From 0842f2f42001087d621b1ae2d09d9bed72e69a44 Mon Sep 17 00:00:00 2001 From: Jashan Pratap Singh Date: Wed, 9 Sep 2026 10:57:32 -0400 Subject: [PATCH 1/2] Add GitHub Actions workflow for auto-labeling issues --- .github/workflows/repo-community-labeling.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/repo-community-labeling.yml diff --git a/.github/workflows/repo-community-labeling.yml b/.github/workflows/repo-community-labeling.yml new file mode 100644 index 0000000..5e548ae --- /dev/null +++ b/.github/workflows/repo-community-labeling.yml @@ -0,0 +1,18 @@ +name: "Auto-label Community Issues" + +on: + issues: + types: [opened] + pull_request: + types: [opened] + +permissions: + contents: read + issues: write + pull-requests: write + +jobs: + community-labeling: + uses: tenstorrent/tt-github-actions/.github/workflows/issues-community-autotag.yml@main + secrets: + AUTOLABEL_COMMUNITY_ISSUES: ${{ secrets.AUTOLABEL_COMMUNITY_ISSUES }} From 79438789402e47d6a56ac28a8cbfc2d64ca61bf0 Mon Sep 17 00:00:00 2001 From: Eric Zietlow Date: Mon, 14 Sep 2026 16:29:03 +0000 Subject: [PATCH 2/2] ci: drop the superseded community-issue-tagging workflow #79 merged `community-issue-tagging.yml`, which calls the older `on-community-issue.yml`. This PR adds `repo-community-labeling.yml`, which calls `issues-community-autotag.yml`. Both fire on `issues: [opened]` and `pull_request: [opened]`, so keeping both runs two community-labelling jobs on every new issue and PR. The one removed here is the dead one, and its own upstream says so: - `on-community-issue.yml`'s "Add community label" step is still commented out (line 55, unchanged since 2025-08-18), so it only prints debug output; - it reads `secrets.TT_BOT_ORG_MEMBERS_READ_TOKEN` without declaring it under `workflow_call.secrets`, and the caller passes no secrets and does not use `secrets: inherit`, so the token resolves EMPTY, the membership curl 401s and every author is classified a community member. Confirmed in production: tt-studio run 34095486994 and tt-forge run 33954443282 both log "HTTP Status: 401 / Detected community member" for Tenstorrent employees. `issues-community-autotag.yml` declares `AUTOLABEL_COMMUNITY_ISSUES` as a required `workflow_call` secret, this caller passes exactly that, and it actually applies the label (`gh issue edit --add-label`). It is also the version the org is migrating to: tt-flash and tt-kmd have both replaced the contents of their `community-issue-tagging.yml` with this same caller. `repo-community-labeling.yml` is left byte-identical to the org template at tenstorrent/.github, deliberately, so it keeps picking up upstream changes. Verified the caller/callee contract mechanically for both pairs -- required secrets passed, none passed that the callee does not declare, no required inputs omitted, caller permissions >= the callee job's, and no secret USED by the callee without being declared+passed. The new pair passes all five; the pair being deleted fails two of them, including the used-but-undeclared secret above. Co-Authored-By: Claude Opus 5 --- .github/workflows/community-issue-tagging.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 .github/workflows/community-issue-tagging.yml diff --git a/.github/workflows/community-issue-tagging.yml b/.github/workflows/community-issue-tagging.yml deleted file mode 100644 index ef1330d..0000000 --- a/.github/workflows/community-issue-tagging.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: "Community Issue / PR Labeling Workflow" - -on: - issues: - types: [opened] - pull_request: - types: [opened] - -jobs: - call-central-workflow: - uses: tenstorrent/tt-github-actions/.github/workflows/on-community-issue.yml@main -