Redesign the Area axis to a pure product-surface set: cli, spec, go-glx, import-export, docs, website, infra, security

[isaacschepp]

Context / Problem

The "Area" dropdown is the product-surface axis for issue intake. Its canonical list lives in .github/issue-areas.yml (lines 32-38) and is mirrored into three templates' id: area dropdowns (bug_report.yml:5-16, feature_request.yml, enhancement.yml), with .github/workflows/issue-templates-drift.yml failing CI on any divergence and .github/workflows/issue-labeler.yml reading the file at runtime to compute valid labels.

Today the list is:

areas:
  - cli
  - spec
  - go-glx
  - import-export
  - ui
  - tooling

The axis is broken because it conflates two different dimensions:

• A product surface (where the code lives), and
• A kind-of-work dimension that the native GitHub issue type already owns (this repo has types Task, Bug, Feature, Enhancement, Infrastructure, Discussion).

Symptoms:

1. tooling is a 53% catch-all — 133 of 247 open issues. It is a kind, not a surface: 91 of those 133 (68%) are already typed Infrastructure (measured 2026-06-08), so the label largely re-encodes the native issue-type axis. Splitting tooling into ci/build/deps/release would just recreate the same axis-conflation one level down.
2. CODEOWNERS-owned dirs have no area. CODEOWNERS owns /docs/ and /website/ (lines 25-26) and /.github/ (line 29), but there are no docs, website, or infra areas. So docs-site, user-docs, and CI work all fall into tooling or needs-triage.
3. Security work is invisible. ~33 of the 133 tooling issues (a quarter) are SLSA/cosign/Scorecard/vuln/supply-chain work (e.g. CI: add harden-runner to release and security workflows #350 harden-runner, SECURITY.md: add safe harbor clause and embargo policy #424 SECURITY.md, dependabot: add native cooldown (min-release-age) to defend against worm-class supply-chain updates #929 dependabot cooldown, ci: set persist-credentials: false on read-only checkout steps (artipacked hardening) #945 artipacked, scorecard.yml: SHA-pin ossf/scorecard-action and codeql-action/upload-sarif (match repo convention; reconcile codeql with security.yml) #1019 SHA-pin scorecard) — buried inside tooling with no cross-cutting label to find them by.
4. ui (4 issues) is mixed and partly backs no code. It conflates VitePress docs-site issues (Website: upgrade VitePress from alpha to stable release #277/Website: add OpenGraph and Twitter Card meta tags #281) with archive-viewer vaporware (Read-only web viewer for sharing archives #91/Visual editor — local-first browser UI for GLX archives #93). ui maps to no directory in CODEOWNERS.

The root defect is the axis design, not the parsing/labeler machinery (which #885/#946/#948 cover). Fixing it drains both the tooling and needs-triage piles at the source.

Proposal / Recommendation

Make Area a pure product-surface axis that maps 1:1 to CODEOWNERS dirs wherever possible, lets the native Infrastructure issue type own the kind-of-work dimension, and admits exactly one justified cross-cutting exception (security).

New .github/issue-areas.yml list (keep values FLAT bare strings; defer any area/* namespacing):

areas:
  - cli
  - spec
  - go-glx
  - import-export
  - docs
  - website
  - infra
  - security

Rationale per change:

• Dissolve tooling. Its CI surface becomes infra (maps to /.github/). The kind-of-work dimension (ci/build/deps/release) is carried by the existing Infrastructure issue type, NOT by new area labels. Do not add ci/build/deps/release as areas.
• Add docs (/docs/) and website (/website/) — the only CODEOWNERS-owned dirs with no area.
• Add security — the one sanctioned cross-cutting label (no 1:1 dir) for the SLSA/cosign/Scorecard/vuln issues currently invisible inside tooling.
• Retire ui. Route VitePress docs-site issues (Website: upgrade VitePress from alpha to stable release #277/Website: add OpenGraph and Twitter Card meta tags #281) to website; leave the archive-viewer vaporware (Read-only web viewer for sharing archives #91/Visual editor — local-first browser UI for GLX archives #93) as type: Feature with no area until it is real code.
• Keep cli/spec/go-glx/import-export unchanged — each maps 1:1 to a CODEOWNERS dir. Low issue count is a product signal, not a defect.

This is a data-only change to the runtime-read list plus the mirrored dropdowns — no labeler/awk/PyYAML code change is required (issue-labeler.yml and issue-templates-drift.yml read the list dynamically).

New labels needed (do not yet exist as repo labels)

docs, website, infra, security must be created as repo labels before this lands. This matters because of #946: the labeler hard-fails gh --add-label when a valid area has no backing repo label. Conversely, ui and tooling labels should be deleted only after a scripted relabel of the ~133 tooling + 4 ui issues by directory heuristic.

Sequencing (to avoid breaking the labeler / drift gate)

1. Create repo labels docs, website, infra, security (prerequisite — see issue-labeler: a valid Area whose repo label is missing hard-fails gh --add-label (drift check guards options, not label existence) #946).
2. Scripted relabel of the ~133 tooling + 4 ui open issues to the new surface labels by directory/keyword heuristic; tag security issues security.
3. Update .github/issue-areas.yml AND all three templates' id: area option lists in the same commit (the issue-templates-drift.yml gate fails otherwise).
4. Delete the now-unused ui and tooling repo labels.

Acceptance criteria

• .github/issue-areas.yml areas: is exactly cli, spec, go-glx, import-export, docs, website, infra, security (flat bare strings).
• The id: area dropdown options in bug_report.yml, feature_request.yml, and enhancement.yml match the new list; issue-templates-drift.yml passes on the PR.
• Repo labels docs, website, infra, security exist before the templates change merges (guards issue-labeler: a valid Area whose repo label is missing hard-fails gh --add-label (drift check guards options, not label existence) #946).
• The ~133 tooling and 4 ui open issues are relabeled to surface labels; security issues additionally carry security.
• ui and tooling repo labels are deleted after the relabel.
• No change to issue-labeler.yml / issue-templates-drift.yml parsing logic (list is read at runtime).
• ci/build/deps/release are NOT added as areas (kind-of-work stays on the Infrastructure issue type).
• Archive-viewer issues (Read-only web viewer for sharing archives #91/Visual editor — local-first browser UI for GLX archives #93) remain type: Feature with no area; docs-site issues (Website: upgrade VitePress from alpha to stable release #277/Website: add OpenGraph and Twitter Card meta tags #281) carry website.

Relates to

• issue-labeler: single source of truth for Area options, robust parsing, and a triage fallback #885 (closed) — single source of truth for Area options; the groundwork this builds on.
• feature_request.yml: separate Feature vs Enhancement intake and surface the spec-change proposal path #887 (closed) — Feature vs Enhancement intake; established the type-vs-area separation this extends.
• issue-labeler: a valid Area whose repo label is missing hard-fails gh --add-label (drift check guards options, not label existence) #946 — missing-repo-label hard-fail: the reason docs/website/infra/security labels must be created before the list changes.
• issue-labeler: land the deferred form-aware labeler swap — id-keyed form parsing instead of the awk markdown parse (#915 groundwork) #948 — deferred form-aware labeler swap; orthogonal (parsing mechanism, not the area list).
• issue-templates-drift.yml: drift check hard-codes the 3 template paths while its trigger globs ISSUE_TEMPLATE/*.yml — a 4th template's Area dropdown drifts unchecked #949 / issue-templates-drift.yml: add a concurrency group (the lone PR-triggered workflow without one) #950 — issue-templates-drift hardening (4th-template glob gap, concurrency group); this PR touches the templates the drift gate guards.

Note: this issue is itself filed under area tooling only because that is the closest existing label until infra exists — which is precisely the bucket this proposal dissolves.

---

Follow-up issues filed alongside this one (same review)

This issue is the hub for a focused 2026 review of .github/issue-areas.yml and its labeling machinery (how the canonical Area list relates to the three issue-form templates, the issue-templates-drift gate, the issue-labeler workflow, the repo labels, and CODEOWNERS). The concrete sub-findings were filed separately:

• issue-labeler: needs-triage is additive-only and never cleared — 93% of needs-triage labels are false positives #1063 — issue-labeler: needs-triage is additive-only and never cleared — ~93% of needs-triage labels are false positives (Infrastructure). The bug that inflates the needs-triage pile this proposal also drains.
• issue-templates-drift: drift check guards id:area but the labeler keys on the rendered "### Area" heading — also assert the dropdown label is 'Area' #1064 — issue-templates-drift: the gate guards id: area + options but the labeler keys on the rendered ### Area heading; also assert the dropdown label is Area (Infrastructure).
• issue intake: make the Area dropdown optional with an abstain option + a per-area legend (stop laundering a forced guess into an authoritative label) #1066 — issue intake UX: make the Area dropdown optional, add an abstain option and a per-area legend, and stop laundering a forced guess into an authoritative label (Infrastructure).
• Discussion: replace the issue-templates-drift differ with a generator that injects issue-areas.yml into each template (--check mode, like make docs-cli) #1065 — Discussion: replace the drift differ with a generator that injects issue-areas.yml into each template (--check mode, mirroring make docs-cli).
• ci: scheduled taxonomy-drift tripwire — alert when any one Area exceeds ~30% of open issues #1067 — ci: scheduled taxonomy-drift tripwire that alerts when any one Area exceeds ~30% of open issues (would have caught the 53% tooling overload automatically) (Infrastructure).
• Discussion: mirror Area into a native field and add suggestion-only AI triage over the post-#948 residual #1068 — Discussion: mirror Area into a native Projects/Issue field and add a SHA-pinned, suggestion-only AI triage over the post-issue-labeler: needs-triage is additive-only and never cleared — 93% of needs-triage labels are false positives #1063/issue-labeler: land the deferred form-aware labeler swap — id-keyed form parsing instead of the awk markdown parse (#915 groundwork) #948 residual.
• A labels-as-code option (label existence + color + description as a versioned manifest) was added as a comment on issue-labeler: a valid Area whose repo label is missing hard-fails gh --add-label (drift check guards options, not label existence) #946.
• The 5 genuinely-unclassified issues surfaced by this review (Analyze output passes attacker-controlled YAML names through ESC bytes to the terminal #925, GEDCOM import: preserve Ancestry media _OID (OBJE media object id) instead of dropping it #944, fix: media path containment follows symlinks out of the archive directory (glx view + copyMediaFile) #972, Several standard source types downgrade to "other" on GLX→GEDCOM→GLX round-trip #1005, fix: ExtractFirstYear reads day-of-month as year for non-ISO Gregorian dates #1025) were re-homed to their correct areas (cli/import-export/go-glx) as part of this pass — concrete evidence that the "empty" import-export area is empty because work was misrouted to needs-triage, not because the work doesn't exist.

[annadheeraj2008-max]

I would like to work on this issue. Can I be assigned?