Add GitHub issue pre-screening#10
Conversation
| context.debug( | ||
| f"pre-screen rejected {subject_id}; leaving for human: " | ||
| f"{screening.reason}" | ||
| ) |
| ] | ||
| args.extend(["--model", _effective_model(context, self.config)]) | ||
| args.append("-") | ||
| context.debug(f"running Codex pre-screener for {request.subject_id}") |
| context.debug( | ||
| f"Codex pre-screener failed for {request.subject_id}: " | ||
| f"{result.stderr.strip()}" | ||
| ) |
| structured = _extract_structured(_read_text(output_file)) | ||
| allowed = structured.get("allowed") | ||
| if not isinstance(allowed, bool): | ||
| context.debug(f"Codex pre-screener returned no decision for {request.subject_id}") |
There was a problem hiding this comment.
Code Review
This pull request introduces a pre-screening mechanism that allows plugins to gate automation requests through a go/no-go safety check, defaulting to an 'accept all' behavior. It includes a Codex-backed implementation for AI-driven screening, configuration updates to support model and reasoning effort settings, and integration into the GitHub issue triage plugin. Feedback focuses on removing a hardcoded project name in the triage policy to improve reusability and addressing an inconsistency in the dynamic loading logic for pre-screener modules.
| "issue": issue, | ||
| }, | ||
| policy=( | ||
| "Allow automation only when the GitHub issue is about rsyslog with high " |
There was a problem hiding this comment.
The pre-screening policy is hardcoded to the 'rsyslog' project. This makes the plugin non-reusable for other repositories without modifying the source code, which contradicts the generic nature of the plugin and the example configuration provided in scheduler.example.toml. Consider using the repository name dynamically or making the policy string configurable.
| "Allow automation only when the GitHub issue is about rsyslog with high " | |
| f"Allow automation only when the GitHub issue is about {repo.repo} with high " |
| factory = getattr(module, "create_prescreener", None) | ||
| if factory is None: | ||
| return module.PreScreener(config, runner) | ||
| return factory(config, runner) |
There was a problem hiding this comment.
The fallback logic for loading a pre-screener assumes a class named PreScreener exists in the module if a factory function is not found. However, the provided implementation in prescreen_codex.py uses CodexPreScreener. This inconsistency might lead to an AttributeError if a user provides a module without a factory function but follows the Protocol. Consider allowing the class name to be configurable or using a more consistent naming convention.
Introduce a scheduler-level pre-screening API with an accept-all default and a Codex-backed implementation. The GitHub issue triage plugin now asks the registered screener for a go/no-go decision before enqueueing triage work, using a policy that rejects likely unrelated or unsafe vulnerability-probing issues while allowing normal hardening and support workflows. Pre-screening model settings come from [prescreen], inherit [codex] when omitted, and fall back to gpt-5.4-mini with medium reasoning only when neither path configures them. Main task model and reasoning settings remain under [codex]. Validation: .venv/bin/pre-commit run --all-files; .venv/bin/ruff check .; .venv/bin/bandit -c pyproject.toml -r src; git ls-files -z | xargs -0 .venv/bin/detect-secrets-hook --baseline .secrets.baseline; .venv/bin/pip-audit -r requirements-dev.txt; .venv/bin/actionlint; .venv/bin/zizmor --offline .github; PYTHONPATH=src python3 -m unittest discover -s tests; python3 -m compileall -q src tests; .venv/bin/python -m build; .venv/bin/python -m pip install --force-reinstall dist/*.whl; .venv/bin/codex-bg --help
8f37bec to
7cd7912
Compare
Summary
Validation