chore: unify issue labeling automation and reduce false positives

chore(deps): bump webfactory/ssh-agent from 0.9.0 to 0.10.0 (#4910)

Bumps [webfactory/ssh-agent](https://github.com/webfactory/ssh-agent) from 0.9.0 to 0.10.0.
- [Release notes](https://github.com/webfactory/ssh-agent/releases)
- [Changelog](https://github.com/webfactory/ssh-agent/blob/master/CHANGELOG.md)
- [Commits](webfactory/ssh-agent@v0.9.0...v0.10.0)

---
updated-dependencies:
- dependency-name: webfactory/ssh-agent
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore(deps): bump dessant/lock-threads from 5 to 6 (#4909)

Bumps [dessant/lock-threads](https://github.com/dessant/lock-threads) from 5 to 6.
- [Release notes](https://github.com/dessant/lock-threads/releases)
- [Changelog](https://github.com/dessant/lock-threads/blob/main/CHANGELOG.md)
- [Commits](dessant/lock-threads@v5...v6)

---
updated-dependencies:
- dependency-name: dessant/lock-threads
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
feat: sync GitHub issue types with `type:` labels

feat: enable manual backfill for issue labels

This change introduces a `workflow_dispatch` triggered job that allows for manually re-evaluating and applying labels to existing issues.

The new job iterates through a specified set of issues (filtered by state and an optional limit), adds a temporary `maintenance: relabel-backfill` label, and immediately removes it. The primary `labeling-issues` workflow is updated to specifically *not* ignore these bot-generated label events when the temporary label is involved, thus forcing a re-evaluation of the issue by the current labeling logic.

This provides a mechanism to correct mislabeled issues or apply updated labeling rules to the entire issue backlog.

feat: enhance relabel backfill with detailed summary and update github-script

This change significantly improves the observability of the manual issue relabel backfill workflow by introducing:

- Detailed console logging for each issue being processed.
- A comprehensive `core.summary` output in the workflow run, providing tables for overall statistics, processed issues, and any encountered failures.

Additionally, the `actions/github-script` action is updated to v8.

chore: make issue type inference more robust by respecting existing labels

Previously, the automated issue type inference relied solely on the issue title. This could result in valid `type:` labels being removed if the title was ambiguous or didn't explicitly match a predefined pattern.

This change introduces a fallback mechanism where existing `type:` labels are considered if a type cannot be clearly inferred from the title. This reduces unnecessary label churn and improves the accuracy of automated labeling.

fix: backfill runs triage inline instead of label-toggle

GitHub does not fire new workflow runs when GITHUB_TOKEN creates label
events (built-in loop prevention). Replace the label-toggle backfill
approach with an inline version that mirrors the deterministic
reconciliation logic from issue-ai-maintenance directly: type labels,
command/distro labels, game/engine labels, Issue Type GraphQL sync,
and tmux false-positive cleanup. No AI call is made during backfill.

Also removes the now-unnecessary BACKFILL_TRIGGER_LABEL exemption from
the bot-loop guard in issue-ai-maintenance.

fix: track issue type + locked state in backfill summary

- Add 'Issue Type set' column to processed issues summary table
- Track issueTypeSet per issue (null when already correct/unchanged)
- Skip REST label mutations for locked issues (they return 403) with
  a console note; Issue Type GraphQL sync still runs for locked issues
- Show lock emoji in issue number column when issue is locked
- Track actual applied add/remove counts (not desired counts)

fix: allow backfill label updates on locked issues

Remove locked-issue skip branch in backfill so label add/remove operations
run for locked issues as well. Keep lock marker in summary for visibility.

fix: keep legacy server request issues classified correctly

Recognize 'server request' anywhere in issue titles (e.g. '[callofduty1] Server Request')
and prefer type: game server request over generic feature when both labels exist.
Apply this in both issue-ai-maintenance and backfill logic.

fix: classify legacy server-request titles in backfill and maintenance

Detect legacy server-request phrasing in issue titles:
- bracketed game/server titles ending with 'Creation'
- titles containing 'Server Creation'
- titles containing 'Server Support' or 'Support for ... server'

Apply the same heuristics in both issue-ai-maintenance and backfill
inferTypeFromTitle paths so old issues are not downgraded to feature.

feat: infer game labels from legacy issue text in relabel

When no structured Game form section is present, infer game labels/scripts
deterministically from title/body using serverlist alias mappings.
Apply this to both issue-ai-maintenance and backfill to improve
historical game labeling without relying on AI.

feat: add optional AI fallback for backfill game detection

Add workflow_dispatch input ai_game_fallback (default false).
In backfill mode, only call AI when deterministic game mapping finds no
match; accept only high-confidence results and map through known game
aliases/labels. Include AI usage stats in the run summary table.

fix: avoid pruning legacy game labels without structured game input

Only remove existing game:* labels when an issue has explicit structured
Game form selections. For legacy title/body inference (and AI fallback),
add matched game labels but do not remove other existing game labels.
This prevents edge cases like issue #1 from losing valid multi-game tags.

fix: require alias evidence for AI game fallback labels

Backfill AI game fallback now accepts a detected game only when the issue
text contains a literal alias token for the mapped game label. Add explicit
logs for AI accept/reject/unmapped outcomes to make attribution auditable
in job logs and prevent false positives like issue #17.

feat: annotate game label adds with detection source in backfill logs

Each game label add now shows its source in the per-issue log line:
  #240: added "game: Opposing Force" (text-match)
  #248: added "game: Counter-Strike: Global Offensive" (form-field)
  #N:   added "game: X" (ai-fallback)

Non-game labels (engine, type, needs, etc.) are unchanged.

fix: add missing hasAliasHitForLabel to backfill script context

Each github-script step runs in its own isolated JS context. The backfill
step was calling hasAliasHitForLabel (used by the AI alias-evidence gate)
but the function was only defined in the triage step, causing a ReferenceError
on any issue that triggered AI fallback.

fix: retry AI fallback once on HTTP 429 with Retry-After backoff

When the GitHub Models API rate-limits the backfill (429), read the
Retry-After header (capped at 60s), wait, then retry the request once.
If the retry also fails the issue is skipped as before.

fix: accept joined-token alias evidence in AI game fallback gate

Alias evidence now allows multi-token aliases to match when words are
joined in issue text (e.g. counterstrike vs counter strike), while
keeping exact token checks for single-word aliases.

fix: treat generic AI detections as non-game in backfill

When AI fallback returns generic platform/engine terms (e.g. srcds,
source dedicated server, steamcmd), treat them as non-game detections
instead of logging them as unmapped games. Also prompt the model to
return null for generic terms.

chore: log AI rate-limit headers and 429 count in backfill

Capture Retry-After, X-RateLimit-* and request id on 429 responses,
log them on retry and final skip, and include total AI 429 hits in the
workflow summary table.

fix: disable AI fallback for run on long Retry-After cooldown

When GitHub Models returns 429 with a large Retry-After (over 300s),
stop AI fallback for the remainder of the backfill run instead of
sleeping and retrying per issue. Include disable reason in summary.

fix: prevent overlapping game alias double-matches in text detection

Prefer longest non-overlapping alias matches so titles like
"Killing Floor 2" do not also infer "Killing Floor" unless both
are explicitly present as separate mentions.

fix: prune stale broad game labels when specific game is inferred

For legacy issues without structured game selection, remove existing game
labels only when they are broader overlaps of a newly inferred specific
game label (e.g. remove Killing Floor when Killing Floor 2 is inferred).

fix: stop relabel backfill early when API rate limit is hit

Detect GitHub API rate limit errors during processing, stop the run
gracefully, and report header-derived rate limit details in logs and
summary instead of emitting repeated per-issue failures.

feat(labeler): implement Linux support verification for server requests

* Added checks for Linux support based on issue content and Steam API data.
* Integrated AI analysis for documentation to assess Linux compatibility.
* Automatically create or remove labels based on support verification results.
* Enhanced feedback for users regarding Linux server support status.

Co-authored-by: Copilot <[email protected]>

fix(labeler): broaden Linux support check triggers for server requests

fix(labeler): improve game detection logic for structured fields

* Refine fallback logic to avoid guessing from free text when a structured Game field exists.
* Ensure AI-detected game fallback only occurs when no structured Game field is present.

Co-authored-by: Copilot <[email protected]>

fix(labeler): update game section extraction logic

* Adjusted the extraction of the game field to accommodate both 'Game server' and 'Game' sections.
* This change improves compatibility with different input formats in server requests and bug reports.

Co-authored-by: Copilot <[email protected]>

feat(labeler): enhance Linux support detection logic

* Added handling for dedicated server tool AppIDs in Steam API checks.
* Introduced a checkbox confirmation mechanism for Linux support, improving evidence assessment.
* Updated verdict messaging to clarify Linux support status based on new checks.

Co-authored-by: Copilot <[email protected]>

feat(labeler): implement SteamCMD Linux support check

* Added a new function `runSteamCmdLinuxCheck` to assess Linux platform support using SteamCMD.
* Enhanced existing logic to incorporate SteamCMD results alongside Steam API checks.
* Updated comments to clarify the distinction between server tool AppIDs and client platform support.
* Improved error handling and logging for SteamCMD assessments.

Co-authored-by: Copilot <[email protected]>

feat(labeler): add confirmed Linux support label logic

* Introduced logic to determine and apply a `status: linux support confirmed` label based on AI assessment and Steam confirmation.
* Implemented error handling for label creation if it does not exist.
* Enhanced existing label management to ensure accurate representation of Linux support status.

Co-authored-by: Copilot <[email protected]>

fix(labeler): refine Steam support checks for dedicated servers

* Updated comments to clarify the purpose of Steam Store API checks.
* Removed unnecessary checks for Steam API results in determining Linux support.
* Enhanced logging and reasoning for server tool AppIDs.
* Improved clarity in the output messages regarding Linux support status.

Co-authored-by: Copilot <[email protected]>

feat(labeler): enhance Linux support check comment formatting

* Added conditional header for Linux support check comments.
* Included a block to indicate if the confirmed Linux label was applied.

Co-authored-by: Copilot <[email protected]>

fix: apply linux status labels directly instead of via deferred labelsToAdd set

chore: synced file(s) with dgibbs64/repo-sync (#4911)

* chore: synced local '.github/' with remote 'general/.github/'

* chore: synced local './' with remote 'bash/'

Author: dgibbs64

.devcontainer/devcontainer.json

@@ -1,30 +1,30 @@
 {
-	"name": "BASH Dev Container",
-	"image": "mcr.microsoft.com/devcontainers/base:ubuntu",
-	"features": {
-		"ghcr.io/devcontainers-community/npm-features/prettier:1": {
-			"plugins": "prettier-plugin-sh"
-		},
-		"ghcr.io/devcontainers-extra/features/actionlint:1": {},
-		"ghcr.io/devcontainers-extra/features/checkov:1": {},
-		"ghcr.io/devcontainers-extra/features/markdownlint-cli:1": {},
-		"ghcr.io/devcontainers-extra/features/shellcheck:1": {},
-		"ghcr.io/devcontainers-extra/features/yamllint:2": {},
-		"ghcr.io/devcontainers/features/github-cli:1": {}
-	},
-	"customizations": {
-		"vscode": {
-			"extensions": [
-				"DavidAnson.vscode-markdownlint",
-				"editorconfig.editorconfig",
-				"esbenp.prettier-vscode",
-				"github.vscode-github-actions",
-				"GitHub.vscode-pull-request-github",
-				"redhat.vscode-yaml",
-				"timonwong.shellcheck",
-				"yzhang.markdown-all-in-one"
-			]
-		}
-	},
-	"postCreateCommand": "npm init -y >/dev/null 2>&1 || true && npm install --no-save prettier prettier-plugin-sh prettier-plugin-jinja-template"
+  "name": "BASH Dev Container",
+  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+  "features": {
+    "ghcr.io/devcontainers-community/npm-features/prettier:1": {
+      "plugins": "prettier-plugin-sh"
+    },
+    "ghcr.io/devcontainers-extra/features/actionlint:1": {},
+    "ghcr.io/devcontainers-extra/features/checkov:1": {},
+    "ghcr.io/devcontainers-extra/features/markdownlint-cli:1": {},
+    "ghcr.io/devcontainers-extra/features/shellcheck:1": {},
+    "ghcr.io/devcontainers-extra/features/yamllint:2": {},
+    "ghcr.io/devcontainers/features/github-cli:1": {}
+  },
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "DavidAnson.vscode-markdownlint",
+        "editorconfig.editorconfig",
+        "esbenp.prettier-vscode",
+        "github.vscode-github-actions",
+        "GitHub.vscode-pull-request-github",
+        "redhat.vscode-yaml",
+        "timonwong.shellcheck",
+        "yzhang.markdown-all-in-one"
+      ]
+    }
+  },
+  "postCreateCommand": "npm init -y >/dev/null 2>&1 || true && npm install --no-save prettier prettier-plugin-sh prettier-plugin-jinja-template && sudo apt-get update && sudo apt-get install -y ripgrep"
 }

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -8,6 +8,51 @@ body:
     attributes:
       value: |
         Thanks for taking the time to fill out this bug report!
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      description: Triage metadata used for prioritization.
+      options:
+        - "severity: low"
+        - "severity: medium"
+        - "severity: high"
+        - "severity: critical"
+    validations:
+      required: true
+  - type: dropdown
+    id: reproducibility
+    attributes:
+      label: Reproducibility
+      description: Triage metadata used for prioritization.
+      options:
+        - "reproducible: always"
+        - "reproducible: sometimes"
+        - "reproducible: unable"
+    validations:
+      required: true
+  - type: dropdown
+    id: regression
+    attributes:
+      label: Regression
+      description: Triage metadata used for prioritization.
+      options:
+        - "regression: yes"
+        - "regression: no"
+        - "regression: unknown"
+    validations:
+      required: true
+  - type: dropdown
+    id: affects-latest
+    attributes:
+      label: Affects latest release
+      description: Triage metadata used for prioritization.
+      options:
+        - "latest-release: yes"
+        - "latest-release: no"
+        - "latest-release: unknown"
+    validations:
+      required: true
   - type: input
     id: user-story
     attributes:
@@ -16,6 +61,14 @@ body:
       placeholder: As a [user description], I want [desired action] so that [desired outcome].
     validations:
       required: true
+  - type: input
+    id: script-name
+    attributes:
+      label: Script name
+      description: LinuxGSM script name in use.
+      placeholder: vhserver
+    validations:
+      required: true
   - type: input
     id: game
     attributes:
@@ -66,6 +119,22 @@ body:
         - "command: send"
     validations:
       required: true
+  - type: textarea
+    id: expected-behavior
+    attributes:
+      label: Expected behavior
+      description: What should happen?
+      placeholder: Describe the expected result.
+    validations:
+      required: true
+  - type: textarea
+    id: actual-behavior
+    attributes:
+      label: Actual behavior
+      description: What actually happens?
+      placeholder: Describe the observed result.
+    validations:
+      required: true
   - type: textarea
     id: further-info
     attributes:
@@ -74,11 +143,19 @@ body:
       placeholder: Tell us what you see!
     validations:
       required: true
+  - type: checkboxes
+    id: prechecks
+    attributes:
+      label: Pre-checks
+      description: Confirm standard troubleshooting has been completed.
+      options:
+        - label: I ran update and validate before reporting this issue.
+          required: true
   - type: textarea
     id: logs
     attributes:
       label: Relevant log output
-      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
+      description: Include the exact command used and the full related output (debug/details if available). This will be automatically formatted into code.
       render: shell
   - type: textarea
     id: steps
@@ -90,3 +167,5 @@ body:
         2. Click on '....'
         3. Scroll down to '....'
         4. See error
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -6,3 +6,6 @@ contact_links:
   - name: Discord Server
     about: Join the LinuxGSM Discord community server. Discuss your LinuxGSM setup, get help and advice
     url: https://linuxgsm.com/discord
+  - name: Report a security vulnerability
+    about: Please report security vulnerabilities privately, not in public issues.
+    url: https://github.com/GameServerManagers/LinuxGSM/security/advisories/new

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -8,6 +8,17 @@ body:
     attributes:
       value: |
         Thanks for taking the time to fill out this feature request!
+  - type: dropdown
+    id: priority
+    attributes:
+      label: Priority
+      description: How important is this feature to you?
+      options:
+        - "priority: low"
+        - "priority: medium"
+        - "priority: high"
+    validations:
+      required: true
   - type: input
     id: user-story
     attributes:
@@ -64,12 +75,41 @@ body:
         - "command: update-lgsm"
         - "command: wipe"
         - "command: send"
+    validations:
+      required: false
+  - type: textarea
+    id: problem-statement
+    attributes:
+      label: Problem statement
+      description: What is painful today, and why is this needed?
+      placeholder: Describe the current limitation or pain point.
+    validations:
+      required: true
+  - type: dropdown
+    id: scope-impact
+    attributes:
+      label: Scope and impact
+      description: Which area would this change impact?
+      options:
+        - "scope: single game"
+        - "scope: multiple games"
+        - "scope: all servers"
+        - "scope: documentation only"
+        - "scope: ci/cd or automation"
+        - "scope: other"
     validations:
       required: true
   - type: textarea
     id: further-info
     attributes:
       label: Further information
-      description: A clear description of what the feature is and any ideas on how to achieve this.
+      description: A clear description of the proposed solution and any implementation ideas.
     validations:
       required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Describe alternatives or workarounds you considered.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/server_request.yml

@@ -7,19 +7,27 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for taking the time to fill out this game server!
+        Thanks for taking the time to fill out this game server request!
   - type: input
     id: game-server
     attributes:
       label: Game server
       description: What game server would you like to add?
     validations:
       required: true
+  - type: checkboxes
+    id: dedicated-server
+    attributes:
+      label: Dedicated server
+      description: Confirm this is a dedicated server request and not client hosting.
+      options:
+        - label: "Yes, this is a dedicated server (not client hosting)."
+          required: true
   - type: checkboxes
     id: on-linux
     attributes:
       label: Linux support
-      description: Does this game server have Linux support? (not wine)
+      description: Does this game server have native Linux server support? (not wine)
       options:
         - label: "Yes"
     validations:
@@ -38,20 +46,40 @@ body:
     id: steam-id
     attributes:
       label: Steam appid
-      description: What is the Steam appid of the game server? Use SteamDB to get the appid. (https://steamdb.info).
+      description: What is the Steam appid of the dedicated server? Required when Steam is Yes. Use SteamDB to get the appid (https://steamdb.info).
       placeholder: "892970"
     validations:
       required: false
+  - type: textarea
+    id: official-docs
+    attributes:
+      label: Official dedicated server documentation
+      description: Provide official documentation links for installing/running the dedicated server.
+      placeholder: |
+        https://example.com/docs/server-setup
+        https://example.com/docs/dedicated-server
+    validations:
+      required: true
+  - type: textarea
+    id: linux-binary-proof
+    attributes:
+      label: Linux binary proof
+      description: Provide evidence that Linux server binaries are available (official docs/download links/version notes).
+      placeholder: |
+        https://example.com/downloads/linux-dedicated-server
+        https://example.com/release-notes/linux-server
+    validations:
+      required: true
   - type: textarea
     id: guides
     attributes:
       label: Guides
-      description: Links to guides on how to install the game server
+      description: Links to community or third-party guides on how to install the game server.
   - type: checkboxes
     id: terms
     attributes:
       label: Code of Conduct
-      description: By submitting this issue, you agree to follow our [Code of Conduct](https://example.com)
+      description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/GameServerManagers/LinuxGSM/blob/master/CODE_OF_CONDUCT.md)
       options:
         - label: I agree to follow this project's Code of Conduct
           required: true

.github/instructions/pr-review.instructions.md

@@ -0,0 +1,29 @@
+---
+title: "LinuxGSM PR Review Guidance"
+applyTo: "**"
+description: "Use when reviewing pull requests in LinuxGSM; prioritize regressions, behavior changes, shell safety, and missing tests over style-only feedback."
+---
+
+Focus review effort on correctness and operational safety first.
+
+Primary priorities:
+
+- Identify behavior regressions and compatibility risks.
+- Flag unsafe shell patterns (`rm -rf`, unquoted vars, unchecked command failures).
+- Verify workflow changes do not weaken permissions or secret handling.
+- Check for missing tests/validation when logic changes.
+- Confirm labels, templates, and automation rules stay internally consistent.
+
+Feedback expectations:
+
+- Give concrete, actionable findings with file and reason.
+- Prefer high-signal issues over style nits.
+- If no defects are found, state that clearly and mention residual risk areas.
+- Suggest minimal, low-risk fixes before proposing broad refactors.
+
+LinuxGSM-specific checks:
+
+- Shell scripts should preserve robust defaults (`set -euo pipefail` where appropriate).
+- Label/workflow updates should avoid duplicate or stale taxonomy.
+- Automation should fail safe (log and continue for advisory AI; block on true CI errors).
+- Keep issue/PR automation rules aligned with templates and existing labels.