Skip to content

feat: add bug-assess agentic workflow#3023

Open
mnriem wants to merge 5 commits into
mainfrom
mnriem/assess-bug-workflow
Open

feat: add bug-assess agentic workflow#3023
mnriem wants to merge 5 commits into
mainfrom
mnriem/assess-bug-workflow

Conversation

@mnriem

@mnriem mnriem commented Jun 17, 2026

Copy link
Copy Markdown
Collaborator

What

Adds a gh-aw agentic workflow that automatically assesses bug reports.

  • .github/workflows/bug-assess.md — workflow source
  • .github/workflows/bug-assess.lock.yml — compiled GitHub Actions YAML (gh aw compile)

How it works

  • Trigger: runs only when the bug-assess label is added to an issue (enforced via a job condition github.event.label.name == 'bug-assess'). Bot actors are skipped.
  • Assessment: reads the issue body + comments, locates suspected code paths in the checked-out repo via grep/find, judges merit and severity, and proposes a remediation — based on the project's bug-assessment prompt, adapted to the issue context.
  • Delivery: the GitHub Issues API has no real file-attachment endpoint, so the workflow posts the full assessment.md as a single issue comment, led by a one-line summary (valid? + priority) so the verdict is visible at a glance.
  • Triage: applies a severity / needs-reproduction / invalid label.

Safety

  • Read-only on repository source — only outputs are the issue comment and triage labels.
  • Treats issue/comment/fetched-URL content as untrusted data, never instructions; refuses loopback / private / cloud-metadata hosts; never echoes secrets.

Notes

  • The lock file is generated by gh aw compile; edit the .md and recompile rather than editing the .lock.yml directly.
  • Depends on the bug-assess label (and the optional severity-* / needs-reproduction / invalid labels) existing in the repo.

Add a gh-aw agentic workflow that triggers when an issue is labeled
`bug-assess`. It assesses the report against the codebase (symptom, suspected
code paths, verdict, severity, remediation) and posts the full assessment.md as
an issue comment, led by a one-line valid?/priority summary. It also applies
severity / needs-reproduction / invalid triage labels.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 17, 2026 16:28

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new gh-aw “bug-assess” agentic workflow that runs on issues:labeled and (via compiled job conditions) activates only when the bug-assess label is applied, then produces a written bug assessment and applies triage labels.

Changes:

  • Introduces .github/workflows/bug-assess.md defining the assessment prompt, tool allowlist, and safe-outputs constraints for comments/labels.
  • Adds the compiled workflow .github/workflows/bug-assess.lock.yml generated by gh aw compile.
Show a summary per file
File Description
.github/workflows/bug-assess.md New gh-aw workflow source: instructions for reading the issue, assessing, and emitting a single comment + up to 2 labels.
.github/workflows/bug-assess.lock.yml Compiled GitHub Actions workflow implementing the agent run, safe-outputs handling, and label-gated activation.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 2/2 changed files
  • Comments generated: 1

Comment thread .github/workflows/bug-assess.md
Set safe-outputs.noop.report-as-issue: false so noop runs on
failures/timeouts no longer create extra report issues, keeping
outputs limited to the issue comment and triage labels.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot's findings

  • Files reviewed: 2/2 changed files
  • Comments generated: 4

Comment thread .github/workflows/bug-assess.md
Comment thread .github/workflows/bug-assess.md Outdated
Comment thread .github/workflows/bug-assess.lock.yml
Comment thread .github/workflows/bug-assess.lock.yml
Reword the Triggering Conditions paragraph to reflect that the
issues:labeled trigger fires for any label and the bug-assess
filtering happens via a job-level condition, not at the trigger.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot's findings

  • Files reviewed: 2/2 changed files
  • Comments generated: 3

Comment thread .github/workflows/bug-assess.md
Comment thread .github/workflows/bug-assess.md Outdated
Comment thread .github/workflows/bug-assess.md Outdated
- Add a 65,000-char comment-size limit instruction with explicit
  truncation marking so large reports don't fail the safe-outputs
  validator.
- Clarify the read-only guardrail: scratch files allowed under
  $RUNNER_TEMP, never write into the working tree or commit/push.
- Align the one-line summary verdict vocabulary (Invalid) with the
  canonical 'invalid' verdict and Step 8 label rules.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot's findings

  • Files reviewed: 2/2 changed files
  • Comments generated: 4

Comment thread .github/workflows/bug-assess.md Outdated
Comment thread .github/workflows/bug-assess.md Outdated
Comment thread .github/workflows/bug-assess.md Outdated
Comment thread .github/workflows/bug-assess.lock.yml Outdated
- Use 'severity' instead of 'priority' in the Step 7 one-line summary to
  match Step 5, the Severity header field, and the severity-* labels.
- Clarify the read-only guardrail: comment + labels are the intended
  outputs on success, while the gh-aw harness may separately emit
  failure-report artifacts/issues when a run errors or times out.
- Recompile with gh-aw v0.78.1 so the gh-aw-actions/setup pin matches
  the repo's other workflow lock files and actions-lock.json.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot's findings

  • Files reviewed: 3/3 changed files
  • Comments generated: 0 new

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants