result = checkIfAllGlobsMatchAllFiles(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(false);
+    });
+  });
+});

__tests__/fixtures/all_options.yml

@@ -0,0 +1,17 @@
+label1:
+  - any:
+      - changed-files:
+          - any-glob-to-any-file: ['glob']
+      - head-branch: ['regexp']
+      - base-branch: ['regexp']
+  - all:
+      - changed-files:
+          - all-globs-to-all-files: ['glob']
+      - head-branch: ['regexp']
+      - base-branch: ['regexp']
+
+label2:
+  - changed-files:
+      - any-glob-to-any-file: ['glob']
+  - head-branch: ['regexp']
+  - base-branch: ['regexp']

__tests__/fixtures/any_and_all.yml

@@ -0,0 +1,8 @@
+tests:
+  - any:
+      - head-branch: ['^tests/', '^test/']
+      - changed-files:
+          - any-glob-to-any-file: ['tests/**/*']
+  - all:
+      - changed-files:
+          - all-globs-to-all-files: ['!tests/requirements.txt']

__tests__/fixtures/branches.yml

@@ -0,0 +1,11 @@
+test-branch:
+  - head-branch: '^test/'
+
+feature-branch:
+  - head-branch: '/feature/'
+
+bug-branch:
+  - head-branch: '^bug/|fix/'
+
+array-branch:
+  - head-branch: ['^array/']

__tests__/fixtures/not_supported.yml

@@ -0,0 +1,3 @@
+label:
+  - all:
+      - unknown: 'this-is-not-supported'

__tests__/fixtures/only_pdfs.yml

@@ -1,2 +1,3 @@
 touched-a-pdf-file:
-  - any: ['*.pdf']
+  - changed-files:
+      - any-glob-to-any-file: ['*.pdf']

__tests__/labeler.test.ts

@@ -1,29 +1,235 @@
-import { checkGlobs } from "../src/labeler";
+import * as yaml from 'js-yaml';
+import * as core from '@actions/core';
+import * as api from '../src/api';
+import {labeler} from '../src/labeler';
+import * as github from '@actions/github';
+import * as fs from 'fs';
+import {checkMatchConfigs} from '../src/labeler';
+import {
+  MatchConfig,
+  toMatchConfig,
+  getLabelConfigMapFromObject,
+  BaseMatchConfig
+} from '../src/api/get-label-configs';
 
-import * as core from "@actions/core";
-
-jest.mock("@actions/core");
+jest.mock('@actions/core');
+jest.mock('../src/api');
 
 beforeAll(() => {
-  jest.spyOn(core, "getInput").mockImplementation((name, options) => {
-    return jest.requireActual("@actions/core").getInput(name, options);
+  jest.spyOn(core, 'getInput').mockImplementation((name, options) => {
+    return jest.requireActual('@actions/core').getInput(name, options);
   });
 });
 
-const matchConfig = [{ any: ["*.txt"] }];
+const loadYaml = (filepath: string) => {
+  const loadedFile = fs.readFileSync(filepath);
+  const content = Buffer.from(loadedFile).toString();
+  return yaml.load(content);
+};
 
-describe("checkGlobs", () => {
-  it("returns true when our pattern does match changed files", () => {
-    const changedFiles = ["foo.txt", "bar.txt"];
-    const result = checkGlobs(changedFiles, matchConfig);
+describe('getLabelConfigMapFromObject', () => {
+  const yamlObject = loadYaml('__tests__/fixtures/all_options.yml');
+  const expected = new Map<string, MatchConfig[]>();
+  expected.set('label1', [
+    {
+      any: [
+        {changedFiles: [{anyGlobToAnyFile: ['glob']}]},
+        {baseBranch: undefined, headBranch: ['regexp']},
+        {baseBranch: ['regexp'], headBranch: undefined}
+      ]
+    },
+    {
+      all: [
+        {changedFiles: [{allGlobsToAllFiles: ['glob']}]},
+        {baseBranch: undefined, headBranch: ['regexp']},
+        {baseBranch: ['regexp'], headBranch: undefined}
+      ]
+    }
+  ]);
+  expected.set('label2', [
+    {
+      any: [
+        {changedFiles: [{anyGlobToAnyFile: ['glob']}]},
+        {baseBranch: undefined, headBranch: ['regexp']},
+        {baseBranch: ['regexp'], headBranch: undefined}
+      ]
+    }
+  ]);
 
-    expect(result).toBeTruthy();
-  });
-
-  it("returns false when our pattern does not match changed files", () => {
-    const changedFiles = ["foo.docx"];
-    const result = checkGlobs(changedFiles, matchConfig);
-
-    expect(result).toBeFalsy();
+  it('returns a MatchConfig', () => {
+    const result = getLabelConfigMapFromObject(yamlObject);
+    expect(result).toEqual(expected);
+  });
+});
+
+describe('toMatchConfig', () => {
+  describe('when all expected config options are present', () => {
+    const config = {
+      'changed-files': [{'any-glob-to-any-file': ['testing-files']}],
+      'head-branch': ['testing-head'],
+      'base-branch': ['testing-base']
+    };
+    const expected: BaseMatchConfig = {
+      changedFiles: [{anyGlobToAnyFile: ['testing-files']}],
+      headBranch: ['testing-head'],
+      baseBranch: ['testing-base']
+    };
+
+    it('returns a MatchConfig object with all options', () => {
+      const result = toMatchConfig(config);
+      expect(result).toEqual(expected);
+    });
+
+    describe('and there are also unexpected options present', () => {
+      config['test-test'] = 'testing';
+
+      it('does not include the unexpected items in the returned MatchConfig object', () => {
+        const result = toMatchConfig(config);
+        expect(result).toEqual(expected);
+      });
+    });
+  });
+});
+
+describe('checkMatchConfigs', () => {
+  describe('when a single match config is provided', () => {
+    const matchConfig: MatchConfig[] = [
+      {any: [{changedFiles: [{anyGlobToAnyFile: ['*.txt']}]}]}
+    ];
+
+    it('returns true when our pattern does match changed files', () => {
+      const changedFiles = ['foo.txt', 'bar.txt'];
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
+
+      expect(result).toBeTruthy();
+    });
+
+    it('returns false when our pattern does not match changed files', () => {
+      const changedFiles = ['foo.docx'];
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
+
+      expect(result).toBeFalsy();
+    });
+
+    it('returns true when either the branch or changed files patter matches', () => {
+      const matchConfig: MatchConfig[] = [
+        {
+          any: [
+            {changedFiles: [{anyGlobToAnyFile: ['*.txt']}]},
+            {headBranch: ['some-branch']}
+          ]
+        }
+      ];
+      const changedFiles = ['foo.txt', 'bar.txt'];
+
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
+      expect(result).toBe(true);
+    });
+
+    it('returns false for a file starting with dot if `dot` option is false', () => {
+      const changedFiles = ['.foo.txt'];
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
+
+      expect(result).toBeFalsy();
+    });
+
+    it('returns true for a file starting with dot if `dot` option is true', () => {
+      const changedFiles = ['.foo.txt'];
+      const result = checkMatchConfigs(changedFiles, matchConfig, true);
+
+      expect(result).toBeTruthy();
+    });
+  });
+
+  describe('when multiple MatchConfigs are supplied', () => {
+    const matchConfig: MatchConfig[] = [
+      {any: [{changedFiles: [{anyGlobToAnyFile: ['*.txt']}]}]},
+      {any: [{headBranch: ['some-branch']}]}
+    ];
+    const changedFiles = ['foo.txt', 'bar.md'];
+
+    it('returns false when only one config matches', () => {
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
+      expect(result).toBe(false);
+    });
+
+    it('returns true when only both config matches', () => {
+      const matchConfig: MatchConfig[] = [
+        {any: [{changedFiles: [{anyGlobToAnyFile: ['*.txt']}]}]},
+        {any: [{headBranch: ['head-branch']}]}
+      ];
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
+      expect(result).toBe(true);
+    });
+  });
+});
+
+describe('labeler error handling', () => {
+  const mockClient = {} as any;
+  const mockPullRequest = {
+    number: 123,
+    data: {labels: []},
+    changedFiles: []
+  };
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+
+    (github.getOctokit as jest.Mock).mockReturnValue(mockClient);
+    (api.getPullRequests as jest.Mock).mockReturnValue([
+      {
+        ...mockPullRequest,
+        data: {labels: [{name: 'old-label'}]}
+      }
+    ]);
+
+    (api.getLabelConfigs as jest.Mock).mockResolvedValue(
+      new Map([['new-label', ['dummy-config']]])
+    );
+
+    // Force match so "new-label" is always added
+    jest.spyOn({checkMatchConfigs}, 'checkMatchConfigs').mockReturnValue(true);
+  });
+
+  it('throws a custom error for HttpError 403 with "unauthorized" message', async () => {
+    (api.setLabels as jest.Mock).mockRejectedValue({
+      name: 'HttpError',
+      status: 403,
+      message: 'Request failed with status code 403: Unauthorized'
+    });
+
+    await expect(labeler()).rejects.toThrow(
+      /does not have permission to create labels/
+    );
+  });
+
+  it('rethrows unexpected HttpError', async () => {
+    const unexpectedError = {
+      name: 'HttpError',
+      status: 404,
+      message: 'Not Found'
+    };
+    (api.setLabels as jest.Mock).mockRejectedValue(unexpectedError);
+
+    // NOTE: In the current implementation, labeler rethrows the raw error object (not an Error instance).
+    // `rejects.toThrow` only works with real Error objects, so here we must use `rejects.toEqual`.
+    // If labeler is updated to always wrap errors in `Error`, this test can be changed to use `rejects.toThrow`.
+    await expect(labeler()).rejects.toEqual(unexpectedError);
+  });
+
+  it('handles "Resource not accessible by integration" gracefully', async () => {
+    const error = {
+      name: 'HttpError',
+      message: 'Resource not accessible by integration'
+    };
+    (api.setLabels as jest.Mock).mockRejectedValue(error);
+
+    await labeler();
+
+    expect(core.warning).toHaveBeenCalledWith(
+      expect.stringContaining("requires 'issues: write'"),
+      expect.any(Object)
+    );
+    expect(core.setFailed).toHaveBeenCalledWith(error.message);
   });
 });

__tests__/main.test.ts

@@ -1,116 +1,508 @@
-import { run } from "../src/labeler";
-import * as github from "@actions/github";
-import * as core from "@actions/core";
+import {run} from '../src/labeler';
+import * as github from '@actions/github';
+import * as core from '@actions/core';
+import path from 'path';
+import fs from 'fs';
 
-const fs = jest.requireActual("fs");
+jest.mock('@actions/core');
+jest.mock('@actions/github');
 
-jest.mock("@actions/core");
-jest.mock("@actions/github");
+const gh = github.getOctokit('_');
+const setLabelsMock = jest.spyOn(gh.rest.issues, 'setLabels');
+const reposMock = jest.spyOn(gh.rest.repos, 'getContent');
+const paginateMock = jest.spyOn(gh, 'paginate');
+const getPullMock = jest.spyOn(gh.rest.pulls, 'get');
+const readFileSyncMock = jest.spyOn(fs, 'readFileSync');
+const existsSyncMock = jest.spyOn(fs, 'existsSync');
+const coreErrorMock = jest.spyOn(core, 'error');
+const coreWarningMock = jest.spyOn(core, 'warning');
+const coreSetFailedMock = jest.spyOn(core, 'setFailed');
+const setOutputSpy = jest.spyOn(core, 'setOutput');
 
-const gh = github.getOctokit("_");
-const addLabelsMock = jest.spyOn(gh.rest.issues, "addLabels");
-const removeLabelMock = jest.spyOn(gh.rest.issues, "removeLabel");
-const reposMock = jest.spyOn(gh.rest.repos, "getContent");
-const paginateMock = jest.spyOn(gh, "paginate");
-const getPullMock = jest.spyOn(gh.rest.pulls, "get");
+class HttpError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'HttpError';
+  }
+}
+
+class NotFound extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'NotFound';
+  }
+}
 
 const yamlFixtures = {
-  "only_pdfs.yml": fs.readFileSync("__tests__/fixtures/only_pdfs.yml"),
+  'branches.yml': fs.readFileSync('__tests__/fixtures/branches.yml'),
+  'only_pdfs.yml': fs.readFileSync('__tests__/fixtures/only_pdfs.yml'),
+  'not_supported.yml': fs.readFileSync('__tests__/fixtures/not_supported.yml'),
+  'any_and_all.yml': fs.readFileSync('__tests__/fixtures/any_and_all.yml')
+};
+
+const configureInput = (
+  mockInput: Partial<{
+    'repo-token': string;
+    'configuration-path': string;
+    'sync-labels': boolean;
+    dot: boolean;
+    'pr-number': string[];
+  }>
+) => {
+  jest
+    .spyOn(core, 'getInput')
+    .mockImplementation((name: string, ...opts) => mockInput[name]);
+  jest
+    .spyOn(core, 'getMultilineInput')
+    .mockImplementation((name: string, ...opts) => mockInput[name]);
+  jest
+    .spyOn(core, 'getBooleanInput')
+    .mockImplementation((name: string, ...opts) => mockInput[name]);
 };
 
 afterAll(() => jest.restoreAllMocks());
 
-describe("run", () => {
-  it("adds labels to PRs that match our glob patterns", async () => {
-    usingLabelerConfigYaml("only_pdfs.yml");
-    mockGitHubResponseChangedFiles("foo.pdf");
-
-    await run();
-
-    expect(removeLabelMock).toHaveBeenCalledTimes(0);
-    expect(addLabelsMock).toHaveBeenCalledTimes(1);
-    expect(addLabelsMock).toHaveBeenCalledWith({
-      owner: "monalisa",
-      repo: "helloworld",
-      issue_number: 123,
-      labels: ["touched-a-pdf-file"],
-    });
-  });
-
-  it("does not add labels to PRs that do not match our glob patterns", async () => {
-    usingLabelerConfigYaml("only_pdfs.yml");
-    mockGitHubResponseChangedFiles("foo.txt");
-
-    await run();
-
-    expect(removeLabelMock).toHaveBeenCalledTimes(0);
-    expect(addLabelsMock).toHaveBeenCalledTimes(0);
-  });
-
-  it("(with sync-labels: true) it deletes preexisting PR labels that no longer match the glob pattern", async () => {
-    let mockInput = {
-      "repo-token": "foo",
-      "configuration-path": "bar",
-      "sync-labels": true,
-    };
-
-    jest
-      .spyOn(core, "getInput")
-      .mockImplementation((name: string, ...opts) => mockInput[name]);
-
-    usingLabelerConfigYaml("only_pdfs.yml");
-    mockGitHubResponseChangedFiles("foo.txt");
+describe('run', () => {
+  it('(with dot: false) adds labels to PRs that match our glob patterns', async () => {
+    configureInput({});
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.pdf');
     getPullMock.mockResolvedValue(<any>{
       data: {
-        labels: [{ name: "touched-a-pdf-file" }],
-      },
+        labels: []
+      }
     });
 
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(0);
-    expect(removeLabelMock).toHaveBeenCalledTimes(1);
-    expect(removeLabelMock).toHaveBeenCalledWith({
-      owner: "monalisa",
-      repo: "helloworld",
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
       issue_number: 123,
-      name: "touched-a-pdf-file",
+      labels: ['touched-a-pdf-file']
     });
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'touched-a-pdf-file'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'touched-a-pdf-file'
+    );
   });
 
-  it("(with sync-labels: false) it issues no delete calls even when there are preexisting PR labels that no longer match the glob pattern", async () => {
-    let mockInput = {
-      "repo-token": "foo",
-      "configuration-path": "bar",
-      "sync-labels": false,
-    };
-
-    jest
-      .spyOn(core, "getInput")
-      .mockImplementation((name: string, ...opts) => mockInput[name]);
-
-    usingLabelerConfigYaml("only_pdfs.yml");
-    mockGitHubResponseChangedFiles("foo.txt");
+  it('(with dot: true) adds labels to PRs that match our glob patterns', async () => {
+    configureInput({dot: true});
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('.foo.pdf');
     getPullMock.mockResolvedValue(<any>{
       data: {
-        labels: [{ name: "touched-a-pdf-file" }],
-      },
+        labels: []
+      }
     });
 
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(0);
-    expect(removeLabelMock).toHaveBeenCalledTimes(0);
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 123,
+      labels: ['touched-a-pdf-file']
+    });
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'touched-a-pdf-file'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'touched-a-pdf-file'
+    );
   });
+
+  it('(with dot: false) does not add labels to PRs that do not match our glob patterns', async () => {
+    configureInput({});
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('.foo.pdf');
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: []
+      }
+    });
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', '');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', '');
+  });
+
+  it('(with dot: true) does not add labels to PRs that do not match our glob patterns', async () => {
+    configureInput({dot: true});
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.txt');
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+  });
+
+  it('does not add a label when the match config options are not supported', async () => {
+    configureInput({});
+    usingLabelerConfigYaml('not_supported.yml');
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+  });
+
+  it('adds labels based on the branch names that match the regexp pattern', async () => {
+    configureInput({});
+    github.context.payload.pull_request!.head = {ref: 'test/testing-time'};
+    usingLabelerConfigYaml('branches.yml');
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 123,
+      labels: ['test-branch']
+    });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', 'test-branch');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'test-branch');
+  });
+
+  it('adds multiple labels based on branch names that match different regexp patterns', async () => {
+    configureInput({});
+    github.context.payload.pull_request!.head = {
+      ref: 'test/feature/123'
+    };
+    usingLabelerConfigYaml('branches.yml');
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 123,
+      labels: ['test-branch', 'feature-branch']
+    });
+
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'test-branch,feature-branch'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'test-branch,feature-branch'
+    );
+  });
+
+  it('can support multiple branches by batching', async () => {
+    configureInput({});
+    github.context.payload.pull_request!.head = {ref: 'fix/123'};
+    usingLabelerConfigYaml('branches.yml');
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 123,
+      labels: ['bug-branch']
+    });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', 'bug-branch');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'bug-branch');
+  });
+
+  it('can support multiple branches by providing an array', async () => {
+    configureInput({});
+    github.context.payload.pull_request!.head = {ref: 'array/123'};
+    usingLabelerConfigYaml('branches.yml');
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 123,
+      labels: ['array-branch']
+    });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', 'array-branch');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'array-branch');
+  });
+
+  it('adds a label when matching any and all patterns are provided', async () => {
+    configureInput({});
+    usingLabelerConfigYaml('any_and_all.yml');
+    mockGitHubResponseChangedFiles('tests/test.ts');
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 123,
+      labels: ['tests']
+    });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', 'tests');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'tests');
+  });
+
+  it('does not add a label when not all any and all patterns are matched', async () => {
+    configureInput({});
+    usingLabelerConfigYaml('any_and_all.yml');
+    mockGitHubResponseChangedFiles('tests/requirements.txt');
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+  });
+
+  it('(with sync-labels: true) it deletes preexisting PR labels that no longer match the glob pattern', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'sync-labels': true
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.txt');
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: [{name: 'touched-a-pdf-file'}, {name: 'manually-added'}]
+      }
+    });
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 123,
+      labels: ['manually-added']
+    });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', '');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'manually-added');
+  });
+
+  it('(with sync-labels: false) it issues no delete calls even when there are preexisting PR labels that no longer match the glob pattern', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'sync-labels': false
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.txt');
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: [{name: 'touched-a-pdf-file'}, {name: 'manually-added'}]
+      }
+    });
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', '');
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'touched-a-pdf-file,manually-added'
+    );
+  });
+
+  it('(with sync-labels: false) it only logs the excess labels', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'sync-labels': false
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.pdf');
+
+    const existingLabels = Array.from({length: 100}).map((_, idx) => ({
+      name: `existing-label-${idx}`
+    }));
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: existingLabels
+      }
+    });
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+
+    expect(coreWarningMock).toHaveBeenCalledTimes(1);
+    expect(coreWarningMock).toHaveBeenCalledWith(
+      'Maximum of 100 labels allowed. Excess labels: touched-a-pdf-file',
+      {title: 'Label limit for a PR exceeded'}
+    );
+    const allLabels: string = existingLabels.map(i => i.name).join(',');
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', '');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', allLabels);
+  });
+
+  it('(with pr-number: array of one item, uses the PR number specified in the parameters', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'pr-number': ['104']
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.pdf');
+
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: [{name: 'manually-added'}]
+      }
+    });
+
+    await run();
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 104,
+      labels: ['manually-added', 'touched-a-pdf-file']
+    });
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'touched-a-pdf-file'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'manually-added,touched-a-pdf-file'
+    );
+  });
+
+  it('(with pr-number: array of two items, uses the PR number specified in the parameters', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'pr-number': ['104', '150']
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.pdf');
+
+    getPullMock.mockResolvedValueOnce(<any>{
+      data: {
+        labels: [{name: 'manually-added'}]
+      }
+    });
+
+    getPullMock.mockResolvedValueOnce(<any>{
+      data: {
+        labels: []
+      }
+    });
+
+    await run();
+    expect(setLabelsMock).toHaveBeenCalledTimes(2);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 104,
+      labels: ['manually-added', 'touched-a-pdf-file']
+    });
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 150,
+      labels: ['touched-a-pdf-file']
+    });
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'touched-a-pdf-file'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'manually-added,touched-a-pdf-file'
+    );
+  });
+
+  it('does not add labels to PRs that have no changed files', async () => {
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles();
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+  });
+
+  it('should use local configuration file if it exists', async () => {
+    const configFile = 'only_pdfs.yml';
+    const configFilePath = path.join(__dirname, 'fixtures', configFile);
+    mockGitHubResponseChangedFiles('foo.pdf');
+    const readFileSyncOptions = {encoding: 'utf8'};
+
+    configureInput({
+      'configuration-path': configFilePath
+    });
+    await run();
+
+    expect(existsSyncMock).toHaveBeenCalledWith(configFilePath);
+    expect(readFileSyncMock).toHaveBeenCalledWith(
+      configFilePath,
+      readFileSyncOptions
+    );
+    expect(reposMock).not.toHaveBeenCalled();
+  });
+
+  it('should fetch configuration file from API if it does not exist locally', async () => {
+    const configFilePath = 'non_existed_path/labeler.yml';
+    mockGitHubResponseChangedFiles('foo.pdf');
+    configureInput({
+      'configuration-path': configFilePath
+    });
+    await run();
+    expect(existsSyncMock).toHaveBeenCalledWith(configFilePath);
+    expect(readFileSyncMock).not.toHaveBeenCalled();
+    expect(reposMock).toHaveBeenCalled();
+  });
+
+  test.each([
+    [new HttpError('Error message')],
+    [new NotFound('Error message')]
+  ])(
+    'should warn if configuration file could not be fetched through the API, log error and fail the action',
+    async error => {
+      const configFilePath = 'non_existed_path/labeler.yml';
+      reposMock.mockImplementation(() => {
+        throw error;
+      });
+      const warningMessage = `The config file was not found at ${configFilePath}. Make sure it exists and that this action has the correct access rights.`;
+      mockGitHubResponseChangedFiles('foo.pdf');
+      configureInput({
+        'configuration-path': configFilePath
+      });
+
+      await run();
+
+      expect(coreWarningMock).toHaveBeenCalledWith(warningMessage);
+      expect(coreErrorMock).toHaveBeenCalledWith(error);
+      expect(coreSetFailedMock).toHaveBeenCalledWith(error.message);
+    }
+  );
 });
 
 function usingLabelerConfigYaml(fixtureName: keyof typeof yamlFixtures): void {
   reposMock.mockResolvedValue(<any>{
-    data: { content: yamlFixtures[fixtureName], encoding: "utf8" },
+    data: {content: yamlFixtures[fixtureName], encoding: 'utf8'}
   });
 }
 
 function mockGitHubResponseChangedFiles(...files: string[]): void {
-  const returnValue = files.map((f) => ({ filename: f }));
+  const returnValue = files.map(f => ({filename: f}));
   paginateMock.mockReturnValue(<any>returnValue);
 }

action.yml

@@ -3,7 +3,9 @@ description: 'Automatically label new pull requests based on the paths of files
 author: 'GitHub'
 inputs:
   repo-token:
-    description: 'The GITHUB_TOKEN secret'
+    description: 'The GitHub token used to manage labels'
+    required: false
+    default: ${{ github.token }}
   configuration-path:
     description: 'The path for the label configurations'
     default: '.github/labeler.yml'
@@ -12,7 +14,19 @@ inputs:
     description: 'Whether or not to remove labels when matching files are reverted'
     default: false
     required: false
+  dot:
+    description: 'Whether or not to auto-include paths starting with dot (e.g. `.github`)'
+    default: true
+    required: false
+  pr-number:
+    description: 'The pull request number(s)'
+    required: false
 
+outputs:
+  new-labels:
+    description: 'A comma-separated list of all new labels'
+  all-labels:
+    description: 'A comma-separated list of all labels that the PR contains'
 runs:
-  using: 'node16'
+  using: 'node24'
   main: 'dist/index.js'

package.json

@@ -1,12 +1,17 @@
 {
   "name": "labeler",
-  "version": "4.0.1",
+  "version": "6.0.0",
   "description": "Labels pull requests by files altered",
   "main": "lib/main.js",
+    "engines": {
+    "node": ">=24"
+  },
   "scripts": {
     "build": "tsc && ncc build lib/main.js",
-    "format": "prettier --write \"**/*.ts\"",
-    "format-check": "prettier --check \"**/*.ts\"",
+    "format": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write \"**/*.{ts,yml,yaml}\"",
+    "format-check": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --check \"**/*.{ts,yml,yaml}\"",
+    "lint": "eslint --config ./.eslintrc.js \"**/*.ts\"",
+    "lint:fix": "eslint --config ./.eslintrc.js \"**/*.ts\" --fix",
     "test": "jest"
   },
   "repository": {
@@ -22,20 +27,30 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@actions/github": "^5.0.0",
+    "@actions/core": "^1.11.1",
+    "@actions/github": "^6.0.0",
+    "@octokit/plugin-retry": "^6.0.0",
     "js-yaml": "^4.1.0",
-    "minimatch": "^3.0.4"
+    "lodash.isequal": "^4.5.0",
+    "minimatch": "^10.0.1"
   },
   "devDependencies": {
-    "@types/jest": "^27.4.1",
-    "@types/node": "^16.11.7",
-    "@types/minimatch": "^3.0.5",
-    "@types/js-yaml": "^4.0.5",
-    "@vercel/ncc": "^0.34.0",
-    "jest": "^27.5.1",
-    "prettier": "^2.7.1",
-    "ts-jest": "^27.1.3",
-    "typescript": "^4.8.2"
+    "@types/jest": "^29.5.14",
+    "@types/js-yaml": "^4.0.9",
+    "@types/lodash.isequal": "^4.5.8",
+    "@types/minimatch": "^5.1.2",
+    "@types/node": "^24.1.0",
+    "@typescript-eslint/eslint-plugin": "^7.3.1",
+    "@typescript-eslint/parser": "^7.18.0",
+    "@vercel/ncc": "^0.38.3",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-jest": "^28.11.0",
+    "eslint-plugin-node": "^11.1.0",
+    "jest": "^29.7.0",
+    "prettier": "^3.4.2",
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.7.3"
+
   }
 }

src/api/get-changed-files.ts

@@ -0,0 +1,24 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+import {ClientType} from './types';
+
+export const getChangedFiles = async (
+  client: ClientType,
+  prNumber: number
+): Promise<string[]> => {
+  const listFilesOptions = client.rest.pulls.listFiles.endpoint.merge({
+    owner: github.context.repo.owner,
+    repo: github.context.repo.repo,
+    pull_number: prNumber
+  });
+
+  const listFilesResponse = await client.paginate(listFilesOptions);
+  const changedFiles = listFilesResponse.map((f: any) => f.filename);
+
+  core.debug('found changed files:');
+  for (const file of changedFiles) {
+    core.debug('  ' + file);
+  }
+
+  return changedFiles;
+};

src/api/get-changed-pull-requests.ts

@@ -0,0 +1,38 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+import {getChangedFiles} from './get-changed-files';
+import {ClientType} from './types';
+
+export async function* getPullRequests(
+  client: ClientType,
+  prNumbers: number[]
+) {
+  for (const prNumber of prNumbers) {
+    core.debug(`looking for pr #${prNumber}`);
+    let prData: any;
+    try {
+      const result = await client.rest.pulls.get({
+        owner: github.context.repo.owner,
+        repo: github.context.repo.repo,
+        pull_number: prNumber
+      });
+      prData = result.data;
+    } catch (error: any) {
+      core.warning(`Could not find pull request #${prNumber}, skipping`);
+      continue;
+    }
+
+    core.debug(`fetching changed files for pr #${prNumber}`);
+    const changedFiles: string[] = await getChangedFiles(client, prNumber);
+    if (!changedFiles.length) {
+      core.warning(`Pull request #${prNumber} has no changed files, skipping`);
+      continue;
+    }
+
+    yield {
+      data: prData,
+      number: prNumber,
+      changedFiles
+    };
+  }
+}

src/api/get-content.ts

@@ -0,0 +1,16 @@
+import * as github from '@actions/github';
+import {ClientType} from './types';
+
+export const getContent = async (
+  client: ClientType,
+  repoPath: string
+): Promise<string> => {
+  const response: any = await client.rest.repos.getContent({
+    owner: github.context.repo.owner,
+    repo: github.context.repo.repo,
+    path: repoPath,
+    ref: github.context.sha
+  });
+
+  return Buffer.from(response.data.content, response.data.encoding).toString();
+};

src/api/get-label-configs.ts

@@ -0,0 +1,126 @@
+import * as core from '@actions/core';
+import * as yaml from 'js-yaml';
+import fs from 'fs';
+import {ClientType} from './types';
+import {getContent} from './get-content';
+
+import {
+  ChangedFilesMatchConfig,
+  toChangedFilesMatchConfig
+} from '../changedFiles';
+
+import {toBranchMatchConfig, BranchMatchConfig} from '../branch';
+
+export interface MatchConfig {
+  all?: BaseMatchConfig[];
+  any?: BaseMatchConfig[];
+}
+
+export type BaseMatchConfig = BranchMatchConfig & ChangedFilesMatchConfig;
+
+const ALLOWED_CONFIG_KEYS = ['changed-files', 'head-branch', 'base-branch'];
+
+export const getLabelConfigs = (
+  client: ClientType,
+  configurationPath: string
+): Promise<Map<string, MatchConfig[]>> =>
+  Promise.resolve()
+    .then(() => {
+      if (!fs.existsSync(configurationPath)) {
+        core.info(
+          `The configuration file (path: ${configurationPath}) was not found locally, fetching via the api`
+        );
+
+        return getContent(client, configurationPath);
+      }
+
+      core.info(
+        `The configuration file (path: ${configurationPath}) was found locally, reading from the file`
+      );
+
+      return fs.readFileSync(configurationPath, {
+        encoding: 'utf8'
+      });
+    })
+    .catch(error => {
+      if (error.name == 'HttpError' || error.name == 'NotFound') {
+        core.warning(
+          `The config file was not found at ${configurationPath}. Make sure it exists and that this action has the correct access rights.`
+        );
+      }
+      return Promise.reject(error);
+    })
+    .then(configuration => {
+      // loads (hopefully) a `{[label:string]: MatchConfig[]}`, but is `any`:
+      const configObject: any = yaml.load(configuration);
+
+      // transform `any` => `Map<string,MatchConfig[]>` or throw if yaml is malformed:
+      return getLabelConfigMapFromObject(configObject);
+    });
+
+export function getLabelConfigMapFromObject(
+  configObject: any
+): Map<string, MatchConfig[]> {
+  const labelMap: Map<string, MatchConfig[]> = new Map();
+  for (const label in configObject) {
+    const configOptions = configObject[label];
+    if (
+      !Array.isArray(configOptions) ||
+      !configOptions.every(opts => typeof opts === 'object')
+    ) {
+      throw Error(
+        `found unexpected type for label '${label}' (should be array of config options)`
+      );
+    }
+    const matchConfigs = configOptions.reduce<MatchConfig[]>(
+      (updatedConfig, configValue) => {
+        if (!configValue) {
+          return updatedConfig;
+        }
+
+        Object.entries(configValue).forEach(([key, value]) => {
+          // If the top level `any` or `all` keys are provided then set them, and convert their values to
+          // our config objects.
+          if (key === 'any' || key === 'all') {
+            if (Array.isArray(value)) {
+              const newConfigs = value.map(toMatchConfig);
+              updatedConfig.push({[key]: newConfigs});
+            }
+          } else if (ALLOWED_CONFIG_KEYS.includes(key)) {
+            const newMatchConfig = toMatchConfig({[key]: value});
+            // Find or set the `any` key so that we can add these properties to that rule,
+            // Or create a new `any` key and add that to our array of configs.
+            const indexOfAny = updatedConfig.findIndex(mc => !!mc['any']);
+            if (indexOfAny >= 0) {
+              updatedConfig[indexOfAny].any?.push(newMatchConfig);
+            } else {
+              updatedConfig.push({any: [newMatchConfig]});
+            }
+          } else {
+            // Log the key that we don't know what to do with.
+            core.info(`An unknown config option was under ${label}: ${key}`);
+          }
+        });
+
+        return updatedConfig;
+      },
+      []
+    );
+
+    if (matchConfigs.length) {
+      labelMap.set(label, matchConfigs);
+    }
+  }
+
+  return labelMap;
+}
+
+export function toMatchConfig(config: any): BaseMatchConfig {
+  const changedFilesConfig = toChangedFilesMatchConfig(config);
+  const branchConfig = toBranchMatchConfig(config);
+
+  return {
+    ...changedFilesConfig,
+    ...branchConfig
+  };
+}

src/api/index.ts

@@ -0,0 +1,6 @@
+export * from './get-changed-files';
+export * from './get-changed-pull-requests';
+export * from './get-content';
+export * from './get-label-configs';
+export * from './set-labels';
+export * from './types';

src/api/set-labels.ts

@@ -0,0 +1,15 @@
+import * as github from '@actions/github';
+import {ClientType} from './types';
+
+export const setLabels = async (
+  client: ClientType,
+  prNumber: number,
+  labels: string[]
+) => {
+  await client.rest.issues.setLabels({
+    owner: github.context.repo.owner,
+    repo: github.context.repo.repo,
+    issue_number: prNumber,
+    labels: labels
+  });
+};

src/api/types.ts

@@ -0,0 +1,2 @@
+import * as github from '@actions/github';
+export type ClientType = ReturnType<typeof github.getOctokit>;

src/branch.ts

@@ -0,0 +1,98 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+
+export interface BranchMatchConfig {
+  headBranch?: string[];
+  baseBranch?: string[];
+}
+
+type BranchBase = 'base' | 'head';
+
+export function toBranchMatchConfig(config: any): BranchMatchConfig {
+  if (!config['head-branch'] && !config['base-branch']) {
+    return {};
+  }
+
+  const branchConfig = {
+    headBranch: config['head-branch'],
+    baseBranch: config['base-branch']
+  };
+
+  for (const branchName in branchConfig) {
+    if (typeof branchConfig[branchName] === 'string') {
+      branchConfig[branchName] = [branchConfig[branchName]];
+    }
+  }
+
+  return branchConfig;
+}
+
+export function getBranchName(branchBase: BranchBase): string | undefined {
+  const pullRequest = github.context.payload.pull_request;
+  if (!pullRequest) {
+    return undefined;
+  }
+
+  if (branchBase === 'base') {
+    return pullRequest.base?.ref;
+  } else {
+    return pullRequest.head?.ref;
+  }
+}
+
+export function checkAnyBranch(
+  regexps: string[],
+  branchBase: BranchBase
+): boolean {
+  const branchName = getBranchName(branchBase);
+  if (!branchName) {
+    core.debug(`   no branch name`);
+    return false;
+  }
+
+  core.debug(`   checking "branch" pattern against ${branchName}`);
+  const matchers = regexps.map(regexp => new RegExp(regexp));
+  for (const matcher of matchers) {
+    if (matchBranchPattern(matcher, branchName)) {
+      core.debug(`   "branch" patterns matched against ${branchName}`);
+      return true;
+    }
+  }
+
+  core.debug(`   "branch" patterns did not match against ${branchName}`);
+  return false;
+}
+
+export function checkAllBranch(
+  regexps: string[],
+  branchBase: BranchBase
+): boolean {
+  const branchName = getBranchName(branchBase);
+  if (!branchName) {
+    core.debug(`   cannot fetch branch name from the pull request`);
+    return false;
+  }
+
+  core.debug(`   checking "branch" pattern against ${branchName}`);
+  const matchers = regexps.map(regexp => new RegExp(regexp));
+  for (const matcher of matchers) {
+    if (!matchBranchPattern(matcher, branchName)) {
+      core.debug(`   "branch" patterns did not match against ${branchName}`);
+      return false;
+    }
+  }
+
+  core.debug(`   "branch" patterns matched against ${branchName}`);
+  return true;
+}
+
+function matchBranchPattern(matcher: RegExp, branchName: string): boolean {
+  core.debug(`    - ${matcher}`);
+  if (matcher.test(branchName)) {
+    core.debug(`    "branch" pattern matched`);
+    return true;
+  }
+
+  core.debug(`    ${matcher} did not match`);
+  return false;
+}

src/changedFiles.ts

@@ -0,0 +1,360 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+import {Minimatch} from 'minimatch';
+import {printPattern, isObject, kebabToCamel} from './utils';
+
+export interface ChangedFilesMatchConfig {
+  changedFiles?: ChangedFilesGlobPatternsConfig[];
+}
+
+interface ChangedFilesGlobPatternsConfig {
+  anyGlobToAnyFile?: string[];
+  anyGlobToAllFiles?: string[];
+  allGlobsToAnyFile?: string[];
+  allGlobsToAllFiles?: string[];
+}
+
+type ClientType = ReturnType<typeof github.getOctokit>;
+
+const ALLOWED_FILES_CONFIG_KEYS = [
+  'any-glob-to-any-file',
+  'any-glob-to-all-files',
+  'all-globs-to-any-file',
+  'all-globs-to-all-files'
+];
+
+export async function getChangedFiles(
+  client: ClientType,
+  prNumber: number
+): Promise<string[]> {
+  const listFilesOptions = client.rest.pulls.listFiles.endpoint.merge({
+    owner: github.context.repo.owner,
+    repo: github.context.repo.repo,
+    pull_number: prNumber
+  });
+
+  const listFilesResponse = await client.paginate(listFilesOptions);
+  const changedFiles = listFilesResponse.map((f: any) => f.filename);
+
+  core.debug('found changed files:');
+  for (const file of changedFiles) {
+    core.debug('  ' + file);
+  }
+
+  return changedFiles;
+}
+
+export function toChangedFilesMatchConfig(
+  config: any
+): ChangedFilesMatchConfig {
+  if (!config['changed-files'] || !config['changed-files'].length) {
+    return {};
+  }
+  const changedFilesConfigs = Array.isArray(config['changed-files'])
+    ? config['changed-files']
+    : [config['changed-files']];
+
+  const validChangedFilesConfigs: ChangedFilesGlobPatternsConfig[] = [];
+
+  changedFilesConfigs.forEach(changedFilesConfig => {
+    if (!isObject(changedFilesConfig)) {
+      throw new Error(
+        `The "changed-files" section must have a valid config structure. Please read the action documentation for more information`
+      );
+    }
+
+    const changedFilesConfigKeys = Object.keys(changedFilesConfig);
+    const invalidKeys = changedFilesConfigKeys.filter(
+      key => !ALLOWED_FILES_CONFIG_KEYS.includes(key)
+    );
+
+    if (invalidKeys.length) {
+      throw new Error(
+        `Unknown config options were under "changed-files": ${invalidKeys.join(
+          ', '
+        )}`
+      );
+    }
+
+    changedFilesConfigKeys.forEach(key => {
+      validChangedFilesConfigs.push({
+        [kebabToCamel(key)]: Array.isArray(changedFilesConfig[key])
+          ? changedFilesConfig[key]
+          : [changedFilesConfig[key]]
+      });
+    });
+  });
+
+  return {
+    changedFiles: validChangedFilesConfigs
+  };
+}
+
+export function checkAnyChangedFiles(
+  changedFiles: string[],
+  globPatternsConfigs: ChangedFilesGlobPatternsConfig[],
+  dot: boolean
+): boolean {
+  core.debug(`   checking "changed-files" patterns`);
+
+  for (const globPatternsConfig of globPatternsConfigs) {
+    if (globPatternsConfig.anyGlobToAnyFile) {
+      if (
+        checkIfAnyGlobMatchesAnyFile(
+          changedFiles,
+          globPatternsConfig.anyGlobToAnyFile,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" matched`);
+        return true;
+      }
+    }
+
+    if (globPatternsConfig.anyGlobToAllFiles) {
+      if (
+        checkIfAnyGlobMatchesAllFiles(
+          changedFiles,
+          globPatternsConfig.anyGlobToAllFiles,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" matched`);
+        return true;
+      }
+    }
+
+    if (globPatternsConfig.allGlobsToAnyFile) {
+      if (
+        checkIfAllGlobsMatchAnyFile(
+          changedFiles,
+          globPatternsConfig.allGlobsToAnyFile,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" matched`);
+        return true;
+      }
+    }
+
+    if (globPatternsConfig.allGlobsToAllFiles) {
+      if (
+        checkIfAllGlobsMatchAllFiles(
+          changedFiles,
+          globPatternsConfig.allGlobsToAllFiles,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" matched`);
+        return true;
+      }
+    }
+  }
+
+  core.debug(`   "changed-files" did not match`);
+  return false;
+}
+
+export function checkAllChangedFiles(
+  changedFiles: string[],
+  globPatternsConfigs: ChangedFilesGlobPatternsConfig[],
+  dot: boolean
+): boolean {
+  core.debug(`   checking "changed-files" patterns`);
+
+  for (const globPatternsConfig of globPatternsConfigs) {
+    if (globPatternsConfig.anyGlobToAnyFile) {
+      if (
+        !checkIfAnyGlobMatchesAnyFile(
+          changedFiles,
+          globPatternsConfig.anyGlobToAnyFile,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" did not match`);
+        return false;
+      }
+    }
+
+    if (globPatternsConfig.anyGlobToAllFiles) {
+      if (
+        !checkIfAnyGlobMatchesAllFiles(
+          changedFiles,
+          globPatternsConfig.anyGlobToAllFiles,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" did not match`);
+        return false;
+      }
+    }
+
+    if (globPatternsConfig.allGlobsToAnyFile) {
+      if (
+        !checkIfAllGlobsMatchAnyFile(
+          changedFiles,
+          globPatternsConfig.allGlobsToAnyFile,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" did not match`);
+        return false;
+      }
+    }
+
+    if (globPatternsConfig.allGlobsToAllFiles) {
+      if (
+        !checkIfAllGlobsMatchAllFiles(
+          changedFiles,
+          globPatternsConfig.allGlobsToAllFiles,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" did not match`);
+        return false;
+      }
+    }
+  }
+
+  core.debug(`   "changed-files" patterns matched`);
+  return true;
+}
+
+export function checkIfAnyGlobMatchesAnyFile(
+  changedFiles: string[],
+  globs: string[],
+  dot: boolean
+): boolean {
+  core.debug(`    checking "any-glob-to-any-file" config patterns`);
+  const matchers = globs.map(g => new Minimatch(g, {dot}));
+
+  for (const matcher of matchers) {
+    const matchedFile = changedFiles.find(changedFile => {
+      core.debug(
+        `     checking "${printPattern(
+          matcher
+        )}" pattern against ${changedFile}`
+      );
+
+      return matcher.match(changedFile);
+    });
+
+    if (matchedFile) {
+      core.debug(
+        `     "${printPattern(matcher)}" pattern matched ${matchedFile}`
+      );
+      return true;
+    }
+  }
+
+  core.debug(`    none of the patterns matched any of the files`);
+  return false;
+}
+
+export function checkIfAllGlobsMatchAnyFile(
+  changedFiles: string[],
+  globs: string[],
+  dot: boolean
+): boolean {
+  core.debug(`    checking "all-globs-to-any-file" config patterns`);
+  const matchers = globs.map(g => new Minimatch(g, {dot}));
+
+  for (const changedFile of changedFiles) {
+    const mismatchedGlob = matchers.find(matcher => {
+      core.debug(
+        `     checking "${printPattern(
+          matcher
+        )}" pattern against ${changedFile}`
+      );
+
+      return !matcher.match(changedFile);
+    });
+
+    if (mismatchedGlob) {
+      core.debug(
+        `     "${printPattern(
+          mismatchedGlob
+        )}" pattern did not match ${changedFile}`
+      );
+
+      continue;
+    }
+
+    core.debug(`    all patterns matched ${changedFile}`);
+    return true;
+  }
+
+  core.debug(`    none of the files matched all patterns`);
+  return false;
+}
+
+export function checkIfAnyGlobMatchesAllFiles(
+  changedFiles: string[],
+  globs: string[],
+  dot: boolean
+): boolean {
+  core.debug(`    checking "any-glob-to-all-files" config patterns`);
+  const matchers = globs.map(g => new Minimatch(g, {dot}));
+
+  for (const matcher of matchers) {
+    const mismatchedFile = changedFiles.find(changedFile => {
+      core.debug(
+        `     checking "${printPattern(
+          matcher
+        )}" pattern against ${changedFile}`
+      );
+
+      return !matcher.match(changedFile);
+    });
+
+    if (mismatchedFile) {
+      core.debug(
+        `     "${printPattern(
+          matcher
+        )}" pattern did not match ${mismatchedFile}`
+      );
+
+      continue;
+    }
+
+    core.debug(`    "${printPattern(matcher)}" pattern matched all files`);
+    return true;
+  }
+
+  core.debug(`    none of the patterns matched all files`);
+  return false;
+}
+
+export function checkIfAllGlobsMatchAllFiles(
+  changedFiles: string[],
+  globs: string[],
+  dot: boolean
+): boolean {
+  core.debug(`    checking "all-globs-to-all-files" config patterns`);
+  const matchers = globs.map(g => new Minimatch(g, {dot}));
+
+  for (const changedFile of changedFiles) {
+    const mismatchedGlob = matchers.find(matcher => {
+      core.debug(
+        `     checking "${printPattern(
+          matcher
+        )}" pattern against ${changedFile}`
+      );
+
+      return !matcher.match(changedFile);
+    });
+
+    if (mismatchedGlob) {
+      core.debug(
+        `     "${printPattern(
+          mismatchedGlob
+        )}" pattern did not match ${changedFile}`
+      );
+
+      return false;
+    }
+  }
+
+  core.debug(`    all patterns matched all files`);
+  return true;
+}

src/get-inputs/get-inputs.ts

@@ -0,0 +1,10 @@
+import * as core from '@actions/core';
+import {getPrNumbers} from './get-pr-numbers';
+
+export const getInputs = () => ({
+  token: core.getInput('repo-token'),
+  configPath: core.getInput('configuration-path', {required: true}),
+  syncLabels: core.getBooleanInput('sync-labels'),
+  dot: core.getBooleanInput('dot'),
+  prNumbers: getPrNumbers()
+});

src/get-inputs/get-pr-numbers.ts

@@ -0,0 +1,28 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+
+const getPrNumberFromContext = () =>
+  github.context.payload.pull_request?.number;
+
+export const getPrNumbers = (): number[] => {
+  const prInput = core.getMultilineInput('pr-number');
+
+  if (!prInput?.length) {
+    return [getPrNumberFromContext()].filter(Boolean) as number[];
+  }
+
+  const result: number[] = [];
+
+  for (const line of prInput) {
+    const prNumber = parseInt(line, 10);
+
+    if (isNaN(prNumber) && prNumber <= 0) {
+      core.warning(`'${prNumber}' is not a valid pull request number`);
+      continue;
+    }
+
+    result.push(prNumber);
+  }
+
+  return result;
+};

src/get-inputs/index.ts

@@ -0,0 +1 @@
+export * from './get-inputs';

src/labeler.ts

@@ -1,260 +1,237 @@
-import * as core from "@actions/core";
-import * as github from "@actions/github";
-import * as yaml from "js-yaml";
-import { Minimatch, IMinimatch } from "minimatch";
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+import * as pluginRetry from '@octokit/plugin-retry';
+import * as api from './api';
+import isEqual from 'lodash.isequal';
+import {getInputs} from './get-inputs';
 
-interface MatchConfig {
-  all?: string[];
-  any?: string[];
-}
+import {BaseMatchConfig, MatchConfig} from './api/get-label-configs';
+
+import {checkAllChangedFiles, checkAnyChangedFiles} from './changedFiles';
+
+import {checkAnyBranch, checkAllBranch} from './branch';
 
-type StringOrMatchConfig = string | MatchConfig;
 type ClientType = ReturnType<typeof github.getOctokit>;
 
-export async function run() {
-  try {
-    const token = core.getInput("repo-token", { required: true });
-    const configPath = core.getInput("configuration-path", { required: true });
-    const syncLabels = !!core.getInput("sync-labels", { required: false });
+// GitHub Issues cannot have more than 100 labels
+const GITHUB_MAX_LABELS = 100;
 
-    const prNumber = getPrNumber();
-    if (!prNumber) {
-      console.log("Could not get pull request number from context, exiting");
-      return;
-    }
+export const run = () =>
+  labeler().catch(error => {
+    core.error(error);
+    core.setFailed(error.message);
+  });
 
-    const client: ClientType = github.getOctokit(token);
+export async function labeler() {
+  const {token, configPath, syncLabels, dot, prNumbers} = getInputs();
 
-    const { data: pullRequest } = await client.rest.pulls.get({
-      owner: github.context.repo.owner,
-      repo: github.context.repo.repo,
-      pull_number: prNumber,
-    });
+  if (!prNumbers.length) {
+    core.warning('Could not get pull request number(s), exiting');
+    return;
+  }
 
-    core.debug(`fetching changed files for pr #${prNumber}`);
-    const changedFiles: string[] = await getChangedFiles(client, prNumber);
-    const labelGlobs: Map<string, StringOrMatchConfig[]> = await getLabelGlobs(
+  const client: ClientType = github.getOctokit(token, {}, pluginRetry.retry);
+
+  const pullRequests = api.getPullRequests(client, prNumbers);
+
+  for await (const pullRequest of pullRequests) {
+    const labelConfigs: Map<string, MatchConfig[]> = await api.getLabelConfigs(
       client,
       configPath
     );
+    const preexistingLabels = pullRequest.data.labels.map(l => l.name);
+    const allLabels: Set<string> = new Set<string>(preexistingLabels);
 
-    const labels: string[] = [];
-    const labelsToRemove: string[] = [];
-    for (const [label, globs] of labelGlobs.entries()) {
+    for (const [label, configs] of labelConfigs.entries()) {
       core.debug(`processing ${label}`);
-      if (checkGlobs(changedFiles, globs)) {
-        labels.push(label);
-      } else if (pullRequest.labels.find((l) => l.name === label)) {
-        labelsToRemove.push(label);
+      if (checkMatchConfigs(pullRequest.changedFiles, configs, dot)) {
+        allLabels.add(label);
+      } else if (syncLabels) {
+        allLabels.delete(label);
       }
     }
 
-    if (labels.length > 0) {
-      await addLabels(client, prNumber, labels);
+    const labelsToAdd = [...allLabels].slice(0, GITHUB_MAX_LABELS);
+    const excessLabels = [...allLabels].slice(GITHUB_MAX_LABELS);
+
+    let newLabels: string[] = [];
+
+    try {
+      if (!isEqual(labelsToAdd, preexistingLabels)) {
+        await api.setLabels(client, pullRequest.number, labelsToAdd);
+        newLabels = labelsToAdd.filter(
+          label => !preexistingLabels.includes(label)
+        );
+      }
+    } catch (error: any) {
+      if (
+        error.name === 'HttpError' &&
+        error.status === 403 &&
+        error.message.toLowerCase().includes('unauthorized')
+      ) {
+        throw new Error(
+          `Failed to set labels for PR #${pullRequest.number}. The workflow does not have permission to create labels. ` +
+            `Ensure the 'issues: write' permission is granted in the workflow file or manually create the missing labels in the repository before running the action.`
+        );
+      } else if (
+        error.name !== 'HttpError' ||
+        error.message !== 'Resource not accessible by integration'
+      ) {
+        throw error;
+      }
+
+      core.warning(
+        `The action requires 'issues: write' permission to create new labels or 'pull-requests: write' permission to add existing labels to pull requests. ` +
+          `For more information, refer to the action documentation: https://github.com/actions/labeler#recommended-permissions`,
+        {
+          title: `${process.env['GITHUB_ACTION_REPOSITORY']} running under '${github.context.eventName}' is misconfigured`
+        }
+      );
+
+      core.setFailed(error.message);
+
+      return;
     }
 
-    if (syncLabels && labelsToRemove.length) {
-      await removeLabels(client, prNumber, labelsToRemove);
-    }
-  } catch (error: any) {
-    core.error(error);
-    core.setFailed(error.message);
-  }
-}
+    core.setOutput('new-labels', newLabels.join(','));
+    core.setOutput('all-labels', labelsToAdd.join(','));
 
-function getPrNumber(): number | undefined {
-  const pullRequest = github.context.payload.pull_request;
-  if (!pullRequest) {
-    return undefined;
-  }
-
-  return pullRequest.number;
-}
-
-async function getChangedFiles(
-  client: ClientType,
-  prNumber: number
-): Promise<string[]> {
-  const listFilesOptions = client.rest.pulls.listFiles.endpoint.merge({
-    owner: github.context.repo.owner,
-    repo: github.context.repo.repo,
-    pull_number: prNumber,
-  });
-
-  const listFilesResponse = await client.paginate(listFilesOptions);
-  const changedFiles = listFilesResponse.map((f: any) => f.filename);
-
-  core.debug("found changed files:");
-  for (const file of changedFiles) {
-    core.debug("  " + file);
-  }
-
-  return changedFiles;
-}
-
-async function getLabelGlobs(
-  client: ClientType,
-  configurationPath: string
-): Promise<Map<string, StringOrMatchConfig[]>> {
-  const configurationContent: string = await fetchContent(
-    client,
-    configurationPath
-  );
-
-  // loads (hopefully) a `{[label:string]: string | StringOrMatchConfig[]}`, but is `any`:
-  const configObject: any = yaml.load(configurationContent);
-
-  // transform `any` => `Map<string,StringOrMatchConfig[]>` or throw if yaml is malformed:
-  return getLabelGlobMapFromObject(configObject);
-}
-
-async function fetchContent(
-  client: ClientType,
-  repoPath: string
-): Promise<string> {
-  const response: any = await client.rest.repos.getContent({
-    owner: github.context.repo.owner,
-    repo: github.context.repo.repo,
-    path: repoPath,
-    ref: github.context.sha,
-  });
-
-  return Buffer.from(response.data.content, response.data.encoding).toString();
-}
-
-function getLabelGlobMapFromObject(
-  configObject: any
-): Map<string, StringOrMatchConfig[]> {
-  const labelGlobs: Map<string, StringOrMatchConfig[]> = new Map();
-  for (const label in configObject) {
-    if (typeof configObject[label] === "string") {
-      labelGlobs.set(label, [configObject[label]]);
-    } else if (configObject[label] instanceof Array) {
-      labelGlobs.set(label, configObject[label]);
-    } else {
-      throw Error(
-        `found unexpected type for label ${label} (should be string or array of globs)`
+    if (excessLabels.length) {
+      core.warning(
+        `Maximum of ${GITHUB_MAX_LABELS} labels allowed. Excess labels: ${excessLabels.join(
+          ', '
+        )}`,
+        {title: 'Label limit for a PR exceeded'}
       );
     }
   }
-
-  return labelGlobs;
 }
 
-function toMatchConfig(config: StringOrMatchConfig): MatchConfig {
-  if (typeof config === "string") {
-    return {
-      any: [config],
-    };
-  }
-
-  return config;
-}
-
-function printPattern(matcher: IMinimatch): string {
-  return (matcher.negate ? "!" : "") + matcher.pattern;
-}
-
-export function checkGlobs(
+export function checkMatchConfigs(
   changedFiles: string[],
-  globs: StringOrMatchConfig[]
+  matchConfigs: MatchConfig[],
+  dot: boolean
 ): boolean {
-  for (const glob of globs) {
-    core.debug(` checking pattern ${JSON.stringify(glob)}`);
-    const matchConfig = toMatchConfig(glob);
-    if (checkMatch(changedFiles, matchConfig)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-function isMatch(changedFile: string, matchers: IMinimatch[]): boolean {
-  core.debug(`    matching patterns against file ${changedFile}`);
-  for (const matcher of matchers) {
-    core.debug(`   - ${printPattern(matcher)}`);
-    if (!matcher.match(changedFile)) {
-      core.debug(`   ${printPattern(matcher)} did not match`);
+  for (const config of matchConfigs) {
+    core.debug(` checking config ${JSON.stringify(config)}`);
+    if (!checkMatch(changedFiles, config, dot)) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function checkMatch(
+  changedFiles: string[],
+  matchConfig: MatchConfig,
+  dot: boolean
+): boolean {
+  if (!Object.keys(matchConfig).length) {
+    core.debug(`  no "any" or "all" patterns to check`);
+    return false;
+  }
+
+  if (matchConfig.all) {
+    if (!checkAll(matchConfig.all, changedFiles, dot)) {
+      return false;
+    }
+  }
+
+  if (matchConfig.any) {
+    if (!checkAny(matchConfig.any, changedFiles, dot)) {
       return false;
     }
   }
 
-  core.debug(`   all patterns matched`);
   return true;
 }
 
 // equivalent to "Array.some()" but expanded for debugging and clarity
-function checkAny(changedFiles: string[], globs: string[]): boolean {
-  const matchers = globs.map((g) => new Minimatch(g));
+export function checkAny(
+  matchConfigs: BaseMatchConfig[],
+  changedFiles: string[],
+  dot: boolean
+): boolean {
   core.debug(`  checking "any" patterns`);
-  for (const changedFile of changedFiles) {
-    if (isMatch(changedFile, matchers)) {
-      core.debug(`  "any" patterns matched against ${changedFile}`);
-      return true;
+  if (
+    !matchConfigs.length ||
+    !matchConfigs.some(configOption => Object.keys(configOption).length)
+  ) {
+    core.debug(`  no "any" patterns to check`);
+    return false;
+  }
+
+  for (const matchConfig of matchConfigs) {
+    if (matchConfig.baseBranch) {
+      if (checkAnyBranch(matchConfig.baseBranch, 'base')) {
+        core.debug(`  "any" patterns matched`);
+        return true;
+      }
+    }
+
+    if (matchConfig.changedFiles) {
+      if (checkAnyChangedFiles(changedFiles, matchConfig.changedFiles, dot)) {
+        core.debug(`  "any" patterns matched`);
+        return true;
+      }
+    }
+
+    if (matchConfig.headBranch) {
+      if (checkAnyBranch(matchConfig.headBranch, 'head')) {
+        core.debug(`  "any" patterns matched`);
+        return true;
+      }
     }
   }
 
-  core.debug(`  "any" patterns did not match any files`);
+  core.debug(`  "any" patterns did not match any configs`);
   return false;
 }
 
 // equivalent to "Array.every()" but expanded for debugging and clarity
-function checkAll(changedFiles: string[], globs: string[]): boolean {
-  const matchers = globs.map((g) => new Minimatch(g));
-  core.debug(` checking "all" patterns`);
-  for (const changedFile of changedFiles) {
-    if (!isMatch(changedFile, matchers)) {
-      core.debug(`  "all" patterns did not match against ${changedFile}`);
-      return false;
+export function checkAll(
+  matchConfigs: BaseMatchConfig[],
+  changedFiles: string[],
+  dot: boolean
+): boolean {
+  core.debug(`  checking "all" patterns`);
+  if (
+    !matchConfigs.length ||
+    !matchConfigs.some(configOption => Object.keys(configOption).length)
+  ) {
+    core.debug(`  no "all" patterns to check`);
+    return false;
+  }
+
+  for (const matchConfig of matchConfigs) {
+    if (matchConfig.baseBranch) {
+      if (!checkAllBranch(matchConfig.baseBranch, 'base')) {
+        core.debug(`  "all" patterns did not match`);
+        return false;
+      }
+    }
+
+    if (matchConfig.changedFiles) {
+      if (!changedFiles.length) {
+        core.debug(`  no files to check "changed-files" patterns against`);
+        return false;
+      }
+
+      if (!checkAllChangedFiles(changedFiles, matchConfig.changedFiles, dot)) {
+        core.debug(`  "all" patterns did not match`);
+        return false;
+      }
+    }
+
+    if (matchConfig.headBranch) {
+      if (!checkAllBranch(matchConfig.headBranch, 'head')) {
+        core.debug(`  "all" patterns did not match`);
+        return false;
+      }
     }
   }
 
-  core.debug(`  "all" patterns matched all files`);
+  core.debug(`  "all" patterns matched all configs`);
   return true;
 }
-
-function checkMatch(changedFiles: string[], matchConfig: MatchConfig): boolean {
-  if (matchConfig.all !== undefined) {
-    if (!checkAll(changedFiles, matchConfig.all)) {
-      return false;
-    }
-  }
-
-  if (matchConfig.any !== undefined) {
-    if (!checkAny(changedFiles, matchConfig.any)) {
-      return false;
-    }
-  }
-
-  return true;
-}
-
-async function addLabels(
-  client: ClientType,
-  prNumber: number,
-  labels: string[]
-) {
-  await client.rest.issues.addLabels({
-    owner: github.context.repo.owner,
-    repo: github.context.repo.repo,
-    issue_number: prNumber,
-    labels: labels,
-  });
-}
-
-async function removeLabels(
-  client: ClientType,
-  prNumber: number,
-  labels: string[]
-) {
-  await Promise.all(
-    labels.map((label) =>
-      client.rest.issues.removeLabel({
-        owner: github.context.repo.owner,
-        repo: github.context.repo.repo,
-        issue_number: prNumber,
-        name: label,
-      })
-    )
-  );
-}

src/main.ts

@@ -1,3 +1,3 @@
-import { run } from "./labeler";
+import {run} from './labeler';
 
 run();

src/utils.ts

@@ -0,0 +1,13 @@
+import {Minimatch} from 'minimatch';
+
+export const printPattern = (matcher: Minimatch): string => {
+  return (matcher.negate ? '!' : '') + matcher.pattern;
+};
+
+export const kebabToCamel = (str: string): string => {
+  return str.replace(/-./g, m => m.toUpperCase()[1]);
+};
+
+export function isObject(obj: unknown): obj is object {
+  return obj !== null && typeof obj === 'object' && !Array.isArray(obj);
+}