[only21mil]

Problem

When .github/VOUCHED.td changes on main, PR Vouch should relabel the affected open PRs. It doesn't. The push run puts every open PR into one label matrix, and GitHub allows at most 256 jobs per matrix. With more than 1,500 open PRs today, the run fails right after Collect PR targets and no label changes.

Every push run since 2026-04-30 has failed this way, 19 in a row. The last green one was 2026-03-29. A visible case: the trust-list commit 55a8234 vouched @mweinbach on 2026-10-16. As of 2026-10-23, #18525 and #18518 still carry vouch:unvouched, while their other three open PRs show vouch:trusted. Denouncing someone has the same gap, so their open PRs keep vouch:trusted.

Change

• On a push, Collect PR targets reads VOUCHED.td at the commit before the push and at the pushed commit. It targets only open PRs whose author was added, denounced, un-denounced or removed. Comments, reordering and edited denounce reasons are not changes. Entries are read the way the label job's mitchellh/vouch check-user action reads them: the whole handle is lowercased, platform included (the list has bil0000 while the account is Bil0000), and the first entry for a handle decides its status. A PR without an author is skipped instead of stopping the run.
• If more than 256 PRs still match, it labels the 256 most recently updated and logs a warning that lists the rest by number, so a maintainer can comment /recheck-vouch on them. If the earlier commit can't be read, that list counts as empty, so every listed author's PRs get relabeled instead of none.
• The selection moved to .github/scripts/pr-vouch-targets.cjs so it can be tested. This follows thread-transfer-report.cjs and check-nightly-release.cjs. The job checks out .github/scripts from the pushed main commit only on push. PR and comment events still run the inline script with no checkout.
• .github/workflows/pr-vouch.yml is gone from the push paths. That trigger relabeled every open PR, which can't fit in one matrix anymore, and a workflow edit changes nobody's trust status.
• The new test runs in its own Test PR vouch targets step in ci.yml.
• Cleanup: the parsing comment in pr-vouch-targets.cjs is trimmed from 5 lines to 3 so it fits the 4-line comment cap that refactor: halve code comments and cap comment blocks at four lines #21514 added on main. Every parsing rule stays; only the upstream file citations go.

Labels that went stale during the failed runs stay as they are. They update on the author's next push, on /recheck-vouch, or when that author's entry changes again.

Scope and approval

There is no issue. I think this qualifies as a focused fix for an obvious bug, since the workflow has failed on every trust-list push for six months. PR and comment events and the label job are unchanged. The size is a 98-line module plus an 82-line test, because the selection logic needed to be testable outside the YAML.

Verification

• node --test .github/scripts/pr-vouch-targets.test.cjs fails on main because the module doesn't exist, and all 5 tests pass on this branch. The first test vouches one author among 1,302 open PRs and expects only that author's 2 PRs, in either login case. The second covers what counts as a status change. The third matches the action's parsing: a GitHub: platform prefix, and a denouncement added above an existing vouch. The fourth checks the cap and the skipped list. The fifth checks that a PR without an author does not stop the others.
• The Test release checks and Test PR vouch targets commands from ci.yml: 34 and 5 tests pass.
• Replay: I ran the Collect PR targets script from pr-vouch.yml on main and on this branch against a stub github object. The inputs were real: VOUCHED.td at both commits of the last two trust-list pushes, and a saved list of the 1,279 PRs open early on 2026-10-21. Main yields a 1,279-job matrix both times. This branch yields @mweinbach's 5 open PRs and @bompus's 4.
• actionlint passes on pr-vouch.yml and ci.yml, with the custom runner-label check ignored. vp fmt --check and vp lint pass on the changed files.
• Cleanup commit: vp run check:changed passes against the PR base, and again on a scratch merge with current main (typecheck and the affected tests included). On that merge, the old 5-line comment fails vp lint with 1 error and the trimmed comment passes. The 5 vouch tests still pass on the merged tree.

Regression test, failing on main and passing on this branch:

The collect step replayed on the last two trust-list pushes:

Not checked:

• A live Actions run. I didn't push a trust-list change to a fork, so the checkout plus require path is unproven in Actions. thread-transfer-report.yml uses the same pattern on main.
• The unreadable-earlier-commit fallback against the real API.
• The cap path in a real run. In the 2026-10-21 snapshot, the most open PRs by one author is 154.

Prior PRs: #602 by @t3dotgg added this workflow and its trust-list relabeling. This PR keeps its label job unchanged and narrows only the push targets. No earlier PR or issue covers this failure. #23387 is a separate change in the same workflow that merges cleanly with this one.

Generated with muse-wonder-full-1.0 and GPT-6.1 Sol in T3 Code Nightly