Add repo-ask workflow for repository research #104
Conversation
Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>
Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a new “Repo Ask” command-triggered GitHub Actions workflow plus documentation so users can ask repository questions via /repo-ask ... comments on issues/PRs.
Changes:
- Added
.github/workflows/repo-ask.ymlto trigger onissue_commentand post repository-context responses. - Added documentation under
docs/workflows/and linked it from the rootREADME.md. - Added a configuration template at
.github/workflows/agentics/repo-ask.config.md.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 15 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/repo-ask.yml |
New issue-comment-triggered workflow that parses /repo-ask, gathers basic repo context, and posts results. |
.github/workflows/agentics/repo-ask.config.md |
Template config file intended to customize repo-ask behavior. |
docs/workflows/repo-ask.md |
Primary workflow documentation: install, usage, security notes, and examples. |
docs/workflows/README.md |
Index page listing available agentic workflows and general guidance. |
README.md |
Adds an “Agentic Workflows” section linking to the new docs and showing /repo-ask usage. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
docs/workflows/repo-ask.md
Outdated
|
|
||
| > For an overview of all available workflows, see the [main README](../README.md). | ||
|
|
||
| The [repo-ask workflow](../../.github/workflows/repo-ask.yml) is a command-triggered workflow that acts as an intelligent research assistant for your repository. When invoked with the `repo-ask` command, it provides accurate, well-researched answers to questions about your codebase, features, documentation, or any repository-related topics by leveraging web search, repository analysis, and bash commands. |
There was a problem hiding this comment.
This description claims the workflow leverages web search and an AI agent to provide “accurate, well-researched answers,” but the current repo-ask.yml only posts a basic template response with file listing/README preview and no web search/agent integration. Please update the wording to match actual behavior (or implement the agent/web-search pieces).
| The [repo-ask workflow](../../.github/workflows/repo-ask.yml) is a command-triggered workflow that acts as an intelligent research assistant for your repository. When invoked with the `repo-ask` command, it provides accurate, well-researched answers to questions about your codebase, features, documentation, or any repository-related topics by leveraging web search, repository analysis, and bash commands. | |
| The [repo-ask workflow](../../.github/workflows/repo-ask.yml) is a command-triggered workflow that posts a templated response summarizing your repository, such as a file listing and README preview, when invoked with the `repo-ask` command. |
.github/workflows/repo-ask.yml
Outdated
| const question = `${{ steps.parse.outputs.question }}`; | ||
|
|
||
| await github.rest.issues.createComment({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| issue_number: context.issue.number, | ||
| body: `🔍 **Repo Ask** is researching your question...\n\n> ${question}\n\n_This may take a moment. I'll update this comment with my findings._` | ||
| }); |
There was a problem hiding this comment.
Untrusted question text is injected into a JavaScript template literal at workflow-parse time: const question = `${{ steps.parse.outputs.question }}`;. If the question contains backticks or ${...}, it can break the script (and potentially enable code injection). Pass the value via env: and read from process.env, or avoid interpolation by reading from context.payload.comment.body and parsing in JS.
| echo "### Structure" >> /tmp/repo-analysis.md | ||
| echo "\`\`\`" >> /tmp/repo-analysis.md | ||
| find . -maxdepth 2 -type f -name "*.md" -o -name "*.py" -o -name "*.js" -o -name "*.ts" | head -50 >> /tmp/repo-analysis.md | ||
| echo "\`\`\`" >> /tmp/repo-analysis.md |
There was a problem hiding this comment.
find is used with multiple -o clauses without parentheses, so -type f / -maxdepth only apply to part of the expression due to operator precedence. This can include unintended paths (and potentially slow the run). Group the name predicates with parentheses, or repeat -type f for each branch.
| # Store file list for context | ||
| find . -type f -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.md" | head -100 > /tmp/file-list.txt | ||
|
|
There was a problem hiding this comment.
Similarly, this find command mixes -type f with multiple -o clauses without grouping, so later -name terms are not constrained by -type f. Add parentheses around the -name predicates (or use \( ... \)), ensuring -type f applies to all patterns.
.github/workflows/repo-ask.yml
Outdated
| github.event.comment.author_association == 'COLLABORATOR' || | ||
| github.event.comment.author_association == 'CONTRIBUTOR' |
There was a problem hiding this comment.
The workflow gate allows author_association == 'CONTRIBUTOR', which can include external users without write access. This contradicts the comment “user has write permissions” and can be unsafe if later steps start using secrets or more powerful tooling. Consider restricting to trusted associations (OWNER/MEMBER/COLLABORATOR) or perform an explicit permission check via the GitHub API (repos.getCollaboratorPermissionLevel).
| github.event.comment.author_association == 'COLLABORATOR' || | |
| github.event.comment.author_association == 'CONTRIBUTOR' | |
| github.event.comment.author_association == 'COLLABORATOR' |
.github/workflows/repo-ask.yml
Outdated
| # Escape special characters for GitHub output | ||
| QUESTION="${QUESTION//'%'/'%25'}" | ||
| QUESTION="${QUESTION//$'\n'/'%0A'}" | ||
| QUESTION="${QUESTION//$'\r'/'%0D'}" | ||
|
|
||
| echo "question=$QUESTION" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
The output escaping (%0A, %0D, %25) is for the deprecated ::set-output command and will mutate the actual question stored in $GITHUB_OUTPUT (newlines become the literal string %0A). Use the $GITHUB_OUTPUT multiline syntax (name<<EOF ... EOF) and remove this percent-encoding so downstream steps receive the original text.
| # Escape special characters for GitHub output | |
| QUESTION="${QUESTION//'%'/'%25'}" | |
| QUESTION="${QUESTION//$'\n'/'%0A'}" | |
| QUESTION="${QUESTION//$'\r'/'%0D'}" | |
| echo "question=$QUESTION" >> $GITHUB_OUTPUT | |
| # Write the question to GITHUB_OUTPUT using multiline syntax to preserve newlines and special characters | |
| { | |
| echo 'question<<EOF_QUESTION' >> "$GITHUB_OUTPUT" | |
| echo "$QUESTION" >> "$GITHUB_OUTPUT" | |
| echo 'EOF_QUESTION' >> "$GITHUB_OUTPUT" | |
| } |
.github/workflows/repo-ask.yml
Outdated
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| issue_number: context.issue.number, | ||
| body: `🔍 **Repo Ask** is researching your question...\n\n> ${question}\n\n_This may take a moment. I'll update this comment with my findings._` |
There was a problem hiding this comment.
The status comment says “I'll update this comment with my findings,” but the workflow later creates a new comment instead of editing the original. Either edit the same comment (store its id and use issues.updateComment) or adjust the message so it doesn't promise an update.
| body: `🔍 **Repo Ask** is researching your question...\n\n> ${question}\n\n_This may take a moment. I'll update this comment with my findings._` | |
| body: `🔍 **Repo Ask** is researching your question...\n\n> ${question}\n\n_This may take a moment. I'll be back with my findings soon._` |
docs/workflows/repo-ask.md
Outdated
|
|
||
| **Mandatory Checklist** | ||
|
|
||
| * [ ] I have read the notes on coding tasks in the [main README](../README.md) and understand the implications. |
There was a problem hiding this comment.
This second reference to the “main README” also uses ../README.md, which likely points to a non-existent docs/README.md. Update it to the correct relative path to the repository root README (e.g., ../../README.md).
| * [ ] I have read the notes on coding tasks in the [main README](../README.md) and understand the implications. | |
| * [ ] I have read the notes on coding tasks in the [main README](../../README.md) and understand the implications. |
| | Workflow | Description | Trigger | | ||
| |----------|-------------|---------| | ||
| | [Repo Ask](./repo-ask.md) | Intelligent research assistant for repository questions | `/repo-ask` command | | ||
|
|
There was a problem hiding this comment.
The markdown table header uses double leading pipes (||), which breaks table rendering. Use single pipes for each row (e.g., | Workflow | Description | Trigger |) and a proper separator row.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
@copilot apply changes based on the comments in this thread |
Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>
Applied all review feedback in commit 7b9a9d3: Security fixes:
Documentation updates:
|
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
Bug: The repo-ask workflow, when triggered by a PR comment, checks out the default branch instead of the PR branch because the checkout step is missing a ref.
Severity: HIGH
Suggested Fix
In the checkout step, add the ref parameter and set it to github.event.issue.pull_request.head.sha. This will ensure that when the workflow is triggered by a comment on a pull request, it checks out the correct commit from the PR's head branch for analysis. You should also add a condition to this step to only run for PR comments.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/repo-ask.yml#L28-L31
Potential issue: The `repo-ask.yml` workflow is triggered by the `issue_comment` event.
When a comment is made on a pull request, the workflow runs in the context of the
repository's default branch. The `actions/checkout` step on lines 28-31 does not specify
a `ref` to check out. Consequently, it defaults to checking out the code from the
default branch, not the branch associated with the pull request. This causes the
workflow to analyze the wrong codebase, providing misleading information and defeating
its intended purpose of analyzing changes within a specific pull request.
Did we get this right? 👍 / 👎 to inform future reviews.
groupthinking
added
bug
Pull Request
Description
Implements the repo-ask workflow - a command-triggered GitHub Actions workflow that posts a templated response summarizing repository context. Users trigger it via
/repo-ask [question]comments on issues/PRs.Key components:
.github/workflows/repo-ask.yml- Workflow triggered byissue_comment, validates permissions (OWNER/MEMBER/COLLABORATOR only), gathers repo context, posts findingsdocs/workflows/repo-ask.md- Full documentation with installation, configuration, use casesdocs/workflows/README.md- Workflow index page.github/workflows/agentics/repo-ask.config.md- Configuration template (placeholder for future integration)Security improvements applied:
Usage:
Note: The current implementation returns a template-based response with file listing and README preview. Full AI agent integration is planned for future development.
Type of change
Checklist
Screenshots (if applicable)
Additional context
YAML syntax validated. CodeQL security check passed with no alerts. No test infrastructure exists for GitHub Actions workflows in this repo.
All review feedback addressed including security fixes for input handling, permission restrictions, documentation accuracy updates, and proper GITHUB_OUTPUT syntax.
Original prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.