Jan Krivanek d9e4a5e113 PR triage workflows: orchestrator, worker, and evaluate-now label (#716) ...

* PR triage workflows: orchestrator, worker, and evaluate-now label

Implements docs/design/pr-triage-workflows.md:
- pr-triage-batch.yml: hourly orchestrator that classifies open PRs
- pr-triage.yml + pr-triage-act.sh: per-PR worker (state recompute,
  label reconciliation, eval-trigger, ping comments with cool-down)
- evaluation.yml: gate job now also handles pull_request_target [labeled]
  with the evaluate-now label as a second entry point alongside /evaluate

* Add temporary push triggers for testing pr-triage workflows

* test: live-run pr-triage worker once

* test: re-run worker for cool-down check

* fix: age gate uses created_at and applies only before first ping

* Remove temporary test triggers and inline test marker

* Add pr-malicious-scan agent workflow; replace design doc with brief overview

- New: .github/workflows/pr-malicious-scan.agent.md + compiled .lock.yml.
  Static diff scanner for external (non-trusted) PR contributors. Triggers
  on pull_request_target [opened/synchronize/reopened] and workflow_dispatch.
  Surfaces findings as code-scanning alerts plus a single maintainer-ping
  comment per head SHA when high-severity / workflow-tamper / supply-chain
  hits. Never executes PR head code.
- docs/design/pr-triage-workflows.md replaced with a brief overview + diagram.
  The full implementation plan is kept locally as
  docs/design/pr-triage-workflows-plan.md (gitignored).
- pr-triage-batch.yml's existing dispatch-scanner branch now resolves to
  the new scanner; orchestrator unchanged.

* Fix markdownlint MD038 (pipe inside code span) in malicious-scan agent

2026-06-03 20:01:19 +00:00

7.5 KiB

Raw Permalink Blame History

View Raw