Skip to content

Add GitHub issue pre-screening#10

Merged
rgerhards merged 1 commit into
mainfrom
feature/github-issue-prescreener
May 18, 2026
Merged

Add GitHub issue pre-screening#10
rgerhards merged 1 commit into
mainfrom
feature/github-issue-prescreener

Conversation

@rgerhards
Copy link
Copy Markdown
Member

Summary

  • add scheduler-level pre-screening API with an accept-all default implementation
  • add Codex-backed pre-screener with fail-closed go/no-go decisions
  • make pre-screen model configurable under [prescreen], inheriting [codex] when omitted and falling back to gpt-5.4-mini/medium
  • have GitHub issue triage pre-screen issues for rsyslog relevance and unsafe cybersecurity probing before enqueueing triage work

Validation

  • .venv/bin/pre-commit run --all-files
  • .venv/bin/ruff check .
  • .venv/bin/bandit -c pyproject.toml -r src
  • git ls-files -z | xargs -0 .venv/bin/detect-secrets-hook --baseline .secrets.baseline
  • .venv/bin/pip-audit -r requirements-dev.txt
  • .venv/bin/actionlint
  • .venv/bin/zizmor --offline .github
  • PYTHONPATH=src python3 -m unittest discover -s tests
  • python3 -m compileall -q src tests
  • .venv/bin/python -m build
  • .venv/bin/python -m pip install --force-reinstall dist/*.whl
  • .venv/bin/codex-bg --help

Comment on lines +69 to +72
context.debug(
f"pre-screen rejected {subject_id}; leaving for human: "
f"{screening.reason}"
)
]
args.extend(["--model", _effective_model(context, self.config)])
args.append("-")
context.debug(f"running Codex pre-screener for {request.subject_id}")
Comment on lines +57 to +60
context.debug(
f"Codex pre-screener failed for {request.subject_id}: "
f"{result.stderr.strip()}"
)
structured = _extract_structured(_read_text(output_file))
allowed = structured.get("allowed")
if not isinstance(allowed, bool):
context.debug(f"Codex pre-screener returned no decision for {request.subject_id}")
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a pre-screening mechanism that allows plugins to gate automation requests through a go/no-go safety check, defaulting to an 'accept all' behavior. It includes a Codex-backed implementation for AI-driven screening, configuration updates to support model and reasoning effort settings, and integration into the GitHub issue triage plugin. Feedback focuses on removing a hardcoded project name in the triage policy to improve reusability and addressing an inconsistency in the dynamic loading logic for pre-screener modules.

"issue": issue,
},
policy=(
"Allow automation only when the GitHub issue is about rsyslog with high "
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The pre-screening policy is hardcoded to the 'rsyslog' project. This makes the plugin non-reusable for other repositories without modifying the source code, which contradicts the generic nature of the plugin and the example configuration provided in scheduler.example.toml. Consider using the repository name dynamically or making the policy string configurable.

Suggested change
"Allow automation only when the GitHub issue is about rsyslog with high "
f"Allow automation only when the GitHub issue is about {repo.repo} with high "

Comment thread src/codex_bg/scheduler.py Outdated
Comment on lines +367 to +370
factory = getattr(module, "create_prescreener", None)
if factory is None:
return module.PreScreener(config, runner)
return factory(config, runner)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The fallback logic for loading a pre-screener assumes a class named PreScreener exists in the module if a factory function is not found. However, the provided implementation in prescreen_codex.py uses CodexPreScreener. This inconsistency might lead to an AttributeError if a user provides a module without a factory function but follows the Protocol. Consider allowing the class name to be configurable or using a more consistent naming convention.

Introduce a scheduler-level pre-screening API with an accept-all default and a Codex-backed implementation. The GitHub issue triage plugin now asks the registered screener for a go/no-go decision before enqueueing triage work, using a policy that rejects likely unrelated or unsafe vulnerability-probing issues while allowing normal hardening and support workflows.

Pre-screening model settings come from [prescreen], inherit [codex] when omitted, and fall back to gpt-5.4-mini with medium reasoning only when neither path configures them. Main task model and reasoning settings remain under [codex].

Validation: .venv/bin/pre-commit run --all-files; .venv/bin/ruff check .; .venv/bin/bandit -c pyproject.toml -r src; git ls-files -z | xargs -0 .venv/bin/detect-secrets-hook --baseline .secrets.baseline; .venv/bin/pip-audit -r requirements-dev.txt; .venv/bin/actionlint; .venv/bin/zizmor --offline .github; PYTHONPATH=src python3 -m unittest discover -s tests; python3 -m compileall -q src tests; .venv/bin/python -m build; .venv/bin/python -m pip install --force-reinstall dist/*.whl; .venv/bin/codex-bg --help
@rgerhards rgerhards force-pushed the feature/github-issue-prescreener branch from 8f37bec to 7cd7912 Compare May 18, 2026 14:22
@rgerhards rgerhards self-assigned this May 18, 2026
@rgerhards rgerhards merged commit 16048c6 into main May 18, 2026
5 checks passed
@rgerhards rgerhards deleted the feature/github-issue-prescreener branch May 18, 2026 14:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant