feat(ci): add permission-based trigger gate to issue-auto-implement GitHub Action#242
Merged
Conversation
- Add workflow issue-auto-implement.yml (label, comment, PR review triggers) - Add composite action: team check, labels, assess script, implement placeholder, verify loop, create PR - Add assess script (TypeScript/tsx, Claude, fixtures) with vitest tests - Add workflow issue-auto-implement-test.yml to run assess tests on PR - Add README (usage, inputs, testing) and AGENTS.md (flows, verification, next steps) - Use AUTO_IMPLEMENT_* prefix for secrets/vars; require github_allowed_trigger_team Made-with: Cursor
- Add CONTEXT_FILES and GITHUB_WORKSPACE to assess step env - Load repo files (AGENTS.md, REFERENCE.md, etc.) and append to assessment prompt - Skip missing files; REPO_ROOT from GITHUB_WORKSPACE or cwd for local runs Made-with: Cursor
- For issues and issue_comment events, call GitHub API for issue comments - Include all comments in Claude prompt (author, date, body) - Fall back to payload comment/comments when API not used Made-with: Cursor
- Set GITHUB_WORKSPACE in job env so assess script has repo root in CI - Use working-directory instead of cd for install/test step - Add npm cache keyed by assess package-lock.json Made-with: Cursor
In CI the runner sets GITHUB_EVENT_PATH, so the script was invoking main() on import; loadPayload() then threw and process.exit(1) caused Vitest to fail with an unhandled error. Only run main() when GITHUB_EVENT_PATH is set and VITEST is not (i.e. when invoked as script, not by tests). Made-with: Cursor
- Add assess/implement.ts: fetch issue, call Claude for edits JSON, apply files, write commit message - Action: run implement script with env; commit and push using generated commit message - Add .gitignore for .commit_msg; document implement script in AGENTS.md Made-with: Cursor
- Implement script accepts PREVIOUS_VERIFY_OUTPUT and adds it to Claude prompt on retry - Single step loops: implement → commit/push → verify; on verify failure retry with output - Create PR uses implement_verify_loop.outcome; document loop in AGENTS.md Made-with: Cursor
- Main code: assess/src/ (index.ts, implement.ts, normalize.ts) - Tests: assess/test/ (index.test.ts, normalize.test.ts) - Fixtures stay at assess/fixtures/ - Update package.json scripts and action.yml to use src/ - Add .env.example, setup-local-env.sh, .gitignore .env; update README/AGENTS paths Made-with: Cursor
…integration, fixtures) - test/unit/ — unit tests (npm test), no API - test/integration/ — Claude API tests (npm run test:integration), not in CI - test/fixtures/ — shared event JSONs for both and assess:fixture script - Remove top-level fixtures/ and test-integration/; update vitest configs and paths Made-with: Cursor
Made-with: Cursor
- Implement runs only Claude Code CLI (no API path); pass AUTO_IMPLEMENT_ANTHROPIC_API_KEY to CLI - Assess uses only AUTO_IMPLEMENT_ANTHROPIC_API_KEY - Action installs Claude Code CLI in CI when assess outcome is implement - README: add CI/CD checklist; docs for implement and env - AGENTS.md: implement flow and backlog updated Made-with: Cursor
…h-and-open-pr - push-and-open-pr.ts: check gh pr view --json state; only skip create when OPEN - run-local-assess.ts: worktree flow, calls pushAndOpenPr, default context - load-dotenv.ts: used by run-local-assess - scripts/push-and-open-pr.sh: optional standalone script Made-with: Cursor
…ssess:local - README: add How to use (workflow, secrets, trigger label, trigger) - Remove TEST_PLAN.md references from README and AGENTS.md - package.json: add assess:local script Made-with: Cursor
- Add issue-auto-implement-setup.yml (workflow_dispatch) to create automation/auto-implement, automation/needs-info, automation/pr-created - README: quick start step 3 mentions running setup workflow - REMOTE_TEST_PLAN: prerequisites reference setup workflow Made-with: Cursor
Made-with: Cursor
Made-with: Cursor
…with default token) - Add optional github_allowed_trigger_min_permission input (triage, push, maintain, admin). When set via repo variable AUTO_IMPLEMENT_ALLOWED_TRIGGER_MIN_PERMISSION, the action checks repo collaborator permission via API; works with default GITHUB_TOKEN (no read:org). - Keep team check (AUTO_IMPLEMENT_ALLOWED_TRIGGER_TEAM) as alternative; token needs read:org. - Exactly one gate required per run; if both variables set, permission check is used. - Update README and AGENTS.md with both options. Made-with: Cursor
…E conflict) Made-with: Cursor
leggetter
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an alternative trigger gate that works with the default
GITHUB_TOKEN(noread:org/ PAT required).Changes
AUTO_IMPLEMENT_ALLOWED_TRIGGER_MIN_PERMISSION(e.g.push,maintain). The action calls the repo collaborator permission API and requires the triggering user to have at least that permission. Works with default token.AUTO_IMPLEMENT_ALLOWED_TRIGGER_TEAM(e.g.org/team). Unchanged; token needsread:org.Why
The team check requires a token with
read:org; the defaultGITHUB_TOKENdoes not have it, so runs failed with HTTP 404 when checking team membership. SettingAUTO_IMPLEMENT_ALLOWED_TRIGGER_MIN_PERMISSION(e.g.push) allows maintainers/admins to trigger using the default token while still gating on repo permission.Made with Cursor