Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 83 additions & 0 deletions .github/workflows/assign.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,83 @@
name: Issue Commands

on:
issue_comment:
types: [created]

jobs:
issue_commands:
Copy link

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow doesn't declare explicit permissions. On many repos the default GITHUB_TOKEN permissions are read-only, which will cause addAssignees/removeAssignees/createComment to fail. Please add least-privilege permissions (e.g., permissions: issues: write and contents: read if needed) at the workflow or job level so this feature reliably works and limits token scope.

Suggested change
issue_commands:
issue_commands:
permissions:
issues: write

Copilot uses AI. Check for mistakes.
runs-on: ubuntu-latest
if: github.event.issue.pull_request == null && (startsWith(github.event.comment.body, '/assign') || startsWith(github.event.comment.body, '/unassign'))
steps:
- name: Handle Issue Commands
uses: actions/github-script@v6
Copy link

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For supply-chain safety, consider pinning actions/github-script to a full-length commit SHA (or at least a major+minor) rather than @v6. This reduces the risk of unexpected behavior changes from upstream updates.

Suggested change
uses: actions/github-script@v6
uses: actions/github-script@v6.4.1

Copilot uses AI. Check for mistakes.
with:
script: |
const commenter = context.payload.comment.user.login;
const issueNumber = context.payload.issue.number;
const body = context.payload.comment.body.trim();

if (body === '/assign') {
try {
Comment on lines +10 to +21
Copy link

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The job-level if: runs when the comment starts with /assign or /unassign, but the script only handles exact matches (body === '/assign' / '/unassign'). Comments like /assign please or /assign\n... will trigger the workflow but then do nothing (no feedback). Consider parsing the first token/line in the script (or tightening the job condition) so the trigger condition and command handling are consistent.

Copilot uses AI. Check for mistakes.
// Check if already assigned
const { data: issue } = await github.rest.issues.get({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber
});

if (issue.assignees.some(assignee => assignee.login === commenter)) {
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
body: `@${commenter}, you are already assigned to this issue!`
});
return;
}

await github.rest.issues.addAssignees({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
assignees: [commenter]
});

await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
body: `Sure thing, @${commenter}! You've been assigned to this issue. Happy coding! 🚀`
});

console.log(`Successfully assigned ${commenter} to issue #${issueNumber}`);
} catch (error) {
console.error(`Failed to assign ${commenter}: ${error.message}`);
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
body: `Oops, @${commenter}! I couldn't assign you to this issue. You might need to be a collaborator or have the necessary permissions.`
});
}
} else if (body === '/unassign') {
try {
await github.rest.issues.removeAssignees({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
assignees: [commenter]
});

await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
body: `@${commenter}, you have been unassigned from this issue.`
});

console.log(`Successfully unassigned ${commenter} from issue #${issueNumber}`);
} catch (error) {
console.error(`Failed to unassign ${commenter}: ${error.message}`);
Copy link

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/unassign error handling only logs to the Actions output. If removeAssignees fails (e.g., commenter isn't assigned, lacks permission, or assignment is disabled for outside collaborators), the user gets no feedback. Consider posting an explanatory comment in the catch (similar to the /assign path) so the command isn't silently ignored.

Suggested change
console.error(`Failed to unassign ${commenter}: ${error.message}`);
console.error(`Failed to unassign ${commenter}: ${error.message}`);
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issueNumber,
body: `Oops, @${commenter}! I couldn't unassign you from this issue. You might not currently be assigned, or you may not have the necessary permissions.`
});

Copilot uses AI. Check for mistakes.
}
}
Loading