[Bug]: Maintainer-authored issues can be scored ready for outside contributors

[dearsishs]

[Bug]: Maintainer-authored issues can be scored ready for outside contributors

Description

buildIssueQualityReport does not penalize issues opened by maintainer-associated accounts. Outside contributors may act on maintainer-filed issues marked ready.

Steps to reproduce

1. Evaluate open issue with authorAssociation: OWNER and no linked PRs.
2. Report can return status ready.

Expected behavior

Maintainer-authored issues are downgraded (e.g. needs_proof) with a warning.

Actual behavior

Can be scored ready like external contributor issues.

[dosubot]

I can confirm this bug. Looking at buildIssueQualityReport in src/signals/engine.ts, there is no check on authorAssociation anywhere in the function. The scoring logic evaluates content quality, linked PRs, bounty state, and age — but never considers who authored the issue.

The status assignment at lines 2273–2280 can produce "ready" as the default when score ≥ 45 and no blocking conditions trigger needs_proof, hold, or do_not_use. Since maintainer authorship isn't a blocking condition, an OWNER-filed issue with a decent body and no linked PRs will pass through as ready.

Notably, the codebase does have an isMaintainerAssociation() helper used elsewhere [1], so wiring it into this function as an additional warning or needs_proof trigger should be straightforward — e.g., adding a warning when authorAssociation is OWNER, MEMBER, or COLLABORATOR would naturally downgrade the score by 18 points and could also force the needs_proof status directly.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.