ci: robust stale issue lifecycle and consolidated triage labels#27015
ci: robust stale issue lifecycle and consolidated triage labels#27015cocosheng-g wants to merge 1 commit into
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly improves the reliability of the repository's issue management system. By shifting from timestamp-based stale detection to a granular timeline event analysis, the lifecycle manager now correctly identifies actual inactivity, preventing premature closures. Additionally, the triage process has been streamlined to ensure consistent label usage and improved communication with users when information is requested. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
cocosheng-g
force-pushed
the
new-worktree
branch
2 times, most recently
from
63ab1aa to
5f78138
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances the GitHub Action scripts for issue and PR management by implementing pagination for searches and a more sophisticated stale-handling logic that checks the issue timeline for human activity. It also introduces specific stale messaging for bug reports and allows comments to be posted when specific labels are added, even if general comments are suppressed. Review feedback identifies a high-severity security risk concerning the lack of sanitization for LLM-generated content, which could permit indirect prompt injection, and recommends including pull request review events in the activity whitelist to prevent active PRs from being marked stale.
I am having trouble creating individual review comments. Click here to see my feedback.
.github/scripts/apply-issue-labels.cjs (214-221)
The script incorporates LLM-generated content (entry.explanation) directly into GitHub issue comments without any validation or sanitization. This creates a vulnerability to Indirect Prompt Injection. An attacker can craft a malicious issue description or comment that tricks the LLM into generating harmful content (e.g., phishing links, malicious markdown, or misleading instructions). When the bot posts this content, it carries the authority of the repository, which can be used to deceive users or maintainers. Additionally, the script relies on the issue_number provided in the LLM output (line 80) to determine which issue to modify. Without verifying that this issue_number corresponds to the issue currently being triaged, an attacker could potentially influence the LLM to perform unauthorized actions (labeling or commenting) on arbitrary issues within the repository.
.github/scripts/gemini-lifecycle-manager.cjs (219)
The current whitelist of meaningful events is missing Pull Request specific activities. Since the search query on line 194 includes both issues and pull requests, a PR that is actively being reviewed (e.g., via a human review or a review request) could be incorrectly closed as stale if no comments or label changes occur.
Please add reviewed, review_requested, and review_request_removed to the whitelist to ensure PRs under active review are protected from stale closure.
if (['commented', 'cross-referenced', 'connected', 'reopened', 'assigned', 'reviewed', 'review_requested', 'review_request_removed'].includes(e.event)) {
|
Size Change: -2.38 kB (-0.01%) Total Size: 34.1 MB
ℹ️ View Unchanged
|
gemini-cli
Bot
added
the
status/need-issue
cocosheng-g
force-pushed
the
new-worktree
branch
10 times, most recently
from
223108a to
000b613
Compare
1 participant
Description
This PR implements two major improvements to the GitHub issue triage and lifecycle workflows to better manage the open bug backlog:
Robust Stale Closure Logic (`gemini-lifecycle-manager.cjs`)
Consolidated Triage Bot Behavior (`gemini-scheduled-issue-triage.yml`)