* Add github-triage plugin
Triages open GitHub issues for the current repository via the gh CLI:
closes already-resolved issues with comments citing the resolving PR or
commit, cross-links issues with pending fix PRs, and assigns local-only
priority and change-size (size/XS–XXL) estimates for everything else.
All GitHub writes are gated behind a single review-and-iterate approval;
priority/effort are never posted. Registers the plugin in the marketplace,
README, and CODEOWNERS.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add optional PR triage to github-triage skill
Before issue triage, optionally clear open PRs (so merges feed the
"already resolved" issue check):
- incrementally merge allowlisted bot PRs and maintainer-approved PRs,
one at a time, re-verifying mergeability/CI before each and confirming
each landed;
- spawn one read-only review subagent per never-reviewed PR, saving each
review to github-pr-<number>-review.md locally (never posted).
PR readiness uses verified gh --json semantics: mergeStateStatus==CLEAN
(MERGEABLE alone is insufficient; UNKNOWN is never-merge), per-node
statusCheckRollup (CheckRun status+conclusion vs StatusContext state),
author.is_bot + trusted allowlist, and latestReviews state+authorAssociation
rather than the branch-protection-driven reviewDecision. All merges gated;
never --auto/--admin/force.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Fix github-triage bugs found in end-to-end dry run
Validated the skill against trailofbits/graphtage (real issues + PRs),
which surfaced four bugs:
- gh repo view takes the repo positionally, not -R; fixed the
default-branch and merge-method lookups.
- CI readiness treated NEUTRAL/SKIPPED checks as failures, wrongly
blocking mergeable Dependabot PRs (CLEAN with a NEUTRAL CodeQL run).
Reworked to "CI not blocking" (hard failures + pending only), with
mergeStateStatus==CLEAN as the authority.
- Not-ready bot PRs were routed to the review-subagent bucket; bots are
now excluded so they fall to Needs work.
- Bot allowlist now normalizes gh's author.login renderings
(app/dependabot and dependabot[bot]) so bot detection actually matches.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>
Evan Sultanik