mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-15 02:02:34 -04:00
3fe10ac744
* ci: add Oz cloud triage workflow for new issues Wire Warp's Oz "cloud factory" issue-triage stage onto pnpm/pnpm as a GitHub-triggered cloud agent (part of the pnpm x Warp OSS partnership). - .github/workflows/triage-issues.yml runs on issues:[opened], skips Bot-authored issues, and invokes warpdotdev/oz-agent-action@v1 with the triage skill. Minimal permissions: contents:read, issues:write. - .agents/skills/triage/SKILL.md adapts the canonical triage rubric to pnpm: it maps the four readiness states onto existing pnpm "state:" labels (accepted / needs design / needs steps to repro / blocked / rejected) instead of creating new ones, is aware of the TypeScript/pacquet/pnpr split and the install/add/update/remove parity rule, and is conservative about removing maintainer-applied labels. Triage-only for now; the implementation/auto-PR stage is intentionally not included. Activation also requires the WARP_API_KEY secret and the Oz by Warp GitHub App with the org enabled in Warp's Admin Panel. * ci: address CodeRabbit review on Oz triage PR - Pin actions to commit SHAs (actions/checkout to the repo's v7.0.0 pin, warpdotdev/oz-agent-action to the v1 tag commit) with version comments, matching the repo convention and satisfying zizmor. - Harden the triage skill against prompt injection: treat all fetched issue content (title, body, comments, attachments, linked docs) as untrusted data, never as instructions, and forbid actions beyond the defined read/label/comment steps. - Make the non-bug "Needs info" path consistent across the decision rule, the label-application step, and the result template: apply no state label and post clarifying questions instead of forcing an ill-fitting label.