feat: add gateway issue dispatcher workflow#2603
Conversation
Audits open 'gateway'-labeled issues in github/gh-aw every 6 hours, creates tracking issues in github/gh-aw-mcpg with problem analysis and proposed solutions, then links the two via a comment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a new scheduled agentic workflow that periodically audits gateway-labeled issues in github/gh-aw and creates linked tracking issues in github/gh-aw-mcpg via safe-outputs.
Changes:
- Introduces a new workflow prompt (
.md) describing the audit/filter/create/link procedure and safe-output constraints. - Adds the compiled/locked GitHub Actions workflow (
.lock.yml) to run on a 6-hour scattered schedule with MCP + safe-outputs wiring.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/gateway-issue-dispatcher.md | Defines the agent procedure, tool access, and safe-output limits for cross-repo issue triage + tracking issue creation. |
| .github/workflows/gateway-issue-dispatcher.lock.yml | Generated locked workflow implementing the scheduled Copilot/AWF run with MCP gateway and safe-outputs execution. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ```bash | ||
| gh issue list --repo github/gh-aw --label gateway --state open --json number,title,body,url,labels,createdAt --limit 100 | ||
| ``` | ||
|
|
||
| If there are no open gateway issues, report "No open gateway issues found" and | ||
| stop. | ||
|
|
||
| ### Step 2: Filter Already-Processed Issues | ||
|
|
||
| For each gateway issue, check its comments for an existing link to a | ||
| `github/gh-aw-mcpg` issue. An issue is already processed if any comment | ||
| contains a URL matching `github.com/github/gh-aw-mcpg/issues/`. | ||
|
|
||
| ```bash | ||
| # For each issue number, check comments | ||
| gh issue view <NUMBER> --repo github/gh-aw --json comments --jq '.comments[].body' \ | ||
| | grep -q 'github.com/github/gh-aw-mcpg/issues/' && echo "SKIP" || echo "PROCESS" | ||
| ``` |
There was a problem hiding this comment.
The prompt relies on gh issue list/view commands, but this workflow doesn’t set GH_TOKEN (or otherwise ensure gh is authenticated) in the agent runtime. This can cause the dispatcher to fail at Step 1/2. Prefer using the configured GitHub MCP issues tools for listing issues and reading comments, or add an explicit mechanism to authenticate gh with the intended cross-repo token in the agent environment.
| safe-outputs: | ||
| github-token: ${{ secrets.CROSS_REPO_PAT }} | ||
| max-bot-mentions: 1 | ||
| create-issue: | ||
| max: 10 | ||
| target-repo: "github/gh-aw-mcpg" | ||
| labels: [gateway, from-gh-aw] | ||
| add-comment: | ||
| max: 10 | ||
| target: "*" | ||
| target-repo: "github/gh-aw" |
There was a problem hiding this comment.
safe-outputs limits both create-issue and add-comment to max: 10, but the procedure says to process each unprocessed gateway issue (and Step 1 fetches up to 100). If there are >10 unprocessed issues, the run will be unable to complete as described. Either cap processing to the 10 oldest unprocessed issues in the instructions, or raise the safe-output limits accordingly.
| github-token: ${{ secrets.CROSS_REPO_PAT }} | ||
| allowed-repos: ["github/gh-aw", "github/gh-aw-mcpg"] | ||
| min-integrity: none | ||
| bash: true | ||
|
|
||
| safe-outputs: | ||
| github-token: ${{ secrets.CROSS_REPO_PAT }} |
There was a problem hiding this comment.
The same CROSS_REPO_PAT secret is used for both read-only GitHub MCP access and for write operations via safe-outputs. Even though the MCP server is configured as read-only, using a write-scoped PAT here increases blast radius if any enforcement is bypassed. Consider splitting this into separate secrets (read-only for MCP queries, write-only for safe-outputs) with least-privilege scopes.
| github-token: ${{ secrets.CROSS_REPO_PAT }} | |
| allowed-repos: ["github/gh-aw", "github/gh-aw-mcpg"] | |
| min-integrity: none | |
| bash: true | |
| safe-outputs: | |
| github-token: ${{ secrets.CROSS_REPO_PAT }} | |
| github-token: ${{ secrets.CROSS_REPO_PAT_READ }} | |
| allowed-repos: ["github/gh-aw", "github/gh-aw-mcpg"] | |
| min-integrity: none | |
| bash: true | |
| safe-outputs: | |
| github-token: ${{ secrets.CROSS_REPO_PAT_WRITE }} |
Adds an agentic workflow that runs every 6 hours to audit open
gateway-labeled issues ingithub/gh-awand create corresponding tracking issues ingithub/gh-aw-mcpgwith problem analysis and proposed solutions.What it does
github/gh-awwith thegatewaylabelgh-aw-mcpgtracking issue (detected via comment URL)gh-aw-mcpgwith problem description, analysis, proposed solution, and testing guidancegh-awissue with a link to the new tracking issueConfiguration
CROSS_REPO_PATsecret for read/write across both reposmin-integrity: none,allowed-repos: [github/gh-aw, github/gh-aw-mcpg]create-issue→github/gh-aw-mcpg,add-comment→github/gh-awPrerequisites
Add a
CROSS_REPO_PATrepository secret withissues:write+repo:readaccess to bothgithub/gh-awandgithub/gh-aw-mcpg.