fix: ensure issues created outside templates receive needs-triage label

[Abogical]

Issue # (if applicable)

Closes #37454.

Reason for this change

Issues created outside of GitHub issue templates (e.g., via the GitHub API, AI-assisted tools like Claude Code, or blank issue forms) never receive the needs-triage label. Since the issue-triage-manager workflow in issue-label-assign.yml requires needs-triage via included-labels, these issues are silently skipped — no area label, no assignee, no triage visibility.

Description of changes

Added a new lightweight workflow .github/workflows/ensure-triage-label.yml that:

• Triggers on issues: [opened]
• Checks if the newly opened issue has zero labels (join(github.event.issue.labels.*.name, '') == '')
• If so, applies the needs-triage label using actions/github-script@v7

This ensures every new issue enters the triage pipeline regardless of how it was created, while preserving the existing template-based labeling for issues filed through the forms (which already have labels and won't match the if condition).

Describe any new or updated permissions being added

The workflow requests issues: write permission, scoped only to the ensure-triage-label job. This is the minimum permission needed to add a label to an issue.

Description of how you validated changes

Tested on a fork (Abogical/aws-cdk):

1. Pushed the workflow to the fork's main branch so it becomes active
2. Created a blank issue (no template, no labels): Abogical/aws-cdk#24
3. The workflow ran successfully and applied needs-triage: workflow run

How the workflow works:

• When a new issue is opened, GitHub triggers the ensure-triage-label workflow
• The if condition checks whether the issue has any labels
• If the issue has no labels (blank issue / API-created), the job runs and adds needs-triage
• If the issue was created via a template (which pre-applies labels like bug, needs-triage), the condition is false and the job is skipped — no duplicate work

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-03 08:13 UTC · Rule: default-squash
• ✅ Checks passed · in-place
• ✅ Merged — 2026-04-03 08:50 UTC · at d18e2d26d94e379f83d6e52abff9d687d381d0b1

This pull request spent 36 minutes 38 seconds in the queue, including 30 minutes 35 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • fix: ensure issues created outside templates receive needs-triage label #37505
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • fix: ensure issues created outside templates receive needs-triage label #37505
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.