chore: area labels as code, auto-labeling and current issue forms

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for taking the time to report a bug! Please fill out the sections below.
+        Search the existing issues first. A security weakness goes through [private reporting](https://github.com/HardMax71/Integr8sCode/security/advisories/new), not a public issue.
 
   - type: textarea
     id: description
@@ -44,25 +44,28 @@ body:
       description: Which part of the system is affected?
       options:
         - Frontend (UI)
-        - Backend API
-        - Execution (K8s pods)
-        - Workers (Saga, DLQ, etc.)
-        - SSE / Real-time updates
-        - Authentication
-        - Other
+        - API (routes, auth, rate limits, settings)
+        - Running scripts (queue, sagas, pods, results)
+        - Kafka events (consumers, DLQ, replay)
+        - Live updates and notifications
+        - Metrics, dashboards and logs
+        - Deployment (compose, deploy.sh, production)
+        - CI and tooling
+        - Documentation
+        - Not sure
     validations:
       required: true
 
   - type: textarea
     id: environment
     attributes:
       label: Environment
-      description: Please provide relevant environment details.
+      description: Whatever applies.
       placeholder: |
-        - OS: [e.g., Ubuntu 22.04, macOS 14]
-        - Browser: [e.g., Chrome 120, Firefox 121]
-        - Deployment: [e.g., local dev, production]
-        - Python version: [e.g., 3.12]
+        - Where: local dev (./deploy.sh dev) or production
+        - Version: release tag or commit, e.g. 2026.10.3 or 7b9f060
+        - Script language and version, e.g. Go 1.27
+        - Browser, e.g. Firefox 145
     validations:
       required: false
 

.github/ISSUE_TEMPLATE/config.yml

@@ -1,6 +1,9 @@
 # Discussions are off, so questions come in as issues. Neither template fits a question, hence blank issues stay on.
 blank_issues_enabled: true
 contact_links:
+  - name: Report a security weakness
+    url: https://github.com/HardMax71/Integr8sCode/security/advisories/new
+    about: Report it privately so it can be fixed before it's public
   - name: Documentation
     url: https://hardmax71.github.io/Integr8sCode/
     about: Check the documentation for guides and reference material

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for suggesting a feature! Please describe what you'd like to see.
+        Describe the problem first, then what you'd like to see.
 
   - type: textarea
     id: problem
@@ -40,12 +40,15 @@ body:
       description: Which part of the system would this affect?
       options:
         - Frontend (UI)
-        - Backend API
-        - Execution (K8s pods)
-        - Workers
+        - API (routes, auth, rate limits, settings)
+        - Running scripts (queue, sagas, pods, results)
+        - Kafka events (consumers, DLQ, replay)
+        - Live updates and notifications
+        - Metrics, dashboards and logs
+        - Deployment (compose, deploy.sh, production)
+        - CI and tooling
         - Documentation
-        - DevOps / CI/CD
-        - Other
+        - Not sure
     validations:
       required: true
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -31,6 +31,7 @@ Fixes #
 - [ ] Frontend unit tests pass (`cd frontend && npm run test`)
 - [ ] Backend E2E tests pass (`docker compose exec -T backend sh -c 'uv sync --group test --no-dev --frozen --no-install-project --no-build && pytest tests/e2e'`)
 - [ ] Frontend E2E tests pass (`cd frontend && npm run test:e2e`)
+- [ ] API spec and client regenerated if routes or schemas changed (`./deploy.sh openapi`, then `./deploy.sh types`), never edited by hand
 - [ ] Manual testing performed
 
 **Manual test steps:**

.github/issue-labeler.yml

@@ -0,0 +1,21 @@
+# Area label per answer to the Component field of the issue forms, applied by the Labels workflow.
+# Each pattern matches the start of a dropdown option, so keep them in step with both forms.
+
+"area: frontend":
+  - '### Component\s+Frontend'
+"area: api":
+  - '### Component\s+API'
+"area: execution":
+  - '### Component\s+Running scripts'
+"area: events":
+  - '### Component\s+Kafka events'
+"area: realtime":
+  - '### Component\s+Live updates'
+"area: observability":
+  - '### Component\s+Metrics'
+"area: deploy":
+  - '### Component\s+Deployment'
+"area: ci":
+  - '### Component\s+CI and tooling'
+documentation:
+  - '### Component\s+Documentation'

.github/labeler.yml

@@ -0,0 +1,99 @@
+# Area labels for pull requests by changed path, applied by the Labels workflow.
+# Issues get theirs from the Component field instead; keep both in step with the label list.
+
+"area: frontend":
+  - changed-files:
+      - any-glob-to-any-file: frontend/**
+
+"area: api":
+  - changed-files:
+      - any-glob-to-any-file:
+          - backend/app/api/**
+          - backend/app/schemas_pydantic/**
+          - backend/app/core/middlewares/**
+          - backend/app/core/exceptions/**
+          - backend/app/core/security.py
+          - backend/app/services/admin/**
+          - backend/app/services/auth_service.py
+          - backend/app/services/login_lockout.py
+          - backend/app/services/rate_limit_service.py
+          - backend/app/services/saved_script_service.py
+          - backend/app/services/user_settings_service.py
+          - backend/app/settings.py
+          - backend/config*.toml
+          - docs/reference/openapi.json
+
+"area: execution":
+  - changed-files:
+      - any-glob-to-any-file:
+          - backend/app/services/execution_service.py
+          - backend/app/services/execution_queue.py
+          - backend/app/services/runtime_settings.py
+          - backend/app/services/saga/**
+          - backend/app/services/k8s_worker/**
+          - backend/app/services/pod_monitor/**
+          - backend/app/services/result_processor/**
+          - backend/app/runtime_registry.py
+          - backend/app/scripts/**
+          - backend/workers/run_k8s_worker.py
+          - backend/workers/run_pod_monitor.py
+          - backend/workers/run_result_processor.py
+          - backend/workers/run_saga_orchestrator.py
+
+"area: events":
+  - changed-files:
+      - any-glob-to-any-file:
+          - backend/app/events/**
+          - backend/app/dlq/**
+          - backend/app/domain/events/**
+          - backend/app/infrastructure/kafka/**
+          - backend/app/services/idempotency/**
+          - backend/app/services/event_replay/**
+          - backend/app/services/event_service.py
+          - backend/workers/run_dlq_processor.py
+          - backend/workers/run_event_replay.py
+
+"area: realtime":
+  - changed-files:
+      - any-glob-to-any-file:
+          - backend/app/services/sse/**
+          - backend/app/services/notification_service.py
+          - backend/app/services/notification_scheduler.py
+          - backend/app/api/routes/sse.py
+          - backend/app/api/routes/notifications.py
+          - frontend/src/lib/notifications/**
+
+"area: observability":
+  - changed-files:
+      - any-glob-to-any-file:
+          - backend/app/core/metrics/**
+          - backend/app/core/tracing/**
+          - backend/app/core/logging.py
+          - backend/app/core/middlewares/metrics.py
+          - backend/grafana/**
+          - backend/loki/**
+          - backend/otel-collector-config.yaml
+          - backend/tests/contract/**
+
+"area: deploy":
+  - changed-files:
+      - any-glob-to-any-file:
+          - docker-compose.yaml
+          - deploy.sh
+          - "**/Dockerfile*"
+          - cert-generator/**
+          - .github/workflows/docker.yml
+          - .github/workflows/release-deploy.yml
+
+"area: ci":
+  - changed-files:
+      - any-glob-to-any-file:
+          - .github/**
+          - .pre-commit-config.yaml
+
+documentation:
+  - changed-files:
+      - any-glob-to-any-file:
+          - docs/**
+          - "*.md"
+          - mkdocs.yml

.github/labels.yml

@@ -0,0 +1,75 @@
+# Every label in the repo. Label Sync makes the repo match this file and deletes labels that aren't in it,
+# so add or rename a label here (rename with from_name), never in the GitHub UI.
+
+- name: "area: api"
+  color: "#c5def5"
+  description: "FastAPI routes, auth, rate limiting, settings"
+- name: "area: ci"
+  color: "#c5def5"
+  description: "GitHub workflows, test infrastructure, repo tooling"
+- name: "area: deploy"
+  color: "#c5def5"
+  description: "Compose, deploy.sh, images, release workflow, production host"
+- name: "area: events"
+  color: "#c5def5"
+  description: "Kafka consumers and middlewares, producer, idempotency, DLQ, replay"
+- name: "area: execution"
+  color: "#c5def5"
+  description: "Queue, sagas, k8s worker, pod monitor, result processor, executor pods, runtimes"
+- name: "area: frontend"
+  color: "#c5def5"
+  description: "Svelte UI and the generated API client"
+- name: "area: observability"
+  color: "#c5def5"
+  description: "Metrics, dashboards, alerts, logs, traces, OTel collector"
+- name: "area: realtime"
+  color: "#c5def5"
+  description: "SSE streams and notifications"
+- name: "bug"
+  color: "#d73a4a"
+  description: "Something isn't working"
+- name: "dependencies"
+  color: "#0366d6"
+  description: "Pull requests that update a dependency file"
+- name: "docker"
+  color: "#21ceff"
+  description: "Pull requests that update docker code"
+- name: "documentation"
+  color: "#0075ca"
+  description: "Improvements or additions to documentation"
+- name: "duplicate"
+  color: "#cfd3d7"
+  description: "This issue or pull request already exists"
+- name: "enhancement"
+  color: "#a2eeef"
+  description: "New feature or request"
+- name: "github_actions"
+  color: "#000000"
+  description: "Pull requests that update GitHub Actions code"
+- name: "good first issue"
+  color: "#7057ff"
+  description: "Good for newcomers"
+- name: "help wanted"
+  color: "#008672"
+  description: "Extra attention is needed"
+- name: "invalid"
+  color: "#e4e669"
+  description: "This doesn't seem right"
+- name: "javascript"
+  color: "#168700"
+  description: "Pull requests that update javascript code"
+- name: "python:uv"
+  color: "#2b67c6"
+  description: "Pull requests that update python:uv code"
+- name: "question"
+  color: "#d876e3"
+  description: "Further information is requested"
+- name: "security"
+  color: "#b60205"
+  description: "Hardening or a security weakness; report anything exploitable privately"
+- name: "triage"
+  color: "#FBCA04"
+  description: "New report, needs a first look"
+- name: "wontfix"
+  color: "#ffffff"
+  description: "This will not be worked on"

.github/workflows/label-sync.yml

@@ -0,0 +1,55 @@
+name: Label Sync
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - .github/labels.yml
+      - .github/labeler.yml
+      - .github/issue-labeler.yml
+      - .github/ISSUE_TEMPLATE/**
+      - .github/workflows/label-sync.yml
+  pull_request:
+    branches: [main]
+    paths:
+      - .github/labels.yml
+      - .github/labeler.yml
+      - .github/issue-labeler.yml
+      - .github/ISSUE_TEMPLATE/**
+      - .github/workflows/label-sync.yml
+  schedule:
+    - cron: "0 3 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  sync:
+    name: Check and sync labels
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Fail on labels used but not declared
+        run: |
+          declared=$(yq '.[].name' .github/labels.yml | sort -u)
+          used=$({
+            yq -N 'keys | .[]' .github/labeler.yml .github/issue-labeler.yml
+            yq -N '.labels[]' .github/ISSUE_TEMPLATE/bug_report.yml .github/ISSUE_TEMPLATE/feature_request.yml
+          } | sort -u)
+          undeclared=$(comm -13 <(echo "$declared") <(echo "$used"))
+          if [ -n "$undeclared" ]; then
+            echo "::error::Labels used in the labeler configs or issue forms but missing from .github/labels.yml:"
+            echo "$undeclared"
+            exit 1
+          fi
+
+      # Makes the repo's labels match .github/labels.yml; on PRs it only prints what it would change
+      - uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d  # v6.0.0
+        with:
+          dry-run: ${{ github.event_name == 'pull_request' }}

.github/workflows/labels.yml

@@ -0,0 +1,34 @@
+name: Labels
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+  issues:
+    types: [opened, edited]
+
+permissions: {}
+
+jobs:
+  pull-request:
+    name: Label PR by changed paths
+    if: github.event_name == 'pull_request_target'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      # Reads .github/labeler.yml from main and the changed file list from the API; never checks out PR code
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13  # v7.0.0
+
+  issue:
+    name: Label issue by component
+    if: github.event_name == 'issues'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: github/issue-labeler@ccca1e16fcb66762200e616fc29b57b940c1cb67  # v3.5
+        with:
+          configuration-path: .github/issue-labeler.yml
+          enable-versioned-regex: 0

CONTRIBUTING.md

@@ -137,7 +137,9 @@ test: add e2e tests for DLQ processor
 
 ## Reporting Issues
 
-Use GitHub Issues: the Bug Report template for unexpected behavior or errors, the Feature Request template for new functionality. Include reproduction steps, environment details and relevant logs.
+Use GitHub Issues: the Bug Report template for unexpected behavior or errors, the Feature Request template for new functionality. Include reproduction steps, environment details and relevant logs. The Component you pick sets the issue's `area:` label, and pull requests get theirs from the files they change.
+
+Report a security weakness through [private vulnerability reporting](https://github.com/HardMax71/Integr8sCode/security/advisories/new) instead of an issue. See [SECURITY.md](SECURITY.md).
 
 ## Questions?