ci: add workflow to validate Ondo Tokenized metadata has a label

[vivek-consensys]

Summary

Adds a GitHub Actions workflow that validates any PR adding or modifying metadata for Ondo Tokenized tokens includes a corresponding label file.

Motivation

As Ondo Global Markets tokenized stock/ETF entries are added to this repo, it's important to ensure they are consistently labelled so downstream consumers (e.g. MetaMask swap UI) can correctly identify and filter RWA tokens. Without this check, metadata entries with (Ondo Tokenized in the name could be merged without a label, leading to inconsistent data.

What this workflow does

• Triggers on every pull request
• Identifies metadata files changed or added in the PR diff (does not scan the full repo, so pre-existing unlabelled entries are unaffected)
• For each changed metadata file whose name contains (Ondo Tokenized), checks that:
  • A corresponding label file exists under labels/
  • The label file contains a non-empty labels array
• Fails the check with a clear error message and the exact command to fix it:

  npm run asset:set -- --caip <caip> --labels "ondo"
  

Example failure output

❌ Validation failed — the following Ondo Tokenized metadata entries are missing a label file:

  • Missing label file for: metadata/eip155:1/erc20:0xABC.json (expected: labels/eip155:1/erc20:0xABC.json)

Every token whose name contains '(Ondo Tokenized)' must have a corresponding
label file under labels/ with at least one label (e.g. "ondo").

Notes

• Intentionally scoped to PR diff only — a separate PR addresses pre-existing unlabelled Ondo tokens on master
• Works across all chain namespaces (eip155:1, eip155:56, solana:*, etc.) since the metadata/ → labels/ path substitution is chain-agnostic

---

Note

Low Risk
CI-only validation with no runtime or data-path changes; scope is limited to PR diffs.

Overview
Adds a pull-request GitHub Actions job that enforces label coverage for newly changed Ondo RWA metadata.

On each PR it collects added or modified metadata/**/*.json files (vs the base branch), and for any whose name contains (Ondo Tokenized) it requires a parallel file under labels/ (same path with metadata/ swapped) with a non-empty labels array. Failures print actionable guidance, including npm run asset:set -- --caip <caip> --labels "ondo". Pre-existing unlabelled tokens on the default branch are not scanned.

^{Reviewed by Cursor Bugbot for commit 25db382. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 25db382. Configure here.}

[cursor]

Git diff failure skips validation

Medium Severity

The changed-metadata step pipes git diff into grep and ends with || true without pipefail. If git diff fails (for example when origin/${{ github.base_ref }} is missing or invalid), the step still succeeds, changed_metadata.txt stays empty, and the label check passes without validating any files.

 

^{Reviewed by Cursor Bugbot for commit 25db382. Configure here.}