[posquit0]

👋 Background

Provide a Python/uv alternative to #47 with the same action path, policy inputs, outputs, and reusable-workflow integration. Both PRs target main independently; choose one implementation, not both.

⚙️ Description

• Add .github/actions/github.pr.size-labeler using uv run --no-config --locked --script size_labeler.py, uv 0.13.2, and Python 3.12. PEP 723 metadata and the adjacent lock file replace a package project and generated build artifacts.
• Delegate GitHub authentication, API objects and pagination to PyGithub 2.10.0; YAML parsing/duplicate detection to ruamel.yaml 0.19.1; glob matching to wcmatch 11.2. Pin direct/transitive dependency versions and hashes. No runtime npm, Docker, checkout, or handwritten HTTP/pagination client.
• Preserve exclusive thresholds 15/100/500/1000, configurable XS/S/M/L/XL labels, independent file/line deletion filters, ignored-path globs, overwrite controls, dry runs, sticky XL comments, optional XL failure, outputs, and truncated-count handling.
• Discover .github/size-labeler.yaml, then .github/size-labeler.yml, or use config_file. Read only from the PR base SHA. File keys override matching policy inputs, while auth/API URL/PR number/config path stay invocation inputs.
• Include the same reusable-workflow migration as feat(github.pr.size-labeler): add runtime-installed GitHub Script action #47, so existing consumers retain their input interface.

Validation: 77 local tests passed, including the exact same 69 JSON contract scenarios as #47 (byte-identical fixture file). Additional tests exercise real PyGithub pagination and mutation methods through a stub transport, Enterprise URLs, output serialization, validation, and error handling. YAML lint, action/workflow schemas, jactionlint, and diff checks passed. Dedicated CI tests Linux AMD64 and ARM64 and runs the actual composite against this PR with read-only credentials and dry_run enabled.

Dependency selection

• PyGithub: established project (~7,800 stars), August 2026 release and October activity; replaces custom API pagination/client code.
• ruamel.yaml: YAML 1.2 with duplicate-key rejection. A small JSON-schema resolver aligns scalar semantics with js-yaml; PyYAML would require more compatibility code.
• wcmatch: actively maintained specialist glob library (~169 stars), October 2026 release; handles globstar, braces, dotfiles and extglobs. Both PRs use matching Bash-style behavior, including regression tests for differences found between engines.
• HTTPX/requests alone would require custom pagination; Pydantic and a CLI framework do not materially reduce this policy's cross-field validation/environment-input code. Tests use unittest rather than adding a test framework dependency.

Latest head validation: Linux AMD64 and ARM64 tests plus the actual read-only composite smoke test both passed. CI run.

---

🚨 To Reviewers

• Alternative to feat(github.pr.size-labeler): add runtime-installed GitHub Script action #47, not a stacked follow-up. Compare the runtime/dependency approach and merge only one PR.
• Ownership is by configured label name. Same-name manually applied labels are managed; unrelated size labels are preserved unless overwrite is enabled.
• Config overrides dry_run too. Tests use a read-only token; live label/comment writes are validated through stubs.
• The smoke workflow verifies native AMD64/ARM64 execution. Installing Python/tools/packages requires network access on first use; subsequent executions use uv's local cache.

[github-actions]

GitHub Actions Integration

Repository	jactionlint	check-jsonschema (workflows)	check-jsonschema (actions)
tedilabs/github-actions	✅	✅	✅

✅ All 1 passed.

[github-actions]

This PR has too many changes. Please make sure you are NOT addressing multiple issues with one PR.

[posquit0]

We are choosing #47 (GitHub Script with runtime npm installation) for this action.

The work is primarily GitHub API orchestration. GitHub Script already supplies the authenticated client, pagination, workflow context, outputs, and failure reporting. After removing bundling from #47, its plain JavaScript implementation has fewer integration components to maintain. The Python/uv alternative additionally needs Actions environment/output plumbing and YAML compatibility code.

Both alternatives passed their behavior tests and native AMD64/ARM64 smoke tests. #48 established a useful comparison and helped expand the shared behavioral contract. We will continue the requested interface refinements in #47 and close this alternative in favor of that implementation.