ci: labeler

.github/labeler-config-pr.yml

@@ -0,0 +1,29 @@
+# Keyword regex labels for PRs only. No area/* — pr-paths.yml handles those.
+
+"bug": '\b([Bb]ug(s)?|[Ff]ix(es)?)\b'
+
+"enhancement": '\b([Ff]eat(s)?)\b'
+
+"documentation": '\b([Dd]ocumentation|[Dd]ocs|[Rr]eadme)\b'
+
+"question": '\b([Qq]uestion(s)?|[Hh]elp|[Hh]ow to)\b'
+
+"performance": '\b([Pp]erformance|[Oo]ptimiz(e|ation)|[Ss]peed|[Ee]fficiency)\b'
+
+"dependencies": '([Cc]hore\(deps\)|[Ff]ix\(deps\))'
+
+"ci": '\b([Cc]i|[Cc]ontinuous integration|[Bb]uild|[Ww]orkflow)\b'
+
+"chore": '\b([Cc]hore|[Mm]aintenance|[Rr]efactor|[Cc]leanup)\b'
+
+"security": '\b([Ss]ecurity|[Ss]andbox(ed)?|[Ll]andlock|[Ss]eccomp|[Vv]ulnerabilit(y|ies)|[Cc][Vv][Ee])\b'
+
+"os/windows": '\b([Ww]indows|[Ww]in(10|11)|[Mm]icrosoft)\b'
+
+"os/linux": '\b([Ll]inux|[Uu]buntu|[Dd]ebian|[Ff]edora|[Aa]rch [Ll]inux|[Nn]ix[Oo][Ss]|[Pp]op!?_?[Oo][Ss])\b'
+
+"os/macos": '\b([Mm]ac[Oo][Ss]?|[Oo][Ss] ?[Xx]|[Dd]arwin|[Mm]acbook)\b'
+
+"arch/arm64": '\b(arm64|aarch64|[Aa]pple ?[Ss]ilicon|[Mm][1-4]( [Pp]ro| [Mm]ax| [Uu]ltra)?|[Mm]ac(book)? [Mm][1-4])\b'
+
+"arch/amd64": '\b(amd64|x86[_-]?64|x64|[Ii]ntel( [Mm]ac)?)\b'

.github/labeler-config.yml

@@ -0,0 +1,49 @@
+# Keyword regex labels for issues. PRs use labeler-config-pr.yml + pr-paths.yml.
+
+"bug": '\b([Bb]ug(s)?|[Ff]ix(es)?)\b'
+
+"enhancement": '\b([Ff]eat(s)?)\b'
+
+"documentation": '\b([Dd]ocumentation|[Dd]ocs|[Rr]eadme)\b'
+
+"question": '\b([Qq]uestion(s)?|[Hh]elp|[Hh]ow to)\b'
+
+"performance": '\b([Pp]erformance|[Oo]ptimiz(e|ation)|[Ss]peed|[Ee]fficiency)\b'
+
+"dependencies": '([Cc]hore\(deps\)|[Ff]ix\(deps\))'
+
+"ci": '\b([Cc]i|[Cc]ontinuous integration|[Bb]uild|[Ww]orkflow)\b'
+
+"chore": '\b([Cc]hore|[Mm]aintenance|[Rr]efactor|[Cc]leanup)\b'
+
+"security": '\b([Ss]ecurity|[Ss]andbox(ed)?|[Ll]andlock|[Ss]eccomp|[Vv]ulnerabilit(y|ies)|[Cc][Vv][Ee])\b'
+
+"os/windows": '\b([Ww]indows|[Ww]in(10|11)|[Mm]icrosoft)\b'
+
+"os/linux": '\b([Ll]inux|[Uu]buntu|[Dd]ebian|[Ff]edora|[Aa]rch [Ll]inux|[Nn]ix[Oo][Ss]|[Pp]op!?_?[Oo][Ss])\b'
+
+"os/macos": '\b([Mm]ac[Oo][Ss]?|[Oo][Ss] ?[Xx]|[Dd]arwin|[Mm]acbook)\b'
+
+"arch/arm64": '\b(arm64|aarch64|[Aa]pple ?[Ss]ilicon|[Mm][1-4]( [Pp]ro| [Mm]ax| [Uu]ltra)?|[Mm]ac(book)? [Mm][1-4])\b'
+
+"arch/amd64": '\b(amd64|x86[_-]?64|x64|[Ii]ntel( [Mm]ac)?)\b'
+
+"area/render": '\b([Rr]ender(ing|er)?|[Hh]alf[- ]?block|▀)\b'
+
+"area/protocol/kitty": '\b([Kk]itty( [Gg]raphics)?|[Gg]hostty|[Ww]ez[Tt]erm)\b'
+
+"area/protocol/sixel": '\b([Ss]ixel|[Ff]oot|[Mm]lterm|[Cc]ontour)\b'
+
+"area/protocol/halfblock": '\b([Hh]alf[- ]?block|U\+2580|Unicode block)\b'
+
+"area/decode": '\b([Dd]ecod(e|er|ing)|stb_image|stbi|[Jj]peg|[Pp]ng|[Gg]if|[Bb]mp|[Tt]ga|[Hh]dr|[Pp]sd|[Pp]nm)\b'
+
+"area/detect": '\b([Dd]etect(ion)?|[Pp]rotocol detect|TERM|TERM_PROGRAM|KITTY_WINDOW_ID)\b'
+
+"area/sandbox": '\b([Ss]andbox(ed)?|[Ll]andlock|[Ss]eccomp|[Ww]orker|[Ss]ubprocess)\b'
+
+"area/resize": '\b([Rr]esiz(e|ing)|[Ss]cal(e|ing)|[Bb]ilinear|[Aa]spect ratio)\b'
+
+"area/docs": '\b([Dd]ocumentation|[Dd]ocs|[Rr]eadme|[Mm]an ?page)\b'
+
+"area/build": '\b([Bb]uild|[Mm]akefile|[Gg]oreleaser|[Cc]go|[Cc][Gg][Oo])\b'

.github/labels.yml

@@ -0,0 +1,139 @@
+# Label definitions. Synced by .github/workflows/label-sync.yml via `gh label`.
+
+# --- Type ---
+- name: bug
+  color: d73a4a
+  description: Something isn't working
+- name: enhancement
+  color: a2eeef
+  description: New feature or request
+- name: documentation
+  color: 0075ca
+  description: Documentation changes
+- name: question
+  color: d876e3
+  description: Further information requested
+- name: performance
+  color: fbca04
+  description: Performance improvement
+- name: dependencies
+  color: 0366d6
+  description: Dependency updates
+- name: ci
+  color: 1d76db
+  description: CI / build pipeline
+- name: chore
+  color: cfd3d7
+  description: Maintenance, refactor, cleanup
+- name: security
+  color: b60205
+  description: Security-related
+
+# --- Triage / lifecycle ---
+- name: needs-triage
+  color: ededed
+  description: Awaiting maintainer review
+- name: needs-response
+  color: fbca04
+  description: Waiting on issue author reply
+- name: stale
+  color: cccccc
+  description: No activity for extended period
+- name: pinned
+  color: 0e8a16
+  description: Exempt from stale
+- name: in-progress
+  color: 5319e7
+  description: Actively being worked on
+- name: blocked
+  color: b60205
+  description: Blocked on external dependency
+- name: help-wanted
+  color: 008672
+  description: Extra attention is needed
+- name: good-first-issue
+  color: 7057ff
+  description: Good for newcomers
+- name: popular
+  color: ff6f00
+  description: High community interest (10+ 👍)
+- name: duplicate
+  color: cfd3d7
+  description: Duplicate of another issue
+- name: wontfix
+  color: ffffff
+  description: Will not be worked on
+- name: invalid
+  color: e4e669
+  description: Not valid
+- name: ci-failure
+  color: b60205
+  description: Tracked CI failure on master
+
+# --- OS ---
+- name: os/windows
+  color: 0078d4
+  description: Windows-specific
+- name: os/linux
+  color: fcc624
+  description: Linux-specific
+- name: os/macos
+  color: "333333"
+  description: macOS-specific
+
+# --- Arch ---
+- name: arch/arm64
+  color: 6e40c9
+  description: arm64 / aarch64
+- name: arch/amd64
+  color: 1f6feb
+  description: amd64 / x86_64
+
+# --- Area ---
+- name: area/render
+  color: c2e0c6
+  description: Rendering pipeline
+- name: area/protocol/kitty
+  color: c2e0c6
+  description: Kitty graphics protocol
+- name: area/protocol/sixel
+  color: c2e0c6
+  description: DEC Sixel protocol
+- name: area/protocol/halfblock
+  color: c2e0c6
+  description: Unicode half-block fallback
+- name: area/decode
+  color: c2e0c6
+  description: Image decoder (stb_image / CGo)
+- name: area/detect
+  color: c2e0c6
+  description: Terminal capability detection
+- name: area/sandbox
+  color: c2e0c6
+  description: Sandbox worker / Landlock / seccomp
+- name: area/resize
+  color: c2e0c6
+  description: Image resize / scaling
+- name: area/docs
+  color: c2e0c6
+  description: Docs site / README
+- name: area/build
+  color: c2e0c6
+  description: Build / release / packaging
+
+# --- Size ---
+- name: size/XS
+  color: "3cbf00"
+  description: "Diff: 0–10 lines"
+- name: size/S
+  color: "5d9801"
+  description: "Diff: 11–50 lines"
+- name: size/M
+  color: "eebb00"
+  description: "Diff: 51–200 lines"
+- name: size/L
+  color: "ee9900"
+  description: "Diff: 201–800 lines"
+- name: size/XL
+  color: "ee5500"
+  description: "Diff: 800+ lines"

.github/pr-paths.yml

@@ -0,0 +1,73 @@
+# Path → label rules for actions/labeler@v6 (PR file paths).
+
+"area/render":
+  - changed-files:
+      - any-glob-to-any-file:
+          - render/**
+
+"area/protocol/kitty":
+  - changed-files:
+      - any-glob-to-any-file:
+          - render/kitty.go
+
+"area/protocol/sixel":
+  - changed-files:
+      - any-glob-to-any-file:
+          - render/sixel.go
+          - render/quantize.go
+
+"area/protocol/halfblock":
+  - changed-files:
+      - any-glob-to-any-file:
+          - render/halfblock.go
+
+"area/decode":
+  - changed-files:
+      - any-glob-to-any-file:
+          - decode/**
+
+"area/detect":
+  - changed-files:
+      - any-glob-to-any-file:
+          - detect/**
+
+"area/sandbox":
+  - changed-files:
+      - any-glob-to-any-file:
+          - sandbox/**
+
+"area/resize":
+  - changed-files:
+      - any-glob-to-any-file:
+          - internal/resize/**
+
+"area/docs":
+  - changed-files:
+      - any-glob-to-any-file:
+          - docs/**
+          - README.md
+          - "**/*.md"
+
+"area/build":
+  - changed-files:
+      - any-glob-to-any-file:
+          - .goreleaser*.yml
+          - .golangci.yml
+
+"ci":
+  - changed-files:
+      - any-glob-to-any-file:
+          - .github/workflows/**
+          - .github/labeler-config.yml
+          - .github/labeler-config-pr.yml
+          - .github/labels.yml
+          - .github/pr-paths.yml
+          - .github/release.yml
+
+"dependencies":
+  - changed-files:
+      - any-glob-to-any-file:
+          - go.mod
+          - go.sum
+          - docs/package.json
+          - docs/package-lock.json

.github/workflows/label-sync.yml

@@ -0,0 +1,64 @@
+name: "Label Sync"
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - .github/labels.yml
+      - .github/workflows/label-sync.yml
+  workflow_dispatch:
+    inputs:
+      prune:
+        description: "Delete labels not in labels.yml"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_TOKEN }}
+      LABELS_FILE: .github/labels.yml
+      PRUNE: ${{ github.event.inputs.prune || 'false' }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Upsert labels
+        run: |
+          set -euo pipefail
+          count=$(yq '. | length' "$LABELS_FILE")
+          for i in $(seq 0 $((count - 1))); do
+            name=$(yq ".[$i].name" "$LABELS_FILE")
+            color=$(yq ".[$i].color" "$LABELS_FILE")
+            description=$(yq ".[$i].description // \"\"" "$LABELS_FILE")
+            echo "::group::$name"
+            gh label create "$name" \
+              --repo "$GITHUB_REPOSITORY" \
+              --color "$color" \
+              --description "$description" \
+              --force
+            echo "::endgroup::"
+          done
+
+      - name: Prune extra labels
+        if: env.PRUNE == 'true'
+        run: |
+          set -euo pipefail
+          desired=$(yq -r '.[].name' "$LABELS_FILE" | sort -u)
+          current=$(gh label list --repo "$GITHUB_REPOSITORY" --limit 500 --json name -q '.[].name' | sort -u)
+          extras=$(comm -23 <(echo "$current") <(echo "$desired"))
+          if [ -z "$extras" ]; then
+            echo "No extra labels."
+            exit 0
+          fi
+          echo "Deleting:"
+          echo "$extras"
+          while IFS= read -r name; do
+            [ -z "$name" ] && continue
+            gh label delete "$name" --repo "$GITHUB_REPOSITORY" --yes
+          done <<< "$extras"

.github/workflows/labeler.yml

@@ -0,0 +1,38 @@
+name: "Labeler"
+
+on:
+  issues:
+    types: [opened, edited]
+  pull_request_target:
+    types: [opened, edited]
+
+jobs:
+  triage:
+    if: >
+      ${{ github.event_name == 'issues'
+          || !startsWith(github.event.pull_request.title, 'chore(deps):') }}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Apply Labels (issues — includes area/*)
+        if: github.event_name == 'issues'
+        uses: github/issue-labeler@v3.4
+        with:
+          repo-token: "${{ secrets.BOT_GITHUB_TOKEN }}"
+          configuration-path: .github/labeler-config.yml
+          enable-versioned-regex: 0
+          include-title: 1
+
+      - name: Apply Labels (PRs — no area/*, paths handle those)
+        if: github.event_name == 'pull_request_target'
+        uses: github/issue-labeler@v3.4
+        with:
+          repo-token: "${{ secrets.BOT_GITHUB_TOKEN }}"
+          configuration-path: .github/labeler-config-pr.yml
+          enable-versioned-regex: 0
+          include-title: 1