chore: sync standard GitHub workflows

.github/workflows/backport.yml

@@ -14,6 +14,13 @@ jobs:
     if: >
       github.event.pull_request.merged == true
       && contains(join(github.event.pull_request.labels.*.name, ','), 'backport-to-')
+      && (
+        github.event.action == 'closed'
+        || (
+          github.event.action == 'labeled'
+          && startsWith(github.event.label.name, 'backport-to-')
+        )
+      )
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/label-failed-prs.yml

@@ -0,0 +1,104 @@
+name: Label Failed Pull Requests
+
+on:
+  workflow_run:
+    types: [completed]
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  label-failed-prs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reconcile failed-action labels
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const label = 'action-failed';
+            const failedConclusions = new Set([
+              'failure',
+              'timed_out',
+              'startup_failure',
+              'action_required'
+            ]);
+
+            async function reconcile(prNumber) {
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: prNumber
+              });
+
+              if (pr.state !== 'open') return;
+
+              const runs = await github.paginate(
+                github.rest.actions.listWorkflowRunsForRepo,
+                {
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  head_sha: pr.head.sha,
+                  per_page: 100
+                }
+              );
+
+              const relevantRuns = runs.filter(run =>
+                run.name !== context.workflow &&
+                run.event === 'pull_request' &&
+                run.status === 'completed'
+              );
+
+              const hasFailure = relevantRuns.some(run =>
+                failedConclusions.has(run.conclusion)
+              );
+
+              const labels = pr.labels.map(item => item.name);
+              const hasLabel = labels.includes(label);
+
+              if (hasFailure && !hasLabel) {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: prNumber,
+                  labels: [label]
+                });
+                core.info(`Added ${label} to PR #${prNumber}`);
+              } else if (!hasFailure && hasLabel) {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: prNumber,
+                  name: label
+                });
+                core.info(`Removed ${label} from PR #${prNumber}`);
+              } else {
+                core.info(`PR #${prNumber}: no label change required`);
+              }
+            }
+
+            if (context.eventName === 'workflow_dispatch') {
+              const prs = await github.paginate(github.rest.pulls.list, {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                per_page: 100
+              });
+              core.info(`Reconciling ${prs.length} open PR(s)`);
+              for (const pr of prs) await reconcile(pr.number);
+              return;
+            }
+
+            const run = context.payload.workflow_run;
+            if (!run || run.name === context.workflow) return;
+
+            const prNumbers = new Set((run.pull_requests || []).map(pr => pr.number));
+            if (prNumbers.size === 0) {
+              core.info('Completed workflow run is not associated with an open pull request.');
+              return;
+            }
+
+            for (const prNumber of prNumbers) await reconcile(prNumber);

.github/workflows/linter.yml

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: linters-propms-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  group: linters-${{ github.repository }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -26,26 +26,38 @@ jobs:
           python-version: "3.11"
           cache: pip
 
+      - name: Detect Frappe app package
+        id: app
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -t hooks < <(find . -mindepth 2 -maxdepth 3 -type f -name hooks.py -not -path './.git/*' -print)
+          if [ "${#hooks[@]}" -ne 1 ]; then
+            echo "Expected exactly one Frappe hooks.py, found ${#hooks[@]}" >&2
+            printf '%s\n' "${hooks[@]}" >&2
+            exit 1
+          fi
+          app_dir="$(dirname "${hooks[0]}")"
+          echo "app_dir=${app_dir#./}" >> "$GITHUB_OUTPUT"
+
       - name: Download Semgrep rules
         run: git clone --depth 1 https://github.com/frappe/semgrep-rules.git frappe-semgrep-rules
 
       - name: Install Semgrep
         run: pip install semgrep
 
-      # Blocking: real bugs and security issues only
       - name: Run Semgrep rules
         run: |
           semgrep scan --config ./frappe-semgrep-rules/rules \
             --config r/python.lang.security \
-            --severity=ERROR --error propms
+            --severity=ERROR --error "${{ steps.app.outputs.app_dir }}"
 
-      # Informational: style and i18n warnings, never fails the build
       - name: Semgrep warnings (non-blocking)
         if: always()
         run: |
           semgrep scan --config ./frappe-semgrep-rules/rules \
             --config r/python.lang.security \
-            --severity=WARNING propms || true
+            --severity=WARNING "${{ steps.app.outputs.app_dir }}" || true
 
   deps-vulnerable-check:
     name: Vulnerable Dependency Check

.github/workflows/pre-commit.yml

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: precommit-propms-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  group: precommit-${{ github.repository }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:

.github/workflows/semantic-commits.yml

@@ -7,7 +7,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: commitcheck-propms-${{ github.event.number }}
+  group: commitcheck-${{ github.repository }}-${{ github.event.number }}
   cancel-in-progress: true
 
 jobs: