chore(automation): ensure status/need-triage is applied and never cleared automatically (#16657)

.github/scripts/backfill-need-triage.cjs

@@ -0,0 +1,138 @@
+/* eslint-disable */
+/* global require, console, process */
+
+/**
+ * Script to backfill the 'status/need-triage' label to all open issues
+ * that are NOT currently labeled with '🔒 maintainer only' or 'help wanted'.
+ */
+
+const { execFileSync } = require('child_process');
+
+const isDryRun = process.argv.includes('--dry-run');
+const REPO = 'google-gemini/gemini-cli';
+
+/**
+ * Executes a GitHub CLI command safely using an argument array to prevent command injection.
+ * @param {string[]} args
+ * @returns {string|null}
+ */
+function runGh(args) {
+  try {
+    // Using execFileSync with an array of arguments is safe as it doesn't use a shell.
+    // We set a large maxBuffer (10MB) to handle repositories with many issues.
+    return execFileSync('gh', args, {
+      encoding: 'utf8',
+      maxBuffer: 10 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+  } catch (error) {
+    const stderr = error.stderr ? ` Stderr: ${error.stderr.trim()}` : '';
+    console.error(
+      `❌ Error running gh ${args.join(' ')}: ${error.message}${stderr}`,
+    );
+    return null;
+  }
+}
+
+async function main() {
+  console.log('🔐 GitHub CLI security check...');
+  const authStatus = runGh(['auth', 'status']);
+  if (authStatus === null) {
+    console.error('❌ GitHub CLI (gh) is not installed or not authenticated.');
+    process.exit(1);
+  }
+
+  if (isDryRun) {
+    console.log('🧪 DRY RUN MODE ENABLED - No changes will be made.\n');
+  }
+
+  console.log(`🔍 Fetching and filtering open issues from ${REPO}...`);
+
+  // We use the /issues endpoint with pagination to bypass the 1000-result limit.
+  // The jq filter ensures we exclude PRs, maintainer-only, help-wanted, and existing status/need-triage.
+  const jqFilter =
+    '.[] | select(.pull_request == null) | select([.labels[].name] as $l | (any($l[]; . == "🔒 maintainer only") | not) and (any($l[]; . == "help wanted") | not) and (any($l[]; . == "status/need-triage") | not)) | {number: .number, title: .title}';
+
+  const output = runGh([
+    'api',
+    `repos/${REPO}/issues?state=open&per_page=100`,
+    '--paginate',
+    '--jq',
+    jqFilter,
+  ]);
+
+  if (output === null) {
+    process.exit(1);
+  }
+
+  const issues = output
+    .split('\n')
+    .filter((line) => line.trim())
+    .map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch (_e) {
+        console.error(`⚠️ Failed to parse line: ${line}`);
+        return null;
+      }
+    })
+    .filter(Boolean);
+
+  console.log(`✅ Found ${issues.length} issues matching criteria.`);
+
+  if (issues.length === 0) {
+    console.log('✨ No issues need backfilling.');
+    return;
+  }
+
+  let successCount = 0;
+  let failCount = 0;
+
+  if (isDryRun) {
+    for (const issue of issues) {
+      console.log(
+        `[DRY RUN] Would label issue #${issue.number}: ${issue.title}`,
+      );
+    }
+    successCount = issues.length;
+  } else {
+    console.log(`🏷️  Applying labels to ${issues.length} issues...`);
+
+    for (const issue of issues) {
+      const issueNumber = String(issue.number);
+      console.log(`🏷️  Labeling issue #${issueNumber}: ${issue.title}`);
+
+      const result = runGh([
+        'issue',
+        'edit',
+        issueNumber,
+        '--add-label',
+        'status/need-triage',
+        '--repo',
+        REPO,
+      ]);
+
+      if (result !== null) {
+        successCount++;
+      } else {
+        failCount++;
+      }
+    }
+  }
+
+  console.log(`\n📊 Summary:`);
+  console.log(`   - Success: ${successCount}`);
+  console.log(`   - Failed:  ${failCount}`);
+
+  if (failCount > 0) {
+    console.error(`\n❌ Backfill completed with ${failCount} errors.`);
+    process.exit(1);
+  } else {
+    console.log(`\n🎉 ${isDryRun ? 'Dry run' : 'Backfill'} complete!`);
+  }
+}
+
+main().catch((error) => {
+  console.error('❌ Unexpected error:', error);
+  process.exit(1);
+});

.github/scripts/pr-triage.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+# @license
+# Copyright 2026 Google LLC
+# SPDX-License-Identifier: Apache-2.0
+
 set -euo pipefail
 
 # Initialize a comma-separated string to hold PR numbers that need a comment
@@ -10,7 +14,7 @@ ISSUE_LABELS_CACHE_FLAT=""
 
 # Function to get area and priority labels from an issue (with caching)
 get_issue_labels() {
-    local ISSUE_NUM=$1
+    local ISSUE_NUM="${1}"
     if [[ -z "${ISSUE_NUM}" || "${ISSUE_NUM}" == "null" || "${ISSUE_NUM}" == "" ]]; then
         return
     fi
@@ -18,10 +22,13 @@ get_issue_labels() {
     # Check cache
     case " ${ISSUE_LABELS_CACHE_FLAT} " in
         *" ${ISSUE_NUM}:"*) 
-            local suffix="${ISSUE_LABELS_CACHE_FLAT#* ${ISSUE_NUM}:}"
+            local suffix="${ISSUE_LABELS_CACHE_FLAT#* " ${ISSUE_NUM}:"}"
             echo "${suffix%% *}"
             return
             ;; 
+        *)
+            # Cache miss, proceed to fetch
+            ;;
     esac
 
     echo "   📥 Fetching area and priority labels from issue #${ISSUE_NUM}" >&2
@@ -33,19 +40,19 @@ get_issue_labels() {
     fi
 
     local labels
-    labels=$(echo "${gh_output}" | grep -E "^(area|priority)/" | tr '\n' ',' | sed 's/,$//' || echo "")
+    labels=$(echo "${gh_output}" | grep -E '^(area|priority)/' | tr '\n' ',' | sed 's/,$//' || echo "")
     
     # Save to flat cache
     ISSUE_LABELS_CACHE_FLAT="${ISSUE_LABELS_CACHE_FLAT} ${ISSUE_NUM}:${labels}"
-    echo "$labels"
+    echo "${labels}"
 }
 
 # Function to process a single PR with pre-fetched data
 process_pr_optimized() {
-    local PR_NUMBER=$1
-    local IS_DRAFT=$2
-    local ISSUE_NUMBER=$3
-    local CURRENT_LABELS=$4 # Comma-separated labels
+    local PR_NUMBER="${1}"
+    local IS_DRAFT="${2}"
+    local ISSUE_NUMBER="${3}"
+    local CURRENT_LABELS="${4}" # Comma-separated labels
 
     echo "🔄 Processing PR #${PR_NUMBER}"
 
@@ -84,7 +91,7 @@ process_pr_optimized() {
         ISSUE_LABELS=$(get_issue_labels "${ISSUE_NUMBER}")
 
         if [[ -n "${ISSUE_LABELS}" ]]; then
-            local IFS_OLD=$IFS
+            local IFS_OLD="${IFS}"
             IFS=','
             for label in ${ISSUE_LABELS}; do
                 if [[ -n "${label}" ]] && [[ ",${CURRENT_LABELS}," != *",${label},"* ]]; then
@@ -94,8 +101,8 @@ process_pr_optimized() {
                         LABELS_TO_ADD="${LABELS_TO_ADD},${label}"
                     fi
                 fi
-            done
-            IFS=$IFS_OLD
+done
+            IFS="${IFS_OLD}"
         fi
 
         if [[ -z "${LABELS_TO_ADD}" && -z "${LABELS_TO_REMOVE}" ]]; then
@@ -135,7 +142,7 @@ JQ_EXTRACT_FIELDS='{
     labels: [.labels[].name] | join(",")
 }'
 
-JQ_TSV_FORMAT='"\((.number | tostring))\t\(.isDraft)\t\((.issue // "null") | tostring)\t\(.labels)"'
+JQ_TSV_FORMAT='"\((.number | tostring))\t\(.isDraft)\t\((.issue // \"null\") | tostring)\t\(.labels)"' # Corrected escaping for quotes within the string literal
 
 if [[ -n "${PR_NUMBER:-}" ]]; then
     echo "🔄 Processing single PR #${PR_NUMBER}"
@@ -144,9 +151,9 @@ if [[ -n "${PR_NUMBER:-}" ]]; then
         exit 1
     }
     
-    line=$(echo "$PR_DATA" | jq -r "$JQ_EXTRACT_FIELDS | $JQ_TSV_FORMAT")
-    IFS=$'\t' read -r pr_num is_draft issue_num current_labels <<< "$line"
-    process_pr_optimized "$pr_num" "$is_draft" "$issue_num" "$current_labels"
+    line=$(echo "${PR_DATA}" | jq -r "${JQ_EXTRACT_FIELDS} | ${JQ_TSV_FORMAT}")
+    IFS=$'\t' read -r pr_num is_draft issue_num current_labels <<< "${line}"
+    process_pr_optimized "${pr_num}" "${is_draft}" "${issue_num}" "${current_labels}"
 else
     echo "📥 Getting all open pull requests..."
     PR_DATA_ALL=$(gh pr list --repo "${GITHUB_REPOSITORY}" --state open --limit 1000 --json number,closingIssuesReferences,isDraft,body,labels 2>/dev/null) || {
@@ -157,11 +164,15 @@ else
     PR_COUNT=$(echo "${PR_DATA_ALL}" | jq '. | length')
     echo "📊 Found ${PR_COUNT} open PRs to process"
 
+    # Use a temporary file to avoid masking exit codes in process substitution
+    tmp_file=$(mktemp)
+    echo "${PR_DATA_ALL}" | jq -r ".[] | ${JQ_EXTRACT_FIELDS} | ${JQ_TSV_FORMAT}" > "${tmp_file}"
     while read -r line; do
-        [[ -z "$line" ]] && continue
-        IFS=$'\t' read -r pr_num is_draft issue_num current_labels <<< "$line"
-        process_pr_optimized "$pr_num" "$is_draft" "$issue_num" "$current_labels"
-    done < <(echo "${PR_DATA_ALL}" | jq -r ".[] | $JQ_EXTRACT_FIELDS | $JQ_TSV_FORMAT")
+        [[ -z "${line}" ]] && continue
+        IFS=$'\t' read -r pr_num is_draft issue_num current_labels <<< "${line}"
+        process_pr_optimized "${pr_num}" "${is_draft}" "${issue_num}" "${current_labels}"
+    done < "${tmp_file}"
+    rm -f "${tmp_file}"
 fi
 
 if [[ -z "${PRS_NEEDING_COMMENT}" ]]; then
@@ -170,4 +181,4 @@ else
     echo "prs_needing_comment=[${PRS_NEEDING_COMMENT}]" >> "${GITHUB_OUTPUT}"
 fi
 
-echo "✅ PR triage completed"
+echo "✅ PR triage completed"