ci/github-script: default to commonjs

Since all github-scripts need to be written in commonjs, we now default
to it by not setting package.json. Support from editors for .js files is
slightly better than .cjs. To still allow using module imports in the
test runner script, we trick node into loading the script itself as a
module again via `--import ./run`.

ci/github-script/run

@@ -0,0 +1,55 @@
+#!/usr/bin/env -S node --import ./run
+import { execSync } from 'node:child_process'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { program } from 'commander'
+import { getOctokit } from '@actions/github'
+
+async function run(action, owner, repo) {
+  const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
+
+  const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
+  try {
+    process.env.GITHUB_WORKSPACE = tmp
+    process.chdir(tmp)
+
+    await action({
+      github: getOctokit(token),
+      context: {
+        payload: {},
+        repo: {
+          owner,
+          repo,
+        },
+      },
+      core: {
+        getInput() {
+          return token
+        },
+        error: console.error,
+        info: console.log,
+        notice: console.log,
+        setFailed(msg) {
+          console.error(msg)
+          process.exitCode = 1
+        },
+      },
+      dry: true,
+    })
+  } finally {
+    rmSync(tmp, { recursive: true })
+  }
+}
+
+program
+  .command('labels')
+  .description('Manage labels on pull requests.')
+  .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
+  .action(async (owner, repo) => {
+    const labels = (await import('./labels.js')).default
+    run(labels, owner, repo)
+  })
+
+await program.parse()