Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .github/workflows/bot-autoassign-issue.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name: Issue Assignment Bot
on:
issue_comment:
types: [created]
permissions:
contents: read
issues: write
concurrency:
group: bot-autoassign-issue-${{ github.repository }}-${{ github.event.issue.number }}
cancel-in-progress: true
jobs:
respond-to-assign-request:
if: github.event.issue.pull_request == null
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow runs on every issue_comment creation and immediately mints a GitHub App token with issues: write. Without restricting by comment.body (e.g., a specific command) and/or comment.author_association (member/collaborator), any external user can trigger privileged bot activity and cause unnecessary runs/spam. Add an if: guard similar to .github/workflows/backport.yml (which checks association and command) so only intended requests execute.

Suggested change
if: github.event.issue.pull_request == null
if: >
github.event.issue.pull_request == null &&
contains(github.event.comment.body, '/assign-me') &&
(
github.event.comment.author_association == 'MEMBER' ||
github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'COLLABORATOR'
)

Copilot uses AI. Check for mistakes.
uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-autoassign.yml@master
with:
bot_command: issue_assignment
secrets:
OPENWISP_BOT_APP_ID: ${{ secrets.OPENWISP_BOT_APP_ID }}
OPENWISP_BOT_PRIVATE_KEY: ${{ secrets.OPENWISP_BOT_PRIVATE_KEY }}
20 changes: 20 additions & 0 deletions .github/workflows/bot-autoassign-pr-issue-link.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
name: PR Issue Auto-Assignment
on:
pull_request_target:
types: [opened, closed]
permissions:
contents: read
issues: write
pull-requests: read
concurrency:
group: bot-autoassign-pr-link-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true
jobs:
auto-assign-issue:
if: github.event.action != 'closed' || github.event.pull_request.merged == false
uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-autoassign.yml@master
with:
bot_command: issue_assignment
secrets:
OPENWISP_BOT_APP_ID: ${{ secrets.OPENWISP_BOT_APP_ID }}
OPENWISP_BOT_PRIVATE_KEY: ${{ secrets.OPENWISP_BOT_PRIVATE_KEY }}
30 changes: 30 additions & 0 deletions .github/workflows/bot-autoassign-pr-reopen.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
name: PR Reopen Reassignment
on:
pull_request_target:
types: [reopened]
issue_comment:
types: [created]
permissions:
contents: read
issues: write
pull-requests: write
concurrency:
group: bot-autoassign-pr-reopen-${{ github.repository }}-${{ github.event.pull_request.number || github.event.issue.number }}
cancel-in-progress: true
jobs:
reassign-on-reopen:
if: github.event_name == 'pull_request_target' && github.event.action == 'reopened'
uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-autoassign.yml@master
with:
bot_command: pr_reopen
secrets:
OPENWISP_BOT_APP_ID: ${{ secrets.OPENWISP_BOT_APP_ID }}
OPENWISP_BOT_PRIVATE_KEY: ${{ secrets.OPENWISP_BOT_PRIVATE_KEY }}
handle-pr-activity:
if: github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.issue.user.login == github.event.comment.user.login
uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-autoassign.yml@master
with:
bot_command: pr_reopen
secrets:
OPENWISP_BOT_APP_ID: ${{ secrets.OPENWISP_BOT_APP_ID }}
OPENWISP_BOT_PRIVATE_KEY: ${{ secrets.OPENWISP_BOT_PRIVATE_KEY }}
20 changes: 20 additions & 0 deletions .github/workflows/bot-autoassign-stale-pr.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
name: Stale PR Management
on:
schedule:
- cron: "0 0 * * *"
workflow_dispatch:
permissions:
contents: read
issues: write
pull-requests: write
concurrency:
group: bot-autoassign-stale-pr-${{ github.repository }}
cancel-in-progress: false
jobs:
manage-stale-prs-python:
uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-autoassign.yml@master
with:
bot_command: stale_pr
secrets:
OPENWISP_BOT_APP_ID: ${{ secrets.OPENWISP_BOT_APP_ID }}
OPENWISP_BOT_PRIVATE_KEY: ${{ secrets.OPENWISP_BOT_PRIVATE_KEY }}
Loading