Greptile Summary

This PR subscribes the pull_request event to labeled/unlabeled activity types, adds a matrix-prep job that includes windows-latest when the ci:windows label is present, and gates test-kubernetes on the ci:k8s label in addition to the existing title-match logic. The overall approach is sound, but the matrix-prep shell script inlines label names via ${{ join(...) }} directly into the script body — a shell-injection risk that should be addressed by passing the value through env: instead.

• P1 — shell injection: .github/workflows/ci.yml line 43 — label names interpolated directly into a run script; backtick/$() payloads in label names would execute as commands.

Confidence Score: 3/5

Hold for the shell-injection fix before merging — the label-name interpolation is an exploitable security pattern.

One P1 security finding: label names are interpolated directly into a run shell script via ${{ join(...) }}. Any collaborator with label-create/triage access could craft a label name with backticks or $() to execute arbitrary code in the CI runner. This is a well-documented GitHub Actions hardening failure and should be fixed before merge.

.github/workflows/ci.yml — specifically the matrix-prep step that inlines label names into the shell script body.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[GitHub Event] --> B{Event Type?}
    B -->|push to main| C[matrix-prep: ubuntu + windows]
    B -->|pull_request labeled/unlabeled/opened/sync/reopened| D{ci:windows label?}
    D -->|yes| E[matrix-prep: ubuntu + windows]
    D -->|no| F[matrix-prep: ubuntu only]

    C & E & F --> G[quality job]
    C & E & F --> H[typecheck job]

    G & H --> I[test job]
    G & H --> J{k8s trigger?}

    J -->|push OR title contains k8s/kubernetes OR ci:k8s label| K[test-kubernetes]
    J -->|none match| L[skip test-kubernetes]

    I -->|push to main only| M[test-thorough]

_{Reviews (1): Last reviewed commit: "ci(github): run PR CI on label events; c..." | Re-trigger Greptile}

🌮 @muddlebee's PR: showed up unannounced, improved everything, left zero bugs. Just like a perfect taco. 🌮

👋 Join us on Discord - OpenSRE : hang out, contribute, or hunt for features and issues. Everyone's welcome.