AI Moderator #2679
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # ___ _ _ | |
| # / _ \ | | (_) | |
| # | |_| | __ _ ___ _ __ | |_ _ ___ | |
| # | _ |/ _` |/ _ \ '_ \| __| |/ __| | |
| # | | | | (_| | __/ | | | |_| | (__ | |
| # \_| |_/\__, |\___|_| |_|\__|_|\___| | |
| # __/ | | |
| # _ _ |___/ | |
| # | | | | / _| | | |
| # | | | | ___ _ __ _ __| |_| | _____ ____ | |
| # | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___| | |
| # \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \ | |
| # \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/ | |
| # | |
| # This file was automatically generated by gh-aw. DO NOT EDIT. | |
| # | |
| # To update this file, edit the corresponding .md file and run: | |
| # gh aw compile | |
| # For more information: https://github.com/githubnext/gh-aw/blob/main/.github/aw/github-agentic-workflows.md | |
| # | |
| name: "AI Moderator" | |
| "on": | |
| issue_comment: | |
| # lock-for-agent: true # Lock-for-agent processed as issue locking in activation job | |
| types: | |
| - created | |
| issues: | |
| # lock-for-agent: true # Lock-for-agent processed as issue locking in activation job | |
| types: | |
| - opened | |
| workflow_dispatch: | |
| inputs: | |
| issue_url: | |
| description: Issue URL to moderate (e.g., https://github.com/owner/repo/issues/123) | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: "gh-aw-${{ github.workflow }}-${{ github.event.issue.number }}" | |
| run-name: "AI Moderator" | |
| jobs: | |
| activation: | |
| needs: | |
| - check_external_user | |
| - pre_activation | |
| if: > | |
| (needs.pre_activation.outputs.activated == 'true') && ((github.event_name == 'workflow_dispatch') || (needs.check_external_user.outputs.should_skip != 'true')) | |
| runs-on: ubuntu-slim | |
| permissions: | |
| contents: read | |
| issues: write | |
| outputs: | |
| comment_id: "" | |
| comment_repo: "" | |
| issue_locked: ${{ steps.lock-issue.outputs.locked }} | |
| steps: | |
| - name: Checkout actions folder | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| with: | |
| sparse-checkout: | | |
| actions | |
| persist-credentials: false | |
| - name: Setup Scripts | |
| uses: ./actions/setup | |
| with: | |
| destination: /tmp/gh-aw/actions | |
| - name: Check workflow file timestamps | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_WORKFLOW_FILE: "ai-moderator.lock.yml" | |
| with: | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/check_workflow_timestamp_api.cjs'); | |
| await main(); | |
| - name: Lock issue for agent workflow | |
| id: lock-issue | |
| if: (github.event_name == 'issues') || (github.event_name == 'issue_comment') | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/lock-issue.cjs'); | |
| await main(); | |
| agent: | |
| needs: activation | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs | |
| GH_AW_SAFE_OUTPUTS: /tmp/gh-aw/safeoutputs/outputs.jsonl | |
| GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /tmp/gh-aw/safeoutputs/config.json | |
| GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /tmp/gh-aw/safeoutputs/tools.json | |
| outputs: | |
| has_patch: ${{ steps.collect_output.outputs.has_patch }} | |
| model: ${{ steps.generate_aw_info.outputs.model }} | |
| output: ${{ steps.collect_output.outputs.output }} | |
| output_types: ${{ steps.collect_output.outputs.output_types }} | |
| steps: | |
| - name: Checkout actions folder | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| with: | |
| sparse-checkout: | | |
| actions | |
| persist-credentials: false | |
| - name: Setup Scripts | |
| uses: ./actions/setup | |
| with: | |
| destination: /tmp/gh-aw/actions | |
| - name: Checkout repository | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Create gh-aw temp directory | |
| run: bash /tmp/gh-aw/actions/create_gh_aw_tmp_dir.sh | |
| - name: Configure Git credentials | |
| env: | |
| REPO_NAME: ${{ github.repository }} | |
| SERVER_URL: ${{ github.server_url }} | |
| run: | | |
| git config --global user.email "github-actions[bot]@users.noreply.github.com" | |
| git config --global user.name "github-actions[bot]" | |
| # Re-authenticate git with GitHub token | |
| SERVER_URL_STRIPPED="${SERVER_URL#https://}" | |
| git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git" | |
| echo "Git configured with standard GitHub Actions identity" | |
| - name: Checkout PR branch | |
| if: | | |
| github.event.pull_request | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | |
| with: | |
| github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/checkout_pr_branch.cjs'); | |
| await main(); | |
| - name: Validate COPILOT_GITHUB_TOKEN secret | |
| run: /tmp/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://githubnext.github.io/gh-aw/reference/engines/#github-copilot-default | |
| env: | |
| COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} | |
| - name: Install GitHub Copilot CLI | |
| run: | | |
| # Download official Copilot CLI installer script | |
| curl -fsSL https://raw.githubusercontent.com/github/copilot-cli/main/install.sh -o /tmp/copilot-install.sh | |
| # Execute the installer with the specified version | |
| export VERSION=0.0.374 && sudo bash /tmp/copilot-install.sh | |
| # Cleanup | |
| rm -f /tmp/copilot-install.sh | |
| # Verify installation | |
| copilot --version | |
| - name: Install awf binary | |
| run: | | |
| echo "Installing awf via installer script (requested version: v0.8.2)" | |
| curl -sSL https://raw.githubusercontent.com/githubnext/gh-aw-firewall/main/install.sh | sudo AWF_VERSION=v0.8.2 bash | |
| which awf | |
| awf --version | |
| - name: Determine automatic lockdown mode for GitHub MCP server | |
| id: determine-automatic-lockdown | |
| env: | |
| TOKEN_CHECK: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }} | |
| if: env.TOKEN_CHECK != '' | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| const determineAutomaticLockdown = require('/tmp/gh-aw/actions/determine_automatic_lockdown.cjs'); | |
| await determineAutomaticLockdown(github, context, core); | |
| - name: Downloading container images | |
| run: bash /tmp/gh-aw/actions/download_docker_images.sh ghcr.io/github/github-mcp-server:v0.27.0 | |
| - name: Write Safe Outputs Config | |
| run: | | |
| mkdir -p /tmp/gh-aw/safeoutputs | |
| mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs | |
| cat > /tmp/gh-aw/safeoutputs/config.json << 'EOF' | |
| {"add_labels":{"allowed":["spam","ai-generated","link-spam","ai-inspected"],"max":3},"hide_comment":{"allowed_reasons":["spam"],"max":5},"missing_tool":{},"noop":{"max":1}} | |
| EOF | |
| cat > /tmp/gh-aw/safeoutputs/tools.json << 'EOF' | |
| [ | |
| { | |
| "description": "Add labels to an existing GitHub issue or pull request for categorization and filtering. Labels must already exist in the repository. For creating new issues with labels, use create_issue with the labels property instead. CONSTRAINTS: Only these labels are allowed: [spam ai-generated link-spam ai-inspected]. Target: *.", | |
| "inputSchema": { | |
| "additionalProperties": false, | |
| "properties": { | |
| "item_number": { | |
| "description": "Issue or PR number to add labels to. This is the numeric ID from the GitHub URL (e.g., 456 in github.com/owner/repo/issues/456). If omitted, adds labels to the item that triggered this workflow.", | |
| "type": "number" | |
| }, | |
| "labels": { | |
| "description": "Label names to add (e.g., ['bug', 'priority-high']). Labels must exist in the repository.", | |
| "items": { | |
| "type": "string" | |
| }, | |
| "type": "array" | |
| } | |
| }, | |
| "required": [ | |
| "labels" | |
| ], | |
| "type": "object" | |
| }, | |
| "name": "add_labels" | |
| }, | |
| { | |
| "description": "Report that a tool or capability needed to complete the task is not available. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.", | |
| "inputSchema": { | |
| "additionalProperties": false, | |
| "properties": { | |
| "alternatives": { | |
| "description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).", | |
| "type": "string" | |
| }, | |
| "reason": { | |
| "description": "Explanation of why this tool is needed to complete the task (max 256 characters).", | |
| "type": "string" | |
| }, | |
| "tool": { | |
| "description": "Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.", | |
| "type": "string" | |
| } | |
| }, | |
| "required": [ | |
| "tool", | |
| "reason" | |
| ], | |
| "type": "object" | |
| }, | |
| "name": "missing_tool" | |
| }, | |
| { | |
| "description": "Log a transparency message when no significant actions are needed. Use this to confirm workflow completion and provide visibility when analysis is complete but no changes or outputs are required (e.g., 'No issues found', 'All checks passed'). This ensures the workflow produces human-visible output even when no other actions are taken.", | |
| "inputSchema": { | |
| "additionalProperties": false, | |
| "properties": { | |
| "message": { | |
| "description": "Status or completion message to log. Should explain what was analyzed and the outcome (e.g., 'Code review complete - no issues found', 'Analysis complete - all tests passing').", | |
| "type": "string" | |
| } | |
| }, | |
| "required": [ | |
| "message" | |
| ], | |
| "type": "object" | |
| }, | |
| "name": "noop" | |
| }, | |
| { | |
| "description": "Hide a comment on a GitHub issue, pull request, or discussion. This collapses the comment and marks it as spam, abuse, off-topic, outdated, or resolved. Use this for inappropriate, off-topic, or outdated comments. The comment_id must be a GraphQL node ID (string like 'IC_kwDOABCD123456'), not a numeric REST API comment ID.", | |
| "inputSchema": { | |
| "additionalProperties": false, | |
| "properties": { | |
| "comment_id": { | |
| "description": "GraphQL node ID of the comment to hide (e.g., 'IC_kwDOABCD123456'). This is the GraphQL node ID, not the numeric comment ID from REST API. Can be obtained from GraphQL queries or comment API responses.", | |
| "type": "string" | |
| }, | |
| "reason": { | |
| "description": "Optional reason for hiding the comment. Defaults to SPAM if not provided. Valid values: SPAM (spam content), ABUSE (abusive/harassment content), OFF_TOPIC (not relevant to discussion), OUTDATED (no longer applicable), RESOLVED (issue/question has been resolved).", | |
| "enum": [ | |
| "SPAM", | |
| "ABUSE", | |
| "OFF_TOPIC", | |
| "OUTDATED", | |
| "RESOLVED" | |
| ], | |
| "type": "string" | |
| } | |
| }, | |
| "required": [ | |
| "comment_id" | |
| ], | |
| "type": "object" | |
| }, | |
| "name": "hide_comment" | |
| } | |
| ] | |
| EOF | |
| cat > /tmp/gh-aw/safeoutputs/validation.json << 'EOF' | |
| { | |
| "add_labels": { | |
| "defaultMax": 5, | |
| "fields": { | |
| "item_number": { | |
| "issueOrPRNumber": true | |
| }, | |
| "labels": { | |
| "required": true, | |
| "type": "array", | |
| "itemType": "string", | |
| "itemSanitize": true, | |
| "itemMaxLength": 128 | |
| } | |
| } | |
| }, | |
| "missing_tool": { | |
| "defaultMax": 20, | |
| "fields": { | |
| "alternatives": { | |
| "type": "string", | |
| "sanitize": true, | |
| "maxLength": 512 | |
| }, | |
| "reason": { | |
| "required": true, | |
| "type": "string", | |
| "sanitize": true, | |
| "maxLength": 256 | |
| }, | |
| "tool": { | |
| "required": true, | |
| "type": "string", | |
| "sanitize": true, | |
| "maxLength": 128 | |
| } | |
| } | |
| }, | |
| "noop": { | |
| "defaultMax": 1, | |
| "fields": { | |
| "message": { | |
| "required": true, | |
| "type": "string", | |
| "sanitize": true, | |
| "maxLength": 65000 | |
| } | |
| } | |
| } | |
| } | |
| EOF | |
| - name: Setup MCPs | |
| env: | |
| GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} | |
| GITHUB_MCP_LOCKDOWN: ${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }} | |
| GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | |
| run: | | |
| mkdir -p /tmp/gh-aw/mcp-config | |
| mkdir -p /home/runner/.copilot | |
| cat > /home/runner/.copilot/mcp-config.json << EOF | |
| { | |
| "mcpServers": { | |
| "github": { | |
| "type": "local", | |
| "command": "docker", | |
| "args": [ | |
| "run", | |
| "-i", | |
| "--rm", | |
| "-e", | |
| "GITHUB_PERSONAL_ACCESS_TOKEN", | |
| "-e", | |
| "GITHUB_READ_ONLY=1", | |
| "-e", | |
| "GITHUB_LOCKDOWN_MODE=$GITHUB_MCP_LOCKDOWN", | |
| "-e", | |
| "GITHUB_TOOLSETS=context,repos,issues,pull_requests", | |
| "ghcr.io/github/github-mcp-server:v0.27.0" | |
| ], | |
| "tools": ["*"], | |
| "env": { | |
| "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}" | |
| } | |
| }, | |
| "safeoutputs": { | |
| "type": "local", | |
| "command": "node", | |
| "args": ["/tmp/gh-aw/safeoutputs/mcp-server.cjs"], | |
| "tools": ["*"], | |
| "env": { | |
| "GH_AW_MCP_LOG_DIR": "\${GH_AW_MCP_LOG_DIR}", | |
| "GH_AW_SAFE_OUTPUTS": "\${GH_AW_SAFE_OUTPUTS}", | |
| "GH_AW_SAFE_OUTPUTS_CONFIG_PATH": "\${GH_AW_SAFE_OUTPUTS_CONFIG_PATH}", | |
| "GH_AW_SAFE_OUTPUTS_TOOLS_PATH": "\${GH_AW_SAFE_OUTPUTS_TOOLS_PATH}", | |
| "GH_AW_ASSETS_BRANCH": "\${GH_AW_ASSETS_BRANCH}", | |
| "GH_AW_ASSETS_MAX_SIZE_KB": "\${GH_AW_ASSETS_MAX_SIZE_KB}", | |
| "GH_AW_ASSETS_ALLOWED_EXTS": "\${GH_AW_ASSETS_ALLOWED_EXTS}", | |
| "GITHUB_REPOSITORY": "\${GITHUB_REPOSITORY}", | |
| "GITHUB_SERVER_URL": "\${GITHUB_SERVER_URL}", | |
| "GITHUB_SHA": "\${GITHUB_SHA}", | |
| "GITHUB_WORKSPACE": "\${GITHUB_WORKSPACE}", | |
| "DEFAULT_BRANCH": "\${DEFAULT_BRANCH}" | |
| } | |
| } | |
| } | |
| } | |
| EOF | |
| echo "-------START MCP CONFIG-----------" | |
| cat /home/runner/.copilot/mcp-config.json | |
| echo "-------END MCP CONFIG-----------" | |
| echo "-------/home/runner/.copilot-----------" | |
| find /home/runner/.copilot | |
| echo "HOME: $HOME" | |
| echo "GITHUB_COPILOT_CLI_MODE: $GITHUB_COPILOT_CLI_MODE" | |
| - name: Generate agentic run info | |
| id: generate_aw_info | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const awInfo = { | |
| engine_id: "copilot", | |
| engine_name: "GitHub Copilot CLI", | |
| model: "gpt-5-mini", | |
| version: "", | |
| agent_version: "0.0.374", | |
| workflow_name: "AI Moderator", | |
| experimental: false, | |
| supports_tools_allowlist: true, | |
| supports_http_transport: true, | |
| run_id: context.runId, | |
| run_number: context.runNumber, | |
| run_attempt: process.env.GITHUB_RUN_ATTEMPT, | |
| repository: context.repo.owner + '/' + context.repo.repo, | |
| ref: context.ref, | |
| sha: context.sha, | |
| actor: context.actor, | |
| event_name: context.eventName, | |
| staged: false, | |
| network_mode: "defaults", | |
| allowed_domains: [], | |
| firewall_enabled: true, | |
| awf_version: "v0.8.2", | |
| steps: { | |
| firewall: "squid" | |
| }, | |
| created_at: new Date().toISOString() | |
| }; | |
| // Write to /tmp/gh-aw directory to avoid inclusion in PR | |
| const tmpPath = '/tmp/gh-aw/aw_info.json'; | |
| fs.writeFileSync(tmpPath, JSON.stringify(awInfo, null, 2)); | |
| console.log('Generated aw_info.json at:', tmpPath); | |
| console.log(JSON.stringify(awInfo, null, 2)); | |
| // Set model as output for reuse in other steps/jobs | |
| core.setOutput('model', awInfo.model); | |
| - name: Generate workflow overview | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| const { generateWorkflowOverview } = require('/tmp/gh-aw/actions/generate_workflow_overview.cjs'); | |
| await generateWorkflowOverview(core); | |
| - name: Create prompt | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} | |
| GH_AW_GITHUB_ACTOR: ${{ github.actor }} | |
| GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }} | |
| GH_AW_GITHUB_EVENT_INPUTS_ISSUE_URL: ${{ github.event.inputs.issue_url }} | |
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} | |
| GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} | |
| run: | | |
| bash /tmp/gh-aw/actions/create_prompt_first.sh | |
| cat << 'PROMPT_EOF' > "$GH_AW_PROMPT" | |
| {{#runtime-import? .github/shared-instructions.md}} | |
| # AI Moderator | |
| You are an AI-powered moderation system that automatically detects spam, link spam, and AI-generated content in GitHub issues and comments. | |
| ## Context | |
| Analyze the following content in repository __GH_AW_GITHUB_REPOSITORY__: | |
| **Issue Number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ | |
| **Comment ID** (if applicable): __GH_AW_GITHUB_EVENT_COMMENT_ID__ | |
| **Author**: __GH_AW_GITHUB_ACTOR__ | |
| **Manual URL** (if provided via workflow_dispatch): __GH_AW_GITHUB_EVENT_INPUTS_ISSUE_URL__ | |
| **Content to analyze**: | |
| When running via `workflow_dispatch` with an `issue_url` input: | |
| 1. Parse the issue URL to extract the owner, repo, and issue number | |
| 2. Validate that the URL is an issue URL (not a pull request URL) | |
| 3. Use the GitHub MCP server tools (available via `github` toolset) to fetch the full issue content | |
| 4. Specifically, use the appropriate GitHub API tool to get the issue details including title and body | |
| For other trigger types (issues, issue_comment): | |
| 1. Extract the relevant identifiers from the context: | |
| - For issues: Use issue number from __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ | |
| - For comments: Use issue number and comment ID from the event payload | |
| 2. Use the GitHub MCP server tools to fetch the original, unsanitized content directly from GitHub API | |
| 3. Do NOT use the pre-sanitized text from the activation job - fetch fresh content to analyze the original user input | |
| ## Custom Moderation Rules (Optional) | |
| If custom moderation instructions exist at `.github/prompts/custom-moderation.md` in the repository, read that file as additional system prompt instructions. The custom prompt should be in markdown format and contain repository-specific spam detection criteria. | |
| Example custom moderation file (`.github/prompts/custom-moderation.md`): | |
| ```markdown | |
| # Custom Moderation Rules | |
| Additional spam indicators for this repository: | |
| - Posts mentioning competitor products (CompetitorX, CompetitorY) | |
| - Off-topic gaming discussions (this is a development tools project) | |
| - Cryptocurrency or blockchain mentions (not relevant to this project) | |
| - Generic "me too" comments without substance | |
| ``` | |
| ## Detection Tasks | |
| Perform the following detection analyses on the content: | |
| ### 1. Generic Spam Detection | |
| Analyze for spam indicators: | |
| - Promotional content or advertisements | |
| - Irrelevant links or URLs | |
| - Repetitive text patterns | |
| - Low-quality or nonsensical content | |
| - Requests for personal information | |
| - Cryptocurrency or financial scams | |
| - Content that doesn't relate to the repository's purpose | |
| ### 2. Link Spam Detection | |
| Analyze for link spam indicators: | |
| - Multiple unrelated links | |
| - Links to promotional websites | |
| - Short URL services used to hide destinations (bit.ly, tinyurl, etc.) | |
| - Links to cryptocurrency, gambling, or adult content | |
| - Links that don't relate to the repository or issue topic | |
| - Suspicious domains or newly registered domains | |
| - Links to download executables or suspicious files | |
| ### 3. AI-Generated Content Detection | |
| Analyze for AI-generated content indicators: | |
| - Use of em-dashes (—) in casual contexts | |
| - Excessive use of emoji, especially in technical discussions | |
| - Perfect grammar and punctuation in informal settings | |
| - Constructions like "it's not X - it's Y" or "X isn't just Y - it's Z" | |
| - Overly formal paragraph responses to casual questions | |
| - Enthusiastic but content-free responses ("That's incredible!", "Amazing!") | |
| - "Snappy" quips that sound clever but add little substance | |
| - Generic excitement without specific technical engagement | |
| - Perfectly structured responses that lack natural conversational flow | |
| - Responses that sound like they're trying too hard to be engaging | |
| Human-written content typically has: | |
| - Natural imperfections in grammar and spelling | |
| - Casual internet language and slang | |
| - Specific technical details and personal experiences | |
| - Natural conversational flow with genuine questions or frustrations | |
| - Authentic emotional reactions to technical problems | |
| ## Actions | |
| Based on your analysis: | |
| 1. **For Issues** (when issue number is present): | |
| - If generic spam is detected, use the `add-labels` safe output to add the `spam` label to the issue | |
| - If link spam is detected, use the `add-labels` safe output to add the `link-spam` label to the issue | |
| - If AI-generated content is detected, use the `add-labels` safe output to add the `ai-generated` label to the issue | |
| - Multiple labels can be added if multiple types are detected | |
| - **If no warnings or issues are found** and the content appears legitimate and on-topic, use the `add-labels` safe output to add the `ai-inspected` label to indicate the issue has been reviewed and no threats were found | |
| - **If workflow_dispatch** was used, ensure the labels are applied to the correct issue/PR as specified in the input URL when calling `add-labels` | |
| 2. **For Comments** (when comment ID is present): | |
| - If any type of spam, link spam, or AI-generated spam is detected: | |
| - Use the `hide-comment` safe output to hide the comment with reason 'spam' | |
| - Also add appropriate labels to the parent issue as described above | |
| - If the comment appears legitimate and on-topic, add the `ai-inspected` label to the parent issue | |
| ## Important Guidelines | |
| - Be conservative with detections to avoid false positives | |
| - Consider the repository context when evaluating relevance | |
| - Technical discussions may naturally contain links to resources, documentation, or related issues | |
| - New contributors may have less polished writing - this doesn't necessarily indicate AI generation | |
| - Provide clear reasoning for each detection in your analysis | |
| - Only take action if you have high confidence in the detection | |
| PROMPT_EOF | |
| - name: Substitute placeholders | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| GH_AW_GITHUB_ACTOR: ${{ github.actor }} | |
| GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }} | |
| GH_AW_GITHUB_EVENT_INPUTS_ISSUE_URL: ${{ github.event.inputs.issue_url }} | |
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} | |
| GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} | |
| with: | |
| script: | | |
| const substitutePlaceholders = require('/tmp/gh-aw/actions/substitute_placeholders.cjs'); | |
| // Call the substitution function | |
| return await substitutePlaceholders({ | |
| file: process.env.GH_AW_PROMPT, | |
| substitutions: { | |
| GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR, | |
| GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID, | |
| GH_AW_GITHUB_EVENT_INPUTS_ISSUE_URL: process.env.GH_AW_GITHUB_EVENT_INPUTS_ISSUE_URL, | |
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER, | |
| GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY | |
| } | |
| }); | |
| - name: Append XPIA security instructions to prompt | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| run: | | |
| cat "/tmp/gh-aw/prompts/xpia_prompt.md" >> "$GH_AW_PROMPT" | |
| - name: Append temporary folder instructions to prompt | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| run: | | |
| cat "/tmp/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT" | |
| - name: Append safe outputs instructions to prompt | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| run: | | |
| cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT" | |
| <safe-outputs> | |
| <description>GitHub API Access Instructions</description> | |
| <important> | |
| The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations. | |
| </important> | |
| <instructions> | |
| To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls. | |
| **Available tools**: add_labels, hide_comment, missing_tool, noop | |
| **Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped. | |
| </instructions> | |
| </safe-outputs> | |
| PROMPT_EOF | |
| - name: Append GitHub context to prompt | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| GH_AW_GITHUB_ACTOR: ${{ github.actor }} | |
| GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }} | |
| GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }} | |
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} | |
| GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }} | |
| GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} | |
| GH_AW_GITHUB_RUN_ID: ${{ github.run_id }} | |
| GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }} | |
| run: | | |
| cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT" | |
| <github-context> | |
| The following GitHub context information is available for this workflow: | |
| {{#if __GH_AW_GITHUB_ACTOR__ }} | |
| - **actor**: __GH_AW_GITHUB_ACTOR__ | |
| {{/if}} | |
| {{#if __GH_AW_GITHUB_REPOSITORY__ }} | |
| - **repository**: __GH_AW_GITHUB_REPOSITORY__ | |
| {{/if}} | |
| {{#if __GH_AW_GITHUB_WORKSPACE__ }} | |
| - **workspace**: __GH_AW_GITHUB_WORKSPACE__ | |
| {{/if}} | |
| {{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }} | |
| - **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ | |
| {{/if}} | |
| {{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }} | |
| - **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ | |
| {{/if}} | |
| {{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }} | |
| - **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ | |
| {{/if}} | |
| {{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }} | |
| - **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__ | |
| {{/if}} | |
| {{#if __GH_AW_GITHUB_RUN_ID__ }} | |
| - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__ | |
| {{/if}} | |
| </github-context> | |
| PROMPT_EOF | |
| - name: Substitute placeholders | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| GH_AW_GITHUB_ACTOR: ${{ github.actor }} | |
| GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }} | |
| GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }} | |
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} | |
| GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }} | |
| GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} | |
| GH_AW_GITHUB_RUN_ID: ${{ github.run_id }} | |
| GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }} | |
| with: | |
| script: | | |
| const substitutePlaceholders = require('/tmp/gh-aw/actions/substitute_placeholders.cjs'); | |
| // Call the substitution function | |
| return await substitutePlaceholders({ | |
| file: process.env.GH_AW_PROMPT, | |
| substitutions: { | |
| GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR, | |
| GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID, | |
| GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER, | |
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER, | |
| GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER, | |
| GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY, | |
| GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID, | |
| GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE | |
| } | |
| }); | |
| - name: Append PR context instructions to prompt | |
| if: | | |
| (github.event_name == 'issue_comment') && (github.event.issue.pull_request != null) || github.event_name == 'pull_request_review_comment' || github.event_name == 'pull_request_review' | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| run: | | |
| cat "/tmp/gh-aw/prompts/pr_context_prompt.md" >> "$GH_AW_PROMPT" | |
| - name: Interpolate variables and render templates | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| GH_AW_GITHUB_ACTOR: ${{ github.actor }} | |
| GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }} | |
| GH_AW_GITHUB_EVENT_INPUTS_ISSUE_URL: ${{ github.event.inputs.issue_url }} | |
| GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }} | |
| GH_AW_GITHUB_REPOSITORY: ${{ github.repository }} | |
| with: | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/interpolate_prompt.cjs'); | |
| await main(); | |
| - name: Print prompt | |
| env: | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| run: bash /tmp/gh-aw/actions/print_prompt_summary.sh | |
| - name: Execute GitHub Copilot CLI | |
| id: agentic_execution | |
| # Copilot CLI tool arguments (sorted): | |
| timeout-minutes: 5 | |
| run: | | |
| set -o pipefail | |
| sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --mount /tmp:/tmp:rw --mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw" --mount /usr/bin/date:/usr/bin/date:ro --mount /usr/bin/gh:/usr/bin/gh:ro --mount /usr/bin/yq:/usr/bin/yq:ro --mount /usr/local/bin/copilot:/usr/local/bin/copilot:ro --mount /home/runner/.copilot:/home/runner/.copilot:rw --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --image-tag 0.8.2 \ | |
| -- /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --model gpt-5-mini --allow-all-tools --allow-all-paths --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" \ | |
| 2>&1 | tee /tmp/gh-aw/agent-stdio.log | |
| env: | |
| COPILOT_AGENT_RUNNER_TYPE: STANDALONE | |
| COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} | |
| GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json | |
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | |
| GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} | |
| GITHUB_HEAD_REF: ${{ github.head_ref }} | |
| GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | |
| GITHUB_REF_NAME: ${{ github.ref_name }} | |
| GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }} | |
| GITHUB_WORKSPACE: ${{ github.workspace }} | |
| XDG_CONFIG_HOME: /home/runner | |
| - name: Redact secrets in logs | |
| if: always() | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/redact_secrets.cjs'); | |
| await main(); | |
| env: | |
| GH_AW_SECRET_NAMES: 'COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN' | |
| SECRET_COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} | |
| SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }} | |
| SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }} | |
| SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload Safe Outputs | |
| if: always() | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: safe-output | |
| path: ${{ env.GH_AW_SAFE_OUTPUTS }} | |
| if-no-files-found: warn | |
| - name: Ingest agent output | |
| id: collect_output | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} | |
| GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,raw.githubusercontent.com,registry.npmjs.org" | |
| GITHUB_SERVER_URL: ${{ github.server_url }} | |
| GITHUB_API_URL: ${{ github.api_url }} | |
| with: | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/collect_ndjson_output.cjs'); | |
| await main(); | |
| - name: Upload sanitized agent output | |
| if: always() && env.GH_AW_AGENT_OUTPUT | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: agent-output | |
| path: ${{ env.GH_AW_AGENT_OUTPUT }} | |
| if-no-files-found: warn | |
| - name: Upload engine output files | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: agent_outputs | |
| path: | | |
| /tmp/gh-aw/sandbox/agent/logs/ | |
| /tmp/gh-aw/redacted-urls.log | |
| if-no-files-found: ignore | |
| - name: Parse agent logs for step summary | |
| if: always() | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/ | |
| with: | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/parse_copilot_log.cjs'); | |
| await main(); | |
| - name: Parse firewall logs for step summary | |
| if: always() | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/parse_firewall_logs.cjs'); | |
| await main(); | |
| - name: Validate agent logs for errors | |
| if: always() | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/ | |
| GH_AW_ERROR_PATTERNS: "[{\"id\":\"\",\"pattern\":\"::(error)(?:\\\\s+[^:]*)?::(.+)\",\"level_group\":1,\"message_group\":2,\"description\":\"GitHub Actions workflow command - error\"},{\"id\":\"\",\"pattern\":\"::(warning)(?:\\\\s+[^:]*)?::(.+)\",\"level_group\":1,\"message_group\":2,\"description\":\"GitHub Actions workflow command - warning\"},{\"id\":\"\",\"pattern\":\"::(notice)(?:\\\\s+[^:]*)?::(.+)\",\"level_group\":1,\"message_group\":2,\"description\":\"GitHub Actions workflow command - notice\"},{\"id\":\"\",\"pattern\":\"(ERROR|Error):\\\\s+(.+)\",\"level_group\":1,\"message_group\":2,\"description\":\"Generic ERROR messages\"},{\"id\":\"\",\"pattern\":\"(WARNING|Warning):\\\\s+(.+)\",\"level_group\":1,\"message_group\":2,\"description\":\"Generic WARNING messages\"},{\"id\":\"\",\"pattern\":\"(\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}:\\\\d{2}:\\\\d{2}\\\\.\\\\d{3}Z)\\\\s+\\\\[(ERROR)\\\\]\\\\s+(.+)\",\"level_group\":2,\"message_group\":3,\"description\":\"Copilot CLI timestamped ERROR messages\"},{\"id\":\"\",\"pattern\":\"(\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}:\\\\d{2}:\\\\d{2}\\\\.\\\\d{3}Z)\\\\s+\\\\[(WARN|WARNING)\\\\]\\\\s+(.+)\",\"level_group\":2,\"message_group\":3,\"description\":\"Copilot CLI timestamped WARNING messages\"},{\"id\":\"\",\"pattern\":\"\\\\[(\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}:\\\\d{2}:\\\\d{2}\\\\.\\\\d{3}Z)\\\\]\\\\s+(CRITICAL|ERROR):\\\\s+(.+)\",\"level_group\":2,\"message_group\":3,\"description\":\"Copilot CLI bracketed critical/error messages with timestamp\"},{\"id\":\"\",\"pattern\":\"\\\\[(\\\\d{4}-\\\\d{2}-\\\\d{2}T\\\\d{2}:\\\\d{2}:\\\\d{2}\\\\.\\\\d{3}Z)\\\\]\\\\s+(WARNING):\\\\s+(.+)\",\"level_group\":2,\"message_group\":3,\"description\":\"Copilot CLI bracketed warning messages with timestamp\"},{\"id\":\"\",\"pattern\":\"✗\\\\s+(.+)\",\"level_group\":0,\"message_group\":1,\"description\":\"Copilot CLI failed command indicator\"},{\"id\":\"\",\"pattern\":\"(?:command not found|not found):\\\\s*(.+)|(.+):\\\\s*(?:command not found|not found)\",\"level_group\":0,\"message_group\":0,\"description\":\"Shell command not found error\"},{\"id\":\"\",\"pattern\":\"Cannot find module\\\\s+['\\\"](.+)['\\\"]\",\"level_group\":0,\"message_group\":1,\"description\":\"Node.js module not found error\"},{\"id\":\"\",\"pattern\":\"Permission denied and could not request permission from user\",\"level_group\":0,\"message_group\":0,\"description\":\"Copilot CLI permission denied warning (user interaction required)\"},{\"id\":\"\",\"pattern\":\"\\\\berror\\\\b.*permission.*denied\",\"level_group\":0,\"message_group\":0,\"description\":\"Permission denied error (requires error context)\"},{\"id\":\"\",\"pattern\":\"\\\\berror\\\\b.*unauthorized\",\"level_group\":0,\"message_group\":0,\"description\":\"Unauthorized access error (requires error context)\"},{\"id\":\"\",\"pattern\":\"\\\\berror\\\\b.*forbidden\",\"level_group\":0,\"message_group\":0,\"description\":\"Forbidden access error (requires error context)\"}]" | |
| with: | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/validate_errors.cjs'); | |
| await main(); | |
| - name: Upload agent artifacts | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: agent-artifacts | |
| path: | | |
| /tmp/gh-aw/aw-prompts/prompt.txt | |
| /tmp/gh-aw/aw_info.json | |
| /tmp/gh-aw/mcp-logs/ | |
| /tmp/gh-aw/sandbox/firewall/logs/ | |
| /tmp/gh-aw/agent-stdio.log | |
| if-no-files-found: ignore | |
| check_external_user: | |
| needs: pre_activation | |
| runs-on: ubuntu-slim | |
| outputs: | |
| should_skip: ${{ steps.check_actor.outputs.should_skip || github.event_name == 'workflow_dispatch' }} | |
| steps: | |
| - name: Check if actor is external user or GitHub Action bot | |
| id: check_actor | |
| if: ${{ github.event_name != 'workflow_dispatch' }} | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: |- | |
| const actor = context.actor; | |
| const { owner, repo } = context.repo; | |
| // Skip if the issue was opened by GitHub Action bot or Copilot bot | |
| const excludedBots = ['github-actions[bot]', 'github-actions', 'copilot[bot]']; | |
| if (actor.endsWith('[bot]') && excludedBots.includes(actor)) { | |
| core.info(`⏭️ Skipping workflow - issue opened by bot: ${actor}`); | |
| core.setOutput('should_skip', 'true'); | |
| return; | |
| } | |
| try { | |
| core.info(`Checking permissions for user: ${actor}`); | |
| // Get the user's permission level | |
| const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({ | |
| owner, | |
| repo, | |
| username: actor | |
| }); | |
| const userPermission = permission.permission; | |
| core.info(`User ${actor} has permission: ${userPermission}`); | |
| // Skip workflow for team members (admin, maintain, write) | |
| const teamPermissions = ['admin', 'maintain', 'write']; | |
| if (teamPermissions.includes(userPermission)) { | |
| core.info(`⏭️ Skipping workflow - ${actor} is a team member with ${userPermission} access`); | |
| core.setOutput('should_skip', 'true'); | |
| } else { | |
| core.info(`✅ Running workflow - ${actor} is external user with ${userPermission} access`); | |
| core.setOutput('should_skip', 'false'); | |
| } | |
| } catch (error) { | |
| // If we can't determine permission (e.g., user not a collaborator), assume external and run | |
| core.info(`⚠️ Could not determine permissions for ${actor}: ${error.message}`); | |
| core.info(`✅ Running workflow - assuming external user`); | |
| core.setOutput('should_skip', 'false'); | |
| } | |
| conclusion: | |
| needs: | |
| - activation | |
| - agent | |
| - safe_outputs | |
| if: (always()) && (needs.agent.result != 'skipped') | |
| runs-on: ubuntu-slim | |
| permissions: | |
| contents: read | |
| discussions: write | |
| issues: write | |
| pull-requests: write | |
| outputs: | |
| noop_message: ${{ steps.noop.outputs.noop_message }} | |
| tools_reported: ${{ steps.missing_tool.outputs.tools_reported }} | |
| total_count: ${{ steps.missing_tool.outputs.total_count }} | |
| steps: | |
| - name: Checkout actions folder | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| with: | |
| sparse-checkout: | | |
| actions | |
| persist-credentials: false | |
| - name: Setup Scripts | |
| uses: ./actions/setup | |
| with: | |
| destination: /tmp/gh-aw/actions | |
| - name: Debug job inputs | |
| env: | |
| COMMENT_ID: ${{ needs.activation.outputs.comment_id }} | |
| COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }} | |
| AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }} | |
| AGENT_CONCLUSION: ${{ needs.agent.result }} | |
| run: | | |
| echo "Comment ID: $COMMENT_ID" | |
| echo "Comment Repo: $COMMENT_REPO" | |
| echo "Agent Output Types: $AGENT_OUTPUT_TYPES" | |
| echo "Agent Conclusion: $AGENT_CONCLUSION" | |
| - name: Download agent output artifact | |
| continue-on-error: true | |
| uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 | |
| with: | |
| name: agent-output | |
| path: /tmp/gh-aw/safeoutputs/ | |
| - name: Setup agent output environment variable | |
| run: | | |
| mkdir -p /tmp/gh-aw/safeoutputs/ | |
| find "/tmp/gh-aw/safeoutputs/" -type f -print | |
| echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" | |
| - name: Process No-Op Messages | |
| id: noop | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | |
| GH_AW_NOOP_MAX: 1 | |
| GH_AW_WORKFLOW_NAME: "AI Moderator" | |
| with: | |
| github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/noop.cjs'); | |
| await main(); | |
| - name: Record Missing Tool | |
| id: missing_tool | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | |
| GH_AW_WORKFLOW_NAME: "AI Moderator" | |
| with: | |
| github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/missing_tool.cjs'); | |
| await main(); | |
| - name: Update reaction comment with completion status | |
| id: conclusion | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | |
| GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }} | |
| GH_AW_COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }} | |
| GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| GH_AW_WORKFLOW_NAME: "AI Moderator" | |
| GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} | |
| with: | |
| github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/notify_comment_error.cjs'); | |
| await main(); | |
| - name: Unlock issue after agent workflow | |
| id: unlock-issue | |
| if: (always()) && (((github.event_name == 'issues') || (github.event_name == 'issue_comment')) && (needs.activation.outputs.issue_locked == 'true')) | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/unlock-issue.cjs'); | |
| await main(); | |
| pre_activation: | |
| runs-on: ubuntu-slim | |
| permissions: | |
| contents: read | |
| outputs: | |
| activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }} | |
| steps: | |
| - name: Checkout actions folder | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| with: | |
| sparse-checkout: | | |
| actions | |
| persist-credentials: false | |
| - name: Setup Scripts | |
| uses: ./actions/setup | |
| with: | |
| destination: /tmp/gh-aw/actions | |
| - name: Check team membership for workflow | |
| id: check_membership | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_REQUIRED_ROLES: admin,maintainer,write | |
| GH_AW_ALLOWED_BOTS: agentic-workflows-dev[bot] | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/check_membership.cjs'); | |
| await main(); | |
| safe_outputs: | |
| needs: agent | |
| if: (!cancelled()) && (needs.agent.result != 'skipped') | |
| runs-on: ubuntu-slim | |
| permissions: | |
| contents: read | |
| discussions: write | |
| issues: write | |
| pull-requests: write | |
| timeout-minutes: 15 | |
| env: | |
| GH_AW_ENGINE_ID: "copilot" | |
| GH_AW_ENGINE_MODEL: "gpt-5-mini" | |
| GH_AW_WORKFLOW_ID: "ai-moderator" | |
| GH_AW_WORKFLOW_NAME: "AI Moderator" | |
| outputs: | |
| process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }} | |
| process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }} | |
| steps: | |
| - name: Checkout actions folder | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| with: | |
| sparse-checkout: | | |
| actions | |
| persist-credentials: false | |
| - name: Setup Scripts | |
| uses: ./actions/setup | |
| with: | |
| destination: /tmp/gh-aw/actions | |
| - name: Download agent output artifact | |
| continue-on-error: true | |
| uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 | |
| with: | |
| name: agent-output | |
| path: /tmp/gh-aw/safeoutputs/ | |
| - name: Setup agent output environment variable | |
| run: | | |
| mkdir -p /tmp/gh-aw/safeoutputs/ | |
| find "/tmp/gh-aw/safeoutputs/" -type f -print | |
| echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" | |
| - name: Process Safe Outputs | |
| id: process_safe_outputs | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| env: | |
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | |
| GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_labels\":{\"allowed\":[\"spam\",\"ai-generated\",\"link-spam\",\"ai-inspected\"],\"target\":\"*\"},\"hide_comment\":{\"allowed_reasons\":[\"spam\"],\"max\":5}}" | |
| with: | |
| github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | |
| script: | | |
| const { setupGlobals } = require('/tmp/gh-aw/actions/setup_globals.cjs'); | |
| setupGlobals(core, github, context, exec, io); | |
| const { main } = require('/tmp/gh-aw/actions/safe_output_handler_manager.cjs'); | |
| await main(); | |