From 70f9edeec77a727c19ca79f5c8a8babcf622cc54 Mon Sep 17 00:00:00 2001
From: Shadow <shadow@clawd.bot>
Date: Mon, 9 Feb 2026 18:59:23 -0600
Subject: [PATCH] CI: check maintainer team membership for labels

---
 .github/workflows/labeler.yml | 48 ++++++++++++++++++++++++++---------
 1 file changed, 36 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index f403c1030c..1170975c7a 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -30,14 +30,26 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |
-            const association = context.payload.pull_request?.author_association;
-            if (!association) {
+            const login = context.payload.pull_request?.user?.login;
+            if (!login) {
               return;
             }
-            if (![
-              "MEMBER",
-              "OWNER",
-            ].includes(association)) {
+
+            let isMaintainer = false;
+            try {
+              const membership = await github.rest.teams.getMembershipForUserInOrg({
+                org: context.repo.owner,
+                team_slug: "maintainer",
+                username: login,
+              });
+              isMaintainer = membership?.data?.state === "active";
+            } catch (error) {
+              if (error?.status !== 404) {
+                throw error;
+              }
+            }
+
+            if (!isMaintainer) {
               return;
             }
 
@@ -62,14 +74,26 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |
-            const association = context.payload.issue?.author_association;
-            if (!association) {
+            const login = context.payload.issue?.user?.login;
+            if (!login) {
               return;
             }
-            if (![
-              "MEMBER",
-              "OWNER",
-            ].includes(association)) {
+
+            let isMaintainer = false;
+            try {
+              const membership = await github.rest.teams.getMembershipForUserInOrg({
+                org: context.repo.owner,
+                team_slug: "maintainer",
+                username: login,
+              });
+              isMaintainer = membership?.data?.state === "active";
+            } catch (error) {
+              if (error?.status !== 404) {
+                throw error;
+              }
+            }
+
+            if (!isMaintainer) {
               return;
             }