Improve Labeler Action Documentation and Error Handling for Permissions (#897)

* Update README.md and labeler.ts to clarify permissions for GitHub Labeler Action

* Update dist/index.js with latest build changes

* Update README.md to clarify manual label creation as an alternative to granting issues write permission

* Fix labeler error handling to ensure case-insensitive check for unauthorized access

* Refactor error handling in labeler to throw an error for unauthorized access instead of logging

* Add tests for labeler error handling and improve error reporting

.eslintrc.js

@@ -7,7 +7,7 @@ module.exports = {
     'eslint-config-prettier'
   ],
   parser: '@typescript-eslint/parser',
-  plugins: ['@typescript-eslint', 'eslint-plugin-jest'],
+  plugins: ['@typescript-eslint', 'eslint-plugin-node', 'eslint-plugin-jest'],
   rules: {
     '@typescript-eslint/no-require-imports': 'error',
     '@typescript-eslint/no-non-null-assertion': 'off',
@@ -28,7 +28,8 @@ module.exports = {
       }
     ],
     'no-control-regex': 'off',
-    'no-constant-condition': ['error', {checkLoops: false}]
+    'no-constant-condition': ['error', {checkLoops: false}],
+    'node/no-extraneous-import': 'error'
   },
   overrides: [
     {

.github/workflows/basic-validation.yml

@@ -15,3 +15,5 @@ jobs:
   call-basic-validation:
     name: Basic validation
     uses: actions/reusable-workflows/.github/workflows/basic-validation.yml@main
+    with:
+      node-version: '24.x'

.github/workflows/check-dist.yml

@@ -15,3 +15,5 @@ jobs:
   call-check-dist:
     name: Check dist/
     uses: actions/reusable-workflows/.github/workflows/check-dist.yml@main
+    with:
+      node-version: '24.x'

.github/workflows/publish-immutable-actions.yml

@@ -0,0 +1,20 @@
+name: 'Publish Immutable Action Version'
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+
+    steps:
+      - name: Checking out
+        uses: actions/checkout@v5
+      - name: Publish
+        id: publish
+        uses: actions/publish-immutable-action@0.0.3

.github/workflows/release-new-action-version.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Update the ${{ env.TAG_NAME }} tag
-        uses: actions/publish-action@v0.2.2
+        uses: actions/publish-action@v0.4.0
         with:
           source-tag: ${{ env.TAG_NAME }}
           slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.gitignore

@@ -1,3 +1,4 @@
 .DS_Store
 node_modules/
-lib/
+lib/
+.idea

.licenses/npm/@actions/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/core"
-version: 1.10.0
+version: 1.11.1
 type: npm
 summary: Actions core lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/core

.licenses/npm/@actions/exec.dep.yml

@@ -0,0 +1,20 @@
+---
+name: "@actions/exec"
+version: 1.1.1
+type: npm
+summary: Actions exec lib
+homepage: https://github.com/actions/toolkit/tree/main/packages/exec
+license: mit
+licenses:
+- sources: LICENSE.md
+  text: |-
+    The MIT License (MIT)
+
+    Copyright 2019 GitHub
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+notices: []

.licenses/npm/@actions/github.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/github"
-version: 5.1.1
+version: 6.0.0
 type: npm
 summary: Actions github lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/github

.licenses/npm/@actions/http-client.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/http-client"
-version: 2.0.1
+version: 2.2.0
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client

.licenses/npm/@actions/io.dep.yml

@@ -1,20 +1,20 @@
 ---
-name: uuid
-version: 8.3.2
+name: "@actions/io"
+version: 1.1.3
 type: npm
-summary: RFC4122 (v1, v4, and v5) UUIDs
-homepage: 
+summary: Actions io lib
+homepage: https://github.com/actions/toolkit/tree/main/packages/io
 license: mit
 licenses:
 - sources: LICENSE.md
-  text: |
+  text: |-
     The MIT License (MIT)
 
-    Copyright (c) 2010-2020 Robert Kieffer and other contributors
+    Copyright 2019 GitHub
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
     The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-notices: []
+notices: []

.licenses/npm/@fastify/busboy.dep.yml

@@ -0,0 +1,30 @@
+---
+name: "@fastify/busboy"
+version: 2.0.0
+type: npm
+summary: A streaming parser for HTML form data for node.js
+homepage: 
+license: mit
+licenses:
+- sources: LICENSE
+  text: |-
+    Copyright Brian White. All rights reserved.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to
+    deal in the Software without restriction, including without limitation the
+    rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+    sell copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+    IN THE SOFTWARE.
+notices: []

.licenses/npm/@octokit/auth-token.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/auth-token"
-version: 2.5.0
+version: 4.0.0
 type: npm
 summary: GitHub API token authentication for browsers and Node.js
 homepage: 

.licenses/npm/@octokit/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/core"
-version: 3.6.0
+version: 5.0.1
 type: npm
 summary: Extendable client for GitHub's REST & GraphQL APIs
 homepage: 

.licenses/npm/@octokit/endpoint.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/endpoint"
-version: 6.0.12
+version: 9.0.1
 type: npm
 summary: Turns REST API endpoints into generic request options
 homepage: 

.licenses/npm/@octokit/graphql.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/graphql"
-version: 4.8.0
+version: 7.0.2
 type: npm
 summary: GitHub GraphQL API client for browsers and Node
 homepage: 

.licenses/npm/@octokit/openapi-types-19.0.1.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/openapi-types"
-version: 12.11.0
+version: 19.0.1
 type: npm
 summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
-homepage: 
+homepage:
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/openapi-types-23.0.1.dep.yml

@@ -0,0 +1,20 @@
+---
+name: "@octokit/openapi-types"
+version: 23.0.1
+type: npm
+summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |-
+    Copyright 2020 Gregor Martynus
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+- sources: README.md
+  text: "[MIT](LICENSE)"
+notices: []

.licenses/npm/@octokit/plugin-paginate-rest.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-paginate-rest"
-version: 2.21.3
+version: 9.1.0
 type: npm
 summary: Octokit plugin to paginate REST API endpoint responses
 homepage: 

.licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-rest-endpoint-methods"
-version: 5.16.2
+version: 10.1.0
 type: npm
 summary: Octokit plugin adding one method for all of api.github.com REST API endpoints
 homepage: 

.licenses/npm/@octokit/plugin-retry.dep.yml

@@ -1,15 +1,17 @@
 ---
-name: tr46
-version: 0.0.3
+name: "@octokit/plugin-retry"
+version: 6.0.1
 type: npm
-summary: An implementation of the Unicode TR46 spec
-homepage: https://github.com/Sebmaster/tr46.js#readme
+summary: Automatic retry plugin for octokit
+homepage: 
 license: mit
 licenses:
-- sources: Auto-generated MIT license text
+- sources: LICENSE
   text: |
     MIT License
 
+    Copyright (c) 2018 Octokit contributors
+
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal
     in the Software without restriction, including without limitation the rights
@@ -27,4 +29,6 @@ licenses:
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE.
+- sources: README.md
+  text: "[MIT](LICENSE)"
 notices: []

.licenses/npm/@octokit/request-error.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/request-error"
-version: 2.1.0
+version: 5.1.1
 type: npm
 summary: Error class for Octokit request errors
-homepage: 
+homepage:
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/request.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/request"
-version: 5.6.3
+version: 8.1.4
 type: npm
 summary: Send parameterized requests to GitHub's APIs with sensible defaults in browsers
   and Node

.licenses/npm/@octokit/types-12.1.0.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@octokit/types"
-version: 6.41.0
+version: 12.1.0
 type: npm
 summary: Shared TypeScript definitions for Octokit projects
-homepage: 
+homepage:
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@octokit/types-13.8.0.dep.yml

@@ -0,0 +1,20 @@
+---
+name: "@octokit/types"
+version: 13.8.0
+type: npm
+summary: Shared TypeScript definitions for Octokit projects
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License Copyright (c) 2019 Octokit contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+- sources: README.md
+  text: "[MIT](LICENSE)"
+notices: []

.licenses/npm/bottleneck.dep.yml

@@ -0,0 +1,31 @@
+---
+name: bottleneck
+version: 2.19.5
+type: npm
+summary: Distributed task scheduler and rate limiter
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    The MIT License (MIT)
+
+    Copyright (c) 2014 Simon Grondin
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of
+    this software and associated documentation files (the "Software"), to deal in
+    the Software without restriction, including without limitation the rights to
+    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+    the Software, and to permit persons to whom the Software is furnished to do so,
+    subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+    FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+    COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+    IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+    CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+notices: []

.licenses/npm/brace-expansion.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 2.0.1
+version: 2.0.2
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion

.licenses/npm/lodash.isequal.dep.yml

@@ -0,0 +1,58 @@
+---
+name: lodash.isequal
+version: 4.5.0
+type: npm
+summary: The Lodash method `_.isEqual` exported as a module.
+homepage: https://lodash.com/
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    Copyright JS Foundation and other contributors <https://js.foundation/>
+
+    Based on Underscore.js, copyright Jeremy Ashkenas,
+    DocumentCloud and Investigative Reporters & Editors <http://underscorejs.org/>
+
+    This software consists of voluntary contributions made by many
+    individuals. For exact contribution history, see the revision history
+    available at https://github.com/lodash/lodash
+
+    The following license applies to all parts of this software except as
+    documented below:
+
+    ====
+
+    Permission is hereby granted, free of charge, to any person obtaining
+    a copy of this software and associated documentation files (the
+    "Software"), to deal in the Software without restriction, including
+    without limitation the rights to use, copy, modify, merge, publish,
+    distribute, sublicense, and/or sell copies of the Software, and to
+    permit persons to whom the Software is furnished to do so, subject to
+    the following conditions:
+
+    The above copyright notice and this permission notice shall be
+    included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+    NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+    LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+    WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+    ====
+
+    Copyright and related rights for sample code are waived via CC0. Sample
+    code is defined as all source code displayed within the prose of the
+    documentation.
+
+    CC0: http://creativecommons.org/publicdomain/zero/1.0/
+
+    ====
+
+    Files located in the node_modules and vendor directories are externally
+    maintained libraries used by this software which have their own
+    licenses; we recommend you read them, as their terms may differ from the
+    terms above.
+notices: []

.licenses/npm/minimatch.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: minimatch
-version: 7.4.3
+version: 10.0.1
 type: npm
 summary: a glob matcher in javascript
 homepage: 

.licenses/npm/node-fetch.dep.yml

@@ -1,56 +0,0 @@
----
-name: node-fetch
-version: 2.6.7
-type: npm
-summary: A light-weight module that brings window.fetch to node.js
-homepage: https://github.com/bitinn/node-fetch
-license: mit
-licenses:
-- sources: LICENSE.md
-  text: |+
-    The MIT License (MIT)
-
-    Copyright (c) 2016 David Frank
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE.
-
-- sources: README.md
-  text: |-
-    MIT
-
-    [npm-image]: https://flat.badgen.net/npm/v/node-fetch
-    [npm-url]: https://www.npmjs.com/package/node-fetch
-    [travis-image]: https://flat.badgen.net/travis/bitinn/node-fetch
-    [travis-url]: https://travis-ci.org/bitinn/node-fetch
-    [codecov-image]: https://flat.badgen.net/codecov/c/github/bitinn/node-fetch/master
-    [codecov-url]: https://codecov.io/gh/bitinn/node-fetch
-    [install-size-image]: https://flat.badgen.net/packagephobia/install/node-fetch
-    [install-size-url]: https://packagephobia.now.sh/result?p=node-fetch
-    [discord-image]: https://img.shields.io/discord/619915844268326952?color=%237289DA&label=Discord&style=flat-square
-    [discord-url]: https://discord.gg/Zxbndcm
-    [opencollective-image]: https://opencollective.com/node-fetch/backers.svg
-    [opencollective-url]: https://opencollective.com/node-fetch
-    [whatwg-fetch]: https://fetch.spec.whatwg.org/
-    [response-init]: https://fetch.spec.whatwg.org/#responseinit
-    [node-readable]: https://nodejs.org/api/stream.html#stream_readable_streams
-    [mdn-headers]: https://developer.mozilla.org/en-US/docs/Web/API/Headers
-    [LIMITS.md]: https://github.com/bitinn/node-fetch/blob/master/LIMITS.md
-    [ERROR-HANDLING.md]: https://github.com/bitinn/node-fetch/blob/master/ERROR-HANDLING.md
-    [UPGRADE-GUIDE.md]: https://github.com/bitinn/node-fetch/blob/master/UPGRADE-GUIDE.md
-notices: []

.licenses/npm/undici.dep.yml

@@ -1,16 +1,16 @@
 ---
-name: whatwg-url
-version: 5.0.0
+name: undici
+version: 5.29.0
 type: npm
-summary: An implementation of the WHATWG URL Standard's URL API and parsing machinery
-homepage: 
+summary: An HTTP/1.1 client, written from scratch for Node.js
+homepage: https://undici.nodejs.org
 license: mit
 licenses:
-- sources: LICENSE.txt
+- sources: LICENSE
   text: |
-    The MIT License (MIT)
+    MIT License
 
-    Copyright (c) 2015–2016 Sebastian Mayr
+    Copyright (c) Matteo Collina and Undici contributors
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal
@@ -19,14 +19,16 @@ licenses:
     copies of the Software, and to permit persons to whom the Software is
     furnished to do so, subject to the following conditions:
 
-    The above copyright notice and this permission notice shall be included in
-    all copies or substantial portions of the Software.
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
     AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-    THE SOFTWARE.
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: MIT
 notices: []

.licenses/npm/webidl-conversions.dep.yml

@@ -1,23 +0,0 @@
----
-name: webidl-conversions
-version: 3.0.1
-type: npm
-summary: Implements the WebIDL algorithms for converting to and from JavaScript values
-homepage: 
-license: bsd-2-clause
-licenses:
-- sources: LICENSE.md
-  text: |
-    # The BSD 2-Clause License
-
-    Copyright (c) 2014, Domenic Denicola
-    All rights reserved.
-
-    Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-
-    2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-
-    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-notices: []

README.md

@@ -4,6 +4,25 @@
 
 Automatically label new pull requests based on the paths of files being changed or the branch name.
 
+## Breaking changes in V6
+
+- Upgraded action from node20 to node24.
+  > Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1)
+
+For more details, see the full release notes on the [release page](https://github.com/actions/labeler/releases/tag/v6.0.0)
+
+## Breaking changes in V5
+1) The ability to apply labels based on the names of base and/or head branches was added ([#186](https://github.com/actions/labeler/issues/186) and [#54](https://github.com/actions/labeler/issues/54)). The match object for changed files was expanded with new combinations in order to make it more intuitive and flexible ([#423](https://github.com/actions/labeler/issues/423) and [#101](https://github.com/actions/labeler/issues/101)). As a result, the configuration file structure was significantly redesigned and is not compatible with the structure of the previous version. Please read the documentation below to find out how to adapt your configuration files for use with the new action version.
+
+2) The bug related to the `sync-labels` input was fixed ([#112](https://github.com/actions/labeler/issues/112)). Now the input value is read correctly.
+
+3) By default, `dot` input is set to `true`. Now, paths starting with a dot (e.g. `.github`) are matched by default.
+
+4) Version 5 of this action updated the [runtime to Node.js 20](https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions). All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.
+
+> [!IMPORTANT]
+> Before the update to the v5, please check out [this information](#notes-regarding-pull_request_target-event) about the `pull_request_target` event trigger.
+
 ## Usage
 
 ### Create `.github/labeler.yml`
@@ -14,114 +33,129 @@ The key is the name of the label in your repository that you want to add (eg: "m
 
 #### Match Object
 
-The match object allows control over the matching options, you can specify the label to be applied based on the files that have changed or the name of either the base branch or the head branch. For the changed files options you provide a [path glob](https://github.com/isaacs/minimatch#minimatch), and for the branches you provide a regexp to match against the branch name.
+The match object allows control over the matching options. You can specify the label to be applied based on the files that have changed or the name of either the base branch or the head branch. For the changed files options you provide a [path glob](https://github.com/isaacs/minimatch#minimatch), and for the branches you provide a regexp to match against the branch name.
 
 The base match object is defined as:
 ```yml
-- changed-files: ['list', 'of', 'globs']
+- changed-files: 
+  - any-glob-to-any-file: ['list', 'of', 'globs']
+  - any-glob-to-all-files: ['list', 'of', 'globs']
+  - all-globs-to-any-file: ['list', 'of', 'globs']
+  - all-globs-to-all-files: ['list', 'of', 'globs']
 - base-branch: ['list', 'of', 'regexps']
 - head-branch: ['list', 'of', 'regexps']
 ```
 
-There are two top level keys of `any` and `all`, which both accept the same config options:
+There are two top-level keys, `any` and `all`, which both accept the same configuration options:
 ```yml
 - any:
-  - changed-files: ['list', 'of', 'globs']
+  - changed-files:
+    - any-glob-to-any-file: ['list', 'of', 'globs']
+    - any-glob-to-all-files: ['list', 'of', 'globs']
+    - all-globs-to-any-file: ['list', 'of', 'globs']
+    - all-globs-to-all-files: ['list', 'of', 'globs']
   - base-branch: ['list', 'of', 'regexps']
   - head-branch: ['list', 'of', 'regexps']
 - all:
-  - changed-files: ['list', 'of', 'globs']
+  - changed-files:
+    - any-glob-to-any-file: ['list', 'of', 'globs']
+    - any-glob-to-all-files: ['list', 'of', 'globs']
+    - all-globs-to-any-file: ['list', 'of', 'globs']
+    - all-globs-to-all-files: ['list', 'of', 'globs']
   - base-branch: ['list', 'of', 'regexps']
   - head-branch: ['list', 'of', 'regexps']
 ```
 
+From a boolean logic perspective, top-level match objects, and options within `all` are `AND`-ed together and individual match rules within the `any` object are `OR`-ed.
+
 One or all fields can be provided for fine-grained matching.
 The fields are defined as follows:
-* `all`: all of the provided options must match in order for the label to be applied
-* `any`: if any of the provided options match then a label will be applied
-* `base-branch`: match regexps against the base branch name
-* `changed-files`: match glob patterns against the changed paths
-* `head-branch`: match regexps against the head branch name
+- `all`: ALL of the provided options must match for the label to be applied
+- `any`: if ANY of the provided options match then the label will be applied
+  - `base-branch`: match regexps against the base branch name
+  - `head-branch`: match regexps against the head branch name
+  - `changed-files`: match glob patterns against the changed paths
+    - `any-glob-to-any-file`: ANY glob must match against ANY changed file
+    - `any-glob-to-all-files`: ANY glob must match against ALL changed files
+    - `all-globs-to-any-file`: ALL globs must match against ANY changed file
+    - `all-globs-to-all-files`: ALL globs must match against ALL changed files
 
-If a base option is provided without a top-level key then it will default to `any`. More specifically, the following two configurations are equivalent:
+If a base option is provided without a top-level key, then it will default to `any`. More specifically, the following two configurations are equivalent:
 ```yml
-label1:
-- changed-files: example1/*
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: 'docs/*'
 ```
 and
 ```yml
-label1:
+Documentation:
 - any:
-  - changed-files: ['example1/*']
+  - changed-files:
+    - any-glob-to-any-file: 'docs/*'
 ```
 
-From a boolean logic perspective, top-level match objects, and options within `all`  are `AND`-ed together and individual match rules within the `any` object are `OR`-ed. If path globs are combined with `!` negation, you can write complex matching rules.
+ If path globs are combined with `!` negation, you can write complex matching rules. See the examples below for more information.
 
 #### Basic Examples
 
 ```yml
-# Add 'label1' to any changes within 'example' folder or any subfolders
-label1:
-- changed-files: example/**/*
-
-# Add 'label2' to any file changes within 'example2' folder
-label2:
-- changed-files: example2/*
-
-# Add label3 to any change to .txt files within the entire repository. Quotation marks are required for the leading asterisk
-label3:
-- changed-files: '**/*.txt'
-
-# Add 'label4' to any PR where the head branch name starts with 'example4'
-label4:
-- head-branch: '^example4'
-
-# Add 'label5' to any PR where the base branch name starts with 'example5'
-label5:
-- base-branch: '^example5'
-```
-
-#### Common Examples
-
-```yml
-# Add 'repo' label to any root file changes
-repo:
-- changed-files: '*'
-
-# Add '@domain/core' label to any change within the 'core' package
-'@domain/core':
+# Add 'root' label to any root file changes
+# Quotation marks are required for the leading asterisk
+root:
 - changed-files:
-  - package/core/*
-  - package/core/**/*
+  - any-glob-to-any-file: '*'
 
-# Add 'test' label to any change to *.spec.js files within the source dir
-test:
-- changed-files: src/**/*.spec.js
+# Add 'AnyChange' label to any changes within the entire repository
+AnyChange:
+- changed-files:
+  - any-glob-to-any-file: '**'
+
+# Add 'Documentation' label to any changes within 'docs' folder or any subfolders
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: docs/**
+
+# Add 'Documentation' label to any file changes within 'docs' folder
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: docs/*
+
+# Add 'Documentation' label to any file changes within 'docs' or 'guides' folders
+Documentation:
+- changed-files:
+  - any-glob-to-any-file:
+    - docs/*
+    - guides/*
+
+## Equivalent of the above mentioned configuration using another syntax
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: ['docs/*', 'guides/*']
+
+# Add 'Documentation' label to any change to .md files within the entire repository 
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: '**/*.md'
 
 # Add 'source' label to any change to src files within the source dir EXCEPT for the docs sub-folder
 source:
-- changed-files:
-  - any: ['src/**/*', '!src/docs/*']
-
-# Add 'frontend` label to any change to *.js files as long as the `main.js` hasn't changed
-frontend:
-- any:
-  - changed-files: ['src/**/*.js']
 - all:
-  - changed-files: ['!src/main.js']
+  - changed-files:
+    - any-glob-to-any-file: 'src/**/*'
+    - all-globs-to-all-files: '!src/docs/*'
 
- # Add 'feature' label to any PR where the head branch name starts with `feature` or has a `feature` section in the name
+# Add 'feature' label to any PR where the head branch name starts with `feature` or has a `feature` section in the name
 feature:
  - head-branch: ['^feature', 'feature']
 
- # Add 'release' label to any PR that is opened against the `main` branch
+# Add 'release' label to any PR that is opened against the `main` branch
 release:
  - base-branch: 'main'
 ```
 
 ### Create Workflow
 
-Create a workflow (eg: `.github/workflows/labeler.yml` see [Creating a Workflow file](https://help.github.com/en/articles/configuring-a-workflow#creating-a-workflow-file)) to utilize the labeler action with content:
+Create a workflow (e.g. `.github/workflows/labeler.yml` see [Creating a Workflow file](https://docs.github.com/en/actions/writing-workflows/quickstart#creating-your-first-workflow)) to utilize the labeler action with content:
 
 ```yml
 name: "Pull Request Labeler"
@@ -129,25 +163,160 @@ on:
 - pull_request_target
 
 jobs:
-  triage:
+  labeler:
     permissions:
       contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@v6
 ```
 
 #### Inputs
 
 Various inputs are defined in [`action.yml`](action.yml) to let you configure the labeler:
 
-| Name | Description | Default |
-| - | - | - |
-| `repo-token` | Token to use to authorize label changes. Typically the GITHUB_TOKEN secret, with `contents:read` and `pull-requests:write` access | `github.token` |
-| `configuration-path` | The path to the label configuration file | `.github/labeler.yml` |
-| `sync-labels` | Whether or not to remove labels when matching files are reverted or no longer changed by the PR | `false`|
+| Name                 | Description                                                                                                                                                              | Default               |
+|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------|
+| `repo-token`         | Token to use to authorize label changes. Typically the GITHUB_TOKEN secret                                                                                               | `github.token`        |
+| `configuration-path` | The path to the label configuration file. If the file doesn't exist at the specified path on the runner, action will read from the source repository via the Github API. | `.github/labeler.yml` |
+| `sync-labels`        | Whether or not to remove labels when matching files are reverted or no longer changed by the PR                                                                          | `false`               |
+| `dot`                | Whether or not to auto-include paths starting with dot (e.g. `.github`)                                                                                                  | `true`               |
+| `pr-number`          | The number(s) of pull request to update, rather than detecting from the workflow context                                                                                 | N/A                   |
 
-# Contributions
+##### Using `configuration-path` input together with the `@actions/checkout` action
+You might want to use action called [@actions/checkout](https://github.com/actions/checkout) to upload label configuration file onto the runner from the current or any other repositories. See usage example below:
 
-Contributions are welcome! See the [Contributor's Guide](CONTRIBUTING.md).
+```yml
+    steps:
+    - uses: actions/checkout@v5 # Uploads repository content to the runner
+      with:
+        repository: "owner/repositoryName" # The one of the available inputs, visit https://github.com/actions/checkout#readme to find more
+    - uses: actions/labeler@v6
+      with:
+        configuration-path: 'path/to/the/uploaded/configuration/file'
+
+```
+
+##### Example workflow specifying pull request numbers
+
+```yml
+name: "Label Previous Pull Requests"
+on:
+  schedule:
+    - cron: "0 1 * * 1"
+
+jobs:
+  labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    
+    # Label PRs 1, 2, and 3
+    - uses: actions/labeler@v6
+      with:        
+        pr-number: |
+          1
+          2
+          3
+```
+
+**Note:** in normal usage the `pr-number` input is not required as the action will detect the PR number from the workflow context.
+
+#### Outputs 
+
+Labeler provides the following outputs:  
+
+| Name         | Description                                               |
+|--------------|-----------------------------------------------------------|
+| `new-labels` | A comma-separated list of all new labels                  |
+| `all-labels` | A comma-separated list of all labels that the PR contains |
+
+The following example performs steps based on the output of labeler:
+```yml
+name: "Pull Request Labeler"
+on:
+- pull_request_target
+
+jobs:
+  labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    - id: label-the-PR
+      uses: actions/labeler@v6
+      
+    - id: run-frontend-tests
+      if: contains(steps.label-the-PR.outputs.all-labels, 'frontend')
+      run: |
+        echo "Running frontend tests..."
+        # Put your commands for running frontend tests here
+  
+    - id: run-backend-tests
+      if: contains(steps.label-the-PR.outputs.all-labels, 'backend')
+      run: |
+        echo "Running backend tests..."
+        # Put your commands for running backend tests here
+```
+
+## Recommended Permissions
+
+To successfully add labels to pull requests using the GitHub Labeler Action, specific permissions must be granted based on your use case:
+
+1. **Adding Existing Labels**:
+   - Requires: `pull-requests: write`
+   - Use this if all labels already exist in the repository (i.e., pre-defined in `.github/labeler.yml`).
+
+2. **Creating New Labels**:
+   - Requires: `issues: write`
+   - This is necessary if the action needs to create labels that do not already exist in the repository.
+
+However, when the action runs on a pull request from a forked repository, GitHub only grants read access tokens for `pull_request` events, at most. If you encounter an `Error: HttpError: Resource not accessible by integration`, it's likely due to these permission constraints. To resolve this issue, you can modify the `on:` section of your workflow to use
+[`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) instead of `pull_request` (see example [above](#create-workflow)). This change allows the action to have write access, because `pull_request_target` alters the [context of the action](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) and safely grants additional permissions.
+
+There exists a potentially dangerous misuse of the `pull_request_target` workflow trigger that may lead to malicious PR authors (i.e. attackers) being able to obtain repository write permissions or stealing repository secrets. Hence, it is advisable that `pull_request_target` should only be used in workflows that are carefully designed to avoid executing untrusted code and to also ensure that workflows using `pull_request_target` limit access to sensitive resources. Refer to the [GitHub token permissions documentation](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) for more details about access levels and event contexts.
+
+### Example Workflow Permissions
+
+To ensure the action works correctly, include the following permissions in your workflow file:
+
+```yml
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+```
+
+### Manual Label Creation as an Alternative to Granting issues write Permission 
+
+If you prefer not to grant the `issues: write` permission in your workflow, you can manually create all required labels in the repository before the action runs.
+
+## Notes regarding `pull_request_target` event
+
+Using the `pull_request_target` event trigger involves several peculiarities related to initial set up of the labeler or updating version of the labeler.
+
+### Initial set up of the labeler action
+
+When submitting an initial pull request to a repository using the `pull_request_target` event, the labeler workflow will not run on that pull request because the `pull_request_target` execution runs off the base branch instead of the pull request's branch. Unfortunately this means the introduction of the labeler can not be verified during that pull request and it needs to be committed blindly.
+
+### Updating major version of the labeler
+
+When submitting a pull request that includes updates of the labeler action version and associated configuration files, using the `pull_request_target` event may result in a failed workflow. This is due to the nature of `pull_request_target`, which uses the code from the base branch rather than the branch linked to the pull request — so, potentially outdated configuration files may not be compatible with the updated labeler action.
+
+To prevent this issue, you can switch to using the `pull_request` event temporarily, before merging. This event execution draws from the code within the branch of your pull request, allowing you to verify the new configuration's compatibility with the updated labeler action.
+
+```yml
+name: "Pull Request Labeler"
+on:
+- pull_request
+```
+
+Once you confirm that the updated configuration files function as intended, you can then revert to using the `pull_request_target` event before merging the pull request. Following this step ensures that your workflow is robust and free from disruptions.
+
+## Contributions
+
+Contributions are welcome! See the [Contributor's Guide](CONTRIBUTING.md).

__mocks__/@actions/github.ts

@@ -19,11 +19,14 @@ export const context = {
 const mockApi = {
   rest: {
     issues: {
-      addLabels: jest.fn(),
-      removeLabel: jest.fn()
+      setLabels: jest.fn()
     },
     pulls: {
-      get: jest.fn().mockResolvedValue({}),
+      get: jest.fn().mockResolvedValue({
+        data: {
+          labels: []
+        }
+      }),
       listFiles: {
         endpoint: {
           merge: jest.fn().mockReturnValue({})

__tests__/changedFiles.test.ts

@@ -2,7 +2,11 @@ import {
   ChangedFilesMatchConfig,
   checkAllChangedFiles,
   checkAnyChangedFiles,
-  toChangedFilesMatchConfig
+  toChangedFilesMatchConfig,
+  checkIfAnyGlobMatchesAnyFile,
+  checkIfAllGlobsMatchAnyFile,
+  checkIfAnyGlobMatchesAllFiles,
+  checkIfAllGlobsMatchAllFiles
 } from '../src/changedFiles';
 
 jest.mock('@actions/core');
@@ -11,20 +15,36 @@ jest.mock('@actions/github');
 describe('checkAllChangedFiles', () => {
   const changedFiles = ['foo.txt', 'bar.txt'];
 
-  describe('when the globs match every file that has been changed', () => {
-    const globs = ['*.txt'];
+  describe('when all given glob pattern configs matched', () => {
+    const globPatternsConfigs = [
+      {anyGlobToAnyFile: ['foo.txt']},
+      {anyGlobToAllFiles: ['*.txt']},
+      {allGlobsToAllFiles: ['**']}
+    ];
 
     it('returns true', () => {
-      const result = checkAllChangedFiles(changedFiles, globs);
+      const result = checkAllChangedFiles(
+        changedFiles,
+        globPatternsConfigs,
+        false
+      );
       expect(result).toBe(true);
     });
   });
 
-  describe(`when the globs don't match every file that has changed`, () => {
-    const globs = ['foo.txt'];
+  describe(`when some given glob pattern config did not match`, () => {
+    const globPatternsConfigs = [
+      {anyGlobToAnyFile: ['*.md']},
+      {anyGlobToAllFiles: ['*.txt']},
+      {allGlobsToAllFiles: ['**']}
+    ];
 
     it('returns false', () => {
-      const result = checkAllChangedFiles(changedFiles, globs);
+      const result = checkAllChangedFiles(
+        changedFiles,
+        globPatternsConfigs,
+        false
+      );
       expect(result).toBe(false);
     });
   });
@@ -33,20 +53,34 @@ describe('checkAllChangedFiles', () => {
 describe('checkAnyChangedFiles', () => {
   const changedFiles = ['foo.txt', 'bar.txt'];
 
-  describe('when any glob matches any of the files that have changed', () => {
-    const globs = ['*.txt', '*.md'];
+  describe('when any given glob pattern config matched', () => {
+    const globPatternsConfigs = [
+      {anyGlobToAnyFile: ['*.md']},
+      {anyGlobToAllFiles: ['*.txt']}
+    ];
 
     it('returns true', () => {
-      const result = checkAnyChangedFiles(changedFiles, globs);
+      const result = checkAnyChangedFiles(
+        changedFiles,
+        globPatternsConfigs,
+        false
+      );
       expect(result).toBe(true);
     });
   });
 
-  describe('when none of the globs match any files that have changed', () => {
-    const globs = ['*.md'];
+  describe('when none of the given glob pattern configs matched', () => {
+    const globPatternsConfigs = [
+      {anyGlobToAnyFile: ['*.md']},
+      {anyGlobToAllFiles: ['!*.txt']}
+    ];
 
     it('returns false', () => {
-      const result = checkAnyChangedFiles(changedFiles, globs);
+      const result = checkAnyChangedFiles(
+        changedFiles,
+        globPatternsConfigs,
+        false
+      );
       expect(result).toBe(false);
     });
   });
@@ -63,44 +97,174 @@ describe('toChangedFilesMatchConfig', () => {
   });
 
   describe(`when there is a 'changed-files' key in the config`, () => {
-    describe('and the value is an array of strings', () => {
-      const config = {'changed-files': ['testing']};
+    describe('but the glob pattern config key is not provided', () => {
+      const config = {'changed-files': ['bar']};
 
-      it('sets the value in the config object', () => {
-        const result = toChangedFilesMatchConfig(config);
-        expect(result).toEqual<ChangedFilesMatchConfig>({
-          changedFiles: ['testing']
+      it('throws the error', () => {
+        expect(() => {
+          toChangedFilesMatchConfig(config);
+        }).toThrow(
+          `The "changed-files" section must have a valid config structure. Please read the action documentation for more information`
+        );
+      });
+    });
+
+    describe('but the glob pattern config key is not valid', () => {
+      const config = {'changed-files': [{NotValidConfigKey: ['bar']}]};
+
+      it('throws the error', () => {
+        expect(() => {
+          toChangedFilesMatchConfig(config);
+        }).toThrow(
+          `Unknown config options were under "changed-files": NotValidConfigKey`
+        );
+      });
+    });
+
+    describe('and the glob pattern config key is provided', () => {
+      describe('and the value is an array of strings', () => {
+        const config = {
+          'changed-files': [{'any-glob-to-any-file': ['testing']}]
+        };
+
+        it('sets the value in the config object', () => {
+          const result = toChangedFilesMatchConfig(config);
+          expect(result).toEqual<ChangedFilesMatchConfig>({
+            changedFiles: [{anyGlobToAnyFile: ['testing']}]
+          });
         });
       });
-    });
 
-    describe('and the value is a string', () => {
-      const config = {'changed-files': 'testing'};
+      describe('and the value is a string', () => {
+        const config = {'changed-files': [{'any-glob-to-any-file': 'testing'}]};
 
-      it(`sets the string as an array in the config object`, () => {
-        const result = toChangedFilesMatchConfig(config);
-        expect(result).toEqual<ChangedFilesMatchConfig>({
-          changedFiles: ['testing']
+        it(`sets the string as an array in the config object`, () => {
+          const result = toChangedFilesMatchConfig(config);
+          expect(result).toEqual<ChangedFilesMatchConfig>({
+            changedFiles: [{anyGlobToAnyFile: ['testing']}]
+          });
         });
       });
     });
-
-    describe('but the value is an empty string', () => {
-      const config = {'changed-files': ''};
-
-      it(`returns an empty object`, () => {
-        const result = toChangedFilesMatchConfig(config);
-        expect(result).toEqual<ChangedFilesMatchConfig>({});
-      });
-    });
-
-    describe('but the value is an empty array', () => {
-      const config = {'changed-files': []};
-
-      it(`returns an empty object`, () => {
-        const result = toChangedFilesMatchConfig(config);
-        expect(result).toEqual<ChangedFilesMatchConfig>({});
-      });
-    });
+  });
+});
+
+describe('checkIfAnyGlobMatchesAnyFile', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when any given glob pattern matched any file', () => {
+    const globPatterns = ['*.md', 'foo.txt'];
+
+    it('returns true', () => {
+      const result = checkIfAnyGlobMatchesAnyFile(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('when none of the given glob pattern matched any file', () => {
+    const globPatterns = ['*.md', '!*.txt'];
+
+    it('returns false', () => {
+      const result = checkIfAnyGlobMatchesAnyFile(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(false);
+    });
+  });
+});
+
+describe('checkIfAllGlobsMatchAnyFile', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when all given glob patterns matched any file', () => {
+    const globPatterns = ['**/bar.txt', 'bar.txt'];
+
+    it('returns true', () => {
+      const result = checkIfAllGlobsMatchAnyFile(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('when some of the given glob patterns did not match any file', () => {
+    const globPatterns = ['*.txt', '*.md'];
+
+    it('returns false', () => {
+      const result = checkIfAllGlobsMatchAnyFile(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(false);
+    });
+  });
+});
+
+describe('checkIfAnyGlobMatchesAllFiles', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when any given glob pattern matched all files', () => {
+    const globPatterns = ['*.md', '*.txt'];
+
+    it('returns true', () => {
+      const result = checkIfAnyGlobMatchesAllFiles(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('when none of the given glob patterns matched all files', () => {
+    const globPatterns = ['*.md', 'bar.txt', 'foo.txt'];
+
+    it('returns false', () => {
+      const result = checkIfAnyGlobMatchesAllFiles(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(false);
+    });
+  });
+});
+
+describe('checkIfAllGlobsMatchAllFiles', () => {
+  const changedFiles = ['foo.txt', 'bar.txt'];
+
+  describe('when all given glob patterns matched all files', () => {
+    const globPatterns = ['*.txt', '**'];
+
+    it('returns true', () => {
+      const result = checkIfAllGlobsMatchAllFiles(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('when some of the given glob patterns did not match all files', () => {
+    const globPatterns = ['**', 'foo.txt'];
+
+    it('returns false', () => {
+      const result = checkIfAllGlobsMatchAllFiles(
+        changedFiles,
+        globPatterns,
+        false
+      );
+      expect(result).toBe(false);
+    });
   });
 });

__tests__/fixtures/all_options.yml

@@ -1,14 +1,17 @@
 label1:
   - any:
-      - changed-files: ['glob']
+      - changed-files:
+          - any-glob-to-any-file: ['glob']
       - head-branch: ['regexp']
       - base-branch: ['regexp']
   - all:
-      - changed-files: ['glob']
+      - changed-files:
+          - all-globs-to-all-files: ['glob']
       - head-branch: ['regexp']
       - base-branch: ['regexp']
 
 label2:
-  - changed-files: ['glob']
+  - changed-files:
+      - any-glob-to-any-file: ['glob']
   - head-branch: ['regexp']
   - base-branch: ['regexp']

__tests__/fixtures/any_and_all.yml

@@ -1,6 +1,8 @@
 tests:
   - any:
       - head-branch: ['^tests/', '^test/']
-      - changed-files: ['tests/**/*']
+      - changed-files:
+          - any-glob-to-any-file: ['tests/**/*']
   - all:
-      - changed-files: ['!tests/requirements.txt']
+      - changed-files:
+          - all-globs-to-all-files: ['!tests/requirements.txt']

__tests__/fixtures/only_pdfs.yml

@@ -1,2 +1,3 @@
 touched-a-pdf-file:
-  - changed-files: ['*.pdf']
+  - changed-files:
+      - any-glob-to-any-file: ['*.pdf']

__tests__/labeler.test.ts

@@ -1,15 +1,19 @@
+import * as yaml from 'js-yaml';
+import * as core from '@actions/core';
+import * as api from '../src/api';
+import {labeler} from '../src/labeler';
+import * as github from '@actions/github';
+import * as fs from 'fs';
+import {checkMatchConfigs} from '../src/labeler';
 import {
-  checkMatchConfigs,
   MatchConfig,
   toMatchConfig,
   getLabelConfigMapFromObject,
   BaseMatchConfig
-} from '../src/labeler';
-import * as yaml from 'js-yaml';
-import * as core from '@actions/core';
-import * as fs from 'fs';
+} from '../src/api/get-label-configs';
 
 jest.mock('@actions/core');
+jest.mock('../src/api');
 
 beforeAll(() => {
   jest.spyOn(core, 'getInput').mockImplementation((name, options) => {
@@ -29,14 +33,14 @@ describe('getLabelConfigMapFromObject', () => {
   expected.set('label1', [
     {
       any: [
-        {changedFiles: ['glob']},
+        {changedFiles: [{anyGlobToAnyFile: ['glob']}]},
         {baseBranch: undefined, headBranch: ['regexp']},
         {baseBranch: ['regexp'], headBranch: undefined}
       ]
     },
     {
       all: [
-        {changedFiles: ['glob']},
+        {changedFiles: [{allGlobsToAllFiles: ['glob']}]},
         {baseBranch: undefined, headBranch: ['regexp']},
         {baseBranch: ['regexp'], headBranch: undefined}
       ]
@@ -45,7 +49,7 @@ describe('getLabelConfigMapFromObject', () => {
   expected.set('label2', [
     {
       any: [
-        {changedFiles: ['glob']},
+        {changedFiles: [{anyGlobToAnyFile: ['glob']}]},
         {baseBranch: undefined, headBranch: ['regexp']},
         {baseBranch: ['regexp'], headBranch: undefined}
       ]
@@ -61,12 +65,12 @@ describe('getLabelConfigMapFromObject', () => {
 describe('toMatchConfig', () => {
   describe('when all expected config options are present', () => {
     const config = {
-      'changed-files': ['testing-files'],
+      'changed-files': [{'any-glob-to-any-file': ['testing-files']}],
       'head-branch': ['testing-head'],
       'base-branch': ['testing-base']
     };
     const expected: BaseMatchConfig = {
-      changedFiles: ['testing-files'],
+      changedFiles: [{anyGlobToAnyFile: ['testing-files']}],
       headBranch: ['testing-head'],
       baseBranch: ['testing-base']
     };
@@ -89,52 +93,143 @@ describe('toMatchConfig', () => {
 
 describe('checkMatchConfigs', () => {
   describe('when a single match config is provided', () => {
-    const matchConfig: MatchConfig[] = [{any: [{changedFiles: ['*.txt']}]}];
+    const matchConfig: MatchConfig[] = [
+      {any: [{changedFiles: [{anyGlobToAnyFile: ['*.txt']}]}]}
+    ];
 
     it('returns true when our pattern does match changed files', () => {
       const changedFiles = ['foo.txt', 'bar.txt'];
-      const result = checkMatchConfigs(changedFiles, matchConfig);
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
 
       expect(result).toBeTruthy();
     });
 
     it('returns false when our pattern does not match changed files', () => {
       const changedFiles = ['foo.docx'];
-      const result = checkMatchConfigs(changedFiles, matchConfig);
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
 
       expect(result).toBeFalsy();
     });
 
     it('returns true when either the branch or changed files patter matches', () => {
       const matchConfig: MatchConfig[] = [
-        {any: [{changedFiles: ['*.txt']}, {headBranch: ['some-branch']}]}
+        {
+          any: [
+            {changedFiles: [{anyGlobToAnyFile: ['*.txt']}]},
+            {headBranch: ['some-branch']}
+          ]
+        }
       ];
       const changedFiles = ['foo.txt', 'bar.txt'];
 
-      const result = checkMatchConfigs(changedFiles, matchConfig);
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
       expect(result).toBe(true);
     });
+
+    it('returns false for a file starting with dot if `dot` option is false', () => {
+      const changedFiles = ['.foo.txt'];
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
+
+      expect(result).toBeFalsy();
+    });
+
+    it('returns true for a file starting with dot if `dot` option is true', () => {
+      const changedFiles = ['.foo.txt'];
+      const result = checkMatchConfigs(changedFiles, matchConfig, true);
+
+      expect(result).toBeTruthy();
+    });
   });
 
   describe('when multiple MatchConfigs are supplied', () => {
     const matchConfig: MatchConfig[] = [
-      {any: [{changedFiles: ['*.txt']}]},
+      {any: [{changedFiles: [{anyGlobToAnyFile: ['*.txt']}]}]},
       {any: [{headBranch: ['some-branch']}]}
     ];
     const changedFiles = ['foo.txt', 'bar.md'];
 
     it('returns false when only one config matches', () => {
-      const result = checkMatchConfigs(changedFiles, matchConfig);
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
       expect(result).toBe(false);
     });
 
     it('returns true when only both config matches', () => {
       const matchConfig: MatchConfig[] = [
-        {any: [{changedFiles: ['*.txt']}]},
+        {any: [{changedFiles: [{anyGlobToAnyFile: ['*.txt']}]}]},
         {any: [{headBranch: ['head-branch']}]}
       ];
-      const result = checkMatchConfigs(changedFiles, matchConfig);
+      const result = checkMatchConfigs(changedFiles, matchConfig, false);
       expect(result).toBe(true);
     });
   });
 });
+
+describe('labeler error handling', () => {
+  const mockClient = {} as any;
+  const mockPullRequest = {
+    number: 123,
+    data: {labels: []},
+    changedFiles: []
+  };
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+
+    (github.getOctokit as jest.Mock).mockReturnValue(mockClient);
+    (api.getPullRequests as jest.Mock).mockReturnValue([
+      {
+        ...mockPullRequest,
+        data: {labels: [{name: 'old-label'}]}
+      }
+    ]);
+
+    (api.getLabelConfigs as jest.Mock).mockResolvedValue(
+      new Map([['new-label', ['dummy-config']]])
+    );
+
+    // Force match so "new-label" is always added
+    jest.spyOn({checkMatchConfigs}, 'checkMatchConfigs').mockReturnValue(true);
+  });
+
+  it('throws a custom error for HttpError 403 with "unauthorized" message', async () => {
+    (api.setLabels as jest.Mock).mockRejectedValue({
+      name: 'HttpError',
+      status: 403,
+      message: 'Request failed with status code 403: Unauthorized'
+    });
+
+    await expect(labeler()).rejects.toThrow(
+      /does not have permission to create labels/
+    );
+  });
+
+  it('rethrows unexpected HttpError', async () => {
+    const unexpectedError = {
+      name: 'HttpError',
+      status: 404,
+      message: 'Not Found'
+    };
+    (api.setLabels as jest.Mock).mockRejectedValue(unexpectedError);
+
+    // NOTE: In the current implementation, labeler rethrows the raw error object (not an Error instance).
+    // `rejects.toThrow` only works with real Error objects, so here we must use `rejects.toEqual`.
+    // If labeler is updated to always wrap errors in `Error`, this test can be changed to use `rejects.toThrow`.
+    await expect(labeler()).rejects.toEqual(unexpectedError);
+  });
+
+  it('handles "Resource not accessible by integration" gracefully', async () => {
+    const error = {
+      name: 'HttpError',
+      message: 'Resource not accessible by integration'
+    };
+    (api.setLabels as jest.Mock).mockRejectedValue(error);
+
+    await labeler();
+
+    expect(core.warning).toHaveBeenCalledWith(
+      expect.stringContaining("requires 'issues: write'"),
+      expect.any(Object)
+    );
+    expect(core.setFailed).toHaveBeenCalledWith(error.message);
+  });
+});

__tests__/main.test.ts

@@ -1,18 +1,37 @@
 import {run} from '../src/labeler';
 import * as github from '@actions/github';
 import * as core from '@actions/core';
-
-const fs = jest.requireActual('fs');
+import path from 'path';
+import fs from 'fs';
 
 jest.mock('@actions/core');
 jest.mock('@actions/github');
 
 const gh = github.getOctokit('_');
-const addLabelsMock = jest.spyOn(gh.rest.issues, 'addLabels');
-const removeLabelMock = jest.spyOn(gh.rest.issues, 'removeLabel');
+const setLabelsMock = jest.spyOn(gh.rest.issues, 'setLabels');
 const reposMock = jest.spyOn(gh.rest.repos, 'getContent');
 const paginateMock = jest.spyOn(gh, 'paginate');
 const getPullMock = jest.spyOn(gh.rest.pulls, 'get');
+const readFileSyncMock = jest.spyOn(fs, 'readFileSync');
+const existsSyncMock = jest.spyOn(fs, 'existsSync');
+const coreErrorMock = jest.spyOn(core, 'error');
+const coreWarningMock = jest.spyOn(core, 'warning');
+const coreSetFailedMock = jest.spyOn(core, 'setFailed');
+const setOutputSpy = jest.spyOn(core, 'setOutput');
+
+class HttpError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'HttpError';
+  }
+}
+
+class NotFound extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'NotFound';
+  }
+}
 
 const yamlFixtures = {
   'branches.yml': fs.readFileSync('__tests__/fixtures/branches.yml'),
@@ -21,189 +40,460 @@ const yamlFixtures = {
   'any_and_all.yml': fs.readFileSync('__tests__/fixtures/any_and_all.yml')
 };
 
+const configureInput = (
+  mockInput: Partial<{
+    'repo-token': string;
+    'configuration-path': string;
+    'sync-labels': boolean;
+    dot: boolean;
+    'pr-number': string[];
+  }>
+) => {
+  jest
+    .spyOn(core, 'getInput')
+    .mockImplementation((name: string, ...opts) => mockInput[name]);
+  jest
+    .spyOn(core, 'getMultilineInput')
+    .mockImplementation((name: string, ...opts) => mockInput[name]);
+  jest
+    .spyOn(core, 'getBooleanInput')
+    .mockImplementation((name: string, ...opts) => mockInput[name]);
+};
+
 afterAll(() => jest.restoreAllMocks());
 
 describe('run', () => {
-  it('adds labels to PRs that match our glob patterns', async () => {
+  it('(with dot: false) adds labels to PRs that match our glob patterns', async () => {
+    configureInput({});
     usingLabelerConfigYaml('only_pdfs.yml');
     mockGitHubResponseChangedFiles('foo.pdf');
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: []
+      }
+    });
 
     await run();
 
-    expect(removeLabelMock).toHaveBeenCalledTimes(0);
-    expect(addLabelsMock).toHaveBeenCalledTimes(1);
-    expect(addLabelsMock).toHaveBeenCalledWith({
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+
+    expect(setLabelsMock).toHaveBeenCalledWith({
       owner: 'monalisa',
       repo: 'helloworld',
       issue_number: 123,
       labels: ['touched-a-pdf-file']
     });
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'touched-a-pdf-file'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'touched-a-pdf-file'
+    );
   });
 
-  it('does not add labels to PRs that do not match our glob patterns', async () => {
+  it('(with dot: true) adds labels to PRs that match our glob patterns', async () => {
+    configureInput({dot: true});
     usingLabelerConfigYaml('only_pdfs.yml');
-    mockGitHubResponseChangedFiles('foo.txt');
-
-    await run();
-
-    expect(removeLabelMock).toHaveBeenCalledTimes(0);
-    expect(addLabelsMock).toHaveBeenCalledTimes(0);
-  });
-
-  it('does not add a label when the match config options are not supported', async () => {
-    usingLabelerConfigYaml('not_supported.yml');
-    await run();
-
-    expect(addLabelsMock).toHaveBeenCalledTimes(0);
-    expect(removeLabelMock).toHaveBeenCalledTimes(0);
-  });
-
-  it('(with sync-labels: true) it deletes preexisting PR labels that no longer match the glob pattern', async () => {
-    const mockInput = {
-      'repo-token': 'foo',
-      'configuration-path': 'bar',
-      'sync-labels': 'true'
-    };
-
-    jest
-      .spyOn(core, 'getInput')
-      .mockImplementation((name: string, ...opts) => mockInput[name]);
-    jest
-      .spyOn(core, 'getBooleanInput')
-      .mockImplementation(
-        (name: string, ...opts) => mockInput[name] === 'true'
-      );
-
-    usingLabelerConfigYaml('only_pdfs.yml');
-    mockGitHubResponseChangedFiles('foo.txt');
+    mockGitHubResponseChangedFiles('.foo.pdf');
     getPullMock.mockResolvedValue(<any>{
       data: {
-        labels: [{name: 'touched-a-pdf-file'}]
+        labels: []
       }
     });
 
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(0);
-    expect(removeLabelMock).toHaveBeenCalledTimes(1);
-    expect(removeLabelMock).toHaveBeenCalledWith({
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
       owner: 'monalisa',
       repo: 'helloworld',
       issue_number: 123,
-      name: 'touched-a-pdf-file'
+      labels: ['touched-a-pdf-file']
     });
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'touched-a-pdf-file'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'touched-a-pdf-file'
+    );
   });
 
-  it('(with sync-labels: false) it issues no delete calls even when there are preexisting PR labels that no longer match the glob pattern', async () => {
-    const mockInput = {
-      'repo-token': 'foo',
-      'configuration-path': 'bar',
-      'sync-labels': 'false'
-    };
-
-    jest
-      .spyOn(core, 'getInput')
-      .mockImplementation((name: string, ...opts) => mockInput[name]);
-    jest
-      .spyOn(core, 'getBooleanInput')
-      .mockImplementation(
-        (name: string, ...opts) => mockInput[name] === 'true'
-      );
-
+  it('(with dot: false) does not add labels to PRs that do not match our glob patterns', async () => {
+    configureInput({});
     usingLabelerConfigYaml('only_pdfs.yml');
-    mockGitHubResponseChangedFiles('foo.txt');
+    mockGitHubResponseChangedFiles('.foo.pdf');
     getPullMock.mockResolvedValue(<any>{
       data: {
-        labels: [{name: 'touched-a-pdf-file'}]
+        labels: []
       }
     });
 
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(0);
-    expect(removeLabelMock).toHaveBeenCalledTimes(0);
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', '');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', '');
+  });
+
+  it('(with dot: true) does not add labels to PRs that do not match our glob patterns', async () => {
+    configureInput({dot: true});
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.txt');
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+  });
+
+  it('does not add a label when the match config options are not supported', async () => {
+    configureInput({});
+    usingLabelerConfigYaml('not_supported.yml');
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
   });
 
   it('adds labels based on the branch names that match the regexp pattern', async () => {
+    configureInput({});
     github.context.payload.pull_request!.head = {ref: 'test/testing-time'};
     usingLabelerConfigYaml('branches.yml');
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(1);
-    expect(addLabelsMock).toHaveBeenCalledWith({
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
       owner: 'monalisa',
       repo: 'helloworld',
       issue_number: 123,
       labels: ['test-branch']
     });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', 'test-branch');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'test-branch');
   });
 
   it('adds multiple labels based on branch names that match different regexp patterns', async () => {
+    configureInput({});
     github.context.payload.pull_request!.head = {
       ref: 'test/feature/123'
     };
     usingLabelerConfigYaml('branches.yml');
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(1);
-    expect(addLabelsMock).toHaveBeenCalledWith({
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
       owner: 'monalisa',
       repo: 'helloworld',
       issue_number: 123,
       labels: ['test-branch', 'feature-branch']
     });
+
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'test-branch,feature-branch'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'test-branch,feature-branch'
+    );
   });
 
   it('can support multiple branches by batching', async () => {
+    configureInput({});
     github.context.payload.pull_request!.head = {ref: 'fix/123'};
     usingLabelerConfigYaml('branches.yml');
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(1);
-    expect(addLabelsMock).toHaveBeenCalledWith({
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
       owner: 'monalisa',
       repo: 'helloworld',
       issue_number: 123,
       labels: ['bug-branch']
     });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', 'bug-branch');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'bug-branch');
   });
 
   it('can support multiple branches by providing an array', async () => {
+    configureInput({});
     github.context.payload.pull_request!.head = {ref: 'array/123'};
     usingLabelerConfigYaml('branches.yml');
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(1);
-    expect(addLabelsMock).toHaveBeenCalledWith({
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
       owner: 'monalisa',
       repo: 'helloworld',
       issue_number: 123,
       labels: ['array-branch']
     });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', 'array-branch');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'array-branch');
   });
 
   it('adds a label when matching any and all patterns are provided', async () => {
+    configureInput({});
     usingLabelerConfigYaml('any_and_all.yml');
     mockGitHubResponseChangedFiles('tests/test.ts');
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(1);
-    expect(addLabelsMock).toHaveBeenCalledWith({
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
       owner: 'monalisa',
       repo: 'helloworld',
       issue_number: 123,
       labels: ['tests']
     });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', 'tests');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'tests');
   });
 
   it('does not add a label when not all any and all patterns are matched', async () => {
+    configureInput({});
     usingLabelerConfigYaml('any_and_all.yml');
     mockGitHubResponseChangedFiles('tests/requirements.txt');
     await run();
 
-    expect(addLabelsMock).toHaveBeenCalledTimes(0);
-    expect(removeLabelMock).toHaveBeenCalledTimes(0);
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
   });
+
+  it('(with sync-labels: true) it deletes preexisting PR labels that no longer match the glob pattern', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'sync-labels': true
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.txt');
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: [{name: 'touched-a-pdf-file'}, {name: 'manually-added'}]
+      }
+    });
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 123,
+      labels: ['manually-added']
+    });
+
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', '');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', 'manually-added');
+  });
+
+  it('(with sync-labels: false) it issues no delete calls even when there are preexisting PR labels that no longer match the glob pattern', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'sync-labels': false
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.txt');
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: [{name: 'touched-a-pdf-file'}, {name: 'manually-added'}]
+      }
+    });
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', '');
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'touched-a-pdf-file,manually-added'
+    );
+  });
+
+  it('(with sync-labels: false) it only logs the excess labels', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'sync-labels': false
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.pdf');
+
+    const existingLabels = Array.from({length: 100}).map((_, idx) => ({
+      name: `existing-label-${idx}`
+    }));
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: existingLabels
+      }
+    });
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+
+    expect(coreWarningMock).toHaveBeenCalledTimes(1);
+    expect(coreWarningMock).toHaveBeenCalledWith(
+      'Maximum of 100 labels allowed. Excess labels: touched-a-pdf-file',
+      {title: 'Label limit for a PR exceeded'}
+    );
+    const allLabels: string = existingLabels.map(i => i.name).join(',');
+    expect(setOutputSpy).toHaveBeenCalledWith('new-labels', '');
+    expect(setOutputSpy).toHaveBeenCalledWith('all-labels', allLabels);
+  });
+
+  it('(with pr-number: array of one item, uses the PR number specified in the parameters', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'pr-number': ['104']
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.pdf');
+
+    getPullMock.mockResolvedValue(<any>{
+      data: {
+        labels: [{name: 'manually-added'}]
+      }
+    });
+
+    await run();
+    expect(setLabelsMock).toHaveBeenCalledTimes(1);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 104,
+      labels: ['manually-added', 'touched-a-pdf-file']
+    });
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'touched-a-pdf-file'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'manually-added,touched-a-pdf-file'
+    );
+  });
+
+  it('(with pr-number: array of two items, uses the PR number specified in the parameters', async () => {
+    configureInput({
+      'repo-token': 'foo',
+      'configuration-path': 'bar',
+      'pr-number': ['104', '150']
+    });
+
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles('foo.pdf');
+
+    getPullMock.mockResolvedValueOnce(<any>{
+      data: {
+        labels: [{name: 'manually-added'}]
+      }
+    });
+
+    getPullMock.mockResolvedValueOnce(<any>{
+      data: {
+        labels: []
+      }
+    });
+
+    await run();
+    expect(setLabelsMock).toHaveBeenCalledTimes(2);
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 104,
+      labels: ['manually-added', 'touched-a-pdf-file']
+    });
+    expect(setLabelsMock).toHaveBeenCalledWith({
+      owner: 'monalisa',
+      repo: 'helloworld',
+      issue_number: 150,
+      labels: ['touched-a-pdf-file']
+    });
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'new-labels',
+      'touched-a-pdf-file'
+    );
+    expect(setOutputSpy).toHaveBeenCalledWith(
+      'all-labels',
+      'manually-added,touched-a-pdf-file'
+    );
+  });
+
+  it('does not add labels to PRs that have no changed files', async () => {
+    usingLabelerConfigYaml('only_pdfs.yml');
+    mockGitHubResponseChangedFiles();
+
+    await run();
+
+    expect(setLabelsMock).toHaveBeenCalledTimes(0);
+  });
+
+  it('should use local configuration file if it exists', async () => {
+    const configFile = 'only_pdfs.yml';
+    const configFilePath = path.join(__dirname, 'fixtures', configFile);
+    mockGitHubResponseChangedFiles('foo.pdf');
+    const readFileSyncOptions = {encoding: 'utf8'};
+
+    configureInput({
+      'configuration-path': configFilePath
+    });
+    await run();
+
+    expect(existsSyncMock).toHaveBeenCalledWith(configFilePath);
+    expect(readFileSyncMock).toHaveBeenCalledWith(
+      configFilePath,
+      readFileSyncOptions
+    );
+    expect(reposMock).not.toHaveBeenCalled();
+  });
+
+  it('should fetch configuration file from API if it does not exist locally', async () => {
+    const configFilePath = 'non_existed_path/labeler.yml';
+    mockGitHubResponseChangedFiles('foo.pdf');
+    configureInput({
+      'configuration-path': configFilePath
+    });
+    await run();
+    expect(existsSyncMock).toHaveBeenCalledWith(configFilePath);
+    expect(readFileSyncMock).not.toHaveBeenCalled();
+    expect(reposMock).toHaveBeenCalled();
+  });
+
+  test.each([
+    [new HttpError('Error message')],
+    [new NotFound('Error message')]
+  ])(
+    'should warn if configuration file could not be fetched through the API, log error and fail the action',
+    async error => {
+      const configFilePath = 'non_existed_path/labeler.yml';
+      reposMock.mockImplementation(() => {
+        throw error;
+      });
+      const warningMessage = `The config file was not found at ${configFilePath}. Make sure it exists and that this action has the correct access rights.`;
+      mockGitHubResponseChangedFiles('foo.pdf');
+      configureInput({
+        'configuration-path': configFilePath
+      });
+
+      await run();
+
+      expect(coreWarningMock).toHaveBeenCalledWith(warningMessage);
+      expect(coreErrorMock).toHaveBeenCalledWith(error);
+      expect(coreSetFailedMock).toHaveBeenCalledWith(error.message);
+    }
+  );
 });
 
 function usingLabelerConfigYaml(fixtureName: keyof typeof yamlFixtures): void {

action.yml

@@ -14,7 +14,19 @@ inputs:
     description: 'Whether or not to remove labels when matching files are reverted'
     default: false
     required: false
+  dot:
+    description: 'Whether or not to auto-include paths starting with dot (e.g. `.github`)'
+    default: true
+    required: false
+  pr-number:
+    description: 'The pull request number(s)'
+    required: false
 
+outputs:
+  new-labels:
+    description: 'A comma-separated list of all new labels'
+  all-labels:
+    description: 'A comma-separated list of all labels that the PR contains'
 runs:
-  using: 'node16'
+  using: 'node24'
   main: 'dist/index.js'

package.json

@@ -1,8 +1,11 @@
 {
   "name": "labeler",
-  "version": "4.0.1",
+  "version": "6.0.0",
   "description": "Labels pull requests by files altered",
   "main": "lib/main.js",
+    "engines": {
+    "node": ">=24"
+  },
   "scripts": {
     "build": "tsc && ncc build lib/main.js",
     "format": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write \"**/*.{ts,yml,yaml}\"",
@@ -24,25 +27,30 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@actions/github": "^5.1.1",
+    "@actions/core": "^1.11.1",
+    "@actions/github": "^6.0.0",
+    "@octokit/plugin-retry": "^6.0.0",
     "js-yaml": "^4.1.0",
-    "minimatch": "^7.4.3"
+    "lodash.isequal": "^4.5.0",
+    "minimatch": "^10.0.1"
   },
   "devDependencies": {
-    "@types/jest": "^27.4.1",
-    "@types/js-yaml": "^4.0.5",
+    "@types/jest": "^29.5.14",
+    "@types/js-yaml": "^4.0.9",
+    "@types/lodash.isequal": "^4.5.8",
     "@types/minimatch": "^5.1.2",
-    "@types/node": "^16.11.7",
-    "@typescript-eslint/eslint-plugin": "^5.59.7",
-    "@typescript-eslint/parser": "^5.59.7",
-    "@vercel/ncc": "^0.36.1",
-    "eslint": "^8.41.0",
-    "eslint-config-prettier": "^8.8.0",
-    "eslint-plugin-jest": "^27.2.1",
-    "jest": "^27.5.1",
-    "prettier": "^2.8.8",
-    "ts-jest": "^27.1.3",
-    "typescript": "^4.9.5"
+    "@types/node": "^24.1.0",
+    "@typescript-eslint/eslint-plugin": "^7.3.1",
+    "@typescript-eslint/parser": "^7.18.0",
+    "@vercel/ncc": "^0.38.3",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-jest": "^28.11.0",
+    "eslint-plugin-node": "^11.1.0",
+    "jest": "^29.7.0",
+    "prettier": "^3.4.2",
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.7.3"
+
   }
 }

src/api/get-changed-files.ts

@@ -0,0 +1,24 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+import {ClientType} from './types';
+
+export const getChangedFiles = async (
+  client: ClientType,
+  prNumber: number
+): Promise<string[]> => {
+  const listFilesOptions = client.rest.pulls.listFiles.endpoint.merge({
+    owner: github.context.repo.owner,
+    repo: github.context.repo.repo,
+    pull_number: prNumber
+  });
+
+  const listFilesResponse = await client.paginate(listFilesOptions);
+  const changedFiles = listFilesResponse.map((f: any) => f.filename);
+
+  core.debug('found changed files:');
+  for (const file of changedFiles) {
+    core.debug('  ' + file);
+  }
+
+  return changedFiles;
+};

src/api/get-changed-pull-requests.ts

@@ -0,0 +1,38 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+import {getChangedFiles} from './get-changed-files';
+import {ClientType} from './types';
+
+export async function* getPullRequests(
+  client: ClientType,
+  prNumbers: number[]
+) {
+  for (const prNumber of prNumbers) {
+    core.debug(`looking for pr #${prNumber}`);
+    let prData: any;
+    try {
+      const result = await client.rest.pulls.get({
+        owner: github.context.repo.owner,
+        repo: github.context.repo.repo,
+        pull_number: prNumber
+      });
+      prData = result.data;
+    } catch (error: any) {
+      core.warning(`Could not find pull request #${prNumber}, skipping`);
+      continue;
+    }
+
+    core.debug(`fetching changed files for pr #${prNumber}`);
+    const changedFiles: string[] = await getChangedFiles(client, prNumber);
+    if (!changedFiles.length) {
+      core.warning(`Pull request #${prNumber} has no changed files, skipping`);
+      continue;
+    }
+
+    yield {
+      data: prData,
+      number: prNumber,
+      changedFiles
+    };
+  }
+}

src/api/get-content.ts

@@ -0,0 +1,16 @@
+import * as github from '@actions/github';
+import {ClientType} from './types';
+
+export const getContent = async (
+  client: ClientType,
+  repoPath: string
+): Promise<string> => {
+  const response: any = await client.rest.repos.getContent({
+    owner: github.context.repo.owner,
+    repo: github.context.repo.repo,
+    path: repoPath,
+    ref: github.context.sha
+  });
+
+  return Buffer.from(response.data.content, response.data.encoding).toString();
+};

src/api/get-label-configs.ts

@@ -0,0 +1,126 @@
+import * as core from '@actions/core';
+import * as yaml from 'js-yaml';
+import fs from 'fs';
+import {ClientType} from './types';
+import {getContent} from './get-content';
+
+import {
+  ChangedFilesMatchConfig,
+  toChangedFilesMatchConfig
+} from '../changedFiles';
+
+import {toBranchMatchConfig, BranchMatchConfig} from '../branch';
+
+export interface MatchConfig {
+  all?: BaseMatchConfig[];
+  any?: BaseMatchConfig[];
+}
+
+export type BaseMatchConfig = BranchMatchConfig & ChangedFilesMatchConfig;
+
+const ALLOWED_CONFIG_KEYS = ['changed-files', 'head-branch', 'base-branch'];
+
+export const getLabelConfigs = (
+  client: ClientType,
+  configurationPath: string
+): Promise<Map<string, MatchConfig[]>> =>
+  Promise.resolve()
+    .then(() => {
+      if (!fs.existsSync(configurationPath)) {
+        core.info(
+          `The configuration file (path: ${configurationPath}) was not found locally, fetching via the api`
+        );
+
+        return getContent(client, configurationPath);
+      }
+
+      core.info(
+        `The configuration file (path: ${configurationPath}) was found locally, reading from the file`
+      );
+
+      return fs.readFileSync(configurationPath, {
+        encoding: 'utf8'
+      });
+    })
+    .catch(error => {
+      if (error.name == 'HttpError' || error.name == 'NotFound') {
+        core.warning(
+          `The config file was not found at ${configurationPath}. Make sure it exists and that this action has the correct access rights.`
+        );
+      }
+      return Promise.reject(error);
+    })
+    .then(configuration => {
+      // loads (hopefully) a `{[label:string]: MatchConfig[]}`, but is `any`:
+      const configObject: any = yaml.load(configuration);
+
+      // transform `any` => `Map<string,MatchConfig[]>` or throw if yaml is malformed:
+      return getLabelConfigMapFromObject(configObject);
+    });
+
+export function getLabelConfigMapFromObject(
+  configObject: any
+): Map<string, MatchConfig[]> {
+  const labelMap: Map<string, MatchConfig[]> = new Map();
+  for (const label in configObject) {
+    const configOptions = configObject[label];
+    if (
+      !Array.isArray(configOptions) ||
+      !configOptions.every(opts => typeof opts === 'object')
+    ) {
+      throw Error(
+        `found unexpected type for label '${label}' (should be array of config options)`
+      );
+    }
+    const matchConfigs = configOptions.reduce<MatchConfig[]>(
+      (updatedConfig, configValue) => {
+        if (!configValue) {
+          return updatedConfig;
+        }
+
+        Object.entries(configValue).forEach(([key, value]) => {
+          // If the top level `any` or `all` keys are provided then set them, and convert their values to
+          // our config objects.
+          if (key === 'any' || key === 'all') {
+            if (Array.isArray(value)) {
+              const newConfigs = value.map(toMatchConfig);
+              updatedConfig.push({[key]: newConfigs});
+            }
+          } else if (ALLOWED_CONFIG_KEYS.includes(key)) {
+            const newMatchConfig = toMatchConfig({[key]: value});
+            // Find or set the `any` key so that we can add these properties to that rule,
+            // Or create a new `any` key and add that to our array of configs.
+            const indexOfAny = updatedConfig.findIndex(mc => !!mc['any']);
+            if (indexOfAny >= 0) {
+              updatedConfig[indexOfAny].any?.push(newMatchConfig);
+            } else {
+              updatedConfig.push({any: [newMatchConfig]});
+            }
+          } else {
+            // Log the key that we don't know what to do with.
+            core.info(`An unknown config option was under ${label}: ${key}`);
+          }
+        });
+
+        return updatedConfig;
+      },
+      []
+    );
+
+    if (matchConfigs.length) {
+      labelMap.set(label, matchConfigs);
+    }
+  }
+
+  return labelMap;
+}
+
+export function toMatchConfig(config: any): BaseMatchConfig {
+  const changedFilesConfig = toChangedFilesMatchConfig(config);
+  const branchConfig = toBranchMatchConfig(config);
+
+  return {
+    ...changedFilesConfig,
+    ...branchConfig
+  };
+}

src/api/index.ts

@@ -0,0 +1,6 @@
+export * from './get-changed-files';
+export * from './get-changed-pull-requests';
+export * from './get-content';
+export * from './get-label-configs';
+export * from './set-labels';
+export * from './types';

src/api/set-labels.ts

@@ -0,0 +1,15 @@
+import * as github from '@actions/github';
+import {ClientType} from './types';
+
+export const setLabels = async (
+  client: ClientType,
+  prNumber: number,
+  labels: string[]
+) => {
+  await client.rest.issues.setLabels({
+    owner: github.context.repo.owner,
+    repo: github.context.repo.repo,
+    issue_number: prNumber,
+    labels: labels
+  });
+};

src/api/types.ts

@@ -0,0 +1,2 @@
+import * as github from '@actions/github';
+export type ClientType = ReturnType<typeof github.getOctokit>;

src/changedFiles.ts

@@ -1,13 +1,28 @@
 import * as core from '@actions/core';
 import * as github from '@actions/github';
 import {Minimatch} from 'minimatch';
+import {printPattern, isObject, kebabToCamel} from './utils';
 
 export interface ChangedFilesMatchConfig {
-  changedFiles?: string[];
+  changedFiles?: ChangedFilesGlobPatternsConfig[];
+}
+
+interface ChangedFilesGlobPatternsConfig {
+  anyGlobToAnyFile?: string[];
+  anyGlobToAllFiles?: string[];
+  allGlobsToAnyFile?: string[];
+  allGlobsToAllFiles?: string[];
 }
 
 type ClientType = ReturnType<typeof github.getOctokit>;
 
+const ALLOWED_FILES_CONFIG_KEYS = [
+  'any-glob-to-any-file',
+  'any-glob-to-all-files',
+  'all-globs-to-any-file',
+  'all-globs-to-all-files'
+];
+
 export async function getChangedFiles(
   client: ClientType,
   prNumber: number
@@ -35,76 +50,311 @@ export function toChangedFilesMatchConfig(
   if (!config['changed-files'] || !config['changed-files'].length) {
     return {};
   }
+  const changedFilesConfigs = Array.isArray(config['changed-files'])
+    ? config['changed-files']
+    : [config['changed-files']];
 
-  const changedFilesConfig = config['changed-files'];
+  const validChangedFilesConfigs: ChangedFilesGlobPatternsConfig[] = [];
+
+  changedFilesConfigs.forEach(changedFilesConfig => {
+    if (!isObject(changedFilesConfig)) {
+      throw new Error(
+        `The "changed-files" section must have a valid config structure. Please read the action documentation for more information`
+      );
+    }
+
+    const changedFilesConfigKeys = Object.keys(changedFilesConfig);
+    const invalidKeys = changedFilesConfigKeys.filter(
+      key => !ALLOWED_FILES_CONFIG_KEYS.includes(key)
+    );
+
+    if (invalidKeys.length) {
+      throw new Error(
+        `Unknown config options were under "changed-files": ${invalidKeys.join(
+          ', '
+        )}`
+      );
+    }
+
+    changedFilesConfigKeys.forEach(key => {
+      validChangedFilesConfigs.push({
+        [kebabToCamel(key)]: Array.isArray(changedFilesConfig[key])
+          ? changedFilesConfig[key]
+          : [changedFilesConfig[key]]
+      });
+    });
+  });
 
   return {
-    changedFiles: Array.isArray(changedFilesConfig)
-      ? changedFilesConfig
-      : [changedFilesConfig]
+    changedFiles: validChangedFilesConfigs
   };
 }
 
-function printPattern(matcher: Minimatch): string {
-  return (matcher.negate ? '!' : '') + matcher.pattern;
-}
-
-function isAnyMatch(changedFile: string, matchers: Minimatch[]): boolean {
-  core.debug(`    matching patterns against file ${changedFile}`);
-  for (const matcher of matchers) {
-    core.debug(`     - ${printPattern(matcher)}`);
-    if (matcher.match(changedFile)) {
-      core.debug(`    ${printPattern(matcher)} matched`);
-      return true;
-    }
-  }
-
-  core.debug(`    no patterns matched`);
-  return false;
-}
-
-function isAllMatch(changedFile: string, matchers: Minimatch[]): boolean {
-  core.debug(`    matching patterns against file ${changedFile}`);
-  for (const matcher of matchers) {
-    core.debug(`     - ${printPattern(matcher)}`);
-    if (!matcher.match(changedFile)) {
-      core.debug(`    ${printPattern(matcher)} did not match`);
-      return false;
-    }
-  }
-
-  core.debug(`    all patterns matched`);
-  return true;
-}
-
 export function checkAnyChangedFiles(
   changedFiles: string[],
-  globs: string[]
+  globPatternsConfigs: ChangedFilesGlobPatternsConfig[],
+  dot: boolean
 ): boolean {
-  const matchers = globs.map(g => new Minimatch(g));
-  for (const changedFile of changedFiles) {
-    if (isAnyMatch(changedFile, matchers)) {
-      core.debug(`   "any" patterns matched against ${changedFile}`);
-      return true;
+  core.debug(`   checking "changed-files" patterns`);
+
+  for (const globPatternsConfig of globPatternsConfigs) {
+    if (globPatternsConfig.anyGlobToAnyFile) {
+      if (
+        checkIfAnyGlobMatchesAnyFile(
+          changedFiles,
+          globPatternsConfig.anyGlobToAnyFile,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" matched`);
+        return true;
+      }
+    }
+
+    if (globPatternsConfig.anyGlobToAllFiles) {
+      if (
+        checkIfAnyGlobMatchesAllFiles(
+          changedFiles,
+          globPatternsConfig.anyGlobToAllFiles,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" matched`);
+        return true;
+      }
+    }
+
+    if (globPatternsConfig.allGlobsToAnyFile) {
+      if (
+        checkIfAllGlobsMatchAnyFile(
+          changedFiles,
+          globPatternsConfig.allGlobsToAnyFile,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" matched`);
+        return true;
+      }
+    }
+
+    if (globPatternsConfig.allGlobsToAllFiles) {
+      if (
+        checkIfAllGlobsMatchAllFiles(
+          changedFiles,
+          globPatternsConfig.allGlobsToAllFiles,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" matched`);
+        return true;
+      }
     }
   }
 
-  core.debug(`   "any" patterns did not match any files`);
+  core.debug(`   "changed-files" did not match`);
   return false;
 }
 
 export function checkAllChangedFiles(
   changedFiles: string[],
-  globs: string[]
+  globPatternsConfigs: ChangedFilesGlobPatternsConfig[],
+  dot: boolean
 ): boolean {
-  const matchers = globs.map(g => new Minimatch(g));
+  core.debug(`   checking "changed-files" patterns`);
+
+  for (const globPatternsConfig of globPatternsConfigs) {
+    if (globPatternsConfig.anyGlobToAnyFile) {
+      if (
+        !checkIfAnyGlobMatchesAnyFile(
+          changedFiles,
+          globPatternsConfig.anyGlobToAnyFile,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" did not match`);
+        return false;
+      }
+    }
+
+    if (globPatternsConfig.anyGlobToAllFiles) {
+      if (
+        !checkIfAnyGlobMatchesAllFiles(
+          changedFiles,
+          globPatternsConfig.anyGlobToAllFiles,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" did not match`);
+        return false;
+      }
+    }
+
+    if (globPatternsConfig.allGlobsToAnyFile) {
+      if (
+        !checkIfAllGlobsMatchAnyFile(
+          changedFiles,
+          globPatternsConfig.allGlobsToAnyFile,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" did not match`);
+        return false;
+      }
+    }
+
+    if (globPatternsConfig.allGlobsToAllFiles) {
+      if (
+        !checkIfAllGlobsMatchAllFiles(
+          changedFiles,
+          globPatternsConfig.allGlobsToAllFiles,
+          dot
+        )
+      ) {
+        core.debug(`   "changed-files" did not match`);
+        return false;
+      }
+    }
+  }
+
+  core.debug(`   "changed-files" patterns matched`);
+  return true;
+}
+
+export function checkIfAnyGlobMatchesAnyFile(
+  changedFiles: string[],
+  globs: string[],
+  dot: boolean
+): boolean {
+  core.debug(`    checking "any-glob-to-any-file" config patterns`);
+  const matchers = globs.map(g => new Minimatch(g, {dot}));
+
+  for (const matcher of matchers) {
+    const matchedFile = changedFiles.find(changedFile => {
+      core.debug(
+        `     checking "${printPattern(
+          matcher
+        )}" pattern against ${changedFile}`
+      );
+
+      return matcher.match(changedFile);
+    });
+
+    if (matchedFile) {
+      core.debug(
+        `     "${printPattern(matcher)}" pattern matched ${matchedFile}`
+      );
+      return true;
+    }
+  }
+
+  core.debug(`    none of the patterns matched any of the files`);
+  return false;
+}
+
+export function checkIfAllGlobsMatchAnyFile(
+  changedFiles: string[],
+  globs: string[],
+  dot: boolean
+): boolean {
+  core.debug(`    checking "all-globs-to-any-file" config patterns`);
+  const matchers = globs.map(g => new Minimatch(g, {dot}));
+
   for (const changedFile of changedFiles) {
-    if (!isAllMatch(changedFile, matchers)) {
-      core.debug(`   "all" patterns did not match against ${changedFile}`);
+    const mismatchedGlob = matchers.find(matcher => {
+      core.debug(
+        `     checking "${printPattern(
+          matcher
+        )}" pattern against ${changedFile}`
+      );
+
+      return !matcher.match(changedFile);
+    });
+
+    if (mismatchedGlob) {
+      core.debug(
+        `     "${printPattern(
+          mismatchedGlob
+        )}" pattern did not match ${changedFile}`
+      );
+
+      continue;
+    }
+
+    core.debug(`    all patterns matched ${changedFile}`);
+    return true;
+  }
+
+  core.debug(`    none of the files matched all patterns`);
+  return false;
+}
+
+export function checkIfAnyGlobMatchesAllFiles(
+  changedFiles: string[],
+  globs: string[],
+  dot: boolean
+): boolean {
+  core.debug(`    checking "any-glob-to-all-files" config patterns`);
+  const matchers = globs.map(g => new Minimatch(g, {dot}));
+
+  for (const matcher of matchers) {
+    const mismatchedFile = changedFiles.find(changedFile => {
+      core.debug(
+        `     checking "${printPattern(
+          matcher
+        )}" pattern against ${changedFile}`
+      );
+
+      return !matcher.match(changedFile);
+    });
+
+    if (mismatchedFile) {
+      core.debug(
+        `     "${printPattern(
+          matcher
+        )}" pattern did not match ${mismatchedFile}`
+      );
+
+      continue;
+    }
+
+    core.debug(`    "${printPattern(matcher)}" pattern matched all files`);
+    return true;
+  }
+
+  core.debug(`    none of the patterns matched all files`);
+  return false;
+}
+
+export function checkIfAllGlobsMatchAllFiles(
+  changedFiles: string[],
+  globs: string[],
+  dot: boolean
+): boolean {
+  core.debug(`    checking "all-globs-to-all-files" config patterns`);
+  const matchers = globs.map(g => new Minimatch(g, {dot}));
+
+  for (const changedFile of changedFiles) {
+    const mismatchedGlob = matchers.find(matcher => {
+      core.debug(
+        `     checking "${printPattern(
+          matcher
+        )}" pattern against ${changedFile}`
+      );
+
+      return !matcher.match(changedFile);
+    });
+
+    if (mismatchedGlob) {
+      core.debug(
+        `     "${printPattern(
+          mismatchedGlob
+        )}" pattern did not match ${changedFile}`
+      );
+
       return false;
     }
   }
 
-  core.debug(`   "all" patterns matched all files`);
+  core.debug(`    all patterns matched all files`);
   return true;
 }

src/get-inputs/get-inputs.ts

@@ -0,0 +1,10 @@
+import * as core from '@actions/core';
+import {getPrNumbers} from './get-pr-numbers';
+
+export const getInputs = () => ({
+  token: core.getInput('repo-token'),
+  configPath: core.getInput('configuration-path', {required: true}),
+  syncLabels: core.getBooleanInput('sync-labels'),
+  dot: core.getBooleanInput('dot'),
+  prNumbers: getPrNumbers()
+});

src/get-inputs/get-pr-numbers.ts

@@ -0,0 +1,28 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+
+const getPrNumberFromContext = () =>
+  github.context.payload.pull_request?.number;
+
+export const getPrNumbers = (): number[] => {
+  const prInput = core.getMultilineInput('pr-number');
+
+  if (!prInput?.length) {
+    return [getPrNumberFromContext()].filter(Boolean) as number[];
+  }
+
+  const result: number[] = [];
+
+  for (const line of prInput) {
+    const prNumber = parseInt(line, 10);
+
+    if (isNaN(prNumber) && prNumber <= 0) {
+      core.warning(`'${prNumber}' is not a valid pull request number`);
+      continue;
+    }
+
+    result.push(prNumber);
+  }
+
+  return result;
+};

src/get-inputs/index.ts

@@ -0,0 +1 @@
+export * from './get-inputs';

src/labeler.ts

@@ -1,196 +1,120 @@
 import * as core from '@actions/core';
 import * as github from '@actions/github';
-import * as yaml from 'js-yaml';
+import * as pluginRetry from '@octokit/plugin-retry';
+import * as api from './api';
+import isEqual from 'lodash.isequal';
+import {getInputs} from './get-inputs';
 
-import {
-  ChangedFilesMatchConfig,
-  getChangedFiles,
-  toChangedFilesMatchConfig,
-  checkAllChangedFiles,
-  checkAnyChangedFiles
-} from './changedFiles';
-import {
-  checkAnyBranch,
-  checkAllBranch,
-  toBranchMatchConfig,
-  BranchMatchConfig
-} from './branch';
+import {BaseMatchConfig, MatchConfig} from './api/get-label-configs';
 
-export type BaseMatchConfig = BranchMatchConfig & ChangedFilesMatchConfig;
+import {checkAllChangedFiles, checkAnyChangedFiles} from './changedFiles';
 
-export type MatchConfig = {
-  any?: BaseMatchConfig[];
-  all?: BaseMatchConfig[];
-};
+import {checkAnyBranch, checkAllBranch} from './branch';
 
 type ClientType = ReturnType<typeof github.getOctokit>;
 
-const ALLOWED_CONFIG_KEYS = ['changed-files', 'head-branch', 'base-branch'];
+// GitHub Issues cannot have more than 100 labels
+const GITHUB_MAX_LABELS = 100;
 
-export async function run() {
-  try {
-    const token = core.getInput('repo-token');
-    const configPath = core.getInput('configuration-path', {required: true});
-    const syncLabels = core.getBooleanInput('sync-labels');
+export const run = () =>
+  labeler().catch(error => {
+    core.error(error);
+    core.setFailed(error.message);
+  });
 
-    const prNumber = getPrNumber();
-    if (!prNumber) {
-      core.info('Could not get pull request number from context, exiting');
-      return;
-    }
+export async function labeler() {
+  const {token, configPath, syncLabels, dot, prNumbers} = getInputs();
 
-    const client: ClientType = github.getOctokit(token);
+  if (!prNumbers.length) {
+    core.warning('Could not get pull request number(s), exiting');
+    return;
+  }
 
-    const {data: pullRequest} = await client.rest.pulls.get({
-      owner: github.context.repo.owner,
-      repo: github.context.repo.repo,
-      pull_number: prNumber
-    });
+  const client: ClientType = github.getOctokit(token, {}, pluginRetry.retry);
 
-    core.debug(`fetching changed files for pr #${prNumber}`);
-    const changedFiles: string[] = await getChangedFiles(client, prNumber);
-    const labelConfigs: Map<string, MatchConfig[]> = await getMatchConfigs(
+  const pullRequests = api.getPullRequests(client, prNumbers);
+
+  for await (const pullRequest of pullRequests) {
+    const labelConfigs: Map<string, MatchConfig[]> = await api.getLabelConfigs(
       client,
       configPath
     );
+    const preexistingLabels = pullRequest.data.labels.map(l => l.name);
+    const allLabels: Set<string> = new Set<string>(preexistingLabels);
 
-    const labels: string[] = [];
-    const labelsToRemove: string[] = [];
     for (const [label, configs] of labelConfigs.entries()) {
       core.debug(`processing ${label}`);
-      if (checkMatchConfigs(changedFiles, configs)) {
-        labels.push(label);
-      } else if (pullRequest.labels.find(l => l.name === label)) {
-        labelsToRemove.push(label);
+      if (checkMatchConfigs(pullRequest.changedFiles, configs, dot)) {
+        allLabels.add(label);
+      } else if (syncLabels) {
+        allLabels.delete(label);
       }
     }
 
-    if (labels.length > 0) {
-      await addLabels(client, prNumber, labels);
+    const labelsToAdd = [...allLabels].slice(0, GITHUB_MAX_LABELS);
+    const excessLabels = [...allLabels].slice(GITHUB_MAX_LABELS);
+
+    let newLabels: string[] = [];
+
+    try {
+      if (!isEqual(labelsToAdd, preexistingLabels)) {
+        await api.setLabels(client, pullRequest.number, labelsToAdd);
+        newLabels = labelsToAdd.filter(
+          label => !preexistingLabels.includes(label)
+        );
+      }
+    } catch (error: any) {
+      if (
+        error.name === 'HttpError' &&
+        error.status === 403 &&
+        error.message.toLowerCase().includes('unauthorized')
+      ) {
+        throw new Error(
+          `Failed to set labels for PR #${pullRequest.number}. The workflow does not have permission to create labels. ` +
+            `Ensure the 'issues: write' permission is granted in the workflow file or manually create the missing labels in the repository before running the action.`
+        );
+      } else if (
+        error.name !== 'HttpError' ||
+        error.message !== 'Resource not accessible by integration'
+      ) {
+        throw error;
+      }
+
+      core.warning(
+        `The action requires 'issues: write' permission to create new labels or 'pull-requests: write' permission to add existing labels to pull requests. ` +
+          `For more information, refer to the action documentation: https://github.com/actions/labeler#recommended-permissions`,
+        {
+          title: `${process.env['GITHUB_ACTION_REPOSITORY']} running under '${github.context.eventName}' is misconfigured`
+        }
+      );
+
+      core.setFailed(error.message);
+
+      return;
     }
 
-    if (syncLabels && labelsToRemove.length) {
-      await removeLabels(client, prNumber, labelsToRemove);
-    }
-  } catch (error: any) {
-    core.error(error);
-    core.setFailed(error.message);
-  }
-}
+    core.setOutput('new-labels', newLabels.join(','));
+    core.setOutput('all-labels', labelsToAdd.join(','));
 
-function getPrNumber(): number | undefined {
-  const pullRequest = github.context.payload.pull_request;
-  if (!pullRequest) {
-    return undefined;
-  }
-
-  return pullRequest.number;
-}
-
-async function getMatchConfigs(
-  client: ClientType,
-  configurationPath: string
-): Promise<Map<string, MatchConfig[]>> {
-  const configurationContent: string = await fetchContent(
-    client,
-    configurationPath
-  );
-
-  // loads (hopefully) a `{[label:string]: MatchConfig[]}`, but is `any`:
-  const configObject: any = yaml.load(configurationContent);
-
-  // transform `any` => `Map<string,MatchConfig[]>` or throw if yaml is malformed:
-  return getLabelConfigMapFromObject(configObject);
-}
-
-async function fetchContent(
-  client: ClientType,
-  repoPath: string
-): Promise<string> {
-  const response: any = await client.rest.repos.getContent({
-    owner: github.context.repo.owner,
-    repo: github.context.repo.repo,
-    path: repoPath,
-    ref: github.context.sha
-  });
-
-  return Buffer.from(response.data.content, response.data.encoding).toString();
-}
-
-export function getLabelConfigMapFromObject(
-  configObject: any
-): Map<string, MatchConfig[]> {
-  const labelMap: Map<string, MatchConfig[]> = new Map();
-  for (const label in configObject) {
-    const configOptions = configObject[label];
-    if (
-      !Array.isArray(configOptions) ||
-      !configOptions.every(opts => typeof opts === 'object')
-    ) {
-      throw Error(
-        `found unexpected type for label '${label}' (should be array of config options)`
+    if (excessLabels.length) {
+      core.warning(
+        `Maximum of ${GITHUB_MAX_LABELS} labels allowed. Excess labels: ${excessLabels.join(
+          ', '
+        )}`,
+        {title: 'Label limit for a PR exceeded'}
       );
     }
-    const matchConfigs = configOptions.reduce<MatchConfig[]>(
-      (updatedConfig, configValue) => {
-        if (!configValue) {
-          return updatedConfig;
-        }
-
-        Object.entries(configValue).forEach(([key, value]) => {
-          // If the top level `any` or `all` keys are provided then set them, and convert their values to
-          // our config objects.
-          if (key === 'any' || key === 'all') {
-            if (Array.isArray(value)) {
-              const newConfigs = value.map(toMatchConfig);
-              updatedConfig.push({[key]: newConfigs});
-            }
-          } else if (ALLOWED_CONFIG_KEYS.includes(key)) {
-            const newMatchConfig = toMatchConfig({[key]: value});
-            // Find or set the `any` key so that we can add these properties to that rule,
-            // Or create a new `any` key and add that to our array of configs.
-            const indexOfAny = updatedConfig.findIndex(mc => !!mc['any']);
-            if (indexOfAny >= 0) {
-              updatedConfig[indexOfAny].any?.push(newMatchConfig);
-            } else {
-              updatedConfig.push({any: [newMatchConfig]});
-            }
-          } else {
-            // Log the key that we don't know what to do with.
-            core.info(`An unknown config option was under ${label}: ${key}`);
-          }
-        });
-
-        return updatedConfig;
-      },
-      []
-    );
-
-    if (matchConfigs.length) {
-      labelMap.set(label, matchConfigs);
-    }
   }
-
-  return labelMap;
-}
-
-export function toMatchConfig(config: any): BaseMatchConfig {
-  const changedFilesConfig = toChangedFilesMatchConfig(config);
-  const branchConfig = toBranchMatchConfig(config);
-
-  return {
-    ...changedFilesConfig,
-    ...branchConfig
-  };
 }
 
 export function checkMatchConfigs(
   changedFiles: string[],
-  matchConfigs: MatchConfig[]
+  matchConfigs: MatchConfig[],
+  dot: boolean
 ): boolean {
   for (const config of matchConfigs) {
     core.debug(` checking config ${JSON.stringify(config)}`);
-    if (!checkMatch(changedFiles, config)) {
+    if (!checkMatch(changedFiles, config, dot)) {
       return false;
     }
   }
@@ -198,20 +122,24 @@ export function checkMatchConfigs(
   return true;
 }
 
-function checkMatch(changedFiles: string[], matchConfig: MatchConfig): boolean {
+function checkMatch(
+  changedFiles: string[],
+  matchConfig: MatchConfig,
+  dot: boolean
+): boolean {
   if (!Object.keys(matchConfig).length) {
     core.debug(`  no "any" or "all" patterns to check`);
     return false;
   }
 
   if (matchConfig.all) {
-    if (!checkAll(matchConfig.all, changedFiles)) {
+    if (!checkAll(matchConfig.all, changedFiles, dot)) {
       return false;
     }
   }
 
   if (matchConfig.any) {
-    if (!checkAny(matchConfig.any, changedFiles)) {
+    if (!checkAny(matchConfig.any, changedFiles, dot)) {
       return false;
     }
   }
@@ -222,7 +150,8 @@ function checkMatch(changedFiles: string[], matchConfig: MatchConfig): boolean {
 // equivalent to "Array.some()" but expanded for debugging and clarity
 export function checkAny(
   matchConfigs: BaseMatchConfig[],
-  changedFiles: string[]
+  changedFiles: string[],
+  dot: boolean
 ): boolean {
   core.debug(`  checking "any" patterns`);
   if (
@@ -236,18 +165,21 @@ export function checkAny(
   for (const matchConfig of matchConfigs) {
     if (matchConfig.baseBranch) {
       if (checkAnyBranch(matchConfig.baseBranch, 'base')) {
+        core.debug(`  "any" patterns matched`);
         return true;
       }
     }
 
     if (matchConfig.changedFiles) {
-      if (checkAnyChangedFiles(changedFiles, matchConfig.changedFiles)) {
+      if (checkAnyChangedFiles(changedFiles, matchConfig.changedFiles, dot)) {
+        core.debug(`  "any" patterns matched`);
         return true;
       }
     }
 
     if (matchConfig.headBranch) {
       if (checkAnyBranch(matchConfig.headBranch, 'head')) {
+        core.debug(`  "any" patterns matched`);
         return true;
       }
     }
@@ -260,7 +192,8 @@ export function checkAny(
 // equivalent to "Array.every()" but expanded for debugging and clarity
 export function checkAll(
   matchConfigs: BaseMatchConfig[],
-  changedFiles: string[]
+  changedFiles: string[],
+  dot: boolean
 ): boolean {
   core.debug(`  checking "all" patterns`);
   if (
@@ -274,6 +207,7 @@ export function checkAll(
   for (const matchConfig of matchConfigs) {
     if (matchConfig.baseBranch) {
       if (!checkAllBranch(matchConfig.baseBranch, 'base')) {
+        core.debug(`  "all" patterns did not match`);
         return false;
       }
     }
@@ -284,13 +218,15 @@ export function checkAll(
         return false;
       }
 
-      if (!checkAllChangedFiles(changedFiles, matchConfig.changedFiles)) {
+      if (!checkAllChangedFiles(changedFiles, matchConfig.changedFiles, dot)) {
+        core.debug(`  "all" patterns did not match`);
         return false;
       }
     }
 
     if (matchConfig.headBranch) {
       if (!checkAllBranch(matchConfig.headBranch, 'head')) {
+        core.debug(`  "all" patterns did not match`);
         return false;
       }
     }
@@ -299,33 +235,3 @@ export function checkAll(
   core.debug(`  "all" patterns matched all configs`);
   return true;
 }
-
-async function addLabels(
-  client: ClientType,
-  prNumber: number,
-  labels: string[]
-) {
-  await client.rest.issues.addLabels({
-    owner: github.context.repo.owner,
-    repo: github.context.repo.repo,
-    issue_number: prNumber,
-    labels: labels
-  });
-}
-
-async function removeLabels(
-  client: ClientType,
-  prNumber: number,
-  labels: string[]
-) {
-  await Promise.all(
-    labels.map(label =>
-      client.rest.issues.removeLabel({
-        owner: github.context.repo.owner,
-        repo: github.context.repo.repo,
-        issue_number: prNumber,
-        name: label
-      })
-    )
-  );
-}

src/utils.ts

@@ -0,0 +1,13 @@
+import {Minimatch} from 'minimatch';
+
+export const printPattern = (matcher: Minimatch): string => {
+  return (matcher.negate ? '!' : '') + matcher.pattern;
+};
+
+export const kebabToCamel = (str: string): string => {
+  return str.replace(/-./g, m => m.toUpperCase()[1]);
+};
+
+export function isObject(obj: unknown): obj is object {
+  return obj !== null && typeof obj === 'object' && !Array.isArray(obj);
+}