fix: harden authorship label creation

[haasonsaas]

Summary

• avoid patching authorship label metadata when it already matches the desired state
• tolerate the first-run race where another workflow creates the label after our lookup but before our create call
• keep real API/auth failures visible instead of blanket-suppressing label setup errors

Verification

• actionlint .github/workflows/agent-authorship-label.yml
• ruby -c .github/scripts/classify-agent-authorship.rb

[cursor]

PR Summary

Low Risk
Low risk: changes are limited to GitHub Actions label setup logic, mainly improving error handling and reducing unnecessary API calls. Potential impact is confined to label creation/update behavior if the new 404/concurrency detection misclassifies an API error.

Overview
Improves the agent-authorship-label workflow’s label bootstrap to be more robust and less noisy.

ensure_label now reads existing label metadata and only PATCHes when color/description differ, treats true lookup failures as errors instead of silently continuing, and handles the race where a label is created between lookup and create by detecting “already exists” responses and falling back to an update.

^{Reviewed by Cursor Bugbot for commit 3c28d0a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: GET error JSON makes label lookup always appear successful
  • The workflow now keys label existence off the GET exit status and only treats validated 404 responses as missing labels, so missing labels reach the creation path.
• ✅ Fixed: Exit status always zero after failed if-block
  • The workflow now captures the POST failure code before later checks and returns that saved non-zero status for real API errors.

Preview (3c28d0ab19)

diff --git a/.github/workflows/agent-authorship-label.yml b/.github/workflows/agent-authorship-label.yml
--- a/.github/workflows/agent-authorship-label.yml
+++ b/.github/workflows/agent-authorship-label.yml
@@ -69,17 +69,63 @@
             local name="$1"
             local color="$2"
             local description="$3"
+            local label_json
+            local lookup_stderr
+            local lookup_status=0
+            lookup_stderr="$(mktemp)"
+            label_json="$(gh api "repos/${GITHUB_REPOSITORY}/labels/${name}" 2>"${lookup_stderr}")" || lookup_status=$?
 
-            if gh api "repos/${GITHUB_REPOSITORY}/labels/${name}" >/dev/null 2>&1; then
+            if [ "${lookup_status}" -eq 0 ]; then
+              rm -f "${lookup_stderr}"
+              local existing_color
+              local existing_description
+              existing_color="$(jq -r '.color // ""' <<<"${label_json}")"
+              existing_description="$(jq -r '.description // ""' <<<"${label_json}")"
+
+              if [ "${existing_color}" != "${color}" ] || [ "${existing_description}" != "${description}" ]; then
+                gh api --method PATCH "repos/${GITHUB_REPOSITORY}/labels/${name}" \
+                  -f color="${color}" \
+                  -f description="${description}" >/dev/null
+              fi
+              return 0
+            fi
+
+            if ! grep -qiE '(not found|404)' "${lookup_stderr}" && ! jq -e '(.status | tostring) == "404" or .message == "Not Found"' <<<"${label_json}" >/dev/null 2>&1; then
+              cat "${lookup_stderr}" >&2
+              if [ -n "${label_json}" ]; then
+                printf '%s\n' "${label_json}" >&2
+              fi
+              rm -f "${lookup_stderr}"
+              return "${lookup_status}"
+            fi
+            rm -f "${lookup_stderr}"
+
+            local output_file
+            local create_status=0
+            output_file="$(mktemp)"
+
+            gh api --method POST "repos/${GITHUB_REPOSITORY}/labels" \
+              -f name="${name}" \
+              -f color="${color}" \
+              -f description="${description}" >"${output_file}" 2>&1 || create_status=$?
+
+            if [ "${create_status}" -eq 0 ]; then
+              rm -f "${output_file}"
+              return 0
+            fi
+
+            if grep -qiE '(already.?exists|already_exists|Validation Failed)' "${output_file}"; then
+              echo "Label ${name} was created concurrently; updating metadata if needed."
+              rm -f "${output_file}"
               gh api --method PATCH "repos/${GITHUB_REPOSITORY}/labels/${name}" \
                 -f color="${color}" \
                 -f description="${description}" >/dev/null
-            else
-              gh api --method POST "repos/${GITHUB_REPOSITORY}/labels" \
-                -f name="${name}" \
-                -f color="${color}" \
-                -f description="${description}" >/dev/null
+              return 0
             fi
+
+            cat "${output_file}" >&2
+            rm -f "${output_file}"
+            return "${create_status}"
           }
 
           ensure_label "agent-authored" "6f42c1" "All PR commits carry explicit Maestro authorship trailers"

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 2d1e9c5. Configure here.}