You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Medium Risk
Adds CI that runs a third-party model on untrusted issue text and needs ANTHROPIC_API_KEY, though split jobs and tool restrictions reduce write/exfil risk; no runtime library code changes.
Overview
Adds an automated GitHub issue triage path for maintainers: comment /triage on an issue (or run workflow_dispatch with an issue number). Triage does not run on issue open, so random reporters cannot trigger model runs.
New .cursor/skills/triage-issues/ defines a three-stage workflow (preview → local source research → standardized Triage Report with effort, type, module, labels, questions, and suggested tests). references.md captures description sizing, minimal issue fields, module paths, and main/area:* labels. source-map.md maps v1/v2 client and JDBC modules, area:* → directories, entry points, and stacktrace heuristics so triage stays offline and scoped.
.github/workflows/claude-issue-triage.yml checks out the repo, materializes the issue to triage/issue.md, runs Claude Code against the skill with Read/Glob/Grep/Write only (no Bash or web tools), and requires triage/triage-report.md. A separate comment job downloads the artifact and posts or updates a sticky triage comment. The model job uses read-onlyGITHUB_TOKEN (issues: read); only the comment job gets issues: write, limiting prompt-injection impact on issue writes.
Reviewed by Cursor Bugbot for commit f1af93f. Bugbot is set up for automated code reviews on this repo. Configure here.
Repository collaborators can run the JMH benchmark suite against this PR by commenting:
/benchmark
Optional regression threshold override (Δ% on Time or Alloc/op; defaults to 10%):
/benchmark threshold=15
Only one benchmark run per PR is active at a time — issuing a new /benchmark comment cancels the previous run. After the run finishes a separate comment will be posted comparing it against the latest scheduled run on main; the PR check fails if any benchmark regresses by more than the threshold.
Summary
This PR adds an automated GitHub issue triage capability driven by Claude Code. It introduces a three-stage triage skill (SKILL.md, references.md, source-map.md) under .cursor/skills/triage-issues/ and a new GitHub Actions workflow at .github/workflows/claude-issue-triage.yml. The workflow is triggered by a maintainer /triage comment on an issue or via workflow_dispatch; it is explicitly gated to OWNER/MEMBER/COLLABORATOR association so arbitrary reporters cannot trigger model runs. The job architecture is deliberately split: a read-only triage job runs Claude Code (with only Read/Glob/Grep/Write tools and no network access) and uploads a report artifact, while a separate comment job (the only one holding issues: write) posts the report as a sticky comment. No runtime library code is touched.
What this impacts
New GitHub Actions workflow (.github/workflows/) introducing a Claude-Code-driven CI job
New Cursor skill directory (.cursor/skills/triage-issues/) with prompt engineering artifacts
Requires ANTHROPIC_API_KEY secret provisioned in the repository; introduces ongoing API cost
Issue triage process and maintainer workflow
Concerns
Large diff fires the High rule: 508 additions exceed the 400-line threshold — a split into (a) the skill/reference docs and (b) the GitHub workflow would reduce review surface.
New GitHub workflow: the Medium rule for .github/ changes also fires (superseded by the large-diff High rule).
External secret dependency: ANTHROPIC_API_KEY must be present; the workflow silently fails (Claude step errors) if the secret is absent — no guard step validates it before the 15-minute triage job runs.
Comment-ID extraction fragility: ID=${URL##*-} assumes the comment URL ends in #issuecomment-<id>; if gh issue view --json comments ever returns API URLs (which end in /<id> with no -) instead of web URLs, the PATCH will target a wrong or empty ID.
Required reviewer action
At least one human reviewer should approve before merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/triagein issue commentExample issues:
#2846
#2839
#2827 (comment)
Note
Medium Risk
Adds CI that runs a third-party model on untrusted issue text and needs
ANTHROPIC_API_KEY, though split jobs and tool restrictions reduce write/exfil risk; no runtime library code changes.Overview
Adds an automated GitHub issue triage path for maintainers: comment
/triageon an issue (or runworkflow_dispatchwith an issue number). Triage does not run on issue open, so random reporters cannot trigger model runs.New
.cursor/skills/triage-issues/defines a three-stage workflow (preview → local source research → standardized Triage Report with effort, type, module, labels, questions, and suggested tests).references.mdcaptures description sizing, minimal issue fields, module paths, and main/area:*labels.source-map.mdmaps v1/v2 client and JDBC modules,area:*→ directories, entry points, and stacktrace heuristics so triage stays offline and scoped..github/workflows/claude-issue-triage.ymlchecks out the repo, materializes the issue totriage/issue.md, runs Claude Code against the skill with Read/Glob/Grep/Write only (no Bash or web tools), and requirestriage/triage-report.md. A separatecommentjob downloads the artifact and posts or updates a sticky triage comment. The model job uses read-onlyGITHUB_TOKEN(issues: read); only the comment job getsissues: write, limiting prompt-injection impact on issue writes.Reviewed by Cursor Bugbot for commit f1af93f. Bugbot is set up for automated code reviews on this repo. Configure here.