Skip to content

feat(flue): Add shared issue triage workflow#180

Merged
dcramer merged 34 commits into
mainfrom
flue-issue-triage-bot-persona
May 13, 2026
Merged

feat(flue): Add shared issue triage workflow#180
dcramer merged 34 commits into
mainfrom
flue-issue-triage-bot-persona

Conversation

@dcramer
Copy link
Copy Markdown
Member

@dcramer dcramer commented May 9, 2026

Adds a reusable Flue issue triage workflow in getsentry/.github so target repositories can call one shared Sentry Intern triage implementation instead of carrying local Flue code. The workflow also keeps a manual workflow_dispatch path that points at a specific issue for a real smoke test.

Sentry Intern Triage

The Flue agent enforces a first-sentence Sentry Intern identity in comments, keeps the casually professional triage voice in the skill, and inherits not-planned closure when the canonical duplicate was closed that way. Automatic duplicate closure is limited to same-repository candidates; cross-repository matches now fall back to human review.

Repository Gate

A central feature registry enables issue triage for getsentry/cli, getsentry/dotagents, getsentry/junior, getsentry/sentry-mcp, getsentry/vitest-evals, and getsentry/warden. Reusable workflow calls must target their own getsentry repository, and the workflow checks the feature registry before creating the GitHub App token or checking out the target repository.

Workflow Contracts

The workflow validates required Flue secrets and variables before creating the Sentry Intern token, scopes the app token to issues write on the target repository, and uses the caller GITHUB_TOKEN for source checkout. pnpm setup reads automation/package.json so the pinned action can resolve the packageManager field from the checked-out automation repo, and the Flue agent now treats missing or invalid prepared checkouts as unavailable instead of trusted.

Local Tooling

Adds repo-local Prettier, actionlint, lint-staged, and simple-git-hooks wiring so workflow and formatting checks can run with pnpm before commit. The actionlint wrapper handles both full-repo runs and lint-staged file lists.

Validation

Validated with pnpm run lint, lint-staged against the PR diff, focused Vitest coverage, Flue node build, YAML parsing, allowlist accept and reject checks, pinned action tag checks, git diff whitespace checks, and the PR check suite.

Move issue triage automation into the org .github repository so target repositories can call one shared Flue workflow. Add the Sentry Intern persona, central repository allowlist, manual issue dispatch path, and focused validation coverage.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
@dcramer dcramer marked this pull request as ready for review May 9, 2026 00:32
Comment thread .github/workflows/issue-triage.yml Outdated
Comment thread .github/workflows/issue-triage.yml Outdated
Validate the repository input before exporting a canonical owner/name value and pass that sanitized value through environment variables in shell steps. This avoids evaluating caller-controlled repository text while preserving the reusable workflow contract.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Comment thread .flue/agents/issue-triage.ts Outdated
dcramer and others added 2 commits May 8, 2026 17:47
Subscribe the shared issue triage workflow to opened issue events directly from .github instead of exposing it as a reusable workflow. Resolve the target repository and issue number from either the issue event or manual dispatch before the feature allowlist and agent steps run.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Keep duplicate triage from crashing when GitHub mutations fail. Duplicate closure now records comment, label, and close failures in the result so the workflow can surface human-review context instead of throwing through the whole run.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Comment thread .github/workflows/issue-triage.yml Outdated
Keep issue triage as a reusable workflow because GitHub Actions event triggers run in the repository where the event occurs. Document the required local caller workflow and require workflow_call invocations to target the caller repository before the feature allowlist and token creation steps run.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Comment thread .flue/agents/issue-triage.ts
Check whether the installed gh CLI supports --duplicate-of before linking duplicate closures. Fall back to --reason duplicate on older runners so duplicate triage can still close the issue instead of degrading to human review.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Comment thread .flue/agents/issue-triage.ts
Validate the reusable workflow against GitHub Actions and action input contracts. Keep the workflow scoped to getsentry, validate required secrets before token creation, and configure pnpm setup to read automation/package.json.

Also reject cross-repository duplicate candidates before automatic closure so only same-repo duplicates can be closed without human review.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
@dcramer dcramer marked this pull request as draft May 9, 2026 01:36
@dcramer
Copy link
Copy Markdown
Member Author

dcramer commented May 9, 2026

if this ends up too painful i going to just set it up as a service, and bind a workflow here that calls a custom action

Comment thread .github/workflows/issue-triage.yml
dcramer and others added 2 commits May 8, 2026 18:43
Return an unavailable repository context when the prepared checkout path is missing or not a git checkout. This keeps the diagnosis stage from trusting a checkout path that cannot be inspected.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Install Prettier, lint-staged, simple-git-hooks, and a repo-local actionlint wrapper so workflow linting can run through pnpm. Format existing supported files once so the new lint gate starts green.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Comment thread .flue/agents/issue-triage.ts Outdated
Derive the current repository from the issue URL when the payload omits it, and fall back to human review if either side of the duplicate comparison cannot be validated. This preserves the same-repository auto-close invariant for direct CLI invocations too.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
@dcramer dcramer marked this pull request as ready for review May 9, 2026 16:18
Remove repo-local lint hook scaffolding and keep the workflow allowlist inline. Use the prepared target checkout directly and keep local tests on Node's built-in test runner to reduce dependency churn.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
@dcramer dcramer marked this pull request as draft May 10, 2026 19:55
Comment thread .github/workflows/issue-triage.yml
Comment thread .flue/agents/issue-triage.ts Outdated
dcramer and others added 2 commits May 10, 2026 13:07
Make target repository checkout use the workflow token explicitly and close linked duplicates with gh --duplicate-of when available. Keep a duplicate reason fallback for older gh versions.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Pass the workflow GITHUB_TOKEN explicitly to both target repository checkout steps so reusable workflow callers use their repository-scoped token for source inspection.

Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Comment thread .github/workflows/issue-triage.yml
Comment thread .flue/agents/issue-triage.ts
Comment thread .flue/agents/issue-triage.ts Outdated
Comment thread .flue/agents/issue-triage.ts
Prevent read-only gh commands from inheriting write-scoped GitHub tokens when the read token is missing. Apply the duplicate label only after a duplicate close succeeds so failed closes do not leave open issues marked as duplicates.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Comment thread .flue/agents/issue-triage.ts
Treat the prepared target repository as unavailable unless the checkout directory contains a Git checkout. This prevents a failed checkout that leaves an empty directory from being passed to the triage model as usable context.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Comment thread .github/workflows/issue-triage.yml Outdated
Grant the issue triage read token contents access and use it for target repository checkout. This lets manual dispatch inspect private target repositories instead of silently losing code context under the .github repository token.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Comment thread .flue/agents/issue-triage.ts
Catch remaining unhandled triage failures and return a human-review result instead of crashing the workflow. This covers issue context fetch failures outside the narrower duplicate and update handling paths.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Comment thread .flue/agents/issue-triage.ts
dcramer and others added 4 commits May 11, 2026 12:07
Use the read-only gh command as the default for JSON reads so future read helpers do not silently inherit write-token access.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Remove bespoke provider and network error classification from issue triage. Keep the fail-closed path and preserve the actionable gh close capability error, but otherwise use one generic safe failure summary.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Remove the first-sentence parser that tried to infer whether model comments already identified the bot persona. Make the handler own the fixed Sentry Intern intro and update the triage skill so model comments only provide the substantive note.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Remove the manual workflow default repository so dispatch runs must choose the target explicitly. Clarify the Flue README with the required organization secrets and variable for issue triage.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Comment thread .flue/agents/issue-triage.ts Outdated
Allow model JSON to return null for an absent duplicate candidate without rejecting the entire duplicate search result. Keep the existing runtime guard for duplicate status without a candidate and add focused schema coverage.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Comment thread .flue/agents/issue-triage.ts Outdated
Treat GitHub repository names as case-insensitive when validating same-repository duplicate candidates. This avoids rejecting a valid duplicate only because the candidate URL used different casing.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Comment thread .flue/agents/issue-triage.ts Outdated
Comment thread .github/workflows/issue-triage.yml Outdated
Create gh command definitions at use time so workflow-provided tokens are not captured before runtime. Normalize target repository casing during workflow validation so allowlist and caller checks behave consistently for GitHub repository names.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Add a job-level gate for the issue triage allowlist so disabled repositories skip before runner work continues. Keep the existing validation step for enabled repositories.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Comment thread .github/workflows/issue-triage.yml Outdated
Use explicit repository comparisons for the job-level issue triage allowlist. This keeps the cheap skip path while preserving mixed-case repository input behavior.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Comment thread .github/workflows/issue-triage.yml
Make the job-level repository gate the single allowlist for issue triage. Keep the validation step focused on enabled repository inputs.

Co-Authored-By: OpenAI Codex <codex@openai.com>
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 1e44262. Configure here.

Comment thread .flue/agents/issue-triage.ts Outdated
Remove a redundant human-review condition after the earlier human-review return path. Keep the update result driven by actual update failures.

Co-Authored-By: OpenAI Codex <codex@openai.com>
@dcramer dcramer merged commit b044ee5 into main May 13, 2026
8 checks passed
@dcramer dcramer deleted the flue-issue-triage-bot-persona branch May 13, 2026 23:29
dcramer added a commit that referenced this pull request May 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants