chore(automation): ensure status/need-triage is applied and never cleared automatically#16657
chore(automation): ensure status/need-triage is applied and never cleared automatically#16657
Conversation
Summary of ChangesHello @bdmorgan, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the issue triage workflow by ensuring that all issues consistently receive and retain the Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new workflow and a backfill script to ensure all issues are labeled with status/need-triage. However, a critical command injection vulnerability has been identified in the .github/scripts/backfill-need-triage.cjs script. This vulnerability arises from insecurely constructing shell commands with unvalidated data from an API, posing a risk of Remote Code Execution in the CI environment. A safer method for executing child processes is recommended. Additionally, the backfill script has potential issues related to a hardcoded limit of 1000 issues and insufficient error handling within the issue labeling loop, which could lead to an incomplete backfill process being reported as successful.
gemini-cli
bot
added
the
status/need-issue
|
Size Change: -2 B (0%) Total Size: 23.1 MB ℹ️ View Unchanged
|
…ared automatically
…n backfill script
bdmorgan
force-pushed
the
chore/status-need-triage-automation
branch
from
d374416 to
f7f8d7d
Compare
The previous change incorrectly escaped quotes inside single-quoted strings. In bash single quotes, backslash escapes are not processed, so `\"null\"` is passed literally to jq, causing a syntax error: "unexpected INVALID_CHARACTER (Unix shell quoting issues?)" Fix by using jq's native `null` value with `tostring` instead of trying to embed a quoted string literal. Fixes the audit-prs workflow failure introduced in google-gemini#16657.
The previous change incorrectly escaped quotes inside single-quoted strings. In bash single quotes, backslash escapes are not processed, so `\"null\"` is passed literally to jq, causing a syntax error: "unexpected INVALID_CHARACTER (Unix shell quoting issues?)" Fix by using jq's native `null` value with `tostring` instead of trying to embed a quoted string literal. Fixes the audit-prs workflow failure introduced in google-gemini#16657.
…ared automatically (google-gemini#16657)
…-triage is applied and never cleared automatically (google-gemini#16657)
2 participants
Summary
This PR establishes a robust issue triage flow where all issues are labeled with
status/need-triageand remain that way until a manual maintainer review.Details
.github/workflows/issue-opened-labeler.ymlto applystatus/need-triageto every new issue..github/scripts/backfill-need-triage.cjsto apply the label to all existing open issues (excluding those with🔒 maintainer only).gemini-automated-issue-triage.ymlandgemini-scheduled-issue-triage.yml. Triage bots will now only classify issues, not remove their triage status.Related Issues
N/A