Before you dive in
What you’ll find in the original
- Resolve the live base ref and compare its immutable SHA with the PR head; report the base, head, and merge-base SHAs, then abort if the base or PR snapshot moves before labels are written.
- Abstain when evidence is incomplete, unsupported, ambiguous, or below threshold; preserve manual type and size labels, keep hierarchical updates add-only, and never auto-propose manual workflow labels.
- Run only the reviewed, full-SHA-pinned action code on a fresh hosted runner: never check out or execute PR code, and never let labels authorize merges, deployments, security exceptions, or other privileged actions.
Worth knowing
PR text and patches remain untrusted and are sent to OpenRouter/TypeSafe. GitHub label writes are non-atomic and preservation is best-effort; classifications can be wrong, so this is triage assistance rather than merge authorization. No live labeling run was performed for this review.