feat: Add issue-labeler composite action

[yonib05]

Description

Adds a reusable composite action for automated issue labeling. Repos define a YAML config with their label allowlist and optional classification instructions, then call this action from a thin workflow.

Supports running multiple independent labelers per repo (e.g. one for area tags, one for issue type, one for language) as separate parallel jobs with different configs.

Security

The LLM has no tools, no shell access, and no GitHub API access. Its response is parsed as JSON and each label is validated against the config's hardcoded key set. Invalid labels are silently dropped. IAM is scoped to bedrock:InvokeModel only. The worst outcome from prompt injection is mislabeling.

Structure

issue-labeler/
├── action.yml      # Composite action definition
├── classify.py     # Classification + allowlist validation
└── README.md       # Usage docs and config format

Config format

Consuming repos add a YAML file like:

instructions: |
  CI dependency bumps should be labeled "chore".

labels:
  area-mcp:
    description: "Model Context Protocol, MCP servers/clients/transport"
  area-provider:
    description: "Model providers (Bedrock, OpenAI, Anthropic, Ollama)"

The action accepts either a config_path pointing to such a file, or inline YAML via the config input.

Testing

• Validated config parsing and allowlist filtering logic locally
• Tested Bedrock invoke-model integration against live endpoint
• Verified that labels not in the config are rejected regardless of LLM output