Add GitHub Actions workflow for auto-answering issues by trwalke · Pull Request #5836 · AzureAD/microsoft-authentication-library-for-dotnet

trwalke · 2026-03-11T18:04:32Z

This pull request introduces a new GitHub Actions workflow to automatically respond to issues opened or labeled by trusted contributors. The workflow leverages Azure OpenAI to generate a friendly, informative reply and posts it as a comment on the issue. The automation is restricted to members, owners, collaborators, and contributors to prevent misuse.

Automated issue triage and response:

Added .github/workflows/auto-answer-issues.yml to enable automatic responses to issues using Azure OpenAI, triggered when issues are opened or labeled by trusted contributors.
Implemented environment variable checks and error handling to ensure required secrets and context are available before generating a response.
Integrated the @octokit/rest and openai Node.js packages to interact with GitHub and Azure OpenAI APIs for generating and posting replies.

Security and access control:

Restricted workflow execution to issues created by members, owners, collaborators, or contributors, preventing untrusted users from consuming API tokens.

Copilot

Pull request overview

Adds a new GitHub Actions workflow intended to automatically generate and post responses to newly opened/labeled GitHub issues by running a Node.js script (with OpenAI + Octokit dependencies).

Changes:

Introduces .github/workflows/main.yml to trigger on issues events (opened, labeled).
Sets up Node.js 20, installs @octokit/rest and openai, then executes a repo script to generate/post a response.

.github/workflows/auto-answer-issues.yml

.github/workflows/main.yml

.github/workflows/auto-answer-issues.yml

Copilot · 2026-03-11T18:08:18Z

@trwalke I've opened a new pull request, #5837, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-03-11T20:00:58Z

@trwalke I've opened a new pull request, #5838, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-03-11T20:16:17Z

@trwalke I've opened a new pull request, #5839, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-03-11T20:23:56Z

@trwalke I've opened a new pull request, #5840, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-03-11T20:28:07Z

@trwalke I've opened a new pull request, #5841, to work on those changes. Once the pull request is ready, I'll request review from you.

trwalke · 2026-03-11T20:57:42Z

@copilot rename the file to auto-answer-issues.yml

Copilot · 2026-03-11T20:57:49Z

@trwalke I've opened a new pull request, #5842, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 5 comments.

.github/workflows/auto-answer-issues.yml

Copilot · 2026-03-11T21:01:24Z

@trwalke I've opened a new pull request, #5843, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

.github/workflows/auto-answer-issues.yml

Copilot · 2026-03-11T21:20:41Z

@trwalke I've opened a new pull request, #5844, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-03-11T22:16:53Z

@trwalke I've opened a new pull request, #5845, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-03-11T22:22:15Z

@trwalke I've opened a new pull request, #5846, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

Copilot · 2026-03-11T22:30:35Z

.github/workflows/auto-answer-issues.yml

+permissions:
+  issues: write
+  contents: read


The job requests contents: read, but this workflow doesn’t appear to need repository contents (it only installs npm packages and calls GitHub/Azure OpenAI). For least-privilege, consider removing contents: read unless a later step truly requires it.

Copilot · 2026-03-11T22:30:35Z

.github/workflows/auto-answer-issues.yml

+      - name: Checkout repository
+        uses: actions/checkout@v4
+


The actions/checkout step is not used by subsequent steps (the script is inline and dependencies are installed from the registry). Removing checkout reduces runtime and avoids granting/using repository content access unnecessarily.

Suggested change

- name: Checkout repository

uses: actions/checkout@v4

Copilot · 2026-03-11T22:30:35Z

.github/workflows/auto-answer-issues.yml

+            });
+            const botAlreadyCommented = comments.some(
+              (comment) => comment.user?.login === "github-actions[bot]"


This prompt hard-codes “An issue has been opened…”, but the workflow also runs on the labeled event. Consider adjusting the prompt text based on github.event.action so the model has accurate context (e.g., “opened” vs “labeled for auto-answer”).

Copilot · 2026-03-11T22:30:35Z

.github/workflows/auto-answer-issues.yml

+- Uses markdown formatting suitable for a GitHub issue comment.
+`;
+
+            const completion = await openai.chat.completions.create({
+              model: AZURE_OPENAI_DEPLOYMENT,
+              messages: [


This workflow always posts a new comment for every eligible opened/labeled event. There’s currently no guard for a specific label name and no check for whether the bot has already commented, so repeated labeling (or reopening) can spam issues and burn Azure OpenAI tokens. Consider (a) gating on a dedicated label (e.g. only when action == 'labeled' && label.name == 'auto-answer'), and/or (b) listing existing issue comments via Octokit and exiting early if a prior auto-answer marker/comment from the bot is already present.

gladjohn

do we plan to turn off the issue sentinel workflow that get's triggered now?

This action will attempt to answer questions customers have when posted on the repo.

…hor_association (#5841) * Initial plan * Guard workflow against untrusted triggering using author_association Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com> * Add COLLABORATOR and CONTRIBUTOR to author_association guard Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…issues.yml (#5842) * Initial plan * Rename main.yml to auto-answer-issues.yml Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com>

…5843) * Initial plan * Switch auto-answer-issues workflow from OpenAI.com to Azure OpenAI Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com>

…workflow (#5846) * Initial plan * Fix ESM/CJS issue: use dynamic import() for openai and @octokit/rest in workflow Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com>

…s workflow (#5845) * Initial plan * Remove CONTRIBUTOR from author_association check in auto-answer-issues workflow Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com>

* Initial plan * Add duplicate comment detection to auto-answer-issues workflow Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

Copilot · 2026-04-01T22:13:10Z

.github/workflows/auto-answer-issues.yml

+    # Only run for issues created by org members or owners (i.e., Microsoft Open Source enterprise members).
+    # github.event.issue.author_association is set by GitHub based on the issue author's relationship
+    # to this repository. MEMBER = org member, OWNER = repo/org owner. This prevents untrusted
+    # external contributors from triggering the Azure OpenAI-backed responder and consuming secrets/tokens.


The comment claims this only runs for org members/owners and equates that to “Microsoft Open Source enterprise members”, but github.event.issue.author_association reflects repo/org relationship (not GitHub Enterprise membership). Please adjust this comment to accurately describe what’s enforced so readers don’t assume a stronger guarantee than exists.

Suggested change

# Only run for issues created by org members or owners (i.e., Microsoft Open Source enterprise members).

# github.event.issue.author_association is set by GitHub based on the issue author's relationship

# to this repository. MEMBER = org member, OWNER = repo/org owner. This prevents untrusted

# external contributors from triggering the Azure OpenAI-backed responder and consuming secrets/tokens.

# Only run for issues created by users who have a trusted relationship to this repo/org in GitHub

# (based on github.event.issue.author_association), such as MEMBER, OWNER, or COLLABORATOR.

# author_association reflects the issue author's relationship to this repository/organization only;

# it does NOT indicate GitHub Enterprise or "Microsoft Open Source enterprise" membership.

Copilot · 2026-04-01T22:13:10Z

.github/workflows/auto-answer-issues.yml

+    if: |
+      github.event.issue.author_association == 'MEMBER' ||
+      github.event.issue.author_association == 'OWNER' ||
+      github.event.issue.author_association == 'COLLABORATOR'
+    steps:


The explanatory comment says “Only run for issues created by org members or owners”, but the if: condition also allows COLLABORATOR. Either update the comment to include collaborators, or tighten the condition to match the stated restriction.

Copilot · 2026-04-01T22:13:10Z

.github/workflows/auto-answer-issues.yml

+    if: |
+      github.event.issue.author_association == 'MEMBER' ||
+      github.event.issue.author_association == 'OWNER' ||
+      github.event.issue.author_association == 'COLLABORATOR'
+    steps:


PR description says the automation is restricted to “members, owners, collaborators, and contributors”, but the workflow guard currently does not include CONTRIBUTOR. Either update the PR description to match the implementation, or add CONTRIBUTOR back if it’s intended to be allowed.

Copilot · 2026-04-01T22:13:11Z

.github/workflows/auto-answer-issues.yml

+            // Check if the bot has already commented on this issue to avoid duplicate responses.
+            const comments = await octokit.paginate(octokit.issues.listComments, {
+              owner: REPO_OWNER,
+              repo: REPO_NAME,
+              issue_number: issueNumber,
+              per_page: 100
+            });
+            const botAlreadyCommented = comments.some(
+              (comment) => comment.user?.login === "github-actions[bot]"
+            );
+            if (botAlreadyCommented) {
+              console.log("Bot has already commented on this issue. Skipping.");
+              return;
+            }


The duplicate-response check treats any existing comment by github-actions[bot] as “already answered”. That’s overly broad (other workflows/actions can comment as github-actions[bot]) and can prevent this workflow from ever posting. Consider adding a unique marker to this workflow’s comment (e.g., an HTML comment tag) and checking for that marker instead.

trwalke requested a review from a team as a code owner March 11, 2026 18:04

Copilot AI review requested due to automatic review settings March 11, 2026 18:04

Copilot started reviewing on behalf of trwalke March 11, 2026 18:05 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

.github/workflows/auto-answer-issues.yml Show resolved Hide resolved

.github/workflows/auto-answer-issues.yml Show resolved Hide resolved

.github/workflows/main.yml Outdated Show resolved Hide resolved

.github/workflows/auto-answer-issues.yml Show resolved Hide resolved

Copilot AI mentioned this pull request Mar 11, 2026

[WIP] Update GitHub Actions workflow for auto-answering issues #5837

Closed

bgavrilMS approved these changes Mar 11, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 11, 2026

[WIP] [WIP] Address feedback on GitHub Actions workflow for auto-answering issues #5838

Closed

Copilot AI mentioned this pull request Mar 11, 2026

Rename workflow file from main.yml to auto-answer-issues.yml #5839

Closed

1 task

Copilot AI mentioned this pull request Mar 11, 2026

[WIP] [WIP] Address feedback on GitHub Actions workflow to restrict trigger #5840

Closed

Copilot AI mentioned this pull request Mar 11, 2026

Guard issue auto-answer workflow against untrusted triggering via author_association #5841

Merged

1 task

Copilot AI review requested due to automatic review settings March 11, 2026 20:55

Copilot started reviewing on behalf of trwalke March 11, 2026 20:55 View session

Copilot AI mentioned this pull request Mar 11, 2026

Rename auto-answer-issues workflow file from main.yml to auto-answer-issues.yml #5842

Merged

1 task

Copilot AI reviewed Mar 11, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 11, 2026

Switch auto-answer-issues workflow from OpenAI.com to Azure OpenAI #5843

Merged

1 task

Copilot AI review requested due to automatic review settings March 11, 2026 21:14

Copilot started reviewing on behalf of trwalke March 11, 2026 21:15 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

.github/workflows/auto-answer-issues.yml Outdated Show resolved Hide resolved

.github/workflows/auto-answer-issues.yml Outdated Show resolved Hide resolved

Copilot AI mentioned this pull request Mar 11, 2026

Prevent duplicate bot comments in auto-answer-issues workflow #5844

Merged

1 task

Copilot AI mentioned this pull request Mar 11, 2026

Remove CONTRIBUTOR from author_association guard in auto-answer-issues workflow #5845

Merged

1 task

Copilot AI mentioned this pull request Mar 11, 2026

Fix ESM/CJS runtime failure in auto-answer-issues workflow #5846

Merged

1 task

Copilot AI review requested due to automatic review settings March 11, 2026 22:27

Copilot started reviewing on behalf of trwalke March 11, 2026 22:28 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

gladjohn approved these changes Mar 12, 2026

View reviewed changes

trwalke and others added 8 commits March 19, 2026 20:27

Add GitHub Actions workflow for auto-answering issues

b1dbb67

This action will attempt to answer questions customers have when posted on the repo.

Apply suggestion from @Copilot

ecb3764

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

bgavrilMS force-pushed the trwalke/addGhActionForIssues branch from 7e8dbfc to 52a3945 Compare March 19, 2026 20:27

Merge branch 'main' into trwalke/addGhActionForIssues

ed76c68

Copilot AI review requested due to automatic review settings April 1, 2026 22:08

Copilot started reviewing on behalf of trwalke April 1, 2026 22:10 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

Conversation

trwalke commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

trwalke commented Mar 11, 2026

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

Copilot AI commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

gladjohn left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

trwalke commented Mar 11, 2026 •

edited

Loading