Batch Subproject: add meeting notes (2022–2026)

.github/README_Labelling.md

@@ -0,0 +1,81 @@
+# TOC Labeling Guide
+
+This repository has two labeling paths:
+
+1. **Slash commands in comments** (manual, explicit)
+2. **Automatic labeling** (event and file-path based)
+
+## 1) Slash Commands in Comments
+
+Use slash commands in a normal issue/PR comment to apply or remove labels.
+
+- Command must be on the **first line** of the comment.
+- Format is usually `/command value` (or `/command` for commands with no argument).
+- Commands are processed for issue comments and PR conversation comments.
+
+### Valid commands
+
+#### Core triage/grouping
+
+- `/kind <value>`
+  - values: `dd`, `docs`, `enhancement`, `initiative`, `meeting`, `review`, `subproject`
+- `/triage <value>`
+  - values: `valid`, `needs-information`, `duplicate`, `not-planned`
+- `/tag <value>`
+  - values: `developer-experience`, `infrastructure`, `operational-resilience`, `security-and-compliance`, `workloads-foundation`
+- `/sub <value>`
+  - values: `contributor-strategy-and-advocacy`, `mentoring`, `project-reviews`
+- `/toc`
+
+#### DD lifecycle
+
+- `/dd/triage <value>`
+  - values: `needs-triage`, `needs-adopters`, `needs-more-information`, `needs-security-assessment`
+- `/dd/status <value>`
+  - values: `ready-for-assignment`, `in-progress`, `in-comment-period`, `in-voting`, `complete`, `waiting`
+- `/dd/adopters <value>`
+  - values: `not-started`, `in-progress`, `complete`
+- `/dd/gov-review <value>`
+  - values: `not-started`, `in-progress`, `complete`
+- `/dd/tech-review <value>`
+  - values: `not-started`, `in-progress`, `complete`
+- `/dd/sec-review <value>`
+  - values: `not-started`, `in-progress`, `complete`
+
+#### Initiatives and votes
+
+- `/toc/initiative <value>`
+  - values: `AI`
+- `/init <value>`
+  - values: `not-started`, `in-progress`, `complete`, `stale`
+- `/vote <value>`
+  - values: `open`, `closed`, `nomination`
+- `/help`
+
+#### Remove commands
+
+- `/remove-kind <value>`
+- `/remove-triage <value>`
+- `/remove-tag <value>`
+- `/remove-sub <value>`
+- `/remove-toc`
+- `/remove-toc/initiative <value>`
+- `/remove-init <value>`
+- `/remove-vote`
+- `/remove-dd/triage <value>`
+- `/remove-review <value>`
+- `/remove-level <value>`
+- `/remove-help`
+
+## 2) Automatic Labeling (Overview)
+
+Automatic labeling runs from GitHub Actions and handles broad classification without requiring manual `/` commands.
+
+At a high level it does the following:
+
+- Applies labels when issues/PRs are opened or edited.
+- Uses changed file paths in PRs to infer group labels (for example, TOC/TAG/subproject areas).
+- Maintains helper labels like `needs-kind`, `needs-triage`, and `needs-group` when required categories are missing.
+- Keeps label state clean by removing/replacing mutually exclusive labels in command-driven flows.
+
+In short: use `/` commands when you want explicit control, and rely on automatic labeling for baseline triage and path-based routing.

.github/labels.yaml

@@ -5,6 +5,12 @@ definitionRequired: true
 
 
 labels:
+- name: contribution-agreement/signed
+  description: Contributor has signed the required contribution agreement
+  color: 0e8a16
+- name: contribution-agreement/unsigned
+  description: Contributor has not yet signed the required contribution agreement
+  color: b60205
 - name: dd/adopters/complete
   description: DD Adopter Interviews have been completed
   color: 41cd40
@@ -68,6 +74,9 @@ labels:
 - name: dd/triage/needs-adopters
   description: Additional adopters needed for DD application to be marked ready
   color: b60205
+- name: dd/triage/needs-security-assessment
+  description: Security assessment must be completed before DD can proceed
+  color: b60205
 - name: gitvote
   description: ''
   color: ededed
@@ -427,7 +436,7 @@ ruleset:
       - tag/developer-experience
       - tag/infrastructure
       - tag/operational-resilience
-      - tag/security-compliance
+      - tag/security-and-compliance
       - tag/workloads-foundation
   actions:
   - kind: remove-label 

.github/workflows/create-tech-review.yml

@@ -78,6 +78,14 @@ jobs:
               }
             }
 
+            async function commentExistingTechReview(issueNumber, existingIssue) {
+              await commentOnce(
+                issueNumber,
+                COMMENT_MARKERS.techReviewExists,
+                `Tech review issue: [#${existingIssue.number} - ${existingIssue.title}](${existingIssue.html_url})`
+              );
+            }
+
             function extractFormField(body, fieldKey) {
               if (!body) return null;
               const labels = FIELD_LABELS[fieldKey] || [fieldKey];
@@ -116,20 +124,56 @@ jobs:
               return null;
             }
 
+            function extractProjectNameFallback(issueTitle, issueBody) {
+              // Handle DD app titles like:
+              // [Graduation] KubeVirt Graduation Application
+              // [Incubation] HAMi Incubation Application
+              if (issueTitle) {
+                const titlePattern = /^\s*\[(?:Tech\s*Review|Graduation|Incubation|Sandbox)\]\s*(.+?)\s*(?:Tech\s*Review|Graduation\s*Application|Incubation\s*Application|Sandbox\s*Application)?\s*$/i;
+                const titleMatch = issueTitle.match(titlePattern);
+                if (titleMatch && titleMatch[1] && titleMatch[1].trim().length > 0) {
+                  return titleMatch[1].trim();
+                }
+              }
+
+              // Handle markdown heading bodies like:
+              // # KubeVirt Graduation Application
+              if (issueBody) {
+                const headingPattern = /^#\s+(.+?)\s+(?:Graduation|Incubation|Sandbox)\s+Application\s*$/im;
+                const headingMatch = issueBody.match(headingPattern);
+                if (headingMatch && headingMatch[1] && headingMatch[1].trim().length > 0) {
+                  return headingMatch[1].trim();
+                }
+              }
+
+              return null;
+            }
+
             function normalize(str) {
               return (str || '').trim().toLowerCase();
             }
 
+            function extractTechReviewProjectNameFromTitle(title) {
+              if (!title) return null;
+              const match = title.match(/^\s*\[Tech\s*Review\]:\s*(.+?)\s*$/i);
+              return match && match[1] ? match[1].trim() : null;
+            }
+
+            function escapeForSearchQuery(value) {
+              return (value || '').replace(/"/g, '\\"').trim();
+            }
+
             // --- Main Logic ---
             const issue = context.payload.issue;
             const issueNumber = issue.number;
+            const issueTitle = issue.title;
             const issueBody = issue.body;
 
             console.log(`🔍 Processing issue #${issueNumber}`);
             console.log(`📄 Issue body length: ${issueBody ? issueBody.length : 0}`);
 
             // Extract fields
-            const projectName = extractFormField(issueBody, 'name');
+            const projectName = extractFormField(issueBody, 'name') || extractProjectNameFallback(issueTitle, issueBody);
             const projectLink = extractFormField(issueBody, 'projectLink');
             const ddLink = extractFormField(issueBody, 'ddLink');
             const projectContact = extractFormField(issueBody, 'projectContact');
@@ -168,32 +212,64 @@ jobs:
               return;
             }
 
-            // Check for existing tech review issues for this project
+            // Safety check #1: GitHub search for existing OPEN tech review issue by project
             let existingIssue = null;
             try {
-              const allIssues = await github.paginate(github.rest.issues.listForRepo, {
+              const searchQuery = [
+                `repo:${context.repo.owner}/${context.repo.repo}`,
+                'is:issue',
+                'is:open',
+                'in:title',
+                '"[Tech Review]:"',
+                `"${escapeForSearchQuery(normalizedProjectName)}"`
+              ].join(' ');
+
+              const searchResults = await github.paginate(github.rest.search.issuesAndPullRequests, {
+                q: searchQuery,
+                per_page: 100
+              });
+
+              existingIssue = searchResults.find(item => {
+                if (item.number === issueNumber) return false;
+                if (item.pull_request) return false;
+                const projectNameFromTechReviewTitle = extractTechReviewProjectNameFromTitle(item.title);
+                return normalize(projectNameFromTechReviewTitle) === projectNameLower;
+              });
+
+              if (existingIssue) {
+                console.log(`ℹ️  Found existing tech review issue via search #${existingIssue.number} - commenting and exiting`);
+                await commentExistingTechReview(issueNumber, existingIssue);
+                return;
+              }
+            } catch (error) {
+              console.log('⚠️  Error checking for existing issues via search:', error.message);
+            }
+
+            // Safety check #2: scan open issues as fallback
+            try {
+              const openIssues = await github.paginate(github.rest.issues.listForRepo, {
                 owner: context.repo.owner,
                 repo: context.repo.repo,
-                state: 'all',
-                labels: 'review/tech',
+                state: 'open',
                 per_page: 100
               });
 
-              existingIssue = allIssues.find(item => {
+              existingIssue = openIssues.find(item => {
                 if (item.number === issueNumber) return false;
-                if (!item.title.includes('[Tech Review]:')) return false;
-                const existingProjectName = extractFormField(item.body, 'name');
-                if (normalize(existingProjectName) === projectNameLower) return true;
-                // Fallback: check title for exact word match
-                const titleLower = item.title.toLowerCase();
-                const projectNameRegex = new RegExp(`\\b${projectNameLower.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'i');
-                return projectNameRegex.test(titleLower);
+                if (item.pull_request) return false;
+
+                const projectNameFromTechReviewTitle = extractTechReviewProjectNameFromTitle(item.title);
+                if (!projectNameFromTechReviewTitle) return false;
+
+                if (normalize(projectNameFromTechReviewTitle) === projectNameLower) return true;
+
+                const existingProjectNameFromBody = extractFormField(item.body, 'name');
+                return normalize(existingProjectNameFromBody) === projectNameLower;
               });
 
               if (existingIssue) {
                 console.log(`ℹ️  Found existing tech review issue #${existingIssue.number} - commenting and exiting`);
-                await commentOnce(issueNumber, COMMENT_MARKERS.techReviewExists,
-                  `A tech review issue already exists for this project: [#${existingIssue.number} - ${existingIssue.title}](${existingIssue.html_url})`);
+                await commentExistingTechReview(issueNumber, existingIssue);
                 return;
               } else {
                 console.log('✅ No existing tech review issue found - proceeding to create');

.github/workflows/labeler-backfill.yaml

@@ -0,0 +1,49 @@
+name: Labeler Backfill (manual)
+
+# TEMPORARY: one-shot workflow to re-run the auto-labeler across every open
+# PR and issue in the base repo. Added to recover labels for items whose
+# original labeler run failed (e.g. fork PRs whose "Re-run jobs" is pinned
+# to an old workflow file). Revert this file (and scripts/labeler-backfill.sh)
+# once the backfill has been applied.
+#
+# Run from the Actions tab -> "Labeler Backfill (manual)" -> Run workflow.
+# Leave dry_run=true for the first run to preview; re-run with dry_run=false
+# to apply labels.
+
+on:
+  workflow_dispatch:
+    inputs:
+      scope:
+        description: What to relabel
+        type: choice
+        options:
+          - all
+          - prs
+          - issues
+        default: all
+      dry_run:
+        description: Dry run (log only, no API writes)
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  backfill:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Run labeler backfill
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OWNER: ${{ github.repository_owner }}
+          REPO: ${{ github.event.repository.name }}
+          SCOPE: ${{ inputs.scope }}
+          DRY_RUN: ${{ inputs.dry_run && '1' || '0' }}
+        run: ./scripts/labeler-backfill.sh

.github/workflows/labeler.yaml

@@ -3,8 +3,6 @@ name: Auto Label Issues and PRs
 on:
   issues:
     types: [opened, edited, reopened, transferred]
-  issue_comment:
-    types: [created, edited]
   pull_request_target:
     types: [opened, edited, reopened]
 
@@ -16,19 +14,47 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
+      - name: Checkout PR head for changed-files
+        if: ${{ github.event.pull_request }}
         uses: actions/checkout@v5
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Checkout repository for issue events
+        if: ${{ !github.event.pull_request }}
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Debug event context (temporary)
+        run: |
+          echo "event_name=${{ github.event_name }}"
+          echo "action=${{ github.event.action }}"
+          echo "has_pull_request=${{ github.event.pull_request != null }}"
+          echo "issue_number=${{ github.event.issue.number }}"
+          echo "pr_number=${{ github.event.pull_request.number }}"
 
-      - name: Get changed files
+      - name: Get changed files from PR API
         if: ${{ github.event.pull_request }}
         id: changed-files
-        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c
+        uses: actions/github-script@v8
         with:
-          separator: ","
+          script: |
+            const prNumber = context.payload.pull_request.number;
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+              per_page: 100
+            });
+            core.setOutput("all_changed_files", files.map(f => f.filename).join(","));
 
       - name: Run labeler action for PR
         if: ${{ github.event.pull_request }}
-        uses: cncf/automation/.github/actions/labeler-action@main
+        uses: cncf/automation/.github/actions/labeler-action@66a552b17f013289688a4e238f7a64b0d8e334a6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -41,12 +67,12 @@ jobs:
 
       - name: Run labeler action for Issue
         if: ${{ !github.event.pull_request }}
-        uses: cncf/automation/.github/actions/labeler-action@main
+        uses: cncf/automation/.github/actions/labeler-action@66a552b17f013289688a4e238f7a64b0d8e334a6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           labels: https://raw.githubusercontent.com/cncf/toc/refs/heads/main/.github/labels.yaml
           owner: ${{ github.repository_owner }}
           repo: ${{ github.event.repository.name }}
           issue_number: ${{ github.event.issue.number }}
-          comment_body: ${{ github.event.comment.body }}
+          comment_body: ${{ github.event.issue.body }}