Add domain/* labels and CODEOWNERS-based domain labeling

[bryanbeverly]

Summary

• Adds 7 domain/* labels to labels.yml (scanning, findings, integrations, platform, frontend, infra, database) with a teal color palette
• Extends pr_labeler.py to automatically apply domain/* labels by parsing the caller repo's CODEOWNERS file against the PR's changed files
• Uses last-match-wins semantics (matching GitHub's native CODEOWNERS evaluation) rather than depending on mutable PR reviewer state
• Stale domain labels are removed when files change between pushes
• Repos without a CODEOWNERS file gracefully skip domain labeling
• No changes needed to per-repo caller workflows -- the existing pr-labeler.yml callers pick this up automatically

How it works

1. On each run, fetches the repo's CODEOWNERS via the Contents API (single call, cached per run for backfill)
2. Fetches the PR's changed files via gh pr view --json files
3. Parses CODEOWNERS rules and matches each changed file (last match wins per file)
4. Collects the union of owning team slugs across all files
5. Filters to known domain slugs (ignores catch-all teams like eng-leads)
6. Adds missing domain/* labels and removes stale ones

Test plan

• 81 tests passing locally (26 new), covering:
  • CODEOWNERS parsing (comments, blanks, inline comments, case normalization, multi-owner)
  • Pattern matching (catch-all, anchored dirs, unanchored basenames, globs, * not crossing /, deep paths)
  • Domain resolution (last-match-wins, multi-domain PRs, unowned files, catch-all fallback)
  • Label reconciliation (add new, remove stale, ignore unknown slugs, no-op when CODEOWNERS absent)
• CI tests pass
• After merge: trigger sync-labels workflow_dispatch on target repos to propagate label definitions
• Verify domain labels appear on a new PR in thog

Jira: PLAT-222

Made with Cursor

---

Note

Low Risk
Automation-only changes to GitHub labeling and label definitions; no product runtime or auth paths.

Overview
Adds seven domain/* labels to the shared taxonomy and extends pr_labeler.py so open PRs get those labels from CODEOWNERS, not from reviewer assignment.

On each run the labeler loads CODEOWNERS once (Contents API, standard paths), loads the PR’s changed files, resolves owners with last-match-wins per file (GitHub-style path rules), unions team slugs across files, maps them to known domains (scanning, findings, etc.), and adds missing domain/* labels while removing stale ones. Catch-all teams like eng-leads are ignored; repos without CODEOWNERS skip domain labeling. Existing caller workflows pick this up without changes.

Tests cover parsing, pattern matching, domain resolution, and reconcile behavior.

^{Reviewed by Cursor Bugbot for commit a70cc1a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5670c71. Configure here.}