build(deps): bump release-drafter/release-drafter/autolabeler from 7.7.0 to 7.9.0

[dependabot]

Bumps release-drafter/release-drafter/autolabeler from 7.7.0 to 7.9.0.

Release notes

Sourced from release-drafter/release-drafter/autolabeler's releases.

v7.9.0

What's Changed

New

• feat(autolabeler): sync configured pull request labels (#1787) @​jetersen
• feat(autolabeler): support multiple labels, stop rules and fallback (#1785) @​jetersen
• feat: expose PR labels in Drafter and Check PR outputs (#1782) @​jetersen
• feat: add resolved tag template variable (#1784) @​jetersen

Dependency Updates

• ci(deps): update reviewdog/action-actionlint action to v1.77.0 (#1781) @​renovate[bot]

Bug Fixes

• fix(config): provide standard loading for the programmatic API (#1783) @​jetersen
• fix: skip the missing-baseline warning when from is set (#1789) @​jmeridth

Maintenance

• chore: release v7.9.0 (#1790) @​release-drafter-releaser[bot]
• ci: dogfood Release Drafter and stage npm publishing (#1778) @​jetersen
• ci: lint GitHub Actions workflows with actionlint (#1780) @​jetersen

New Contributors

• No new contributors

Full Changelog: release-drafter/release-drafter@v7.8.0...v7.9.0

v7.8.0

What's Changed

New

• feat: merge repeated changes with group-changes (#1725) @​slawekjaranowski, @​claude
• feat(facade): wire multiforge adapters (#1709) @​jetersen
• feat(adapters): add GitLab REST adapter (#1708) @​jetersen
• feat(adapters): add Gitea and Forgejo REST adapters (#1707) @​jetersen
• feat: add config-driven check-pr validation (#1706) @​jetersen
• feat: move GitHub Actions into workspace (#1705) @​jetersen
• feat: add release-drafter CLI (#1704) @​jetersen
• feat: expose programmatic API (#1702) @​jetersen
• feat: add GitHub adapter (#1701) @​jetersen
• feat: extract forge-neutral core contract (#1699) @​jetersen

Dependency Updates

... (truncated)

Commits

• 72967cd chore: release v7.9.0 (#1790)
• 43cd2a9 feat(autolabeler): sync configured pull request labels (#1787)
• a99850f feat(autolabeler): support multiple labels, stop rules and fallback (#1785)
• 26b7080 feat: expose PR labels in Drafter and Check PR outputs (#1782)
• 58b89af feat: add resolved tag template variable (#1784)
• 7aa25ba fix(config): provide standard loading for the programmatic API (#1783)
• 1e80012 fix: skip the missing-baseline warning when from is set (#1789)
• 57f4179 ci: dogfood Release Drafter and stage npm publishing (#1778)
• 75620c0 ci(deps): update reviewdog/action-actionlint action to v1.77.0 (#1781)
• fb48a58 ci: lint GitHub Actions workflows with actionlint (#1780)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 6, 2026, 11:38 PM ET / October 7, 2026, 03:38 UTC (Revision 3).

ClawSweeper review

What this changes

Updates the commit-pinned Release Drafter action that automatically labels pull requests from v7.7.0 to v7.9.0.

Merge readiness

✅ Ready for maintainer review

The update remains useful: current main still pins v7.7.0. No actionable defect or concrete security regression was found, and the related PR updates a separate action.

Priority: P3
Reviewed head: f6b7e5a7283e1e18c261f14d1e86f1cc969139f6

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, commit-pinned dependency update with compatible configuration and no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot-authored maintenance is exempt from ordinary contributor proof; source inspection verifies the autolabeler contract, while reported workflow checks do not prove execution of the new pin. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot-authored maintenance is exempt from ordinary contributor proof; source inspection verifies the autolabeler contract, while reported workflow checks do not prove execution of the new pin. No stored-data contract changes.
Evidence reviewed	7 items	Pinned introduction and merge result: The introduced delta changes only the autolabeler SHA at line 25; the verified test merge has the same one-line delta against its main parent. Permissions, events, token handling, and the release-drafting action remain unchanged. Still necessary on main: The fetched main revision, also identified in Repository State as release v0.10.2, still uses the v7.7.0 autolabeler commit. Dependency identity and action contract: The workflow directly executes this dependency, making its action contract relevant. GitHub resolves v7.9.0 to the proposed SHA; both old and new action metadata use Node 24, the same bundled entrypoint, and the same default token and configuration name.
Findings	None	None.
Security	None	None.

How this fits together

Slacrawl’s GitHub workflow matches pull request titles against repository-owned rules and applies labels. Those labels help organize changes in draft release notes.

flowchart TD
  A[Pull request events] --> B[Autolabel workflow]
  C[Repository label rules] --> B
  B --> D[Match title and change metadata]
  D --> E[Apply matching labels]
  E --> F[Release note categories]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the autolabeler pinned to the verified upstream release commit while preserving the repository’s existing label rules.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this dependency update does not report a product bug; source inspection confirms the changed action and its configuration contract.

Is this the best way to solve the issue?

Yes: replacing one immutable action pin is a focused upgrade, and upstream preserves the current single-label, add-only behavior by default.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 04cfc53efaa3.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is a bounded maintenance update to release-label automation with no demonstrated urgent regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot-authored maintenance is exempt from ordinary contributor proof; source inspection verifies the autolabeler contract, while reported workflow checks do not prove execution of the new pin. No stored-data contract changes.

Evidence

What I checked:

• Pinned introduction and merge result: The introduced delta changes only the autolabeler SHA at line 25; the verified test merge has the same one-line delta against its main parent. Permissions, events, token handling, and the release-drafting action remain unchanged. (.github/workflows/release-drafter.yml:25, f6b7e5a7283e)
• Still necessary on main: The fetched main revision, also identified in Repository State as release v0.10.2, still uses the v7.7.0 autolabeler commit. (.github/workflows/release-drafter.yml:25, 04cfc53efaa3)
• Dependency identity and action contract: The workflow directly executes this dependency, making its action contract relevant. GitHub resolves v7.9.0 to the proposed SHA; both old and new action metadata use Node 24, the same bundled entrypoint, and the same default token and configuration name. (autolabeler/action.yml:8, 72967cdc98dd)
• Backward-compatible label behavior: The new schema retains single-label rules and defaults sync-labels to false. The runner removes labels only when syncing is enabled; Slacrawl’s unchanged configuration does not enable it. (packages/autolabeler/src/config/config.schema.ts:25, 72967cdc98dd)
• Related update is distinct: build(deps): bump release-drafter/release-drafter from 7.7.0 to 7.9.0 #266 remains open and updates only the release-drafting action at line 37, leaving this PR’s autolabeler update distinct. (.github/workflows/release-drafter.yml:37, bf504413f3a4)
• Workflow history and routing: File history shows Vincent Koc’s workflow hardening, Node 24 upgrade, and commit-pinning work. GitHub identifies vincentkoc as the author of the pinning commit. Local blame could not complete because historical blobs were unavailable; GitHub’s commit patch independently confirmed the pinning change. (.github/workflows/release-drafter.yml:25, 0390dcc930f1)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-04T20:16:53.181Z sha f6b7e5a :: needs maintainer review before merge. :: none
• reviewed 2026-10-05T18:37:24.947Z sha f6b7e5a :: needs maintainer review before merge. :: none

[steipete]

Consolidated into #261, which updates CrawlKit 0.16.7 and both Release Drafter 7.9.0 action pins together. The combined change satisfies the dependency cooldown, has passed the complete remote check gate and independent review, and is awaiting hosted CI and required approval. Closing this duplicate so the updates stay together. Thanks for the dependency update.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.