From fbc85a8b1e628dc16bbbd248d7c031ab88d5062e Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Thu, 11 Sep 2025 15:15:37 -0400
Subject: [PATCH 01/12] Add GitHub workflows for automatic PR labeling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add needs-review workflow: automatically labels non-draft PRs without WIP in title (excludes red-hat-konflux)
- Add needs-changes workflow: manages review status labels based on PR reviews and comments
  - Removes needs-review when any review is submitted
  - Adds needs-changes for non-approved reviews
  - Removes needs-changes when lgtm label is added
  - Allows manual needs-changes labeling via comments

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/needs-changes.yaml | 94 ++++++++++++++++++++++++++++
 .github/workflows/needs-review.yaml  | 24 +++++++
 2 files changed, 118 insertions(+)
 create mode 100644 .github/workflows/needs-changes.yaml
 create mode 100644 .github/workflows/needs-review.yaml

diff --git a/.github/workflows/needs-changes.yaml b/.github/workflows/needs-changes.yaml
new file mode 100644
index 000000000..b991bdbab
--- /dev/null
+++ b/.github/workflows/needs-changes.yaml
@@ -0,0 +1,94 @@
+name: PR Review Label Management
+
+on:
+  pull_request_review:
+    types: [submitted]
+  issue_comment:
+    types: [created]
+  pull_request:
+    types: [labeled]
+
+jobs:
+  manage-review-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Handle review submission
+        if: github.event_name == 'pull_request_review'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const pr_number = context.payload.pull_request.number;
+            const review_state = context.payload.review.state;
+            
+            // Remove needs-review label when any review is submitted
+            try {
+              await github.rest.issues.removeLabel({
+                owner,
+                repo,
+                issue_number: pr_number,
+                name: 'needs-review'
+              });
+              console.log('Removed needs-review label');
+            } catch (error) {
+              console.log('needs-review label not found or already removed');
+            }
+            
+            // Add needs-changes label for non-approved reviews
+            if (review_state === 'changes_requested' || review_state === 'commented') {
+              try {
+                await github.rest.issues.addLabels({
+                  owner,
+                  repo,
+                  issue_number: pr_number,
+                  labels: ['needs-changes']
+                });
+                console.log('Added needs-changes label');
+              } catch (error) {
+                console.log('Error adding needs-changes label:', error.message);
+              }
+            }
+
+      - name: Handle manual needs-changes via comment
+        if: github.event_name == 'issue_comment' && github.event.issue.pull_request
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const comment = context.payload.comment.body.toLowerCase();
+            
+            if (comment.includes('needs-changes') || comment.includes('/needs-changes')) {
+              const { owner, repo } = context.repo;
+              const issue_number = context.payload.issue.number;
+              
+              try {
+                await github.rest.issues.addLabels({
+                  owner,
+                  repo,
+                  issue_number,
+                  labels: ['needs-changes']
+                });
+                console.log('Added needs-changes label via comment');
+              } catch (error) {
+                console.log('Error adding needs-changes label:', error.message);
+              }
+            }
+
+      - name: Remove needs-changes when lgtm is added
+        if: github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name == 'lgtm'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const pr_number = context.payload.pull_request.number;
+            
+            try {
+              await github.rest.issues.removeLabel({
+                owner,
+                repo,
+                issue_number: pr_number,
+                name: 'needs-changes'
+              });
+              console.log('Removed needs-changes label when lgtm was added');
+            } catch (error) {
+              console.log('needs-changes label not found or already removed');
+            }
\ No newline at end of file
diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
new file mode 100644
index 000000000..7e2d40e8a
--- /dev/null
+++ b/.github/workflows/needs-review.yaml
@@ -0,0 +1,24 @@
+name: Auto-label PR for review
+
+on:
+  pull_request:
+    types: [opened, edited, ready_for_review]
+
+jobs:
+  auto-label:
+    runs-on: ubuntu-latest
+    if: >
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.login != 'red-hat-konflux' &&
+      !contains(github.event.pull_request.title, 'WIP')
+    steps:
+      - name: Add needs-review label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: ['needs-review']
+            });
\ No newline at end of file

From 84df2448a1a50bcf6e4b101e8039f496221bfc66 Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Thu, 11 Sep 2025 15:25:56 -0400
Subject: [PATCH 02/12] Add manual needs-review labeling via comments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow users to manually add needs-review label by commenting "needs-review" or "/needs-review" on PRs.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/needs-review.yaml | 32 ++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index 7e2d40e8a..45d717537 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -3,11 +3,14 @@ name: Auto-label PR for review
 on:
   pull_request:
     types: [opened, edited, ready_for_review]
+  issue_comment:
+    types: [created]
 
 jobs:
   auto-label:
     runs-on: ubuntu-latest
     if: >
+      github.event_name == 'pull_request' &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.login != 'red-hat-konflux' &&
       !contains(github.event.pull_request.title, 'WIP')
@@ -21,4 +24,31 @@ jobs:
               repo: context.repo.repo,
               issue_number: context.issue.number,
               labels: ['needs-review']
-            });
\ No newline at end of file
+            });
+
+  manual-needs-review:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'issue_comment' && github.event.issue.pull_request
+    steps:
+      - name: Add needs-review label via comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const comment = context.payload.comment.body.toLowerCase();
+            
+            if (comment.includes('needs-review') || comment.includes('/needs-review')) {
+              const { owner, repo } = context.repo;
+              const issue_number = context.payload.issue.number;
+              
+              try {
+                await github.rest.issues.addLabels({
+                  owner,
+                  repo,
+                  issue_number,
+                  labels: ['needs-review']
+                });
+                console.log('Added needs-review label via comment');
+              } catch (error) {
+                console.log('Error adding needs-review label:', error.message);
+              }
+            }

From 6785ca5cc6d1c7ccf376aafbb3400bf150cd43ed Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Thu, 11 Sep 2025 15:28:31 -0400
Subject: [PATCH 03/12] Fix workflow permissions for label management
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add explicit permissions for issues and pull-requests write access to resolve "Resource not accessible by integration" errors.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/needs-changes.yaml | 4 ++++
 .github/workflows/needs-review.yaml  | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/needs-changes.yaml b/.github/workflows/needs-changes.yaml
index b991bdbab..60fe6f0ee 100644
--- a/.github/workflows/needs-changes.yaml
+++ b/.github/workflows/needs-changes.yaml
@@ -8,6 +8,10 @@ on:
   pull_request:
     types: [labeled]
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   manage-review-labels:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index 45d717537..6f040c8c8 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -6,6 +6,10 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   auto-label:
     runs-on: ubuntu-latest

From 807c25935b41303872e8785fee51378a2db55b46 Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Thu, 11 Sep 2025 15:52:14 -0400
Subject: [PATCH 04/12] permission for the job

---
 .github/workflows/needs-review.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index 6f040c8c8..0bd435645 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -12,6 +12,8 @@ permissions:
 
 jobs:
   auto-label:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     if: >
       github.event_name == 'pull_request' &&

From fa278b88774c0485d9a76fe954f18ee19df2a7aa Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Thu, 11 Sep 2025 16:13:19 -0400
Subject: [PATCH 05/12] use pull_request_target

---
 .github/workflows/needs-review.yaml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index 0bd435645..34152b536 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -1,11 +1,8 @@
 name: Auto-label PR for review
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, edited, ready_for_review]
-  issue_comment:
-    types: [created]
-
 permissions:
   issues: write
   pull-requests: write

From 3c0b1ae4611fd7d739dc3f211b2b2c752fb96628 Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Thu, 11 Sep 2025 16:32:21 -0400
Subject: [PATCH 06/12] updates remove, make needs-review and needs-changes
 mutually exclusive

---
 .github/workflows/needs-changes.yaml |  3 +--
 .github/workflows/needs-review.yaml  | 36 ++++++++++++++++++++++++----
 2 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/needs-changes.yaml b/.github/workflows/needs-changes.yaml
index 60fe6f0ee..04789fa80 100644
--- a/.github/workflows/needs-changes.yaml
+++ b/.github/workflows/needs-changes.yaml
@@ -9,7 +9,6 @@ on:
     types: [labeled]
 
 permissions:
-  issues: write
   pull-requests: write
 
 jobs:
@@ -95,4 +94,4 @@ jobs:
               console.log('Removed needs-changes label when lgtm was added');
             } catch (error) {
               console.log('needs-changes label not found or already removed');
-            }
\ No newline at end of file
+            }
diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index 34152b536..a2d0e477b 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -2,18 +2,18 @@ name: Auto-label PR for review
 
 on:
   pull_request_target:
-    types: [opened, edited, ready_for_review]
+    types: [opened, edited, ready_for_review, labeled]
+  issue_comment:
+    types: [created]
 permissions:
-  issues: write
   pull-requests: write
 
 jobs:
   auto-label:
-    permissions:
-      pull-requests: write
     runs-on: ubuntu-latest
     if: >
-      github.event_name == 'pull_request' &&
+      github.event_name == 'pull_request_target' &&
+      contains(fromJSON('["opened", "edited", "ready_for_review"]'), github.event.action) &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.login != 'red-hat-konflux' &&
       !contains(github.event.pull_request.title, 'WIP')
@@ -55,3 +55,29 @@ jobs:
                 console.log('Error adding needs-review label:', error.message);
               }
             }
+
+  remove-needs-review-on-needs-changes:
+    runs-on: ubuntu-latest
+    if: >
+      github.event_name == 'pull_request_target' &&
+      github.event.action == 'labeled' &&
+      github.event.label.name == 'needs-changes'
+    steps:
+      - name: Remove needs-review label when needs-changes is added
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const pr_number = context.payload.pull_request.number;
+            
+            try {
+              await github.rest.issues.removeLabel({
+                owner,
+                repo,
+                issue_number: pr_number,
+                name: 'needs-review'
+              });
+              console.log('Removed needs-review label when needs-changes was added');
+            } catch (error) {
+              console.log('needs-review label not found or already removed');
+            }

From 901b962c7ab8e4b9d5310ee85eaef762aa02b61b Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Thu, 11 Sep 2025 16:43:24 -0400
Subject: [PATCH 07/12] add synchronize and reoped types

---
 .github/workflows/needs-review.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index a2d0e477b..33110fd66 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -2,7 +2,7 @@ name: Auto-label PR for review
 
 on:
   pull_request_target:
-    types: [opened, edited, ready_for_review, labeled]
+    types: [synchronize, reopened, opened, edited, ready_for_review, labeled]
   issue_comment:
     types: [created]
 permissions:

From 68d0f103fabec2e5d0fe10079d79f04b54153649 Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Fri, 12 Sep 2025 16:21:55 -0400
Subject: [PATCH 08/12] Replace GitHub Actions scripts with gh CLI commands
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert both workflow files to use gh CLI instead of actions/github-script for label management:
- needs-review.yaml: Use gh pr edit for adding/removing needs-review labels
- needs-changes.yaml: Use gh pr edit for managing needs-changes labels based on review state

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/needs-changes.yaml | 102 ++++++++-------------------
 .github/workflows/needs-review.yaml  |  65 +++++------------
 2 files changed, 48 insertions(+), 119 deletions(-)

diff --git a/.github/workflows/needs-changes.yaml b/.github/workflows/needs-changes.yaml
index 04789fa80..f2a7ff064 100644
--- a/.github/workflows/needs-changes.yaml
+++ b/.github/workflows/needs-changes.yaml
@@ -17,81 +17,39 @@ jobs:
     steps:
       - name: Handle review submission
         if: github.event_name == 'pull_request_review'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const pr_number = context.payload.pull_request.number;
-            const review_state = context.payload.review.state;
-            
-            // Remove needs-review label when any review is submitted
-            try {
-              await github.rest.issues.removeLabel({
-                owner,
-                repo,
-                issue_number: pr_number,
-                name: 'needs-review'
-              });
-              console.log('Removed needs-review label');
-            } catch (error) {
-              console.log('needs-review label not found or already removed');
-            }
-            
-            // Add needs-changes label for non-approved reviews
-            if (review_state === 'changes_requested' || review_state === 'commented') {
-              try {
-                await github.rest.issues.addLabels({
-                  owner,
-                  repo,
-                  issue_number: pr_number,
-                  labels: ['needs-changes']
-                });
-                console.log('Added needs-changes label');
-              } catch (error) {
-                console.log('Error adding needs-changes label:', error.message);
-              }
-            }
+        run: |
+          PR_NUMBER=${{ github.event.pull_request.number }}
+          REVIEW_STATE="${{ github.event.review.state }}"
+          
+          # Remove needs-review label when any review is submitted
+          echo "Removing needs-review label"
+          gh pr edit $PR_NUMBER --remove-label needs-review || echo "needs-review label not found or already removed"
+          
+          # Add needs-changes label for non-approved reviews
+          if [[ "$REVIEW_STATE" == "changes_requested" ]] || [[ "$REVIEW_STATE" == "commented" ]]; then
+            echo "Adding needs-changes label for $REVIEW_STATE review"
+            gh pr edit $PR_NUMBER --add-label needs-changes || echo "Failed to add needs-changes label or label already exists"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Handle manual needs-changes via comment
         if: github.event_name == 'issue_comment' && github.event.issue.pull_request
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const comment = context.payload.comment.body.toLowerCase();
-            
-            if (comment.includes('needs-changes') || comment.includes('/needs-changes')) {
-              const { owner, repo } = context.repo;
-              const issue_number = context.payload.issue.number;
-              
-              try {
-                await github.rest.issues.addLabels({
-                  owner,
-                  repo,
-                  issue_number,
-                  labels: ['needs-changes']
-                });
-                console.log('Added needs-changes label via comment');
-              } catch (error) {
-                console.log('Error adding needs-changes label:', error.message);
-              }
-            }
+        run: |
+          COMMENT_BODY="${{ github.event.comment.body }}"
+          COMMENT_LOWER=$(echo "$COMMENT_BODY" | tr '[:upper:]' '[:lower:]')
+          
+          if [[ "$COMMENT_LOWER" == *"needs-changes"* ]] || [[ "$COMMENT_LOWER" == *"/needs-changes"* ]]; then
+            echo "Adding needs-changes label via comment"
+            gh pr edit ${{ github.event.issue.number }} --add-label needs-changes || echo "Failed to add needs-changes label or label already exists"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Remove needs-changes when lgtm is added
         if: github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name == 'lgtm'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const pr_number = context.payload.pull_request.number;
-            
-            try {
-              await github.rest.issues.removeLabel({
-                owner,
-                repo,
-                issue_number: pr_number,
-                name: 'needs-changes'
-              });
-              console.log('Removed needs-changes label when lgtm was added');
-            } catch (error) {
-              console.log('needs-changes label not found or already removed');
-            }
+        run: |
+          echo "Removing needs-changes label when lgtm was added"
+          gh pr edit ${{ github.event.pull_request.number }} --remove-label needs-changes || echo "needs-changes label not found or already removed"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index 33110fd66..4060cdf9f 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -19,42 +19,25 @@ jobs:
       !contains(github.event.pull_request.title, 'WIP')
     steps:
       - name: Add needs-review label
-        uses: actions/github-script@v7
-        with:
-          script: |
-            github.rest.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              labels: ['needs-review']
-            });
+        run: gh pr edit ${{ github.event.pull_request.number }} --add-label needs-review
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   manual-needs-review:
     runs-on: ubuntu-latest
     if: github.event_name == 'issue_comment' && github.event.issue.pull_request
     steps:
       - name: Add needs-review label via comment
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const comment = context.payload.comment.body.toLowerCase();
-            
-            if (comment.includes('needs-review') || comment.includes('/needs-review')) {
-              const { owner, repo } = context.repo;
-              const issue_number = context.payload.issue.number;
-              
-              try {
-                await github.rest.issues.addLabels({
-                  owner,
-                  repo,
-                  issue_number,
-                  labels: ['needs-review']
-                });
-                console.log('Added needs-review label via comment');
-              } catch (error) {
-                console.log('Error adding needs-review label:', error.message);
-              }
-            }
+        run: |
+          COMMENT_BODY="${{ github.event.comment.body }}"
+          COMMENT_LOWER=$(echo "$COMMENT_BODY" | tr '[:upper:]' '[:lower:]')
+          
+          if [[ "$COMMENT_LOWER" == *"needs-review"* ]] || [[ "$COMMENT_LOWER" == *"/needs-review"* ]]; then
+            echo "Adding needs-review label via comment"
+            gh pr edit ${{ github.event.issue.number }} --add-label needs-review || echo "Failed to add label or label already exists"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   remove-needs-review-on-needs-changes:
     runs-on: ubuntu-latest
@@ -64,20 +47,8 @@ jobs:
       github.event.label.name == 'needs-changes'
     steps:
       - name: Remove needs-review label when needs-changes is added
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const pr_number = context.payload.pull_request.number;
-            
-            try {
-              await github.rest.issues.removeLabel({
-                owner,
-                repo,
-                issue_number: pr_number,
-                name: 'needs-review'
-              });
-              console.log('Removed needs-review label when needs-changes was added');
-            } catch (error) {
-              console.log('needs-review label not found or already removed');
-            }
+        run: |
+          echo "Removing needs-review label when needs-changes was added"
+          gh pr edit ${{ github.event.pull_request.number }} --remove-label needs-review || echo "needs-review label not found or already removed"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From b02882ac6780300489e1cfdad043c2da52dc0df8 Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Fri, 12 Sep 2025 16:35:40 -0400
Subject: [PATCH 09/12] update permissions

---
 .github/workflows/needs-changes.yaml | 5 ++---
 .github/workflows/needs-review.yaml  | 4 ++--
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/needs-changes.yaml b/.github/workflows/needs-changes.yaml
index f2a7ff064..202d86981 100644
--- a/.github/workflows/needs-changes.yaml
+++ b/.github/workflows/needs-changes.yaml
@@ -8,12 +8,11 @@ on:
   pull_request:
     types: [labeled]
 
-permissions:
-  pull-requests: write
-
 jobs:
   manage-review-labels:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - name: Handle review submission
         if: github.event_name == 'pull_request_review'
diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index 4060cdf9f..010184484 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -5,12 +5,12 @@ on:
     types: [synchronize, reopened, opened, edited, ready_for_review, labeled]
   issue_comment:
     types: [created]
-permissions:
-  pull-requests: write
 
 jobs:
   auto-label:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     if: >
       github.event_name == 'pull_request_target' &&
       contains(fromJSON('["opened", "edited", "ready_for_review"]'), github.event.action) &&

From 42837176dc4219a46741d37a0b2900cb9193d3ae Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Fri, 12 Sep 2025 16:44:51 -0400
Subject: [PATCH 10/12] Fix git repository error by using GH_REPO instead of
 checkout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace actions/checkout with GH_REPO environment variable to avoid "fatal: not a git repository" errors. This approach matches the existing pr-labels.yaml workflow and is more efficient.

Changes:
- Remove actions/checkout@v4 steps from all jobs
- Replace GITHUB_TOKEN with GH_TOKEN
- Add GH_REPO environment variable for repository context

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/needs-changes.yaml | 9 ++++++---
 .github/workflows/needs-review.yaml  | 9 ++++++---
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/needs-changes.yaml b/.github/workflows/needs-changes.yaml
index 202d86981..a3e801edd 100644
--- a/.github/workflows/needs-changes.yaml
+++ b/.github/workflows/needs-changes.yaml
@@ -30,7 +30,8 @@ jobs:
             gh pr edit $PR_NUMBER --add-label needs-changes || echo "Failed to add needs-changes label or label already exists"
           fi
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
 
       - name: Handle manual needs-changes via comment
         if: github.event_name == 'issue_comment' && github.event.issue.pull_request
@@ -43,7 +44,8 @@ jobs:
             gh pr edit ${{ github.event.issue.number }} --add-label needs-changes || echo "Failed to add needs-changes label or label already exists"
           fi
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
 
       - name: Remove needs-changes when lgtm is added
         if: github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name == 'lgtm'
@@ -51,4 +53,5 @@ jobs:
           echo "Removing needs-changes label when lgtm was added"
           gh pr edit ${{ github.event.pull_request.number }} --remove-label needs-changes || echo "needs-changes label not found or already removed"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index 010184484..6e56318d9 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -21,7 +21,8 @@ jobs:
       - name: Add needs-review label
         run: gh pr edit ${{ github.event.pull_request.number }} --add-label needs-review
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
 
   manual-needs-review:
     runs-on: ubuntu-latest
@@ -37,7 +38,8 @@ jobs:
             gh pr edit ${{ github.event.issue.number }} --add-label needs-review || echo "Failed to add label or label already exists"
           fi
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
 
   remove-needs-review-on-needs-changes:
     runs-on: ubuntu-latest
@@ -51,4 +53,5 @@ jobs:
           echo "Removing needs-review label when needs-changes was added"
           gh pr edit ${{ github.event.pull_request.number }} --remove-label needs-review || echo "needs-review label not found or already removed"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}

From 867d71ce1d4b177a9eee450f2bbab009e895c9b4 Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Fri, 12 Sep 2025 17:00:24 -0400
Subject: [PATCH 11/12] updates for error

---
 .github/workflows/needs-changes.yaml | 6 +++---
 .github/workflows/needs-review.yaml  | 4 ++++
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/needs-changes.yaml b/.github/workflows/needs-changes.yaml
index a3e801edd..c27cbcd70 100644
--- a/.github/workflows/needs-changes.yaml
+++ b/.github/workflows/needs-changes.yaml
@@ -5,7 +5,7 @@ on:
     types: [submitted]
   issue_comment:
     types: [created]
-  pull_request:
+  pull_request_target:
     types: [labeled]
 
 jobs:
@@ -15,7 +15,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Handle review submission
-        if: github.event_name == 'pull_request_review'
+        if: github.event_name == 'pull_request_review' && github.event.pull_request.head.repo.full_name == github.repository
         run: |
           PR_NUMBER=${{ github.event.pull_request.number }}
           REVIEW_STATE="${{ github.event.review.state }}"
@@ -48,7 +48,7 @@ jobs:
           GH_REPO: ${{ github.repository }}
 
       - name: Remove needs-changes when lgtm is added
-        if: github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name == 'lgtm'
+        if: github.event_name == 'pull_request_target' && github.event.action == 'labeled' && github.event.label.name == 'lgtm'
         run: |
           echo "Removing needs-changes label when lgtm was added"
           gh pr edit ${{ github.event.pull_request.number }} --remove-label needs-changes || echo "needs-changes label not found or already removed"
diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index 6e56318d9..e0eab1eb0 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -26,6 +26,8 @@ jobs:
 
   manual-needs-review:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     if: github.event_name == 'issue_comment' && github.event.issue.pull_request
     steps:
       - name: Add needs-review label via comment
@@ -43,6 +45,8 @@ jobs:
 
   remove-needs-review-on-needs-changes:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     if: >
       github.event_name == 'pull_request_target' &&
       github.event.action == 'labeled' &&

From 87313bbe539812ed599df0c8b2d03660bc44808a Mon Sep 17 00:00:00 2001
From: memodi <memodi@redhat.com>
Date: Fri, 12 Sep 2025 17:16:43 -0400
Subject: [PATCH 12/12] Fix workflow execution issues and add debugging
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove restrictive fork condition that was causing steps to be skipped
- Add comprehensive debugging output to diagnose event and condition issues
- Make PR condition more explicit with != null check
- Ensure proper permissions are set on all jobs

This should resolve:
1. needs-changes.yaml steps being skipped
2. needs-review.yaml not executing on "/needs-review" comments

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/needs-changes.yaml | 9 ++++++++-
 .github/workflows/needs-review.yaml  | 9 ++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/needs-changes.yaml b/.github/workflows/needs-changes.yaml
index c27cbcd70..1626fef8e 100644
--- a/.github/workflows/needs-changes.yaml
+++ b/.github/workflows/needs-changes.yaml
@@ -15,8 +15,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Handle review submission
-        if: github.event_name == 'pull_request_review' && github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name == 'pull_request_review'
         run: |
+          echo "Event name: ${{ github.event_name }}"
+          echo "PR number: ${{ github.event.pull_request.number }}"
+          echo "Review state: ${{ github.event.review.state }}"
+          echo "Repository: ${{ github.repository }}"
+          
           PR_NUMBER=${{ github.event.pull_request.number }}
           REVIEW_STATE="${{ github.event.review.state }}"
           
@@ -28,6 +33,8 @@ jobs:
           if [[ "$REVIEW_STATE" == "changes_requested" ]] || [[ "$REVIEW_STATE" == "commented" ]]; then
             echo "Adding needs-changes label for $REVIEW_STATE review"
             gh pr edit $PR_NUMBER --add-label needs-changes || echo "Failed to add needs-changes label or label already exists"
+          else
+            echo "Review state $REVIEW_STATE does not trigger needs-changes label"
           fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/needs-review.yaml b/.github/workflows/needs-review.yaml
index e0eab1eb0..90cf079f8 100644
--- a/.github/workflows/needs-review.yaml
+++ b/.github/workflows/needs-review.yaml
@@ -28,16 +28,23 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
-    if: github.event_name == 'issue_comment' && github.event.issue.pull_request
+    if: github.event_name == 'issue_comment' && github.event.issue.pull_request != null
     steps:
       - name: Add needs-review label via comment
         run: |
+          echo "Event name: ${{ github.event_name }}"
+          echo "Issue number: ${{ github.event.issue.number }}"
+          echo "Comment body: ${{ github.event.comment.body }}"
+          echo "Is PR: ${{ github.event.issue.pull_request != null }}"
+          
           COMMENT_BODY="${{ github.event.comment.body }}"
           COMMENT_LOWER=$(echo "$COMMENT_BODY" | tr '[:upper:]' '[:lower:]')
           
           if [[ "$COMMENT_LOWER" == *"needs-review"* ]] || [[ "$COMMENT_LOWER" == *"/needs-review"* ]]; then
             echo "Adding needs-review label via comment"
             gh pr edit ${{ github.event.issue.number }} --add-label needs-review || echo "Failed to add label or label already exists"
+          else
+            echo "Comment does not contain needs-review trigger"
           fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}