GitHub Issue Ops Dispatcher
Dispatch a deliberately small, read-only command set from GitHub issue comments.
The workflow has no cloud identity, secrets, cluster context, or mutation path
other than posting its result to the originating issue.
When to invoke
- Add or validate an IssueOps command.
- Review IssueOps authorization, parsing, status propagation, or workflow routing.
- Diagnose
/check-agents or /help behavior in issue comments.
Procedure
Authorization boundary
The workflow handles only newly created issue_comment events. A job starts only
when all of these conditions are true:
- The comment belongs to an issue, not a pull request.
- The comment begins with
/.
- GitHub reports the comment author association as
OWNER, MEMBER, or
COLLABORATOR.
Unauthorized comments do not start a job. The job has only contents: read and
issues: write; it has no OIDC token permission, Azure login, Azure secrets, or
cloud mutation capability.
Supported commands
| Command |
Behavior |
/check-agents |
Runs validate-agents.py --strict with Python 3.11 after installing exactly PyYAML==6.0.3. |
/help |
Returns the supported commands and authorization boundary without running a subprocess. |
Commands take no arguments and must begin the first line. /onboard and
/validate return a failed, explanatory result: onboarding requires an approved
deployment workflow, and deployment validation requires an authenticated cluster
context. Other commands also fail with help.
Dispatch behavior
- Read the comment from
ISSUE_COMMENT.
- Parse the first line with
shlex.split and validate the command name.
- Reject arguments, unsupported commands, malformed quoting, and oversized input.
- For
/check-agents, execute a fixed argument list with shell=False semantics,
a repository-root working directory, and a five-minute timeout.
- Post the Markdown result, then make the workflow job return the dispatcher's
exit status.
Output template
## IssueOps command result
**Command:** </check-agents | /help | unsupported command>
**Status:** <PASS | FAIL>
**Exit code:** <process exit code>
<summary and safely rendered command output>
Limits
- This control plane performs no onboarding, deployment, cluster validation, or
cloud authentication.
- Pull-request comments, issue bodies, issue-opened events, unauthorized actors,
leading whitespace before
/, and commands after the first line do not run.
- Use
validation-scripts (skill) for direct validation and
deploy-orchestration (skill) for approved platform changes.
Related primitives
| Name |
Type |
Use it when |
validation-scripts |
skill |
Running repository validators directly. |
deploy-orchestration |
skill |
Coordinating approved deployment actions. |
github-cli |
skill |
Performing general GitHub issue operations. |
Quality gate
1---2name: github-issue-ops-23description: Dispatches authorized GitHub issue-comment commands to read-only repository validation. Use when implementing or validating /check-agents, /help, issue comment authorization, command parsing, or IssueOps workflow behavior.4---56# GitHub Issue Ops Dispatcher78Dispatch a deliberately small, read-only command set from GitHub issue comments.9The workflow has no cloud identity, secrets, cluster context, or mutation path10other than posting its result to the originating issue.1112## When to invoke1314- Add or validate an IssueOps command.15- Review IssueOps authorization, parsing, status propagation, or workflow routing.16- Diagnose `/check-agents` or `/help` behavior in issue comments.1718## Procedure1920### Authorization boundary2122The workflow handles only newly created `issue_comment` events. A job starts only23when all of these conditions are true:24251. The comment belongs to an issue, not a pull request.262. The comment begins with `/`.273. GitHub reports the comment author association as `OWNER`, `MEMBER`, or28 `COLLABORATOR`.2930Unauthorized comments do not start a job. The job has only `contents: read` and31`issues: write`; it has no OIDC token permission, Azure login, Azure secrets, or32cloud mutation capability.3334### Supported commands3536| Command | Behavior |37| --- | --- |38| `/check-agents` | Runs `validate-agents.py --strict` with Python 3.11 after installing exactly `PyYAML==6.0.3`. |39| `/help` | Returns the supported commands and authorization boundary without running a subprocess. |4041Commands take no arguments and must begin the first line. `/onboard` and42`/validate` return a failed, explanatory result: onboarding requires an approved43deployment workflow, and deployment validation requires an authenticated cluster44context. Other commands also fail with help.4546### Dispatch behavior47481. Read the comment from `ISSUE_COMMENT`.492. Parse the first line with `shlex.split` and validate the command name.503. Reject arguments, unsupported commands, malformed quoting, and oversized input.514. For `/check-agents`, execute a fixed argument list with `shell=False` semantics,52 a repository-root working directory, and a five-minute timeout.535. Post the Markdown result, then make the workflow job return the dispatcher's54 exit status.5556## Output template5758```markdown59## IssueOps command result6061**Command:** </check-agents | /help | unsupported command>62**Status:** <PASS | FAIL>63**Exit code:** <process exit code>6465<summary and safely rendered command output>66```6768## Limits6970- This control plane performs no onboarding, deployment, cluster validation, or71 cloud authentication.72- Pull-request comments, issue bodies, issue-opened events, unauthorized actors,73 leading whitespace before `/`, and commands after the first line do not run.74- Use `validation-scripts` (`skill`) for direct validation and75 `deploy-orchestration` (`skill`) for approved platform changes.7677## Related primitives7879| Name | Type | Use it when |80| --- | --- | --- |81| `validation-scripts` | `skill` | Running repository validators directly. |82| `deploy-orchestration` | `skill` | Coordinating approved deployment actions. |83| `github-cli` | `skill` | Performing general GitHub issue operations. |8485## Quality gate8687- [ ] The event and job guard exclude issue bodies and pull-request comments.88- [ ] Only owners, members, and collaborators can start the job.89- [ ] Permissions remain `contents: read` and `issues: write` with no OIDC.90- [ ] Every action is SHA-pinned and PyYAML is exactly version-pinned.91- [ ] Only `/check-agents` and `/help` can succeed.92- [ ] Parsing tests cover supported, unsupported, malformed, and injected input.93- [ ] Dispatcher and workflow preserve a nonzero command status after commenting.
paulasilvatech