Migrate label automation

.github/ISSUE_TEMPLATE/bug.md

@@ -2,7 +2,7 @@
 name: Bug Report
 about: Report a bug in Hyperlight
 title: ''
-labels: bug
+labels: C-bug
 assignees: ''
 ---
 

.github/dependabot.yml

@@ -8,7 +8,7 @@ updates:
       interval: "daily"
       time: "03:00"
     labels:
-      - "kind/dependencies"
+      - "C-deps"
   - package-ecosystem: "cargo"
     directory: "/"
     cooldown:
@@ -17,7 +17,7 @@ updates:
       interval: "daily"
       time: "03:00"
     labels:
-      - "kind/dependencies"
+      - "C-deps"
     open-pull-requests-limit: 20
     groups:
       windows:
@@ -40,8 +40,7 @@ updates:
       interval: "daily"
       time: "03:00"
     labels:
-      - "kind/dependencies"
-      - "area/guest"
+      - "C-deps"
     open-pull-requests-limit: 5
     groups:
       windows:

.github/release.yml

@@ -7,7 +7,7 @@ changelog:
         - "*"
       exclude:
         labels:
-          - kind/dependencies
+          - C-deps
     - title: Full Changelog (dependencies)
       labels:
-        - kind/dependencies
+        - C-deps

.github/workflows/Coverage.yml

@@ -94,6 +94,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Coverage Failure
-        run: ./dev/notify-ci-failure.sh --title="Weekly Coverage Failure - ${{ github.run_number }}" --labels="area/ci-periodics,area/testing,lifecycle/needs-review"
+        run: ./dev/notify-ci-failure.sh --title="Weekly Coverage Failure - ${{ github.run_number }}" --labels="A-ci-periodics,A-testing,S-needs-triage"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/DailyArm64.yml

@@ -102,9 +102,9 @@ jobs:
       timeout_minutes: 35 # 5 minutes fuzzing plus setup and build on slower arm64 runners
 
   # File (or update) a release-blocking GitHub issue if any job fails. The first
-  # label (area/ci-periodics-aarch64) is the de-duplication key used by
+  # label (A-ci-periodics-aarch64) is the de-duplication key used by
   # notify-ci-failure.sh, so this workflow maintains its own issue lineage and is
-  # guaranteed to carry release-blocker, instead of commenting on another periodic
+  # guaranteed to carry P-release-blocker, instead of commenting on another periodic
   # job's issue. NOTE: that label must exist in the repo (Issues -> Labels) or the
   # `gh issue create` call will fail.
   notify-failure:
@@ -121,6 +121,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Daily aarch64 Failure
-        run: ./dev/notify-ci-failure.sh --title="Daily aarch64 Failure - ${{ github.run_number }}" --labels="area/ci-periodics-aarch64,area/ci-periodics,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --title="Daily aarch64 Failure - ${{ github.run_number }}" --labels="A-ci-periodics-aarch64,A-ci-periodics,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/DailyBenchmarks.yml

@@ -66,6 +66,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Benchmark Failure
-        run: ./dev/notify-ci-failure.sh --title="Benchmark Failure - ${{ github.run_number }}" --labels="area/benchmarks,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --title="Benchmark Failure - ${{ github.run_number }}" --labels="A-perf,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/Fuzzing.yml

@@ -44,6 +44,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Fuzzing Failure
-        run: ./dev/notify-ci-failure.sh --labels="area/fuzzing,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --labels="A-fuzzing,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/IssueLabelChecker.yml

@@ -14,22 +14,12 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
     - name: Check and Add label
       run: |
-        # The cryptic head -c -1 is because otherwise gh always terminates output with a newline
-        readarray -d $'\0' lifecycles < <(gh issue view ${{ github.event.issue.number }} --json labels -q '[.labels[] | .name | select(startswith("lifecycle/"))] | join("\u0000")' | head -c -1)
-        if [[ ${#lifecycles[@]} -ne 1 ]]; then
-          if [[ ${#lifecycles[@]} -ge 1 ]]; then
-            echo 'Too many lifecycle labels; replacing all with `lifecycle/needs-review`'
-          fi
-          commands=()
-          for label in "${lifecycles[@]}"; do
-            if [[ "$label" != "lifecycle/needs-review" ]]; then
-              echo "Removing label ${label}"
-              commands+=("--remove-label" "${label}")
-            fi
-          done
-          echo 'Adding `lifecycle/needs review`'
-          commands+=("--add-label" "lifecycle/needs-review")
-          gh issue edit ${{ github.event.issue.number }} "${commands[@]}"
+        # Preserve existing statuses and add S-needs-triage only when none is present.
+        set -euo pipefail
+        HAS_STATUS="$(gh issue view ${{ github.event.issue.number }} --json labels \
+          -q 'any(.labels[].name; startswith("S-"))')"
+        if [[ "$HAS_STATUS" == "false" ]]; then
+          gh issue edit ${{ github.event.issue.number }} --add-label S-needs-triage
         fi
       env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/PRLabelChecker.yml

@@ -12,17 +12,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - name: Ensure exactly one "kind/*" label is applied
+      - name: Ensure exactly one "C-*" (Category) label is applied
         run: |
-          # Count the number of "kind/*" labels directly from the PR labels
+          # Count the number of "C-*" labels directly from the PR labels
           PR_NUMBER=${{ github.event.pull_request.number }}
-          KIND_LABEL_COUNT=$(gh pr view "$PR_NUMBER" --json labels -q '.labels.[].name' | grep -c '^kind/')
+          KIND_LABEL_COUNT=$(gh pr view "$PR_NUMBER" --json labels -q '.labels.[].name' | grep -c '^C-')
 
           if [[ "$KIND_LABEL_COUNT" -eq 1 ]]; then
-            echo "✅ Exactly one 'kind/*' label is applied."
+            echo "✅ Exactly one 'C-*' label is applied."
             exit 0
           else
-            echo "❌ PR must have exactly one 'kind/*' label, but found $KIND_LABEL_COUNT."
+            echo "❌ PR must have exactly one 'C-*' label, but found $KIND_LABEL_COUNT."
             exit 1
           fi
         env:

.github/workflows/ReleaseBlockerCheck.yml

@@ -34,7 +34,7 @@ jobs:
           if [[ "${{ github.ref }}" == *"refs/heads/release/"* ]]; then
             echo "Release branch detected - checking for release blockers..."
             if ! ./dev/check-release-blockers.sh "$REPO"; then
-              echo "::error::Release blocked by open issues with 'release-blocker' label"
+              echo "::error::Release blocked by open issues with P-release-blocker"
               exit 1
             fi
           else

.github/workflows/ReleaseBlockerLabelCleanUp.yml

@@ -14,20 +14,20 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - name: Remove release-blocker label from closed issue
+      - name: Remove P-release-blocker label from closed issue
         run: |
           ISSUE_NUMBER=${{ github.event.issue.number }}
-          echo "Checking if issue #$ISSUE_NUMBER has release-blocker label..."
+          echo "Checking if issue #$ISSUE_NUMBER has P-release-blocker label..."
 
-          # Check if the issue has the release-blocker label
-          HAS_LABEL=$(gh issue view "$ISSUE_NUMBER" --json labels -q '.labels[] | select(.name == "release-blocker") | .name')
+          # Check if the issue has the P-release-blocker label
+          HAS_LABEL=$(gh issue view "$ISSUE_NUMBER" --json labels -q '.labels[] | select(.name == "P-release-blocker") | .name')
 
           if [ -n "$HAS_LABEL" ]; then
-            echo "✅ Issue #$ISSUE_NUMBER has release-blocker label, removing it..."
-            gh issue edit "$ISSUE_NUMBER" --remove-label "release-blocker"
-            echo "✅ Successfully removed release-blocker label from issue #$ISSUE_NUMBER"
+            echo "✅ Issue #$ISSUE_NUMBER has P-release-blocker label, removing it..."
+            gh issue edit "$ISSUE_NUMBER" --remove-label "P-release-blocker"
+            echo "✅ Successfully removed P-release-blocker label from issue #$ISSUE_NUMBER"
           else
-            echo "ℹ️ Issue #$ISSUE_NUMBER does not have release-blocker label, no action needed"
+            echo "ℹ️ Issue #$ISSUE_NUMBER does not have P-release-blocker label, no action needed"
           fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/RustNightly.yml

@@ -124,6 +124,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Nightly Failure
-        run: ./dev/notify-ci-failure.sh --title="Nightly musl Failure - ${{ github.run_number }}" --labels="area/ci-periodics-nightly,area/ci-periodics,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --title="Nightly musl Failure - ${{ github.run_number }}" --labels="A-ci-periodics-nightly,A-ci-periodics,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ValidatePullRequest.yml

@@ -98,7 +98,7 @@ jobs:
     with:
       docs_only: ${{ needs.docs-pr.outputs.docs-only }}
 
-  # Pick the goldens mode. The `regen-goldens` label means regenerate. No label means pull.
+  # Pick the goldens mode. The `S-needs-goldens` label means regenerate. No label means pull.
   # Also validate the label against the goldens state so a stale or missing label fails fast.
   check-golden-label:
     runs-on: ubuntu-latest
@@ -135,13 +135,13 @@ jobs:
         run: |
           labels="$(gh pr view ${{ github.event.pull_request.number }} \
             --repo ${{ github.repository }} --json labels -q '.labels[].name')"
-          if grep -qx regen-goldens <<<"$labels"; then
+          if grep -qx S-needs-goldens <<<"$labels"; then
             echo "should_regen_goldens=true" >> "$GITHUB_OUTPUT"
           else
             echo "should_regen_goldens=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Validate regen-goldens label
+      - name: Validate S-needs-goldens label
         if: github.event_name == 'pull_request'
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}

.github/workflows/WeeklyMshv618.yml

@@ -79,6 +79,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Notify Weekly MSHV 6.18 Failure
-        run: ./dev/notify-ci-failure.sh --title="Weekly MSHV 6.18 Failure - ${{ github.run_number }}" --labels="area/ci-periodics-mshv-6.18,area/ci-periodics,area/testing,lifecycle/needs-review,release-blocker"
+        run: ./dev/notify-ci-failure.sh --title="Weekly MSHV 6.18 Failure - ${{ github.run_number }}" --labels="A-ci-periodics-mshv-6.18,A-ci-periodics,A-testing,S-needs-triage,P-release-blocker"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ready-for-review-label.yml

@@ -1,6 +1,6 @@
 name: Ready-for-review (collect)
 
-# Stage 1 of a two-stage pipeline that removes the "ready-for-review" label from
+# Stage 1 of a two-stage pipeline that removes the "S-needs-review" label from
 # a pull request once it is no longer awaiting review.
 #
 # Pull-request and review events originating from FORKED repositories only ever

.github/workflows/ready-for-review-manage.yml

@@ -1,6 +1,6 @@
 name: Ready-for-review (manage)
 
-# Stage 2 of the two-stage "ready-for-review" label pipeline. It is triggered
+# Stage 2 of the two-stage "S-needs-review" label pipeline. It is triggered
 # when "Ready-for-review (collect)" completes and runs in the context of the
 # base repository's default branch, so it receives a read-write GITHUB_TOKEN
 # even when the originating event came from a fork. This is what lets us remove
@@ -69,5 +69,7 @@ jobs:
     # Shared workflow in the org-wide `.github` repository, pinned to a commit SHA.
     uses: hyperlight-dev/.github/.github/workflows/manage-ready-for-review.yml@e5e471d927d3a72676ab48433da8a99d15a32ad7
     with:
+      # TODO: Remove this override once the shared workflow defaults to S-needs-review.
+      label: S-needs-review
       # fromJSON turns the validated digit-string into a numeric input.
       pr-number: ${{ fromJSON(needs.read-pr.outputs.pr_number) }}

Justfile

@@ -772,7 +772,7 @@ snapshot-goldens-regenerate target=default-target:
     mkdir -p target/snapshot-goldens
     cp -r "${layout}" "${dest}"
 
-# Validate the regen-goldens label against the goldens state.
+# Validate the S-needs-goldens label against the goldens state.
 # has_label is true when a PR carries the label. The label is set
 # when the current GOLDENS_VERSION was bumped and is not published.
 # base_ref is the git ref to diff the version against.
@@ -788,17 +788,17 @@ snapshot-goldens-check-label has_label base_ref image=default-snapshot-goldens-i
         base_version=""
         git cat-file -e "{{ base_ref }}:${version_file}" 2>/dev/null && base_version=$(git show "{{ base_ref }}:${version_file}" | parse_version)
         if [[ "${version}" == "${base_version}" ]]; then
-            echo "::error::regen-goldens is set but GOLDENS_VERSION is unchanged from {{ base_ref }} (${version}). A regen accompanies a version bump. Remove the label or bump the version." >&2
+            echo "::error::S-needs-goldens is set but GOLDENS_VERSION is unchanged from {{ base_ref }} (${version}). A regen accompanies a version bump. Remove the label or bump the version." >&2
             exit 1
         fi
         if published "${version}"; then
-            echo "::error::regen-goldens is set but goldens for ${version} are already published. Remove the label so CI verifies against the published goldens." >&2
+            echo "::error::S-needs-goldens is set but goldens for ${version} are already published. Remove the label so CI verifies against the published goldens." >&2
             exit 1
         fi
         echo "snapshot-goldens-check-label: OK. ${version} bumped from ${base_version} and not yet published."
     else
         if ! published "${version}"; then
-            echo "::error::goldens for ${version} are not published. Add the regen-goldens label, or run RegenSnapshotGoldens first." >&2
+            echo "::error::goldens for ${version} are not published. Add S-needs-goldens, or run RegenSnapshotGoldens first." >&2
             exit 1
         fi
         echo "snapshot-goldens-check-label: OK. ${version} is published."

dev/check-release-blockers.sh

@@ -5,7 +5,7 @@ set -o pipefail
 
 ## DESCRIPTION:
 ##
-## This script checks for open issues with the 'release-blocker' label
+## This script checks for open issues with the 'P-release-blocker' label
 ## in a given GitHub repository. It exits with code 1 if any blocking
 ## issues are found, or 0 if none are found.
 ##
@@ -28,17 +28,17 @@ if [ -z "${1:-}" ]; then
 fi
 
 REPO="$1"
-echo "Checking for open issues with 'release-blocker' label in $REPO..."
+echo "Checking for open issues with 'P-release-blocker' label in $REPO..."
 
 # Extract owner and repo name from the argument
 OWNER=$(echo "$REPO" | cut -d'/' -f1)
 REPO_NAME=$(echo "$REPO" | cut -d'/' -f2)
 
-# Get all open issues with release-blocker label
+# Get all open issues with P-release-blocker label
 BLOCKING_ISSUES=$(gh api graphql -f query='
   query($owner: String!, $repo: String!) {
     repository(owner: $owner, name: $repo) {
-      issues(first: 100, states: OPEN, labels: ["release-blocker"]) {
+      issues(first: 100, states: OPEN, labels: ["P-release-blocker"]) {
         totalCount
         nodes {
           number
@@ -55,7 +55,7 @@ if [ "$BLOCKER_COUNT" -gt 0 ]; then
     echo "❌ Found $BLOCKER_COUNT open release-blocking issue(s):"
     echo "$BLOCKING_ISSUES" | jq -r '.nodes[] | "  - #\(.number): \(.title) (\(.url))"'
     echo ""
-    echo "Release blocked by open issue(s) with 'release-blocker' label"
+    echo "Release blocked by open issue(s) with 'P-release-blocker' label"
     exit 1
 else
     echo "✅ No open release blocking issues found"

dev/notify-ci-failure.sh

@@ -20,16 +20,16 @@ set -o pipefail
 ## 
 ## Usage examples:
 ##   ./dev/notify-fuzzing-failure.sh
-##   ./dev/notify-fuzzing-failure.sh --title="Nightly Failure" --labels="area/testing,kind/bug"
+##   ./dev/notify-fuzzing-failure.sh --title="Nightly Failure" --labels="A-testing,C-bug"
 ##   ./dev/notify-fuzzing-failure.sh --test
 ## Run this script locally like:
-##   GITHUB_REPOSITORY="fork/hyperlight" GITHUB_RUN_ID=1 ./dev/notify-fuzzing-failure.sh --title="Nightly Failure" --labels="area/testing,kind/bug"
+##   GITHUB_REPOSITORY="fork/hyperlight" GITHUB_RUN_ID=1 ./dev/notify-fuzzing-failure.sh --title="Nightly Failure" --labels="A-testing,C-bug"
 
 REPO="${GITHUB_REPOSITORY:-hyperlight-dev/hyperlight}"
 WORKFLOW_RUN_URL="${GITHUB_SERVER_URL:-https://github.com}/${REPO}/actions/runs/${GITHUB_RUN_ID:-unknown}"
 TEST_MODE=false
 ISSUE_TITLE=""
-LABELS="area/testing,kind/bug,area/fuzzing,lifecycle/needs-review"
+LABELS="A-testing,C-bug,A-fuzzing,S-needs-triage"
 
 for arg in "$@"; do
     case $arg in
@@ -53,7 +53,7 @@ done
 IFS=',' read -r -a LABEL_ARRAY <<< "$LABELS"
 
 # Choose a label to search existing issues for; prefer the first label if present
-SEARCH_LABEL="${LABEL_ARRAY[0]:-area/fuzzing}"
+SEARCH_LABEL="${LABEL_ARRAY[0]:-A-fuzzing}"
 
 # Build issue title if not provided
 if [ -z "$ISSUE_TITLE" ]; then

docs/how-to-make-releases.md

@@ -4,7 +4,7 @@ This document details the process of releasing a new version of Hyperlight to [c
 
 ## Resolve any release blockers
 
-Before starting the release process, check for open issues labeled `release-blocker` in the [issue tracker](https://github.com/hyperlight-dev/hyperlight/issues?q=is%3Aissue+is%3Aopen+label%3Arelease-blocker). All such issues must be resolved (closed) before proceeding — the ["Create a Release"](https://github.com/hyperlight-dev/hyperlight/actions/workflows/CreateRelease.yml) workflow runs a [release blocker check](https://github.com/hyperlight-dev/hyperlight/actions/workflows/ReleaseBlockerCheck.yml) as its first step, and all subsequent jobs depend on it, so the publish will fail if any `release-blocker` issues remain open.
+Before starting the release process, check for open issues labeled `P-release-blocker` in the [issue tracker](https://github.com/hyperlight-dev/hyperlight/issues?q=is%3Aissue+is%3Aopen+label%3AP-release-blocker). All such issues must be resolved (closed) before proceeding — the ["Create a Release"](https://github.com/hyperlight-dev/hyperlight/actions/workflows/CreateRelease.yml) workflow runs a [release blocker check](https://github.com/hyperlight-dev/hyperlight/actions/workflows/ReleaseBlockerCheck.yml) as its first step, and all subsequent jobs depend on it, so the publish will fail if any `P-release-blocker` issues remain open.
 
 ## Update Cargo.toml Versions