@plainconceptsplatform/workflows 0.17.0 → 0.20.0

package/dist/catalog-installation.js

@@ -151,11 +151,17 @@ export async function installCatalog(repositoryPath, options = {}) {
 // (the shared CI setup and the OpenCode config) get them on every run and stay stable. A worker
 // gets its VERIFY_COMMANDS default once, when it is first installed: after that the value is the
 // consumer's, and the env merge keeps it.
+//
+// Except when the consumer has no value. "First install only" meant a worker installed before
+// this injection existed kept `VERIFY_COMMANDS: ""` for good, and mergeWorkerEnv then preserved
+// the empty string as the consumer's deliberate choice. All four consuming repositories were in
+// that state, so every merge-gate repair pushed a fix with the verification block interpolating
+// to nothing. An empty value is the absence of a choice, so an update fills it.
 function applyStackDefaults(files, inspection, existing) {
     const defaults = generateStackDefaults(inspection);
     const result = new Map(files);
     for (const [target, content] of result) {
-        if (isWorker(target) && !existing.has(target)) {
+        if (isWorker(target) && (!existing.has(target) || hasEmptyVerifyCommands(existing.get(target)))) {
             result.set(target, injectStackEnv(content, defaults));
         }
         else if (target.endsWith("opencode-ci.md")) {
@@ -167,6 +173,11 @@ function applyStackDefaults(files, inspection, existing) {
     }
     return result;
 }
+// A worker whose VERIFY_COMMANDS is present but empty. Anything else, including a value the
+// consumer wrote, is left alone.
+function hasEmptyVerifyCommands(current) {
+    return typeof current === "string" && /^ {2}VERIFY_COMMANDS: *(""|'')? *$/m.test(current);
+}
 // Directories that belong wholly to the package. A file here that carries our ownership header
 // and is no longer in the package was deleted upstream, and without this it would sit in every
 // consumer forever: that is how `stale-recovery` and `update-changelog` outlived the code that
@@ -306,18 +317,19 @@ async function preCommitHookUpdate(repositoryPath) {
     }
     const content = (await readFile(hookPath, "utf8"))
         .replace("pnpm exec if git diff --cached --name-only -- .github | grep -q .; then", "if git diff --cached --name-only -- .github | grep -q .; then");
-    if (content.includes("compile-agent-workflows")) {
-        const legacyLines = `${compileLine}\n${stageLine}\n${actionLockLine}\n`;
-        if (content.includes(managedLines))
-            return { target, content };
-        if (content.includes(legacyLines))
-            return { target, content: content.replace(legacyLines, managedLines) };
-        const suffix = content.endsWith("\n") || content === "" ? "" : "\n";
-        return { target, content: `${content}${suffix}${managedLines}` };
-    }
-    return { target, content: content.endsWith("\n") || content === ""
-            ? `${content}${managedLines}`
-            : `${content}\n${managedLines}` };
+    // Replace whatever managed block is there, never append beside it. The previous version
+    // recognised only two exact shapes -- the current block and the pre-`if` legacy lines -- and
+    // appended when it matched neither. A consumer holding an *older* wrapped block therefore
+    // gained a second one, so the compiler ran twice on every commit and one of the two staged a
+    // lock path that exists nowhere. All five consumers were carrying two blocks by the time this
+    // was noticed, and every future edit to `managedLines` would have added another. Nothing
+    // failed: running the compiler twice is only wasteful, so it never surfaced.
+    const managedBlock = /^[ \t]*if git diff --cached --name-only -- \.github \| grep -q \.; then\n(?:.*\n)*?[ \t]*fi\n?/gm;
+    const legacyLines = `${compileLine}\n${stageLine}\n${actionLockLine}\n`;
+    let stripped = content.replace(managedBlock, block => block.includes("compile-agent-workflows") ? "" : block);
+    stripped = stripped.split(legacyLines).join("");
+    const body = stripped.replace(/\n{3,}/g, "\n\n").replace(/\s+$/, "");
+    return { target, content: body === "" ? managedLines : `${body}\n${managedLines}` };
 }
 export async function runCompileIfAvailable(repositoryPath) {
     const script = join(repositoryPath, "scripts", "compile-agent-workflows.mjs");

package/dist/stack-defaults.js

@@ -31,31 +31,31 @@ export function generateOpencodeCi(baseContent, inspection) {
     if (inspection.stackHints.solutionFiles.length > 0) {
         const solutionPath = inspection.stackHints.solutionFiles[0].replaceAll("\\", "/");
         if (!result.includes("name: Cache NuGet packages")) {
-            const nugetCache = `  - name: Cache NuGet packages
-    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-    with:
-      path: ~/.nuget/packages
-      key: nuget-\${{ runner.os }}-\${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
-      restore-keys: nuget-\${{ runner.os }}-
-
+            const nugetCache = `  - name: Cache NuGet packages
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: ~/.nuget/packages
+      key: nuget-\${{ runner.os }}-\${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
+      restore-keys: nuget-\${{ runner.os }}-
+
 `;
             result = insertBeforeMarker(result, nugetCache, "  - name: Install workspace dependencies");
         }
         if (!result.includes("name: Restore .NET dependencies")) {
-            const restore = `  - name: Restore .NET dependencies
-    run: dotnet restore ${solutionPath}
-
+            const restore = `  - name: Restore .NET dependencies
+    run: dotnet restore ${solutionPath}
+
 `;
             result = insertBeforeMarker(result, restore, "  - name: Install workspace dependencies");
         }
     }
     if (inspection.stackHints.openSpec && !result.includes("name: Install OpenSpec CLI")) {
-        const openspecStep = `  - name: Install OpenSpec CLI
-    run: |
-      set -euo pipefail
-      npm install -g "@fission-ai/openspec@1.8.0"
-      openspec --version
-
+        const openspecStep = `  - name: Install OpenSpec CLI
+    run: |
+      set -euo pipefail
+      npm install -g "@fission-ai/openspec@1.8.0"
+      openspec --version
+
 `;
         result = insertBeforeMarker(result, openspecStep, "  - name: Install workspace dependencies");
     }

package/dist/worker-env.js

@@ -74,6 +74,10 @@ export function entryValue(entry) {
     const first = entry.lines[0].replace(ENTRY, "$2").trim();
     return [first, ...entry.lines.slice(1).map((line) => line.trim())].join("\n").trim();
 }
+// A value that is present but says nothing: empty, or empty quotes.
+function isBlank(value) {
+    return value === "" || value === '""' || value === "''";
+}
 export function mergeWorkerEnv(packageContent, consumerContent, baselineContent, parse = parseWorkerEnv) {
     const report = { keptEnv: [], updatedDefaults: [], consumerOnlyEnv: [], droppedEnv: [] };
     const pkg = parse(packageContent);
@@ -91,6 +95,16 @@ export function mergeWorkerEnv(packageContent, consumerContent, baselineContent,
             merged.push(entry);
             continue;
         }
+        // An empty value is the absence of a choice, not a choice of nothing. Treating it as the
+        // consumer's is how `VERIFY_COMMANDS: ""` survived in all four consuming repositories with
+        // no baseline to compare against, leaving the merge gate pushing repairs it had verified
+        // with an empty command block. If the package has something and the consumer has nothing,
+        // the package wins.
+        if (isBlank(entryValue(mine)) && !isBlank(entryValue(entry))) {
+            merged.push(entry);
+            report.updatedDefaults.push(entry.key);
+            continue;
+        }
         const base = baselineByKey.get(entry.key);
         if (base !== undefined && entryValue(base) === entryValue(mine)) {
             // Still the previous default: the package changed it, the consumer never did.
@@ -120,26 +134,15 @@ export function mergeWorkerEnv(packageContent, consumerContent, baselineContent,
 function engineEndpoint(content) {
     return /^    OPENAI_BASE_URL: (.+)$/m.exec(content)?.[1];
 }
-// Which self-hosted pool a worker's agent jobs run on. gh-aw cannot share runs-on through an
-// import, so every worker names it. ubuntu-latest is excluded, being GitHub's own runner, used
-// by the deterministic jobs everywhere and chosen by nobody.
-function runnerPools(content) {
-    const found = new Set();
-    for (const match of content.matchAll(/^\s*runs-on(?:-slim)?: (\S+)\s*$/gm)) {
-        if (match[1] !== "ubuntu-latest")
-            found.add(match[1]);
-    }
-    return [...found];
-}
-function preserveRunnerPool(packageContent, consumerContent) {
-    const mine = runnerPools(consumerContent);
-    const theirs = runnerPools(packageContent);
-    // Only an unambiguous swap. A consumer naming several pools has drifted rather than
-    // decided, and guessing which it meant is worse than leaving the package's.
-    if (mine.length !== 1 || theirs.length !== 1 || mine[0] === theirs[0])
-        return packageContent;
-    return packageContent.replace(/^(\s*runs-on(?:-slim)?: )(\S+)(\s*)$/gm, (line, prefix, pool, tail) => pool === "ubuntu-latest" ? line : `${prefix}${mine[0]}${tail}`);
-}
+// The runner pool used to be preserved from the consumer here: a repository naming a single
+// non-ubuntu pool had every worker rewritten to it. That is how Pliny-Bot ended up running
+// triage, refine, implement, apply-review and audit on RunnerLandingZone while its merge-gate
+// and release stayed on agents-arc -- the pool was applied to the workers installed at the time
+// and never to the ones added later, and nothing reported the split. The pool is package-owned
+// now: the agent jobs belong on the Azure fleet (agents-arc, runner group `agentic`), and the
+// router and release worker name RunnerLandingZone. The route matrix asserts both, so a repo
+// cannot drift back without a red run. Per the standing rule for this package, anything a
+// consumer really must vary belongs in `env:` at the top of the file, not in `runs-on`.
 // GitHub evaluates no expression in a `workflow_run.workflows:` list or in a `cron:`, so the two
 // router values that are also needed there cannot be read from `env:` at those two lines. The
 // installer copies them in instead, which is what keeps the pair in step across an update; the
@@ -175,5 +178,5 @@ export function mergeWorker(packageContent, consumerContent, baselineContent) {
     if (endpoint !== undefined) {
         result = result.replace(/^    OPENAI_BASE_URL: .+$/m, `    OPENAI_BASE_URL: ${endpoint}`);
     }
-    return { content: preserveRunnerPool(result, consumerContent), report };
+    return { content: result, report };
 }

package/loops/actions/add-issue-labels/action.yml

@@ -1,50 +1,50 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/add-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Add issue labels
-description: Add one or more labels to an issue or pull request.
-inputs:
-  token:
-    description: GitHub token used by github-script.
-    required: true
-  issue-number:
-    description: Issue or pull request number.
-    required: true
-  labels:
-    description: Labels to add, one per line. A comma-separated list is accepted as well.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Add labels
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        LABELS: ${{ inputs.labels }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const labels = process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean);
-          if (labels.length === 0) {
-            core.notice('No labels to add.');
-            return;
-          }
-
-          // Create what does not exist yet, so shipping a new label in the package does not
-          // require a person to go and make it in every repository first. Its sibling
-          // remove-issue-labels has swallowed 404 for a long time; this one had no guard at all,
-          // so a label the package introduced would fail the step in every consumer until
-          // somebody created it by hand. 422 is "already exists", which is the happy path on
-          // every run after the first.
-          for (const name of labels) {
-            try {
-              await github.rest.issues.createLabel({ ...context.repo, name, color: 'ededed' });
-              core.notice(`Created the ${name} label.`);
-            } catch (error) {
-              if (error.status !== 422) throw error;
-            }
-          }
-
-          await github.rest.issues.addLabels({
-            ...context.repo,
-            issue_number: Number(process.env.ISSUE_NUMBER),
-            labels,
-          });
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/add-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Add issue labels
+description: Add one or more labels to an issue or pull request.
+inputs:
+  token:
+    description: GitHub token used by github-script.
+    required: true
+  issue-number:
+    description: Issue or pull request number.
+    required: true
+  labels:
+    description: Labels to add, one per line. A comma-separated list is accepted as well.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Add labels
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        LABELS: ${{ inputs.labels }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const labels = process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean);
+          if (labels.length === 0) {
+            core.notice('No labels to add.');
+            return;
+          }
+
+          // Create what does not exist yet, so shipping a new label in the package does not
+          // require a person to go and make it in every repository first. Its sibling
+          // remove-issue-labels has swallowed 404 for a long time; this one had no guard at all,
+          // so a label the package introduced would fail the step in every consumer until
+          // somebody created it by hand. 422 is "already exists", which is the happy path on
+          // every run after the first.
+          for (const name of labels) {
+            try {
+              await github.rest.issues.createLabel({ ...context.repo, name, color: 'ededed' });
+              core.notice(`Created the ${name} label.`);
+            } catch (error) {
+              if (error.status !== 422) throw error;
+            }
+          }
+
+          await github.rest.issues.addLabels({
+            ...context.repo,
+            issue_number: Number(process.env.ISSUE_NUMBER),
+            labels,
+          });

package/loops/actions/agent-output.cjs

@@ -1,17 +1,17 @@
-// Managed by @plainconceptsplatform/workflows. Source: loops/actions/agent-output.cjs. Update with `workflows update --force`; consumer edits may be overwritten.
-const fs = require('node:fs');
-
-// Every apply-agent-* action reads the same artifact the same way: a missing file means the
-// agent produced nothing, which is a normal outcome rather than a failure.
-function readAgentItems(outputFile, type) {
-  if (!outputFile || !fs.existsSync(outputFile)) {
-    return [];
-  }
-
-  const parsed = JSON.parse(fs.readFileSync(outputFile, 'utf8'));
-  const items = Array.isArray(parsed.items) ? parsed.items : [];
-
-  return type ? items.filter((item) => item.type === type) : items;
-}
-
-module.exports = { readAgentItems };
+// Managed by @plainconceptsplatform/workflows. Source: loops/actions/agent-output.cjs. Update with `workflows update --force`; consumer edits may be overwritten.
+const fs = require('node:fs');
+
+// Every apply-agent-* action reads the same artifact the same way: a missing file means the
+// agent produced nothing, which is a normal outcome rather than a failure.
+function readAgentItems(outputFile, type) {
+  if (!outputFile || !fs.existsSync(outputFile)) {
+    return [];
+  }
+
+  const parsed = JSON.parse(fs.readFileSync(outputFile, 'utf8'));
+  const items = Array.isArray(parsed.items) ? parsed.items : [];
+
+  return type ? items.filter((item) => item.type === type) : items;
+}
+
+module.exports = { readAgentItems };

package/loops/actions/apply-agent-bundle/action.yml

@@ -1,24 +1,24 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-bundle/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Apply agent bundle
-description: Fast-forward an intended branch to the single commit exported by a verified git bundle.
-inputs:
-  bundle-file:
-    description: Path to the git bundle from the agent artifact.
-    required: true
-  target-branch:
-    description: Branch that must fast-forward to the bundle commit.
-    required: true
-  base-branch:
-    description: Existing branch used only when target-branch does not exist.
-    required: false
-    default: ''
-runs:
-  using: composite
-  steps:
-    - name: Fast-forward branch from bundle
-      shell: bash
-      env:
-        BUNDLE_FILE: ${{ inputs.bundle-file }}
-        TARGET_BRANCH: ${{ inputs.target-branch }}
-        BASE_BRANCH: ${{ inputs.base-branch }}
-      run: bash "$GITHUB_ACTION_PATH/apply-bundle.sh" "$BUNDLE_FILE" "$TARGET_BRANCH" "$BASE_BRANCH"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-bundle/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Apply agent bundle
+description: Fast-forward an intended branch to the single commit exported by a verified git bundle.
+inputs:
+  bundle-file:
+    description: Path to the git bundle from the agent artifact.
+    required: true
+  target-branch:
+    description: Branch that must fast-forward to the bundle commit.
+    required: true
+  base-branch:
+    description: Existing branch used only when target-branch does not exist.
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Fast-forward branch from bundle
+      shell: bash
+      env:
+        BUNDLE_FILE: ${{ inputs.bundle-file }}
+        TARGET_BRANCH: ${{ inputs.target-branch }}
+        BASE_BRANCH: ${{ inputs.base-branch }}
+      run: bash "$GITHUB_ACTION_PATH/apply-bundle.sh" "$BUNDLE_FILE" "$TARGET_BRANCH" "$BASE_BRANCH"

package/loops/actions/apply-agent-comments/action.yml

@@ -1,42 +1,42 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-comments/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Apply agent comments
-description: Post every add_comment item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write and pull-requests:write.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Post comments
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE, 'add_comment');
-
-          let posted = 0;
-
-          for (const item of items) {
-            if (!item.item_number) {
-              core.warning(`add_comment item has no item_number, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            await github.rest.issues.createComment({
-              ...context.repo,
-              issue_number: Number(item.item_number),
-              body: item.body,
-            });
-
-            posted += 1;
-          }
-
-          core.info(`Posted ${posted} comment(s).`);
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-comments/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Apply agent comments
+description: Post every add_comment item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write and pull-requests:write.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Post comments
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE, 'add_comment');
+
+          let posted = 0;
+
+          for (const item of items) {
+            if (!item.item_number) {
+              core.warning(`add_comment item has no item_number, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: Number(item.item_number),
+              body: item.body,
+            });
+
+            posted += 1;
+          }
+
+          core.info(`Posted ${posted} comment(s).`);

package/loops/actions/apply-agent-labels/action.yml

@@ -1,55 +1,55 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Apply agent labels
-description: Apply every add_labels and remove_labels item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Apply label changes
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE)
-            .filter((item) => item.type === 'add_labels' || item.type === 'remove_labels');
-
-          let added = 0;
-          let removed = 0;
-
-          for (const item of items) {
-            const labels = (item.labels ?? []).map((label) => label.name).filter(Boolean);
-
-            if (!item.item_number || labels.length === 0) {
-              core.warning(`${item.type} item is not actionable, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            const issue_number = Number(item.item_number);
-
-            if (item.type === 'add_labels') {
-              await github.rest.issues.addLabels({ ...context.repo, issue_number, labels });
-              added += labels.length;
-              continue;
-            }
-
-            for (const name of labels) {
-              try {
-                await github.rest.issues.removeLabel({ ...context.repo, issue_number, name });
-                removed += 1;
-              } catch (error) {
-                if (error.status !== 404) throw error;
-              }
-            }
-          }
-
-          core.info(`Added ${added} label(s), removed ${removed}.`);
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Apply agent labels
+description: Apply every add_labels and remove_labels item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Apply label changes
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE)
+            .filter((item) => item.type === 'add_labels' || item.type === 'remove_labels');
+
+          let added = 0;
+          let removed = 0;
+
+          for (const item of items) {
+            const labels = (item.labels ?? []).map((label) => label.name).filter(Boolean);
+
+            if (!item.item_number || labels.length === 0) {
+              core.warning(`${item.type} item is not actionable, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            const issue_number = Number(item.item_number);
+
+            if (item.type === 'add_labels') {
+              await github.rest.issues.addLabels({ ...context.repo, issue_number, labels });
+              added += labels.length;
+              continue;
+            }
+
+            for (const name of labels) {
+              try {
+                await github.rest.issues.removeLabel({ ...context.repo, issue_number, name });
+                removed += 1;
+              } catch (error) {
+                if (error.status !== 404) throw error;
+              }
+            }
+          }
+
+          core.info(`Added ${added} label(s), removed ${removed}.`);