Repository navigation
Dispatch Cloclo from Issue Monster instead of assigning Copilot - #74158
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
✅ PR Code Quality Reviewer completed the code quality review. Warning threat detection engine error What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details.
|
|
✅ Test Quality Sentinel completed test quality analysis. Warning threat detection engine error What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details. Test Quality SentinelOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
@copilot use a new workflow called "copi" instead of cloclo which acts as a similarly specialized Pr feedback applier, integrity : write or higher, resolve review comments, excludes workflow yml. Uses copilot with copilot-requests:write + model routing |
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. Design Decision Gate 🏗️Outcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Ponytail Reviewer completed successfully! Ponytail ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
🧠 Matt Pocock Skills Reviewer failed during the skills-based review. Warning threat detection engine error What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details.
|
|
Warning threat detection engine error What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details. Comment MemoryPeek at saved memory (pr-code-quality-reviewer)Note This comment is managed by comment memory.Expand the saved memory block to view or edit the persistent context for this thread.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Request changes
The workflow accepts an unvalidated dispatch input and injects it into the Cloclo prompt, allowing arbitrary input to redirect the agent and comment target. Validate and normalize the issue number before use.
Review scope
One actionable issue was found in the changed markdown. The specialist pass completed, but its lock-file review was unavailable; generated lock changes were not independently assessed.
🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~4 AIC · ⊞ 1.7K
Comment /review to run again
| {{#if github.event.inputs.issue_number}} | ||
| ## Dispatched Issue | ||
|
|
||
| Fix issue #${{ github.event.inputs.issue_number }} in ${{ github.repository }}. |
There was a problem hiding this comment.
The dispatched issue_number is interpolated into the agent prompt without validating that it is a numeric issue ID, so a manually supplied or prompt-injected value can steer Cloclo to arbitrary instructions/targets instead of the intended issue.
💡 Validate the dispatch input before using it
Reject or noop when the input does not match ^[0-9]+$, and only then interpolate the normalized value into the prompt and safe-output target. This keeps workflow dispatch data from becoming an uncontrolled prompt and comment destination.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| {{#if github.event.inputs.issue_number}} | ||
| ## Dispatched Issue | ||
|
|
||
| Fix issue #${{ github.event.inputs.issue_number }} in ${{ github.repository }}. | ||
| Fetch the issue body and relevant comments before making changes. If the number | ||
| does not identify an open issue (or identifies a pull request), call `noop` and stop. | ||
| Create a pull request with the fix and include `Fixes #${{ github.event.inputs.issue_number }}` | ||
| in its body. Post the required summary comment on this issue using `add-comment` | ||
| with `item_number` set to the dispatched issue number. |
|
|
||
| safe-outputs: | ||
| assign-to-agent: | ||
| dispatch-workflow: |
|
|
||
| ``` | ||
| safeoutputs/assign_to_agent(issue_number=<issue_number>, agent="copilot") | ||
| safeoutputs/cloclo(issue_number="<issue_number>") |
| {{#if github.event.inputs.issue_number}} | ||
| ## Dispatched Issue | ||
|
|
||
| Fix issue #${{ github.event.inputs.issue_number }} in ${{ github.repository }}. |
There was a problem hiding this comment.
🟡 Changes recommended
An unvalidated issue number can inject broader safe-output permissions, and the token configuration change breaks an existing regression test.
7 open issues
What changed in this PR
Moves Issue Monster’s automated issue resolution from Copilot assignments to Cloclo dispatches within gh-aw’s workflow system.
Changes:
- Dispatch Cloclo for up to three independent issues per run.
- Add issue-specific fix instructions and summary comments while preserving slash and label commands.
- Introduce concurrency and duplicate-work checks, update evaluations, and regenerate both workflow locks.
| File | Description |
|---|---|
.github/workflows/issue-monster.md |
Replaces assignments with dispatches and updates selection checks, prompts, and evaluations. |
.github/workflows/issue-monster.lock.yml |
Regenerates dispatch tools, permissions, concurrency, and evaluation settings. |
.github/workflows/cloclo.md |
Adds the issue input, fix instructions, comment targeting, and dispatch-scoped concurrency. |
.github/workflows/cloclo.lock.yml |
Regenerates input handling, prompt interpolation, comment policy, and concurrency settings. |
Review effort: Max (auto)
| protected-files: fallback-to-issue | ||
| add-comment: | ||
| max: 1 | ||
| target: ${{ inputs.issue_number || 'triggering' }} |
| dispatch-workflow: | ||
| workflows: [cloclo] |
| label_command: | ||
| name: cloclo | ||
| strategy: decentralized | ||
| workflow_dispatch: |
| actions: read | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }}-cloclo | ||
| group: ${{ github.workflow }}-${{ github.ref }}-cloclo-${{ inputs.issue_number || 'command' }} |
| workflow_id: 'cloclo.lock.yml', | ||
| per_page: 100 | ||
| }); | ||
| if (clocloRuns.workflow_runs.some(run => run.status !== 'completed')) { |
| From the prioritized and filtered list (issues WITHOUT Copilot assignments or open PRs): | ||
| - **Select up to three appropriate issues** to assign | ||
| From the prioritized and filtered list (issues WITHOUT assignees or open Copilot/Cloclo PRs): | ||
| - **Select up to three appropriate issues** to dispatch |
| ### 4a. Handle Retry-Blocked Issues | ||
|
|
||
| The pre-activation job lists issues whose topic already has **two or more Copilot PRs closed without merging**. Never assign these to Copilot. | ||
| The pre-activation job lists issues whose topic already has **two or more Copilot PRs closed without merging**. Never dispatch Cloclo for these issues. |
There was a problem hiding this comment.
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Skills-Based Review 🧠
Applied /diagnosing-bugs and /codebase-design. Requesting changes on one regression: retry protection no longer covers the new dispatch path.
📋 Verified findings and checks
Blocking
- Retry block ignores Cloclo failures. The retry pre-flight still searches only
author:app/copilot-swe-agent. Failed Cloclo PRs never reachcopilot-retry-blocked, so the same topic can be re-dispatched without limit. See the inline comment onissue-monster.md.
Question for the author
- Cloclo concurrency key. Dispatched runs now get their own group keyed by
issue_number, and command runs fall back tocommand. This is intentional if slash-command and dispatched runs may overlap. Confirm that and note it in the PR description.
Checked and not an issue
- The
activationgate admitsworkflow_dispatchruns whoseaw_context.event_typeisscheduleorworkflow_dispatch, through the second disjunct. dispatch-workflowonsafe_outputshasactions: write, so the dispatch is permitted.- Removing
ignore-if-erroris correct.dispatch_workflowreturns{success:false}rather than throwing, so a failed dispatch cannot fail the run. - The Issue Monster in-progress guard covers the
listWorkflowRunscase it targets (per_page: 100).
Still open from existing threads
- Validate
issue_numberas numeric before prompt interpolation incloclo.md. - Tie dispatched issue numbers to the pre-activation candidate list in
issue-monster.md.
@copilot please address the retry-block gap; the concurrency question can be answered in the PR description.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · routing failed · ~11 AIC · ⊞ 5.4K
Comment /matt to run again
| const openCopilotPRs = issue.linkedPRs?.filter(pr => | ||
| pr.state === 'OPEN' && | ||
| (pr.author === 'copilot-swe-agent' || pr.author?.includes('copilot')) && | ||
| (pr.author === 'copilot-swe-agent' || pr.author?.includes('copilot') || pr.labels.includes('cloclo')) && |
There was a problem hiding this comment.
[/diagnosing-bugs] The retry block still ignores Cloclo failures. The retry pre-flight at line 291 (unchanged) searches is:pr is:closed is:unmerged author:app/copilot-swe-agent, so a Cloclo PR closed without merging never counts toward copilot-retry-blocked. The same topic can be re-dispatched indefinitely, which is the loop that protection exists to stop.
💡 Suggested fix
Also count Cloclo-labelled closed PRs in the retry pre-flight, for example by adding a second query is:pr is:closed is:unmerged label:cloclo -label:broccoli and merging its results into closedTopicCounts. Make this change in the same PR so both producers feed the retry guard.
@copilot please address this.
| actions: read | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }}-cloclo | ||
| group: ${{ github.workflow }}-${{ github.ref }}-cloclo-${{ inputs.issue_number || 'command' }} |
There was a problem hiding this comment.
[/codebase-design] The concurrency key now includes issue_number, which falls back to a literal command key. Slash and label runs on the same ref therefore no longer share a queue with dispatched runs. Before this change, every /cloclo run on a ref was serialized. Please confirm that a /cloclo run executing alongside an Issue Monster dispatch is acceptable.
💡 Why it matters
Issue Monster already serializes its own batches through its -dispatch group, so the open question is only the command path versus dispatched work. If serialization is still wanted there, keep the command path in one shared group.
@copilot please address this.
Replace Issue Monster’s Copilot assignments with Cloclo workflow dispatches to fix selected issues.