[westey (westey-m)]

Motivation & Context

Make issue triage easier to maintain and test without relying on the private dashboard scripts or credentials for live model services.

Description & Review Guide

Major changes

• Add the prompt-based gaw-issue-triage workflow, with trusted issue validation and developer-team checks before the agent runs. Manual runs bypass the team check but still respect maintainer stop labels.
• Keep reproduction local to Python/.NET tests or direct documentation checks. Limit issue updates to the selected issue and approved labels, owners, issue type, and Priority.
• Add public package ownership rules and issue-specific evidence bundles. Later runs download the latest eligible bundle, preserve reviewed historical files with their original source, and keep reproduction JSON in artifacts rather than posted comments.
• Add operating guidance, focused tests, and CI coverage for the workflow and its pinned publishing tools.

Impact

The new workflow is manual-only, with preview enabled by default. The existing issue-triage.yml workflow is unchanged. The new workflow does not fix product code, create pull requests, or receive application model-service credentials.

Review focus

Please pay particular attention to the team/manual-run rules, package ownership and allowed assignees, limits on issue updates, and artifact selection and retention. Downloaded evidence must remain separate from observations made in the current run.

Validation

• 81 focused Node tests passed with no skips, including tests against the exact pinned comment/artifact publisher, preparation and team checks, prior-artifact selection, and the existing issue-planning workflow.
• Strict compilation, workflow validation, compiler-integrated actionlint, and shellcheck passed.
• Live hosted workflow behavior, SDK execution in the hosted sandbox, native issue-field access, and multi-run artifact downloads still need deployment testing. Full SDK builds and full repository test suites were not run.

Related Issue

No linked issue provided. This adds repository automation; it is not a generated scheduled-maintenance PR.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with the design, workflow and helper implementation, tests, documentation, and this PR description. The contributor confirmed their review and responsibility before submission.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change.

The broad build/test items remain unchecked because validation was limited to the focused automation checks listed above. The issue-link item remains unchecked because no agreed issue was supplied.

[Copilot]

🟡 Changes recommended

The pinned publisher permits an empty issue type despite the Feature-only allowlist, allowing existing types to be cleared when preview is disabled; trusted validation and a pinned-publisher regression test are needed.

1 open issue

• Reject empty issue types in the pinned publisher · New

What changed in this PR

Adds a manual, preview-by-default issue-triage workflow alongside the unchanged legacy workflow, with local reproduction, package-owner routing, and reusable evidence artifacts.

Changes:

• Adds issue validation, bounded publishing, and Python/.NET investigation guidance.
• Defines ownership routes and preserves reviewed historical evidence separately from current results.
• Adds operating documentation, focused tests, and CI coverage against the pinned publisher.

File	Description
.github/​workflows/​github-automation-tests.yml	Extends CI triggers and configures pinned-publisher tests.
.github/​workflows/​gaw-issue-triage.md	Defines triage behavior, permissions, and output limits.
.github/​workflows/​gaw-issue-triage.lock.yml	Adds the compiled Actions workflow.
.github/​tests/​gaw-issue-triage-workflow.test.js	Checks workflow restrictions and ownership coverage.
.github/​tests/​gaw-issue-triage-publisher.test.js	Tests comment publishing and evidence uploads.
.github/​tests/​gaw-issue-triage-prepare.test.js	Tests issue validation, team checks, and stop labels.
.github/​tests/​gaw-issue-triage-artifacts.test.js	Tests prior-bundle selection and rejection rules.
.github/​scripts/​gaw-issue-triage-prepare.js	Validates the selected issue and determines eligibility.
.github/​scripts/​gaw-issue-triage-artifacts.js	Selects the latest eligible issue-specific bundle.
.github/​gaw-issue-triage.md	Documents operation, limits, and deployment checks.
.github/​gaw-issue-triage-owners.yaml	Maps package paths to owners and labels.
.github/​aw/​actions-lock.json	Pins the new workflow runtime setup action.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 5ab2c97d0724
Model: gpt-5.6-sol

Overview

The PR introduces a manual, preview-first triage workflow with validated issue targeting, read-only agent permissions, issue-scoped allowlisted publishing, and strong prior-artifact provenance checks. Focused tests cover admission rules, publisher bounds, artifact selection, and source/generated workflow parity. Residual risk remains because stop labels are not rechecked before publication, valid source bundles can exceed the retrieval archive-size assumption, and the generated staging transfer uploads agent-controlled data before the configured size limit is enforced.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (3 medium) across 3 files. Details are attached to the affected lines below.

Affected areas: .github/scripts/gaw-issue-triage-artifacts.js, .github/scripts/gaw-issue-triage-prepare.js, .github/workflows/gaw-issue-triage.lock.yml