[fr4nc1sc0-r4m0n]

Motivation

Mergify backports of Observability Agentic Workflow sync PRs get oblt-aw/ai/merge-ready from this labels copier, but the label is applied with GITHUB_TOKEN. GitHub does not start new labeled workflow runs from that actor, so automerge never wakes.

Summary

• Set use-ephemeral-token: true on elastic/oblt-actions/mergify/labels-copier@v1 so the action mints a Vault token and copies labels with it
• Grant the job id-token: write for OIDC

Depends on: elastic/oblt-actions#1171 merged and released on @v1, plus a catalog-info TokenPolicy for this workflow path, or mint will fail closed.

Validation

• After the action release and catalog-info policy are live, open or use a mergify/bp/ PR that copies merge-ready
• Timeline labeled actor is the Vault app (not github-actions[bot])
• Observability Agentic Workflow — Pull Request runs on that labeled event

Related issue: elastic/oblt-aw#2336

[mergify]

This pull request does not have a backport label. Could you fix it @fr4nc1sc0-r4m0n? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-./d./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[Copilot]

🔵 Needs a closer look

The prerequisite Vault TokenPolicy deployment and downstream workflow triggering remain unverified.

No open issues 🎉

What changed in this PR

Updates Mergify backport label copying to use an ephemeral GitHub token so copied labels can trigger downstream automerge workflows.

Changes:

• Grants OIDC permission to mint a token through Vault.
• Passes the minted token to the labels-copier action.

File	Description
.github/​workflows/​mergify-labels-copier.yml	Adds token creation and uses it when copying backport labels.

_{Review effort: Balanced}

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

[Copilot]

🟡 Changes recommended

The published @v1 action does not support the new input, so the upstream release must land or a supported revision must be referenced.

1 open issue

• Publish ephemeral-token support in @​v1 before merging · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human verification is needed to confirm the required action release and TokenPolicy are deployed and copied labels trigger the intended workflow.

No open issues 🎉

1 resolved since last review

• Publish ephemeral-token support in @​v1 before merging

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human verification is needed that the supporting action release and workflow-specific Vault policy are live and copied labels trigger the downstream workflow.

No open issues 🎉

_{Review effort: Balanced}

[fr4nc1sc0-r4m0n]

Dropped unused pull-requests: write / repository-projects: read from this job — they only apply to GITHUB_TOKEN; with use-ephemeral-token: true, label scopes come from the TokenPolicy, so only id-token: write is needed.