GitHub Issue Ops Dispatcher
Dispatch a deliberately small, read-only command set from GitHub issue comments.
The workflow has no cloud identity, secrets, cluster context, or mutation path
other than posting its result to the originating issue.
When to invoke
- Add or validate an IssueOps command.
- Review IssueOps authorization, parsing, status propagation, or workflow routing.
- Diagnose
/check-agents or /help behavior in issue comments.
Procedure
Authorization boundary
The workflow handles only newly created issue_comment events. A job starts only
when all of these conditions are true:
- The comment belongs to an issue, not a pull request.
- The comment begins with
/.
- GitHub reports the comment author association as
OWNER, MEMBER, or
COLLABORATOR.
Unauthorized comments do not start a job. The job has only contents: read and
issues: write; it has no OIDC token permission, Azure login, Azure secrets, or
cloud mutation capability.
Supported commands
| Command |
Behavior |
/check-agents |
Runs validate-agents.py --strict with Python 3.11 after installing exactly PyYAML==6.0.3. |
/help |
Returns the supported commands and authorization boundary without running a subprocess. |
Commands take no arguments and must begin the first line. /onboard and
/validate return a failed, explanatory result: onboarding requires an approved
deployment workflow, and deployment validation requires an authenticated cluster
context. Other commands also fail with help.
Dispatch behavior
- Read the comment from
ISSUE_COMMENT.
- Parse the first line with
shlex.split and validate the command name.
- Reject arguments, unsupported commands, malformed quoting, and oversized input.
- For
/check-agents, execute a fixed argument list with shell=False semantics,
a repository-root working directory, and a five-minute timeout.
- Post the Markdown result, then make the workflow job return the dispatcher's
exit status.
Output template
## IssueOps command result
**Command:** </check-agents | /help | unsupported command>
**Status:** <PASS | FAIL>
**Exit code:** <process exit code>
<summary and safely rendered command output>
Limits
- This control plane performs no onboarding, deployment, cluster validation, or
cloud authentication.
- Pull-request comments, issue bodies, issue-opened events, unauthorized actors,
leading whitespace before
/, and commands after the first line do not run.
- Use
validation-scripts (skill) for direct validation and
deploy-orchestration (skill) for approved platform changes.
Related primitives
| Name |
Type |
Use it when |
validation-scripts |
skill |
Running repository validators directly. |
deploy-orchestration |
skill |
Coordinating approved deployment actions. |
github-cli |
skill |
Performing general GitHub issue operations. |
Quality gate
1---2name: github-issue-ops3description: Dispatches authorized GitHub issue-comment commands to read-only repository validation. Use when implementing or validating /check-agents, /help, issue comment authorization, command parsing, or IssueOps workflow behavior.4---56<!-- Generated from harness/github-copilot/plugins/open-horizons-platform/skills/github-issue-ops/SKILL.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->78# GitHub Issue Ops Dispatcher910Dispatch a deliberately small, read-only command set from GitHub issue comments.11The workflow has no cloud identity, secrets, cluster context, or mutation path12other than posting its result to the originating issue.1314## When to invoke1516- Add or validate an IssueOps command.17- Review IssueOps authorization, parsing, status propagation, or workflow routing.18- Diagnose `/check-agents` or `/help` behavior in issue comments.1920## Procedure2122### Authorization boundary2324The workflow handles only newly created `issue_comment` events. A job starts only25when all of these conditions are true:26271. The comment belongs to an issue, not a pull request.282. The comment begins with `/`.293. GitHub reports the comment author association as `OWNER`, `MEMBER`, or30 `COLLABORATOR`.3132Unauthorized comments do not start a job. The job has only `contents: read` and33`issues: write`; it has no OIDC token permission, Azure login, Azure secrets, or34cloud mutation capability.3536### Supported commands3738| Command | Behavior |39| --- | --- |40| `/check-agents` | Runs `validate-agents.py --strict` with Python 3.11 after installing exactly `PyYAML==6.0.3`. |41| `/help` | Returns the supported commands and authorization boundary without running a subprocess. |4243Commands take no arguments and must begin the first line. `/onboard` and44`/validate` return a failed, explanatory result: onboarding requires an approved45deployment workflow, and deployment validation requires an authenticated cluster46context. Other commands also fail with help.4748### Dispatch behavior49501. Read the comment from `ISSUE_COMMENT`.512. Parse the first line with `shlex.split` and validate the command name.523. Reject arguments, unsupported commands, malformed quoting, and oversized input.534. For `/check-agents`, execute a fixed argument list with `shell=False` semantics,54 a repository-root working directory, and a five-minute timeout.555. Post the Markdown result, then make the workflow job return the dispatcher's56 exit status.5758## Output template5960```markdown61## IssueOps command result6263**Command:** </check-agents | /help | unsupported command>64**Status:** <PASS | FAIL>65**Exit code:** <process exit code>6667<summary and safely rendered command output>68```6970## Limits7172- This control plane performs no onboarding, deployment, cluster validation, or73 cloud authentication.74- Pull-request comments, issue bodies, issue-opened events, unauthorized actors,75 leading whitespace before `/`, and commands after the first line do not run.76- Use `validation-scripts` (`skill`) for direct validation and77 `deploy-orchestration` (`skill`) for approved platform changes.7879## Related primitives8081| Name | Type | Use it when |82| --- | --- | --- |83| `validation-scripts` | `skill` | Running repository validators directly. |84| `deploy-orchestration` | `skill` | Coordinating approved deployment actions. |85| `github-cli` | `skill` | Performing general GitHub issue operations. |8687## Quality gate8889- [ ] The event and job guard exclude issue bodies and pull-request comments.90- [ ] Only owners, members, and collaborators can start the job.91- [ ] Permissions remain `contents: read` and `issues: write` with no OIDC.92- [ ] Every action is SHA-pinned and PyYAML is exactly version-pinned.93- [ ] Only `/check-agents` and `/help` can succeed.94- [ ] Parsing tests cover supported, unsupported, malformed, and injected input.95- [ ] Dispatcher and workflow preserve a nonzero command status after commenting.
paulasilvatech