From b192ea5ea76fd8d640ec8c1327ecf0a0a06b2758 Mon Sep 17 00:00:00 2001
From: Aaron Barnes <aaronbarnes@bamboohr.com>
Date: Fri, 29 May 2026 16:06:25 -0600
Subject: [PATCH] [SPN-2931] Ensure repo labels exist before gh pr edit
 --add-label
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The last sdk-update run failed at the PR-create step:

  'quality-issues' not found

Root cause: `gh pr edit --add-label "a,b,c"` validates every label name
in its CSV against the repo's registered labels and fails the entire
call if any one is missing. We introduced the `quality-issues` name in
the previous PR (#26) but never created the matching label in the repo,
so the first run after merge died here.

Fix: add an "Ensure workflow labels exist" step that runs
`gh label create --force` for each label name the workflow knows about.
--force makes it idempotent (creates if missing, updates color/description
if present, exits 0 either way). Same step covers auto-generated,
breaking, generation-failed, and quality-issues so future additions are
self-healing — code change is enough, no manual repo setup required.

Also adds `issues: write` to the job's permissions block, since
`gh label create` hits the labels API which lives under issues, not
pull-requests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/sdk-update.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/sdk-update.yml b/.github/workflows/sdk-update.yml
index 377a5e4..c8786c1 100644
--- a/.github/workflows/sdk-update.yml
+++ b/.github/workflows/sdk-update.yml
@@ -32,6 +32,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      issues: write  # required so `gh label create` can manage repo labels
 
     steps:
       # Auth model:
@@ -295,6 +296,27 @@ jobs:
         run: git push --force origin HEAD:refs/heads/auto/sdk-update
 
       # ----- Open or update PR ---------------------------------------------
+      # Make sure every label the next step might add or remove actually
+      # exists on the repo. `gh pr edit --add-label "a,b,c"` validates all
+      # names up-front and fails the whole call if any one is missing —
+      # which would silently kill the workflow when we introduce a new
+      # label name in code without remembering to pre-create it in the UI.
+      # `gh label create --force` is the idempotent equivalent: creates if
+      # missing, updates color/description if present, exits 0 either way.
+      - name: Ensure workflow labels exist
+        if: steps.fetch.outputs.changed == 'true' && steps.diff.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh label create "auto-generated"    --color "c9f7b1" --force \
+            --description "PR opened automatically by the sdk-update workflow"
+          gh label create "breaking"          --color "b60205" --force \
+            --description "Contains breaking API changes (semver major)"
+          gh label create "generation-failed" --color "b60205" --force \
+            --description "make generate did not succeed on the latest run"
+          gh label create "quality-issues"    --color "fbca04" --force \
+            --description "Generation succeeded but format/lint/smoke/test reported issues"
+
       - name: Create or update PR
         if: steps.fetch.outputs.changed == 'true' && steps.diff.outputs.has_changes == 'true'
         env: