Fix typo - #639
Merged
Merged
Conversation
yao-msft
approved these changes
Nov 10, 2020
8 tasks
denelon
added a commit
that referenced
this pull request
Jul 29, 2026
…6400) ## 📖 Description Replaces `automatic-issue-deduplication.yml` (which used `pelikhan/action-genai-issue-dedup@v0` with `label_as_duplicate: false`, so it produced **no visible signal** — no label, no comment) with a **GitHub Agentic Workflow** (`gh aw`) that **surfaces likely duplicates for maintainer review**. On every newly opened issue, a Copilot-engine agent reads the issue and searches existing issues (open and closed) **by meaning, not keyword overlap**, then — only when confident — applies a new `Possible-Duplicate` label and posts a single comment listing up to five candidate duplicates with links and one-line rationale. The workflow **detects but never resolves**: it never closes the issue, never removes `Needs-Triage`, and never emits the `Duplicate of #NNN` moderator trigger. Choosing the canonical issue (earliest / curated preferred) and closing stays a maintainer decision. **Why replace the current action** - The current action runs with `label_as_duplicate: false` — no label, no comment, so duplicates are still found manually. - Lexical matching misses semantic duplicates that share little vocabulary. Example: #1458 ("show manifest verbatim") and #159 ("Verbose show command") are the same request but read very differently. - An agentic workflow reasons over meaning/synonyms, and its actions are constrained by a `safe-outputs` allowlist (one comment + one label — no close, no assign, no code execution). **Changed files** - Add `.github/workflows/duplicate-surfacing.md` (agentic spec) - Add `.github/workflows/duplicate-surfacing.lock.yml` (compiled via `gh aw compile`; generated — do not hand-edit) - Add `.github/aw/actions-lock.json` (pinned action versions for the framework) - Update `.gitattributes` (marks `*.lock.yml` as generated / `merge=ours`) - Remove `.github/workflows/automatic-issue-deduplication.yml` - Update `.github/actions/spelling/allow.txt` (add `toolsets` and `msftbot`) **New label required:** `Possible-Duplicate` (advisory), distinct from the authoritative `Resolution-Duplicate` (applied on human confirmation via the trigger). See the linked issue for the label plan. **Enablement prerequisites (org/repo):** agentic workflows enabled + the Copilot engine and its secrets (`COPILOT_GITHUB_TOKEN`, `GH_AW_GITHUB_TOKEN`, `GH_AW_GITHUB_MCP_SERVER_TOKEN`). Same framework microsoft/mxc adopted (#639/#646). **Safety posture:** `safe-outputs` restricts the agent to `add-labels: [Possible-Duplicate]` (max 1) and `add-comment` (max 1); MCP GitHub access is repo-scoped; workflow token is `issues: read`; issue content is treated as untrusted (prompt-injection defenses); trigger is `opened` only to bound comment volume; egress is firewalled to a pinned domain allowlist. _Authored with GitHub Copilot assistance._ ## 🔗 References - Resolves #6399 - Prior art: microsoft/mxc agentic issue-triage (#639, #646) ## 🔍 Validation - `gh aw compile duplicate-surfacing` → 0 errors, 0 warnings; lock file regenerated deterministically. - **Live trial passed** via `gh aw trial` (simulated issue #1458 against microsoft/winget-cli): the agent applied `Possible-Duplicate` (HIGH confidence) and surfaced #159 as the duplicate — the exact semantic match lexical/TF-IDF scoring misses (~0.15). No close, no `Duplicate of` trigger, correct comment format. Trial repo was private and deleted after. ## 🚀 Rollout & enablement - **Scope (intentionally narrow):** this is a contained first step — dedup only, `safe-outputs` limited to one comment + the `Possible-Duplicate` label, **no code changes, no PRs**. Chosen deliberately for a public, first-party repo to build trust before considering broader automation. - **Engine auth — no custom secret required:** the Copilot engine runs on the built-in `GITHUB_TOKEN` together with the `copilot-requests: write` job permission. A dedicated `COPILOT_GITHUB_TOKEN` secret is *not* configured or needed (same setup microsoft/mxc uses, #639/#646). Copilot is already available to Actions in the `microsoft` org. - **Workflow permissions:** the repo default `GITHUB_TOKEN` is read-only; this workflow's `safe-outputs` jobs request `issues: write` + `pull-requests: write` explicitly, which overrides the default — no repo-wide setting change was needed. - **Actions allow-list:** the repo restricts actions to a selected allow-list; `github/gh-aw-actions/*@*` was added so the gh-aw setup action is permitted. GitHub-owned `actions/*` were already allowed; the gh-aw container images (`ghcr.io/github/gh-aw-*`) are pulled at runtime and are not gated by the actions allow-list. - **Not adopting Repo Assist here:** githubnext's broader Repo Assist workflow (which opens PRs and edits code) is a separate, governed decision — out of scope for this PR. - **Public-repo note:** do **not** set `GH_AW_CI_TRIGGER_TOKEN` on this repo (abuse risk per gh aw docs). ## ✅ Checklist - [ ] Signed the [Contributor License Agreement](https://cla.opensource.microsoft.com) - [x] Linked to an issue - [ ] Updated [Release Notes](../doc/ReleaseNotes.md) (if applicable) - [x] Updated documentation (if applicable) — workflow spec is self-documenting; N/A elsewhere - [x] Updated [Copilot instructions](.github/copilot-instructions.md) (if build, architecture, or conventions changed) — N/A, no convention change ## 📋 Issue Type - [ ] Bug fix - [x] Feature - [ ] Task --------- Co-authored-by: Demitrius Nelon <denelon@outlook.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3701d64a-96ba-42f1-be59-b4e7d2a2820a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Minor typo fix.
Microsoft Reviewers: Open in CodeFlow