feat: label issues from non-org-members across all repos

[John McCall (lowlydba)]

Adds a scheduled label-external-issues action and workflow that labels org-wide issues opened by non-org-members, reusing the overture-project-manager App and OIDC/Secrets Manager plumbing from sync-project-status.yml instead of standing up a new App.

Each run searches for open, unlabeled issues created since the last window, skips bot authors, checks org membership per author, and adds the external label to non-members.

overture-project-manager now has Organization: Members (read) and Repository: Issues (write) added to its permission set, so this is ready to run once merged.

Testing

Ran zizmor --persona pedantic against both new files, no findings. Verified the action module loads with node -e and that the workflow/action YAML parse.

workflow_dispatch only works via API/CLI once the workflow file exists on the default branch, so I couldn't dry-run this from the PR branch. Worth a manual dry_run dispatch right after merge to confirm the App permissions and search query behave as expected before relying on it.

Fixes #103

[Copilot]

🟡 Changes recommended

The workflow path, membership handling, and input validation require fixes before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds a scheduled workflow and reusable action to label issues opened by non-organization members across repositories.

Changes:

• Adds scheduled/manual workflow with GitHub App authentication.
• Implements issue search, membership checks, bot skipping, labeling, and dry-run support.
• Adds action validation and setup documentation.

File summaries

File	Summary
.github/workflows/label-external-issues.yml	Runs the cross-repository labeling job; the local action path must be corrected from $/. to ./.
.github/actions/label-external-issues/src/index.js	Discovers issues and applies labels; pending invitations must be handled as non-members.
.github/actions/label-external-issues/README.md	Documents action usage and setup.
.github/actions/label-external-issues/action.yml	Defines inputs and execution; numeric validation must reject malformed values such as 180minutes.

Review details

Suppressed comments (1)

.github/actions/label-external-issues/src/index.js:63

• The membership endpoint distinguishes an active member (204) from a pending invitation (302), but this code treats every successful response as membership and only maps 404 to non-member. A newly invited author is therefore either skipped as a member or causes the run to fail depending on redirect handling, instead of being classified consistently; handle 302 as non-member and only accept 204.

    await github.rest.orgs.checkMembershipForUser({ org, username });
    return true;
  } catch (error) {
    if (error.status === 404) {
      return false;

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.