code-mower 0.5.0b9__tar.gz → 0.5.0b10__tar.gz

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b9
+Version: 0.5.0b10
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -98,11 +98,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b9
+pipx install --python python3.12 code-mower==0.5.0b10
 code-mower --version
 ```
 
-`0.5.0b9` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b10` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -246,11 +246,11 @@ best?" to "which AI builder plus reviewer loop ships best on this product?" See
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.9` from
-[codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and it
-is published as `code-mower==0.5.0b9` on
-[PyPI](https://pypi.org/project/code-mower/). GitHub releases remain the
-auditable source for tags, build artifacts, and release notes.
+The current release target is `v0.5.0-beta.10` from
+[codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
+as `code-mower==0.5.0b10` on [PyPI](https://pypi.org/project/code-mower/)
+after release gates pass. GitHub releases remain the auditable source for tags,
+build artifacts, and release notes.
 
 For source checkout development and release rehearsal, use:
 

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/README.md

@@ -86,11 +86,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b9
+pipx install --python python3.12 code-mower==0.5.0b10
 code-mower --version
 ```
 
-`0.5.0b9` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b10` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -234,11 +234,11 @@ best?" to "which AI builder plus reviewer loop ships best on this product?" See
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.9` from
-[codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and it
-is published as `code-mower==0.5.0b9` on
-[PyPI](https://pypi.org/project/code-mower/). GitHub releases remain the
-auditable source for tags, build artifacts, and release notes.
+The current release target is `v0.5.0-beta.10` from
+[codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
+as `code-mower==0.5.0b10` on [PyPI](https://pypi.org/project/code-mower/)
+after release gates pass. GitHub releases remain the auditable source for tags,
+build artifacts, and release notes.
 
 For source checkout development and release rehearsal, use:
 

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b9"
+version = "0.5.0b10"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b9"
+__version__ = "0.5.0b10"

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/src/code_mower/clear_stale.py

@@ -80,6 +80,9 @@ class StaleClearResult:
     reason: str
     requeue_added: bool = False
     dispatch_requested: bool = False
+    trusted_terminal_status: Optional[str] = None
+    trusted_terminal_sha: Optional[str] = None
+    trusted_terminal_author: Optional[str] = None
 
 
 def _comment_created_at(comment: dict[str, Any]) -> str:
@@ -148,6 +151,9 @@ def resolve_stale_clear_decision(
                     f"terminal label is current: {current_comment.status} by "
                     f"{current_comment.author} for {current_comment.reviewed_sha}"
                 ),
+                trusted_terminal_status=current_comment.status,
+                trusted_terminal_sha=current_comment.reviewed_sha,
+                trusted_terminal_author=current_comment.author,
             )
         return StaleClearResult(
             LabelDecision(
@@ -164,6 +170,9 @@ def resolve_stale_clear_decision(
                 "terminal audit label mismatch for current trusted "
                 f"{current_comment.status} result"
             ),
+            trusted_terminal_status=current_comment.status,
+            trusted_terminal_sha=current_comment.reviewed_sha,
+            trusted_terminal_author=current_comment.author,
         )
 
     decision = LabelDecision(
@@ -179,6 +188,9 @@ def resolve_stale_clear_decision(
         decision,
         "terminal audit label is stale or lacks a current trusted Head SHA",
         requeue_added=config.needs_label not in label_set,
+        trusted_terminal_status=current_comment.status if current_comment else None,
+        trusted_terminal_sha=current_comment.reviewed_sha if current_comment else None,
+        trusted_terminal_author=current_comment.author if current_comment else None,
     )
 
 
@@ -356,6 +368,12 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
         "decision": result.decision.__dict__ if result.decision else None,
         "requeue_added": result.requeue_added,
         "dispatch_requested": dispatch_requested,
+        "trusted_terminal": {
+            "status": result.trusted_terminal_status,
+            "reviewed_sha": result.trusted_terminal_sha,
+            "author": result.trusted_terminal_author,
+            "head_bound": bool(result.trusted_terminal_sha),
+        },
     }
     if args.json or args.dry_run:
         print(json.dumps(output, indent=2, sort_keys=True))

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/src/code_mower/cloud.py

@@ -602,6 +602,11 @@ def main(argv: list[str] | None = None) -> int:
                 print(f"Repository: {result['repo_slug']}")
                 print(f"Runs: {result['run_count']}")
                 print("Provenance: imported history (not calibration evidence)")
+                guidance = result.get("catch_up", {}).get("trust_guidance", {})
+                if guidance:
+                    print(f"Use for: {guidance.get('use_for', '')}")
+                    print(f"Do not use for: {guidance.get('do_not_use_for', '')}")
+                    print(f"Next: {guidance.get('next_step', '')}")
                 print(f"Bundle: {result['export']['output_dir']}")
                 print(f"Events: {result['export']['event_count']}")
                 if result["status"] == "uploaded":

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/src/code_mower/cloud_client/operations.py

@@ -23,6 +23,16 @@ from .setup import DEFAULT_INSTALL_ID_ENV, DEFAULT_TEAM_ID_ENV
 from .upload import build_upload_payload, post_upload_payload
 
 
+CATCH_UP_TRUST_GUIDANCE = {
+    "use_for": "historical activity context and dashboard coverage backfill",
+    "do_not_use_for": "reviewer or lens accuracy, lane promotion, or merge-gate policy",
+    "next_step": (
+        "run current dogfood uploads plus reviewer-runs or calibration evidence "
+        "before making provider/lens decisions"
+    ),
+}
+
+
 def build_catch_up_summary(
     *,
     repo_slug: str,
@@ -63,6 +73,7 @@ def build_catch_up_summary(
         "source_category": "history",
         "history_only": True,
         "calibration_evidence": False,
+        "trust_guidance": CATCH_UP_TRUST_GUIDANCE,
         "git_ref_included": include_git_ref,
         "workflow_counts": dict(sorted(workflow_counts.items())),
         "status_counts": dict(sorted(status_counts.items())),

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/src/code_mower/init.py

@@ -169,6 +169,89 @@ def _lane_module_name(lane_id: str) -> str:
     return lane_id.replace("-", "_")
 
 
+def _display_name(raw_name: str) -> str:
+    return raw_name.replace("_", " ").replace("-", " ").title()
+
+
+def _workflow_name_for_target(target: str) -> str:
+    stem = Path(target).stem.replace("-", " ")
+    return stem[:1].upper() + stem[1:]
+
+
+def _audit_token_env(lane: Mapping[str, Any]) -> str:
+    token_env = lane.get("token_env", [])
+    if not isinstance(token_env, list):
+        token_env = []
+    names = [str(name) for name in token_env]
+    for name in names:
+        if name != "GITHUB_TOKEN" and name.endswith("_LABEL_TOKEN"):
+            return name
+    for name in names:
+        if name != "GITHUB_TOKEN":
+            return name
+    return "CODE_MOWER_AUDIT_LABEL_TOKEN"
+
+
+def _authors_env_for_trailer_lane(trailer_lane: str) -> str:
+    normalized = trailer_lane.replace("-", "_").upper()
+    explicit = {
+        "CLAUDE": "CLAUDE_AUDIT_BOT_AUTHORS",
+        "CODEX": "CODEX_BOT_AUTHORS",
+        "DEVIN": "DEVIN_BOT_AUTHORS",
+    }
+    return explicit.get(normalized, f"{normalized}_BOT_AUTHORS")
+
+
+def _trailer_prefix_for_lane(trailer_lane: str) -> str:
+    return f"{trailer_lane.replace('-', '_').upper()}_AUDIT_STATE"
+
+
+def _workflow_entry_for_target(
+    lane_id: str,
+    lane: Mapping[str, Any],
+    target: str,
+) -> dict[str, str]:
+    driver = str(lane.get("driver"))
+    labels = _labels_for(lane)
+    trailer_lane = _trailer_lane_name(lane_id, lane)
+    common = {
+        "path": target,
+        "lane_id": lane_id,
+        "workflow_name": _workflow_name_for_target(target),
+        "display_name": _display_name(trailer_lane),
+        "needs_label": str(labels["needs"]),
+        "done_label": str(labels["done"]),
+        "blocked_label": str(labels["blocked"]),
+        "label_token_env": _audit_token_env(lane),
+    }
+    if target.endswith("-bridge.yml"):
+        return {
+            **common,
+            "source": "hosted-bridge-workflow-template",
+            "copy_from": "templates/workflows/hosted-bridge.yml.j2",
+            "package_copy_from": "templates/workflows/hosted-bridge.yml.j2",
+        }
+    if driver == "saas_event":
+        adapter = str(lane.get("adapter") or lane.get("provider") or lane_id)
+        return {
+            **common,
+            "source": "saas-reviewer-labeler-workflow-template",
+            "copy_from": "templates/workflows/saas-reviewer-labeler.yml.j2",
+            "package_copy_from": "templates/workflows/saas-reviewer-labeler.yml.j2",
+            "adapter": adapter,
+            "authors_env": f"{adapter.replace('-', '_').upper()}_BOT_AUTHORS",
+        }
+    return {
+        **common,
+        "source": "trailer-comment-labeler-workflow-template",
+        "copy_from": "templates/workflows/trailer-comment-labeler.yml.j2",
+        "package_copy_from": "templates/workflows/trailer-comment-labeler.yml.j2",
+        "trailer_lane": trailer_lane,
+        "trailer_prefix": _trailer_prefix_for_lane(trailer_lane),
+        "authors_env": _authors_env_for_trailer_lane(trailer_lane),
+    }
+
+
 def _running_as_package() -> bool:
     return bool(__package__ and __package__ != "tools")
 
@@ -475,6 +558,37 @@ def _render_stale_workflow_template(text: str, *, lane: str) -> str:
     )
 
 
+def _render_workflow_template(text: str, entry: Mapping[str, Any]) -> str:
+    """Render lightweight workflow placeholders without requiring Jinja."""
+
+    rendered = text.replace("{% raw %}", "").replace("{% endraw %}", "")
+    replacements = {
+        "__ADAPTER__": str(entry.get("adapter") or ""),
+        "__AUTHORS_ENV__": str(entry.get("authors_env") or ""),
+        "__BLOCKED_LABEL__": str(entry.get("blocked_label") or ""),
+        "__DISPLAY_NAME__": str(entry.get("display_name") or ""),
+        "__DONE_LABEL__": str(entry.get("done_label") or ""),
+        "__LABEL_TOKEN_ENV__": str(entry.get("label_token_env") or ""),
+        "__LANE_ID__": str(entry.get("lane_id") or ""),
+        "__NEEDS_LABEL__": str(entry.get("needs_label") or ""),
+        "__TRAILER_LANE__": str(entry.get("trailer_lane") or ""),
+        "__TRAILER_PREFIX__": str(entry.get("trailer_prefix") or ""),
+        "__WORKFLOW_NAME__": str(entry.get("workflow_name") or "Code Mower labeler"),
+    }
+    for placeholder, value in replacements.items():
+        rendered = rendered.replace(placeholder, value)
+    return rendered
+
+
+def _workflow_template_needs_render(source: str) -> bool:
+    return source in {
+        "shared-cleanup-template",
+        "hosted-bridge-workflow-template",
+        "saas-reviewer-labeler-workflow-template",
+        "trailer-comment-labeler-workflow-template",
+    }
+
+
 def _copy_source_candidates(source_root: Path, entry: Mapping[str, Any], path: str) -> tuple[Path, ...]:
     candidates: list[Path] = []
     package_copy_from = entry.get("package_copy_from")
@@ -586,6 +700,11 @@ def apply_init_plan(
                     ),
                     encoding="utf-8",
                 )
+            elif _workflow_template_needs_render(str(entry.get("source"))):
+                destination.write_text(
+                    _render_workflow_template(source.read_text(encoding="utf-8"), entry),
+                    encoding="utf-8",
+                )
             else:
                 shutil.copyfile(source, destination)
         else:
@@ -674,7 +793,7 @@ def render_init_plan(
             )
             if target not in generated_paths:
                 generated_paths.add(target)
-                generated_files.append({"path": target, "source": "workflow-template"})
+                generated_files.append(_workflow_entry_for_target(lane_id, lane, target))
         if lane.get("driver") in {"local_cli", "hosted_bridge", "api_model"}:
             trailer_lane = _trailer_lane_name(lane_id, lane)
             trailer_module = _lane_module_name(trailer_lane)
@@ -700,6 +819,8 @@ def render_init_plan(
             {
                 "path": cleanup_path,
                 "source": "shared-cleanup-template",
+                "copy_from": "templates/workflows/audit-label-cleanup.yml.j2",
+                "package_copy_from": "templates/workflows/audit-label-cleanup.yml.j2",
             }
         )
     for lane_id, lane in selected_lanes.items():

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/src/code_mower/package_content.py

@@ -53,7 +53,24 @@ def _pyproject_text(package_name: str, *, version: str) -> str:
     )
 
 
+def _workflow_template_file_text(target: str) -> str | None:
+    module_dir = Path(__file__).resolve().parent
+    filename = Path(target).name
+    candidates = (
+        module_dir / "templates" / "workflows" / filename,
+        module_dir.parent / "templates" / "workflows" / filename,
+        module_dir.parents[1] / "templates" / "workflows" / filename,
+    )
+    for candidate in candidates:
+        if candidate.is_file():
+            return candidate.read_text(encoding="utf-8")
+    return None
+
+
 def _workflow_template_text(target: str) -> str:
+    file_text = _workflow_template_file_text(target)
+    if file_text is not None:
+        return file_text
     if target.endswith("blind-review-artifacts-dry-run.yml.j2"):
         return "\n".join(
             [

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/src/code_mower/package_manifest.py

@@ -443,6 +443,11 @@ TEMPLATE_FILES = (
     ("workflow", "templates/workflows/hosted-bridge.yml.j2"),
     ("workflow", "templates/workflows/audit-label-cleanup.yml.j2"),
     ("workflow", "templates/workflows/review-clear-stale.yml.j2"),
+    ("workflow", "src/code_mower/templates/workflows/trailer-comment-labeler.yml.j2"),
+    ("workflow", "src/code_mower/templates/workflows/saas-reviewer-labeler.yml.j2"),
+    ("workflow", "src/code_mower/templates/workflows/local-cli-audit.yml.j2"),
+    ("workflow", "src/code_mower/templates/workflows/hosted-bridge.yml.j2"),
+    ("workflow", "src/code_mower/templates/workflows/audit-label-cleanup.yml.j2"),
     ("workflow", "src/code_mower/templates/workflows/review-clear-stale.yml.j2"),
     ("workflow", "templates/workflows/private-standalone-shadow.yml.j2"),
     ("workflow", "src/code_mower/templates/workflows/private-standalone-shadow.yml.j2"),

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/src/code_mower/templates/code-mower.example.yml

@@ -26,6 +26,9 @@ lanes:
       command: codex
       doctor_probe_args:
         - --version
+    review_hygiene:
+      workflow: .github/workflows/codex-clear-stale.yml
+      token_env: GITHUB_TOKEN
 
   claude_review:
     type: review
@@ -81,6 +84,9 @@ lanes:
         - api_error_status
       doctor_probe_auth_status_fields:
         - api_error_status
+    review_hygiene:
+      workflow: .github/workflows/claude-clear-stale.yml
+      token_env: GITHUB_TOKEN
 
   greptile:
     type: audit

{code_mower-0.5.0b9 → code_mower-0.5.0b10}/src/code_mower/templates/providers.yml

@@ -120,7 +120,9 @@ provider_templates:
         - "api_error_status"
       doctor_probe_auth_status_fields:
         - "api_error_status"
-    review_hygiene: {}
+    review_hygiene:
+      workflow: ".github/workflows/claude-clear-stale.yml"
+      token_env: "GITHUB_TOKEN"
   claude_review:
     provider: "claude"
     driver: "manual"
@@ -179,7 +181,9 @@ provider_templates:
       command: "codex"
       doctor_probe_args:
         - "--version"
-    review_hygiene: {}
+    review_hygiene:
+      workflow: ".github/workflows/codex-clear-stale.yml"
+      token_env: "GITHUB_TOKEN"
   cursor_bugbot:
     provider: "cursor_bugbot"
     driver: "saas_event"

code_mower-0.5.0b10/src/code_mower/templates/workflows/audit-label-cleanup.yml.j2

@@ -0,0 +1,41 @@
+# Code Mower workflow template: manually remove stale or retired audit labels.
+name: Code Mower Audit Label Cleanup
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "Pull request number"
+        required: true
+      labels:
+        description: "Comma-separated labels to remove"
+        required: true
+
+permissions:
+  contents: read
+  issues: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Remove requested audit labels
+        env:
+          GH_TOKEN: {% raw %}${{ secrets.AUDIT_LABEL_CLEANUP_TOKEN || github.token }}{% endraw %}
+          PR_NUMBER: {% raw %}${{ github.event.inputs.pr_number }}{% endraw %}
+          LABELS: {% raw %}${{ github.event.inputs.labels }}{% endraw %}
+        run: |
+          set -euo pipefail
+
+          IFS=',' read -r -a labels <<< "${LABELS}"
+          for raw_label in "${labels[@]}"; do
+            label="$(printf '%s' "${raw_label}" | xargs)"
+            [ -n "${label}" ] || continue
+            gh issue edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --remove-label "${label}" || {
+              echo "::notice::Could not remove label ${label}; it may already be absent."
+            }
+          done

code_mower-0.5.0b10/src/code_mower/templates/workflows/hosted-bridge.yml.j2

@@ -0,0 +1,47 @@
+# Code Mower workflow template: manually requeue a hosted reviewer lane.
+#
+# Hosted provider apps own the actual review session. This bridge gives
+# maintainers a cheap, auditable way to re-add the lane's needs label and, when
+# an expected head SHA is supplied, refuse to queue against an unexpected head.
+name: __WORKFLOW_NAME__
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "Pull request number to requeue"
+        required: true
+      head_sha:
+        description: "Optional expected current PR head SHA"
+        required: false
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  requeue:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Requeue __DISPLAY_NAME__ hosted review
+        env:
+          GH_TOKEN: {% raw %}${{ secrets.__LABEL_TOKEN_ENV__ || github.token }}{% endraw %}
+          PR_NUMBER: {% raw %}${{ github.event.inputs.pr_number }}{% endraw %}
+          EXPECTED_HEAD_SHA: {% raw %}${{ github.event.inputs.head_sha }}{% endraw %}
+          NEEDS_LABEL: "__NEEDS_LABEL__"
+        run: |
+          set -euo pipefail
+
+          current_head="$(gh pr view "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json headRefOid --jq .headRefOid)"
+          if [ -n "${EXPECTED_HEAD_SHA:-}" ] && [ "${EXPECTED_HEAD_SHA}" != "${current_head}" ]; then
+            echo "::error::PR #${PR_NUMBER} current head ${current_head} does not match expected ${EXPECTED_HEAD_SHA}"
+            exit 1
+          fi
+
+          gh issue edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --add-label "${NEEDS_LABEL}"
+          echo "Queued ${NEEDS_LABEL} for ${GITHUB_REPOSITORY}#${PR_NUMBER} at ${current_head}."

code_mower-0.5.0b10/src/code_mower/templates/workflows/local-cli-audit.yml.j2

@@ -0,0 +1,34 @@
+# Code Mower workflow template: local CLI audit operating note.
+#
+# Local CLI lanes run in a trusted developer/operator environment so provider
+# auth, local checkout paths, and paid model credentials do not cross fork PR
+# boundaries inside GitHub Actions.
+name: Code Mower Local CLI Audit Note
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "Pull request number to audit locally"
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  instructions:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Print local audit command shape
+        env:
+          PR_NUMBER: {% raw %}${{ github.event.inputs.pr_number }}{% endraw %}
+        run: |
+          cat <<EOF
+          Local CLI audit lanes should be run from a trusted checkout, then the
+          resulting audit comment should be posted back to PR #${PR_NUMBER}.
+
+          Example command shapes:
+            tools/run_codex_audit_pr.sh --repo "${GITHUB_REPOSITORY}" --pr "${PR_NUMBER}"
+            tools/run_claude_audit_pr.sh --repo "${GITHUB_REPOSITORY}" --pr "${PR_NUMBER}"
+          EOF

code_mower-0.5.0b10/src/code_mower/templates/workflows/saas-reviewer-labeler.yml.j2

@@ -0,0 +1,58 @@
+# Code Mower workflow template: apply advisory labels from hosted/SaaS reviewer events.
+name: __WORKFLOW_NAME__
+
+on:
+  issue_comment:
+    types: [created, edited]
+  issues:
+    types: [labeled]
+  pull_request_review:
+    types: [submitted, edited]
+  check_run:
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      adapter:
+        description: "SaaS reviewer adapter to classify"
+        required: false
+        default: "__ADAPTER__"
+
+permissions:
+  contents: read
+  checks: read
+  issues: write
+  pull-requests: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  label:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'issue_comment' &&
+        github.event.issue.pull_request
+      ) ||
+      (
+        github.event_name == 'issues' &&
+        github.event.issue.pull_request
+      ) ||
+      github.event_name == 'pull_request_review' ||
+      github.event_name == 'check_run'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out Code Mower support files from default branch
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          ref: {% raw %}${{ github.event.repository.default_branch }}{% endraw %}
+          persist-credentials: false
+
+      - name: Apply __DISPLAY_NAME__ reviewer labels
+        env:
+          GITHUB_TOKEN: {% raw %}${{ github.token }}{% endraw %}
+          __LABEL_TOKEN_ENV__: {% raw %}${{ secrets.__LABEL_TOKEN_ENV__ }}{% endraw %}
+          __AUTHORS_ENV__: {% raw %}${{ vars.__AUTHORS_ENV__ }}{% endraw %}
+          REVIEWER_ADAPTER: {% raw %}${{ github.event.inputs.adapter || '__ADAPTER__' }}{% endraw %}
+        run: tools/code_mower saas-reviewer-labeler --adapter "${REVIEWER_ADAPTER}"

code_mower-0.5.0b10/src/code_mower/templates/workflows/trailer-comment-labeler.yml.j2

@@ -0,0 +1,57 @@
+# Code Mower workflow template: apply labels from trusted audit-result comments.
+name: __WORKFLOW_NAME__
+
+on:
+  issue_comment:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      lane:
+        description: "Trailer-comment lane to classify"
+        required: false
+        default: "__TRAILER_LANE__"
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  label:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'issue_comment' &&
+        github.event.issue.pull_request &&
+        (
+          contains(github.event.comment.body, '__TRAILER_PREFIX__') ||
+          contains(github.event.comment.body, '__DISPLAY_NAME__ Audit') ||
+          contains(github.event.comment.body, 'HEAD_CHANGED_DURING_REVIEW') ||
+          contains(github.event.comment.body, 'Label state:') ||
+          contains(github.event.comment.body, 'Intended label state:') ||
+          contains(github.event.comment.body, 'Expected labels:') ||
+          contains(github.event.comment.body, 'Intended labels:') ||
+          contains(github.event.comment.body, '__NEEDS_LABEL__') ||
+          contains(github.event.comment.body, '__DONE_LABEL__') ||
+          contains(github.event.comment.body, '__BLOCKED_LABEL__')
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out Code Mower support files from default branch
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          ref: {% raw %}${{ github.event.repository.default_branch }}{% endraw %}
+          persist-credentials: false
+
+      - name: Apply __DISPLAY_NAME__ audit labels
+        env:
+          GITHUB_TOKEN: {% raw %}${{ github.token }}{% endraw %}
+          __LABEL_TOKEN_ENV__: {% raw %}${{ secrets.__LABEL_TOKEN_ENV__ }}{% endraw %}
+          __AUTHORS_ENV__: {% raw %}${{ vars.__AUTHORS_ENV__ }}{% endraw %}
+          TRAILER_LANE: {% raw %}${{ github.event.inputs.lane || '__TRAILER_LANE__' }}{% endraw %}
+        run: tools/code_mower trailer-comment-labeler --lane "${TRAILER_LANE}"