Assign issue and assign reviewer #430

Activity

1. github-actions commented on Feb 26, 2026

   

   github-actionsBot

   on Feb 26, 2026 – with GitHub Actions

   Contributor

   More actions

   tl;dr: issue assignment and labeling are feasible with existing gh-aw safe-output patterns, but reviewer assignment is not currently wired in this repo and needs a new safe-output path (or a documented fallback).

   Recommendation

   Enable issue triage to assign issues + add labels first, and treat assign reviewer as a second phase with explicit security guardrails.

   Findings

   • Issue triage currently imports only comment safe-output guidance (.github/workflows/gh-aw-issue-triage.md:12) and defines safe-outputs: without assignment/label config (.github/workflows/gh-aw-issue-triage.md:67).
   • The issue-triage README documents only add-comment safe output (gh-agent-workflows/issue-triage/README.md:33-35).
   • Trigger permissions already include write scopes needed for issue/PR metadata changes (gh-agent-workflows/issue-triage/example.yml:6-11 has issues: write and pull-requests: write).
   • Repository guidance includes safe-output constraints for:
     • issue creation labels/assignees (.github/workflows/gh-aw-fragments/safe-output-create-issue.md:9-10)
     • upstream-documented safe-output names assign-to-user / assign-to-agent and label constraints (scripts/gh-aw-safe-outputs-validation-rules.md:21-22, :28, :248).
   • I found no in-repo implementation reference for reviewer-request safe output (rg "request-pull-request-reviewer|request-reviewers|requested_reviewers" . returned no matches).
   • Security guidance explicitly warns that triage workflows assigning labels/assignees can be abused for privilege escalation if not gated (SECURITY.md:120-124).

   Verification

   Commands run and observed output:

   $ rg -n "request-pull-request-reviewer|request-reviewers|requested_reviewers" .
   No matches found.
   
   $ rg -n "safe-outputs:|add-comment" .github/workflows/gh-aw-issue-triage.md
   .github/workflows/gh-aw-issue-triage.md:12:  - gh-aw-fragments/safe-output-add-comment-issue.md
   .github/workflows/gh-aw-issue-triage.md:67:safe-outputs:
   
   $ rg -n "permissions:|issues: write|pull-requests: write" gh-agent-workflows/issue-triage/example.yml
   gh-agent-workflows/issue-triage/example.yml:6:permissions:
   gh-agent-workflows/issue-triage/example.yml:10:  issues: write
   gh-agent-workflows/issue-triage/example.yml:11:  pull-requests: write
   

   Detailed Action Plan

   1. Document current capability envelope
      • Update gh-agent-workflows/issue-triage/README.md Safe Outputs section to explicitly list what is supported now vs planned (comment, labels, assignee, reviewer).
   2. Phase 1: enable issue metadata actions
      • In .github/workflows/gh-aw-issue-triage.md, add safe-output entries for issue labeling and assignment (matching existing gh-aw naming/limits already tracked in scripts/gh-aw-safe-outputs-validation-rules.md).
      • Add corresponding fragment docs under .github/workflows/gh-aw-fragments/ so constraints are explicit (max counts, allowed targets, sanitization behavior).
   3. Phase 2: reviewer assignment support
      • Add a dedicated safe-output capability for requesting PR reviewers (or confirm upstream support and wire it through here).
      • If not available yet, document a fallback: triage agent comments tagging intended reviewer(s) instead of direct reviewer assignment.
   4. Security hardening before rollout
      • For label/assignee/reviewer actions on external-triggered workflows, gate execution by author association/trust policy per SECURITY.md:120-124.
      • Limit allowed labels/assignees/reviewers and per-run max operations to minimize abuse.
   5. Validation
      • Run make compile and ensure workflow + trigger artifacts regenerate cleanly.
      • Dry-run on a test issue/PR to confirm safe-output enforcement and no unintended escalations.

   Related Items

   Type	Link	Relevance
   Issue	#430	Current request
   Issue	#321	Prior workflow request involving PR review automation context
   File	.github/workflows/gh-aw-issue-triage.md:12,67	Current issue-triage safe-output wiring
   File	gh-agent-workflows/issue-triage/README.md:33-35	Current documented safe outputs
   File	gh-agent-workflows/issue-triage/example.yml:6-11	Existing write permissions already present
   File	scripts/gh-aw-safe-outputs-validation-rules.md:21-22,28,248	Existing assignment/label rule references
   File	SECURITY.md:120-124	Privilege-escalation risk guidance for triage actions

   ---

   What is this? | From workflow: Issue Triage

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
2. strawgate

   assigned

   Copilot

   and

   strawgate

   on Feb 26, 2026
3. strawgate

   closed this as not plannedon Mar 24, 2026