chore: area labels as code, auto-labeling and current issue forms

[HardMax71]

The repo had only GitHub's default labels and Dependabot's, nothing for subsystems, and the two issue forms offered different Component lists that matched nothing. I've created eight area: labels plus security and put them on all open issues. This PR makes them stick.

Labels are code now. .github/labels.yml lists every label in the repo, generated from the live set, so the first sync changes nothing. Label Sync runs crazy-max/ghaction-github-labeler on main, on Mondays and by hand, and makes the repo match the file. That includes deleting a label the file doesn't list, which takes it off every issue, so new labels go in the file, not the UI. On a PR it only prints what it would change. Before the sync, a yq step fails the run when the PR path rules, the issue rules or an issue form use a label the file doesn't declare. That cross-check is the only hand-written part, since no action covers it.

Labels get applied by stock actions. On PRs, actions/labeler maps changed paths to areas through .github/labeler.yml. It runs on pull_request_target, so fork PRs get labeled too, and it never checks out PR code. On issues, github/issue-labeler maps the Component answer to an area through .github/issue-labeler.yml. It never removes labels, so ones added by hand stay. Both forms now share one Component list that maps one to one onto the areas, plus "Not sure".

Smaller fixes: the bug form asks for a version and the script's language instead of "Python version: 3.12", the issue chooser and a new SECURITY.md point to private vulnerability reporting (already enabled, but nothing linked to it), and the PR template has the generated API step. CONTRIBUTING and the CI/CD doc describe all of it.

Checked: the label check passes as written and fails on a typo in the path rules and in a form; each dropdown option hits exactly one issue rule through JS RegExp; a dry run of the path rules against #312, #315, #316, #319 and #320 gives sensible areas; mkdocs build --strict passes. This PR's Label Sync run is the live dry run.

---

Summary by cubic

The repo only had GitHub's default and Dependabot labels, so I added eight area: labels plus security, applied them to all open issues, and made them stick.

Labels now live as code in .github/labels.yml, and the new Label Sync workflow makes the repo match that file — including deleting labels the file doesn't list, so new labels are added there, not the GitHub UI. PRs get area: labels from changed paths; issues get them from the Component answer in the issue forms. Both forms now share one Component list that maps one to one onto the areas, plus "Not sure".

• The sync workflow dry-runs on PRs and fails when a labeler config or issue form uses an undeclared label.
• The bug form asks for a version and script language, the issue chooser and new SECURITY.md point to private vulnerability reporting, and the PR template includes the generated API step.

^{Written for commit 19bf871. Summary will update on new commits.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8c520195-e435-40f9-bf31-e0bdfc65ecc6

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud