set label on PR based on check result

[fakeboboliu]

A simple improvement of psltool, may fix #2352

not all error has its corresponding label for now, but I leave slots for them in this 5-minute work.

[simon-friedberger]

Before I go through my very exhausting process of forking this repo and then forking it again with a different account, is there a simple way to test this?

[fakeboboliu]

Before I go through my very exhausting process of forking this repo and then forking it again with a different account, is there a simple way to test this?

I'll try to show a test and procedure recently, sorry for no response this weekend, I lubed my keyboards.

[fakeboboliu]

tests are done here:

fakeboboliu#4

[simon-friedberger]

Let's see how it breaks. ;)

[fakeboboliu]

A good sample appears immediately: #2370
Seems we'd better detect if there're any updates to PRIVATE.

This can be done like this:

diff --git a/tools/psltool/psltool.go b/tools/psltool/psltool.go
index 3c22125..7b94c14 100644
--- a/tools/psltool/psltool.go
+++ b/tools/psltool/psltool.go
@@ -261,12 +261,6 @@ func runCheckPR(env *command.Env, prStr string) error {
 		errs = append(errs, ErrReformat)
 	}
 
-	// Label the PR base on our errors
-	labels := errorsToLabels(errs)
-	if err := client.LabelPullRequest(env.Context(), pr, labels); err != nil {
-		return fmt.Errorf("failed to set labels on PR: %w", err)
-	}
-
 	// Print the blocks marked changed, so a human can check that
 	// something was actually checked by validations.
 	var changed []*parser.Suffixes
@@ -282,6 +276,12 @@ func runCheckPR(env *command.Env, prStr string) error {
 		for _, block := range changed {
 			fmt.Fprintf(env, "  %q (%s)\n", block.Info.Name, block.LocationString())
 		}
+
+		// Label the PR base on our errors
+		labels := errorsToLabels(errs)
+		if err := client.LabelPullRequest(env.Context(), pr, labels); err != nil {
+			return fmt.Errorf("failed to set labels on PR: %w", err)
+		}
 	}
 	io.WriteString(env, "\n")
 

[groundcat]

It appears that #2371 just ran into an error🤔

https://github.com/publicsuffix/list/actions/runs/12876682210/job/35900027137

Error: failed to set labels on PR: PUT https://api.github.com/repos/publicsuffix/list/issues/2371/labels: 403 Resource not accessible by integration []
exit status 1

About this error:
https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/resource-not-accessible

[fakeboboliu]

It appears that #2371 just ran into an error🤔

https://github.com/publicsuffix/list/actions/runs/12876682210/job/35900027137

Error: failed to set labels on PR: PUT https://api.github.com/repos/publicsuffix/list/issues/2371/labels: 403 Resource not accessible by integration []
exit status 1

About this error: https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/resource-not-accessible

That's weird, you are not dependabot, and our scan is also done with a configured fine permission in its YAML.

Maybe there're some switchs in GitHub repo's settings needed, I'll try to reproduce it by use a new org and tune every configuration in the panel.