ci: add label-gated issue investigation via Claude - #1316
Merged
Conversation
Adds .github/workflows/claude-issue-investigate.yml: when a maintainer adds the 'investigate' label to an issue, has Claude read it, attempt a real reproduction using the repo's own tooling, and write a diagnosis to investigation-report.md, uploaded as a job artifact. Gated on issues: labeled (checking for the 'investigate' label) rather than issues: opened, since this is a public repo and anyone can open an issue - a maintainer triages first, so no budget gets spent on spam/junk issues. Read-only permissions throughout (contents: read, issues: read) plus id-token: write for the existing Artifactory OIDC step yarn install depends on - Claude has no path to commit, push, open a PR, or write to the issue even if it tried, regardless of what's in the issue body. Issue title/body are never spliced into our own shell script; only the numeric issue number is, and Claude fetches the actual content itself via `gh issue view`. No turn/budget cap for now, by request - it runs until it reproduces the issue or concludes it needs more information. Also creates the 'investigate' label on the repo so it's actually assignable (didn't exist before this). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Elevates permissions from read-only to contents: write and pull-requests: write, since Claude may now branch, commit, push, and open a PR when it both reproduces an issue and is confident the fix is small and clearly correct. Ambiguous or broad fixes still just get noted in the report, no PR. The investigate label remains the trust gate: a maintainer decides an issue is worth Claude's time (and now write access) before this runs at all, same reasoning as before, just now justifying the wider permission set. Any PR still needs human review to merge - branch protection on master isn't bypassed by this workflow. No cap on reproduction effort, per earlier direction - runs until it reproduces or concludes it needs more information. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
abueide
enabled auto-merge (squash)
August 28, 2026 16:17
abueide
disabled auto-merge
August 28, 2026 16:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/workflows/claude-issue-investigate.yml: when a maintainer adds theinvestigatelabel to an issue, Claude reads it, attempts a real reproduction using the repo's own tooling (installs deps, writes and runs a small repro script/test), and writes a diagnosis toinvestigation-report.md, uploaded as a job artifact.Update: if Claude reproduces the issue and is confident the fix is small, narrow, and clearly correct, it now branches (
fix/issue-<number>), commits, pushes, and opens a PR against master withgh pr create(including "Fixes #"). If the right fix is unclear, needs broader changes, or it isn't confident, it still just notes that in the report — no PR. It never comments on the issue itself either way.Why label-gated, not
issues: opened: this is a public repo and anyone can open an issue. Triggering on every new issue with no gate would let any user (including spam) kick off a real, paid Claude session — now with write access, that gate matters even more. A maintainer adding theinvestigatelabel puts a human trust decision in front of both the spend and the write access.Permissions:
contents: writeandpull-requests: write(needed for the fix-PR path),issues: read, andid-token: writefor the existing./.github/actions/artifactory-oidcstepyarn installdepends on. Any PR Claude opens still needs human review to merge — master's branch protection isn't bypassed here, so a bad or injected fix can't land without someone approving it.Issue title/body are never spliced into the shell script that builds the prompt — only the numeric issue number is (not attacker-influenceable). Claude fetches the actual issue content itself via
gh issue viewas a tool call, so untrusted text never touches our own bash.No turn/budget cap — runs until it either reproduces the issue or concludes it needs more information.
Also creates the
investigatelabel on the repo (didn't exist before), so there's actually something to apply.🤖 Generated with Claude Code