fix(tooling): give every packages/ directory a labeler entry, and pin the coverage

.github/labeler.yml

@@ -1,7 +1,11 @@
 # Configuration for pull-requests labeler
 # https://github.com/actions/labeler
 
-# Core packages
+# Packages — one entry per directory under `packages/`, EXCEPT `plugin-*` and
+# `data-*`, which are covered by the `plugin` and `data-adapter` families below.
+# A package with no entry here draws no label, so its PRs are invisible to any
+# sweep keyed on `package: *` (objectui#7746). `scripts/__tests__/labeler-package-coverage.test.ts`
+# fails when a directory under `packages/` draws nothing.
 'package: core':
   - changed-files:
     - any-glob-to-any-file: 'packages/core/**/*'
@@ -18,6 +22,62 @@
   - changed-files:
     - any-glob-to-any-file: 'packages/components/**/*'
 
+'package: app-shell':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/app-shell/**/*'
+
+'package: auth':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/auth/**/*'
+
+'package: cli':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/cli/**/*'
+
+'package: collaboration':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/collaboration/**/*'
+
+'package: create-plugin':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/create-plugin/**/*'
+
+'package: fields':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/fields/**/*'
+
+'package: i18n':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/i18n/**/*'
+
+'package: layout':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/layout/**/*'
+
+'package: mobile':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/mobile/**/*'
+
+'package: permissions':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/permissions/**/*'
+
+'package: providers':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/providers/**/*'
+
+'package: react-runtime':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/react-runtime/**/*'
+
+'package: runner':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/runner/**/*'
+
+'package: sdui-parser':
+  - changed-files:
+    - any-glob-to-any-file: 'packages/sdui-parser/**/*'
+
 # Plugins
 'plugin':
   - changed-files:

.github/workflows/labeler.yml

@@ -7,6 +7,19 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  # `pull-requests: write` only lets the action add labels that ALREADY EXIST in the
+  # repository; creating one it has never seen needs `issues: write`. Upstream states
+  # both halves — actions/labeler v7 README "Recommended Permissions", and its
+  # src/labeler.ts, which on a 403 raises "The workflow does not have permission to
+  # create labels. Ensure the 'issues: write' permission is granted".
+  #
+  # This is load-bearing here rather than defensive: `.github/labeler.yml` gained 14
+  # `package: *` rules in objectui#7746, and 12 of those labels did not exist in this
+  # repository's label registry when they were added. The action applies the whole set
+  # in ONE `setLabels` call, so without this the first PR touching e.g. `packages/auth`
+  # fails the call outright and the PR gets NO labels at all — strictly worse than the
+  # coverage gap #7746 closed. Pinned by scripts/__tests__/labeler-package-coverage.test.ts.
+  issues: write
 
 jobs:
   label:

content/docs/guide/ci-cd-pipeline.md

@@ -1784,6 +1784,14 @@ each release commit are the source of truth for granular and current history.
 
 Automatically labels PRs based on file path patterns defined in `.github/labeler.yml`. Syncs labels on each push to the PR.
 
+The job holds `issues: write` in addition to `pull-requests: write`. That is load-bearing, not
+defensive: `pull-requests: write` alone lets the action attach labels that already exist in the
+repository, while creating one it has never seen requires `issues: write`. Because the action
+applies the whole label set in a single call, a config rule naming a label that does not yet
+exist would otherwise fail the call and leave the PR with **no** labels at all.
+`scripts/__tests__/labeler-package-coverage.test.ts` fails if either permission is dropped, and
+also if a directory under `packages/` draws no label (objectui#7746).
+
 ### Cross-repo Issue Closer (`cross-repo-issue-closer.yml`)
 
 **Trigger:** `pull_request_target` with type `closed`; the job acts only when the PR was actually