Add labels to PR workflow (DataDog/datadog-agent)

The Add labels to PR workflow from DataDog/datadog-agent, explained and optimized by Latchkey.

CI health: C - fair

Point runs-on at Latchkey and get run de-duplication, job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: DataDog/datadog-agent.github/workflows/add-label-pr.ymlLicense Apache-2.0View source

What it does

This is the Add labels to PR workflow from the DataDog/datadog-agent repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

---
name: "Add labels to PR"

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - main
      - "[0-9]+.[0-9]+.x"

permissions: {}

jobs:
  assign-team-label:
    if: github.triggering_actor != 'dd-devflow[bot]' && github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Get GitHub token
        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
        id: octo-sts
        with:
          scope: DataDog/datadog-agent
          policy: self.add-labels-pr.label-pr
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          sparse-checkout: |
            .gitlab-ci.yml
            .github/CODEOWNERS
            .github/actions
            .ddqa/config.toml
            tasks
          persist-credentials: false
      - name: Install dda
        uses: ./.github/actions/install-dda
        with:
          features: legacy-tasks
      - name: Add the internal label
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        with:
          github-token: ${{ steps.octo-sts.outputs.token }}
          script: |
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: ${{ github.event.pull_request.number }},
              labels: ['internal']
            });
      - name: Assign team label
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
        run: dda inv -- -e github.assign-team-label --pr-id="${PR_NUMBER}"

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

---
name: "Add labels to PR"
 
on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - main
      - "[0-9]+.[0-9]+.x"
 
permissions: {}
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  assign-team-label:
    timeout-minutes: 30
    if: github.triggering_actor != 'dd-devflow[bot]' && github.event.pull_request.head.repo.full_name == github.repository
    runs-on: latchkey-small
    permissions:
      id-token: write
    steps:
      - name: Get GitHub token
        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
        id: octo-sts
        with:
          scope: DataDog/datadog-agent
          policy: self.add-labels-pr.label-pr
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          sparse-checkout: |
            .gitlab-ci.yml
            .github/CODEOWNERS
            .github/actions
            .ddqa/config.toml
            tasks
          persist-credentials: false
      - name: Install dda
        uses: ./.github/actions/install-dda
        with:
          features: legacy-tasks
      - name: Add the internal label
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        with:
          github-token: ${{ steps.octo-sts.outputs.token }}
          script: |
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: ${{ github.event.pull_request.number }},
              labels: ['internal']
            });
      - name: Assign team label
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
        run: dda inv -- -e github.assign-team-label --pr-id="${PR_NUMBER}"

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cancel superseded runs when a branch or PR gets a newer push.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout actions/github-script