fix: modernize GHA workflow and set appropriate permissions

.github/workflows/test.yml

@@ -1,19 +1,28 @@
 name: Test
 
-on: [push, pull_request]
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
 
     strategy:
       matrix:
-        node-version: [14.x, 15.x]
+        node-version: [lts/*, latest]
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v2.1.2
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
       - run: npm ci
@@ -23,27 +32,29 @@ jobs:
   # whenever changes are made that effects the `dist/index.js` bundle.
   release:
     needs: tests
-    runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+    runs-on: ubuntu-slim
+    if: github.ref == 'refs/heads/main' && github.repository == 'nodejs/node-pr-labeler'
 
     env:
       TAG: v1
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: true
       - name: Setup Node.js
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v7
         with:
-          node-version: 14.x
+          node-version: lts/*
 
-      - name: npm install and build
-        run: |
-          npm ci
-          npm run build
+      - run: npm ci
+      - run: npm run build
 
       - name: Check if dist/ has changed after build
         id: changedTest
-        run: git diff --quiet HEAD -- dist/ || echo "::set-output name=hasChanged::true"
+        run: git diff --quiet HEAD -- dist/ || echo "hasChanged=true" >> "$GITHUB_OUTPUT"
 
       - name: Commit and update tag
         if: ${{ steps.changedTest.outputs.hasChanged == 'true' }}

.gitignore

@@ -4,4 +4,5 @@ npm-debug.log
 .DS_Store
 .env
 .vscode
+.tap
 .nyc_output

action.yml

@@ -10,5 +10,5 @@ inputs:
     description: 'The path inside the target repository where the .yml config file with filepaths -> labels mapping exists.'
     required: true
 runs:
-  using: 'node12'
+  using: 'node24'
   main: 'dist/index.js'

dist/index.js

@@ -145,7 +145,7 @@ async function fetchExistingLabels (options) {
 async function fetchLabelPages (options) {
   // the github client API is somewhat misleading,
   // this fetches *all* repo labels not just for an issue
-  const listLabelsOptions = await options.client.issues.listLabelsForRepo.endpoint.merge({
+  const listLabelsOptions = await options.client.rest.issues.listLabelsForRepo.endpoint.merge({
     owner: options.owner,
     repo: options.repo,
     per_page: 100

index.js

@@ -1,10 +1,9 @@
 'use strict'
 
-const github = require('@actions/github')
-const core = require('@actions/core')
 const nodeRepo = require('./lib/node-repo')
 
 async function run () {
+  const [github, core] = await Promise.all([import('@actions/github'), import('@actions/core')])
   try {
     const token = core.getInput('repo-token', { required: true })
     const configPath = core.getInput('configuration-path', { required: true })
@@ -18,7 +17,7 @@ async function run () {
     const { owner, repo } = github.context.repo
     const prId = pullRequest.number
     const baseBranch = pullRequest.base.ref
-    const configAsString = await fetchConfig(client, owner, repo, configPath)
+    const configAsString = await fetchConfig(github, client, owner, repo, configPath)
 
     await nodeRepo.resolveLabelsThenUpdatePr({
       baseBranch,
@@ -35,12 +34,13 @@ async function run () {
 }
 
 async function fetchConfig (
+  github,
   client,
   owner,
   repo,
   filepath
 ) {
-  const response = await client.repos.getContent({
+  const response = await client.rest.repos.getContent({
     owner,
     repo,
     path: filepath,

lib/node-repo.js

@@ -2,24 +2,42 @@
 
 /* eslint-disable camelcase */
 
-const core = require('@actions/core')
-const Aigle = require('aigle')
+const { setTimeout } = require('node:timers/promises')
 
 const resolveLabels = require('./resolve-labels')
 
+let _core
+async function getGHCore () {
+  _core ??= await import('@actions/core')
+  return _core
+}
+
 const fiveSeconds = 5 * 1000
 
+async function retry ({ times = 1, interval }, fn) {
+  const errors = []
+  for (let i = 0; i < times; i++) {
+    if (i) await setTimeout(interval)
+    try {
+      return await fn()
+    } catch (err) {
+      errors.push(err)
+    }
+  }
+  throw new AggregateError(errors, `Failed after ${times} attempts`)
+}
+
 async function resolveLabelsThenUpdatePr (options) {
   const times = options.retries || 5
   const interval = options.retryInterval || fiveSeconds
-  const retry = fn => Aigle.retry({ times, interval }, fn)
 
-  const filepathsChanged = await retry(() => listFiles({
+  const filepathsChanged = await retry({ times, interval }, () => listFiles({
     client: options.client,
     owner: options.owner,
     repo: options.repo,
     pull_number: options.prId
   }))
+  const core = await getGHCore()
   core.debug('Fetching PR files for labelling')
 
   const resolvedLabels = resolveLabels(filepathsChanged, options.baseBranch, options.configAsString)
@@ -28,6 +46,7 @@ async function resolveLabelsThenUpdatePr (options) {
 }
 
 async function fetchExistingThenUpdatePr (options, labels) {
+  const core = await getGHCore()
   try {
     const existingLabels = await fetchExistingLabels(options)
     const labelsToAdd = stringsInCommon(existingLabels, labels)
@@ -49,14 +68,15 @@ async function updatePrWithLabels (options, labels) {
     return
   }
 
+  const core = await getGHCore()
   core.debug('Trying to add labels: ' + labels)
 
   try {
-    await options.client.issues.addLabels({
+    await options.client.rest.issues.addLabels({
       owner: options.owner,
       repo: options.repo,
       issue_number: options.prId,
-      labels: labels
+      labels
     })
 
     core.info('Added labels: ' + labels)
@@ -76,7 +96,7 @@ async function fetchExistingLabels (options) {
 async function fetchLabelPages (options) {
   // the github client API is somewhat misleading,
   // this fetches *all* repo labels not just for an issue
-  const listLabelsOptions = await options.client.issues.listLabelsForRepo.endpoint.merge({
+  const listLabelsOptions = await options.client.rest.issues.listLabelsForRepo.endpoint.merge({
     owner: options.owner,
     repo: options.repo,
     per_page: 100
@@ -94,14 +114,14 @@ function stringsInCommon (arr1, arr2) {
 
 async function listFiles ({ owner, repo, pull_number, client }) {
   try {
-    const response = await client.pulls.listFiles({
+    const response = await client.rest.pulls.listFiles({
       owner,
       repo,
       pull_number
     })
     return response.data.map(({ filename }) => filename)
   } catch (err) {
-    core.error('Error retrieving files from GitHub: ' + err)
+    (await getGHCore()).error('Error retrieving files from GitHub: ' + err)
     throw err
   }
 }