Rename the `enhancement` label to `Feature` and `documentation` to `Docs`
across the issue-triage system. The triage agent's `type` value is applied
verbatim as an issue label, so update the validator allow-list, the agent
schema and classification rule, the feature-request template's auto-label,
and the design proposal doc to keep them coherent.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
Make the "Steps to reproduce" field mandatory on the bug report form and
turn off blank issues so reporters can't bypass the structured form. This
raises the floor on bug report quality and cuts low-effort/AI-slop reports.
The field description offers an escape hatch for genuinely intermittent bugs.
Co-authored-by: Isaac
* feat: add AI-powered issue triage workflow via claude-code-action
Implements Stage 2 of the issue triage proposal. On every new issue,
the bot classifies component, assigns priority, routes to contributors,
flags incomplete issues, and detects duplicates — labels only, no
comments (except duplicate flagging). P0/P1 issues are round-robin
assigned to maintainers from .github/MAINTAINER.
Co-authored-by: Isaac
* fix(security): harden issue triage workflow against injection attacks
- Remove direct interpolation of issue title/body from the prompt —
Claude now fetches issue content via `gh issue view` so attacker-
controlled text is treated as data, not instructions
- Restrict tool access from broad `Bash(gh:*)` to only the 4 needed
subcommands: `gh issue view/edit/comment`, `gh search issues`
- Remove `Bash(cat:*)` (could read /proc/self/environ) — pre-read
MAINTAINER list in a prior step and pass via env var instead
- Add explicit security constraints in the prompt: never output secrets,
never run env/printenv, treat issue content as untrusted
- Checkout only .github/MAINTAINER via sparse-checkout (least privilege)
Co-authored-by: Isaac
* feat: replace claude-code-action with omnigent-powered triage agent
Switch from anthropics/claude-code-action (requires ANTHROPIC_API_KEY)
to running a dedicated triage agent via `omnigent run`, using the
existing LLM_API_KEY + GATEWAY_BASE_URL credentials through the
Databricks gateway — same pattern as the Polly review workflow.
- Add examples/triage/ agent config (claude-sdk harness, single-agent)
- Rewrite issue-triage.yml to bootstrap Omnigent, write gateway config,
and run the triage agent headlessly
- Issue content is still never interpolated — the agent fetches it via
`gh issue view` at runtime
- GH_TOKEN is scoped to issues:write only
Co-authored-by: Isaac
* security: eliminate prompt injection attack surface in triage workflow
The previous design gave the LLM shell access + GH_TOKEN, meaning a
crafted issue body could trick the agent into exfiltrating LLM_API_KEY
via `printenv` → `gh issue comment`. Prompt-level "don't do X"
instructions are not a security boundary.
New architecture splits trusted and untrusted steps:
[trusted] fetch issue + duplicate candidates via gh CLI
[LLM] classify → structured JSON only (NO tools, NO shell, NO GH_TOKEN)
[trusted] validate JSON against allowlists → apply labels via gh CLI
The LLM process cannot:
- Run shell commands (no tools configured)
- Access GH_TOKEN (not passed to its step)
- Post comments or edit issues (no gh CLI access)
- Inject arbitrary labels (output validated against allowlists)
The only thing it can do is output text, which is then parsed and
validated by deterministic Python before any GitHub mutation occurs.
Co-authored-by: Isaac
* docs: update triage proposal to reflect omnigent-based implementation
Replace claude-code-action references with the omnigent triage agent
architecture. Update the tool decision, alternatives table, and
security considerations to document the structural prompt injection
defense (tool-less LLM + trusted allowlist validation steps).
Co-authored-by: Isaac
* feat: add .github/ISSUE_ASSIGNEES for triage round-robin assignment
Separate issue assignment from the MAINTAINER list (which includes
managers/directors for PR approval gating). ISSUE_ASSIGNEES contains
only engineers eligible for P0/P1 round-robin assignment.
Co-authored-by: Isaac
* feat: domain-aware round-robin assignment via ISSUE_ASSIGNEES
ISSUE_ASSIGNEES now maps engineers to comp:* domains. The trusted
"Apply triage labels" step filters candidates by the bot's component
classification, falling back to the full list when no domain matches.
Assignment logic is entirely in the trusted step — the LLM never sees
the assignee list.
Co-authored-by: Isaac
* feat: support multiple components per issue in triage
Change the triage JSON schema from a single `component` string to a
`components` array. All matched comp:* labels are applied to the issue.
For assignment, engineers matching ANY of the components are candidates,
then one is picked via round-robin. Still always one assignee per issue.
Co-authored-by: Isaac
* chore: update ISSUE_ASSIGNEES with shared domains and new engineers
Add server, runner, harnesses to all engineers. Add SabhyaC26 and
fanzeyi. Specialists keep their extra domains (policies, web-ui, repr).
Co-authored-by: Isaac
* feat: add comp:infra component for CI/CD, Docker, and deployment issues
Add infra domain to PattaraS, TomeHirata, serena-ruan, and dhruv0811.
Update agent prompt and workflow allowlist to recognize comp:infra.
Co-authored-by: Isaac
* test: add triage agent to _ALT_COVERED in examples coverage guard
The triage agent is a CI-only tool-less JSON classifier with no runtime
behavior to e2e test — its output is validated by the workflow's
trusted allowlist parsing.
Co-authored-by: Isaac
* fix: address Polly review — security and correctness fixes
1. Replace eval with shlex.quote — build gh commands in Python with
proper escaping, write to a script, execute it. No shell interpolation
of model output.
2. Use json.JSONDecoder.raw_decode instead of regex — handles nested
braces in reasoning field.
3. Add triaged label to needs-info issues — they were stuck with neither
needs-triage nor triaged.
4. Validate duplicate_of against pre-fetched candidate list — reject
hallucinated issue numbers.
Co-authored-by: Isaac
* refactor: move triage agent config from examples/ to .github/triage/
The triage agent is CI infrastructure, not a user-facing example.
Moving it under .github/ keeps it with the workflow and templates.
Remove the _ALT_COVERED entry since the examples coverage guard
no longer scans for it.
Co-authored-by: Isaac
* fix: address Polly review round 2 — three runtime bugs
1. Initialize dup=None before if/else — NameError crashed the step
on every needs-info issue, leaving them permanently untriaged.
2. Read priority from /tmp/triage_result.json instead of undefined
$result shell variable — P0/P1 assignment was silently never firing.
3. Use os.environ['ISSUE_NUMBER'] in Python instead of shell
interpolation — consistent with trusted-step architecture.
Co-authored-by: Isaac
* fix: remove component dropdowns from issue templates
Component classification is handled automatically by the AI triage
workflow — the dropdown was redundant and would drift out of sync
with the triage bot's component list.
Co-authored-by: Isaac
* fix: guard label removal, empty search terms, and design doc paths
1. Only --remove-label needs-triage if the issue actually carries it —
gh errors on removing a missing label, aborting the entire step.
2. Skip duplicate search when extracted terms are empty — prevents
noisy/random candidates from triggering false duplicate flags.
3. Fix design doc paths: examples/triage/ → .github/triage/.
Co-authored-by: Isaac
* ci: add GitHub issue templates for bug reports and feature requests
Implements Stage 1 (Lightweight Intake) from the issue triage proposal.
Two form-based templates auto-label with needs-triage; questions redirect
to Discussions; blank issues remain enabled.
Co-authored-by: Isaac
* fix: address Polly review feedback on issue templates
- Fix Discussions URL to point to omnigent-ai org (was 404-ing)
- Rename opaque "Repr" dropdown option to "Repr / Serialization"
- Add title prefills ([Bug], [Feature]) for easier search/triage
- Add component dropdown to feature request template for symmetry
Co-authored-by: Isaac
* feat: add AI-powered issue triage workflow via claude-code-action
Implements Stage 2 of the issue triage proposal. On every new issue,
the bot classifies component, assigns priority, routes to contributors,
flags incomplete issues, and detects duplicates — labels only, no
comments (except duplicate flagging). P0/P1 issues are round-robin
assigned to maintainers from .github/MAINTAINER.
Co-authored-by: Isaac
* Revert "feat: add AI-powered issue triage workflow via claude-code-action"
This reverts commit b0f5206010.
Pat Sukprasert