From 5fab77b78a9404135248b50b3297768df3470b00 Mon Sep 17 00:00:00 2001
From: Nicola Soranzo <nicola.soranzo@earlham.ac.uk>
Date: Sat, 20 Jun 2026 00:20:51 +0100
Subject: [PATCH] Update PR milestone on merge

Every merged pull request should be assigned to the milestone
corresponding to the Galaxy release it will first appear in, see:

https://github.com/galaxyproject/galaxy/blob/dev/doc/source/project/issues.rst

There should normally be one open milestone (before freezing for
the next release) or two (after freeze).
When there is more than one open milestone and the target of the
PR is a release_XX.X branch, the merged PR should be assigned to
the second latest milestone (i.e. the upcoming release).
---
 .github/workflows/labels-verifier.yaml | 57 ++++++++++++++++++++++++--
 .github/workflows/maintenance_bot.yaml |  1 +
 .github/workflows/pr-title-update.yml  |  2 +-
 3 files changed, 56 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/labels-verifier.yaml b/.github/workflows/labels-verifier.yaml
index 1b8767fab99..a86ca0ff82d 100644
--- a/.github/workflows/labels-verifier.yaml
+++ b/.github/workflows/labels-verifier.yaml
@@ -2,17 +2,17 @@ name: Labels Verifier
 on:  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [closed]
+permissions: {}
 jobs:
-  onMerged:
+  check-pr-labels:
     name: Check PR labels on merge
-    if: github.repository_owner == 'galaxyproject'
+    if: github.repository_owner == 'galaxyproject' && github.event.pull_request.merged == true
     permissions:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Check PR labels on merge
         if: |
-          github.event.pull_request.merged == true &&
           ! contains(join(github.event.pull_request.labels.*.name, ', '), 'kind/') &&
           ! contains(github.event.pull_request.labels.*.name, 'merge') &&
           ! contains(github.event.pull_request.labels.*.name, 'minor')
@@ -25,3 +25,54 @@ jobs:
               issue_number: context.issue.number,
               body: 'This PR was merged without a "kind/" label, please correct.',
             })
+  update-milestone:
+    if: github.repository_owner == 'galaxyproject' && github.event.pull_request.merged == true
+    permissions:
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Update PR milestone on merge
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const targetBranch = process.env.GITHUB_BASE_REF;
+            const prNumber = context.issue.number;
+            // Get all open milestones
+            const { data: milestones } = await github.rest.issues.listMilestones({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            });
+            if (milestones.length === 0) {
+              core.setFailed('No open milestones found.');
+              return;
+            }
+
+            // Sort the milestones by number in descending order
+            const sortedMilestones = milestones.sort((a, b) => b.number - a.number);
+            // Every merged pull request should be assigned to the milestone
+            // corresponding to the Galaxy release it will first appear in, see:
+            // https://github.com/galaxyproject/galaxy/blob/dev/doc/source/project/issues.rst
+            let targetMilestone = null;
+            // If targeting 'dev', use the latest (highest number) open milestone
+            if (targetBranch === 'dev') {
+              targetMilestone = sortedMilestones[0];
+            }
+            // If targeting 'release_\d+.\d+' and there are multiple open
+            // milestones, use the second latest open milestone
+            else if (/^release_\d+\.\d+$/.test(targetBranch)) {
+              targetMilestone = sortedMilestones[1] || sortedMilestones[0];
+            }
+
+            // Update the Pull Request with the selected milestone
+            if (targetMilestone) {
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                milestone: targetMilestone.number
+              });
+              console.log(`Successfully updated PR #${prNumber} to milestone: "${targetMilestone.title}"`);
+            } else {
+              console.log('Target branch did not match routing rules. No milestone updated.');
+            }
diff --git a/.github/workflows/maintenance_bot.yaml b/.github/workflows/maintenance_bot.yaml
index 7ae1a06ca76..98e2fff449c 100644
--- a/.github/workflows/maintenance_bot.yaml
+++ b/.github/workflows/maintenance_bot.yaml
@@ -2,6 +2,7 @@ name: Maintenance Bot
 on:  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [opened, reopened, edited, ready_for_review, unlabeled]
+permissions: {}
 jobs:
   labeler:
     name: Assign labels and milestone
diff --git a/.github/workflows/pr-title-update.yml b/.github/workflows/pr-title-update.yml
index 8cf2da2b117..31ba1df17e5 100644
--- a/.github/workflows/pr-title-update.yml
+++ b/.github/workflows/pr-title-update.yml
@@ -6,7 +6,7 @@ on:  # zizmor: ignore[dangerous-triggers]
     branches:
       - dev
       - release_*
-
+permissions: {}
 jobs:
   update-title:
     if: github.repository_owner == 'galaxyproject' && (github.event.action != 'edited' || github.event.changes.base.ref.from != '')