sync-labels workflow fails: ORG_TOKEN secret is not configured

[baijum]

Problem

The Sync Labels workflow (.github/workflows/sync-labels.yml) fails on its first command because the ORG_TOKEN secret it reads is empty/not configured.

Failed run: https://github.com/kaappi/infra/actions/runs/29003617800

env:
  GH_TOKEN:            ← empty (secrets.ORG_TOKEN is unset)
gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable.
##[error]Process completed with exit code 4.

Because the step runs under bash -e, the initial gh repo list kaappi aborts the whole job before any repo is touched. Confirmed the secret is absent at both repo and org level (gh secret list shows only CODECOV_TOKEN at the org).

Impact

Org-wide label sync cannot run from CI. As a workaround, labels.json was applied to all 29 active repos manually via a local gh loop (551/551 writes OK), so labels are currently correct — but the workflow is still broken for future updates.

Fix

1. Create a PAT with label-write access across the org:
   • Fine-grained: resource owner = kaappi org, repository access = All repositories, permission Issues: Read and write (labels live under the Issues API). If the org gates PATs, an org admin must approve it.
   • Classic alternative: repo scope (public_repo if all repos are public).
2. Add it as a secret named exactly ORG_TOKEN on kaappi/infra (or an org-level secret scoped to infra).
3. Re-run the workflow and confirm it iterates all repos.

Also worth fixing while here

• The workflow enumerates repos with gh repo list kaappi --limit 50. There are 29 active repos today, but bump the limit (e.g. 100) so growth past 50 doesn't silently skip repos.
• Consider echoing a per-repo summary / failing only on the fatal gh repo list (individual gh label create calls are already guarded with || echo skip).