From 7a201543673f8f89f51df3a48a5d6ae61bda2d45 Mon Sep 17 00:00:00 2001
From: Yuchen Jiang <yucjiang@amazon.com>
Date: Tue, 13 Oct 2026 20:33:08 +0000
Subject: [PATCH 1/3] Apply issue labels in the github-script step

The auto-label workflow passed the label list and the issue number to a
shell step through ${{ }} expressions. Security scanners flag this
pattern as a script injection risk.

Call the GitHub API from the github-script step. Remove the shell step.

Apply only the labels that exist in the repository. The name match
ignores case, so the "Trn2" rule applies the "trn2" label. The workflow
logs a warning for a label that does not exist, for example "Inf1".
---
 .github/workflows/auto-label-issues.yml | 44 ++++++++++++++++++-------
 1 file changed, 32 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/auto-label-issues.yml b/.github/workflows/auto-label-issues.yml
index ca921a7..bef0a26 100644
--- a/.github/workflows/auto-label-issues.yml
+++ b/.github/workflows/auto-label-issues.yml
@@ -11,7 +11,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - name: Analyze issue content
+      - name: Analyze issue content and apply labels
         id: analyze_content
         uses: actions/github-script@v7
         env:
@@ -211,15 +211,35 @@ jobs:
               labels.push('Training');
             }
 
-            core.setOutput('labels', labels.join(','));
-            core.setOutput('has_labels', labels.length > 0);
+            // =============================================================================
+            // APPLY LABELS
+            // Call the API from this script. Do not pass values to a shell step.
+            // Apply only the labels that exist in the repository. The name match ignores case.
+            // =============================================================================
+            if (labels.length > 0) {
+              const repoLabels = await github.paginate(github.rest.issues.listLabelsForRepo, {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                per_page: 100
+              });
+              const existingLabels = new Map(repoLabels.map(l => [l.name.toLowerCase(), l.name]));
 
-      - name: Apply labels to issue
-        if: steps.analyze_content.outputs.has_labels == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          IFS=',' read -ra LABELS <<< "${{ steps.analyze_content.outputs.labels }}"
-          for label in "${LABELS[@]}"; do
-            gh issue edit ${{ github.event.issue.number }} --add-label "$label" -R ${{ github.repository }}
-          done
+              const labelsToApply = [];
+              for (const label of labels) {
+                const name = existingLabels.get(label.toLowerCase());
+                if (name) {
+                  labelsToApply.push(name);
+                } else {
+                  core.warning(`Label "${label}" does not exist in the repository. Create the label to apply it.`);
+                }
+              }
+
+              if (labelsToApply.length > 0) {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.issue.number,
+                  labels: labelsToApply
+                });
+              }
+            }

From 46887f65f769f99ee11c50397c920e13c755e0f6 Mon Sep 17 00:00:00 2001
From: Yuchen Jiang <yucjiang@amazon.com>
Date: Tue, 13 Oct 2026 20:45:42 +0000
Subject: [PATCH 2/3] TEST ONLY: Run the auto-label workflow on a test pull
 request

Do not merge. An issues workflow runs only from the default branch.
Add a temporary pull_request trigger, and read the title from the pull
request, so that the new workflow runs on a test pull request.
---
 .github/workflows/auto-label-issues.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-label-issues.yml b/.github/workflows/auto-label-issues.yml
index bef0a26..496e231 100644
--- a/.github/workflows/auto-label-issues.yml
+++ b/.github/workflows/auto-label-issues.yml
@@ -4,6 +4,9 @@ name: auto-label-issues
 on:
   issues:
     types: [opened]
+  # TEST ONLY. Do not merge. Run this workflow on a test pull request.
+  pull_request:
+    types: [opened, edited]
 
 jobs:
   auto-label-issues:
@@ -16,7 +19,7 @@ jobs:
         uses: actions/github-script@v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ISSUE_TITLE: ${{ github.event.issue.title }}
+          ISSUE_TITLE: ${{ github.event.issue.title || github.event.pull_request.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
         with:
           script: |

From a8876c64d8bd54dc3234647bece674bc393d775a Mon Sep 17 00:00:00 2001
From: Yuchen Jiang <yucjiang@amazon.com>
Date: Tue, 13 Oct 2026 20:53:04 +0000
Subject: [PATCH 3/3] TEST ONLY: Give the test run write access to pull request
 labels

A label on a pull request needs the pull-requests write permission.
Also run on synchronize, so that a push starts a test run.
---
 .github/workflows/auto-label-issues.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-label-issues.yml b/.github/workflows/auto-label-issues.yml
index 496e231..37ef9cc 100644
--- a/.github/workflows/auto-label-issues.yml
+++ b/.github/workflows/auto-label-issues.yml
@@ -6,13 +6,15 @@ on:
     types: [opened]
   # TEST ONLY. Do not merge. Run this workflow on a test pull request.
   pull_request:
-    types: [opened, edited]
+    types: [opened, edited, synchronize]
 
 jobs:
   auto-label-issues:
     runs-on: ubuntu-latest
     permissions:
       issues: write
+      # TEST ONLY. A label on a pull request needs this permission.
+      pull-requests: write
     steps:
       - name: Analyze issue content and apply labels
         id: analyze_content