feat(#325): detect workflow file changes in triage and skip code agent

agents/triage.md

@@ -130,6 +130,7 @@ Before forming any clarifying question, classify it:
 - Can you form a plausible root cause hypothesis from the available information?
 - Could a developer start investigating without contacting the reporter?
 - **Is progress blocked on other work?** Consider whether the fix depends on an unresolved issue or unmerged PR — in this repo or another. If a developer cannot meaningfully start work until some other issue is resolved, this issue has prerequisites regardless of how clear the problem description is. If the blocking work has no tracking issue yet, you can recommend creating one via the `prerequisites` action's `create` array.
+- **Would resolving this issue require modifying workflow files?** Scan the issue title, body, referenced files, and labels for signals that the fix involves changes under `.github/workflows/`, `.fullsend/.github/workflows/`, or enrolled-repo shim workflows. Prefer deterministic signals — explicit path references, CI/workflow-scoped labels, mentions of GitHub Actions workflow configuration — over vague mentions of "workflow" in non-GHA contexts (e.g., "user onboarding workflow"). If the fix likely requires workflow file changes, set `requires_workflow_changes: true` in `triage_summary` and include a warning in the triage comment that the code agent cannot modify workflow files under current permissions. Reference the least-privilege workflow-change epic and note that manual intervention (human PR or maintainer action) is required.
 
 ### Clarity scoring
 
@@ -292,7 +293,8 @@ Information is sufficient for a developer to investigate and fix.
     "environment": "Relevant environment details",
     "impact": "Who is affected and how",
     "recommended_fix": "What a developer should investigate.",
-    "proposed_test_case": "Conceptual description of a test that would verify the fix — what to test, expected vs actual behavior, and edge cases to cover. Do not assume a specific test framework or file layout."
+    "proposed_test_case": "Conceptual description of a test that would verify the fix — what to test, expected vs actual behavior, and edge cases to cover. Do not assume a specific test framework or file layout.",
+    "requires_workflow_changes": false
   },
   "comment": "A triage summary comment formatted in markdown, presenting the assessment to the maintainers. Include the proposed test case as a fenced code block.",
   "label_actions": {
@@ -305,6 +307,8 @@ Information is sufficient for a developer to investigate and fix.
 }
 ```
 
+**Workflow change detection (optional):** If the issue likely requires modifying GitHub Actions workflow files (`.github/workflows/`, `.fullsend/.github/workflows/`, or enrolled-repo shim workflows), set `requires_workflow_changes: true` in `triage_summary`. When set, the post-triage script skips auto-triggering the code agent because the code agent cannot modify workflow files under current permissions. The triage comment should warn about this limitation and note that manual intervention is required. When `requires_workflow_changes` is not set or is `false`, auto-triggering proceeds normally.
+
 **Label recommendations (optional, all actions):** If the `issue-labels` skill identifies labels that should be applied or removed, include them in the `label_actions` field. This field is optional for all actions. If no labels clearly apply, omit it entirely.
 
 ## Questioning guidelines

schemas/triage-result.schema.json

@@ -132,7 +132,8 @@
         "environment": { "type": "string" },
         "impact": { "type": "string", "minLength": 1 },
         "recommended_fix": { "type": "string", "minLength": 1 },
-        "proposed_test_case": { "type": "string", "minLength": 1 }
+        "proposed_test_case": { "type": "string", "minLength": 1 },
+        "requires_workflow_changes": { "type": "boolean" }
       },
       "additionalProperties": false
     },

scripts/post-triage-test.sh

@@ -492,6 +492,43 @@ run_test "label-category-consistent-passes" \
   '{"action":"sufficient","reasoning":"all clear","clarity_scores":{"symptom":0.9,"cause":0.85,"reproduction":0.9,"impact":0.8,"overall":0.87},"triage_summary":{"title":"Fix crash","severity":"high","category":"bug","problem":"Crash","root_cause_hypothesis":"Buffer overflow","reproduction_steps":["step 1"],"environment":"Linux","impact":"All users","recommended_fix":"Fix buffer","proposed_test_case":"test_crash"},"comment":"## Triage Summary\n\nReady.","label_actions":{"reason":"Area label applies.","actions":[{"action":"add","label":"area/api"}]}}' \
   "gh api repos/test-org/test-repo/issues/42/labels -f labels[]=area/api --silent"
 
+# --- Workflow change detection tests (#325) ---
+
+# Bug with requires_workflow_changes=true should get triaged instead of ready-to-code.
+run_test "workflow-changes-bug-gets-triaged" \
+  '{"action":"sufficient","reasoning":"all clear","clarity_scores":{"symptom":0.9,"cause":0.85,"reproduction":0.9,"impact":0.8,"overall":0.87},"triage_summary":{"title":"Fix CI caching step","severity":"high","category":"bug","problem":"CI cache miss","root_cause_hypothesis":"Missing cache key","reproduction_steps":["step 1"],"environment":"Linux","impact":"All users","recommended_fix":"Update workflow","proposed_test_case":"test_cache","requires_workflow_changes":true},"comment":"## Triage Summary\n\nThis requires workflow changes."}' \
+  "gh api repos/test-org/test-repo/issues/42/labels -f labels[]=triaged --silent"
+
+# Bug with requires_workflow_changes=true should NOT get ready-to-code.
+run_test_no_pattern "workflow-changes-bug-no-ready-to-code" \
+  '{"action":"sufficient","reasoning":"all clear","clarity_scores":{"symptom":0.9,"cause":0.85,"reproduction":0.9,"impact":0.8,"overall":0.87},"triage_summary":{"title":"Fix CI caching step","severity":"high","category":"bug","problem":"CI cache miss","root_cause_hypothesis":"Missing cache key","reproduction_steps":["step 1"],"environment":"Linux","impact":"All users","recommended_fix":"Update workflow","proposed_test_case":"test_cache","requires_workflow_changes":true},"comment":"## Triage Summary\n\nThis requires workflow changes."}' \
+  "labels[]=ready-to-code"
+
+# Documentation with requires_workflow_changes=true should get triaged instead of ready-to-code.
+run_test "workflow-changes-documentation-gets-triaged" \
+  '{"action":"sufficient","reasoning":"all clear","clarity_scores":{"symptom":0.9,"cause":0.85,"reproduction":0.9,"impact":0.8,"overall":0.87},"triage_summary":{"title":"Update CI docs","severity":"low","category":"documentation","problem":"Outdated CI docs","root_cause_hypothesis":"Not updated","reproduction_steps":["step 1"],"environment":"Linux","impact":"Contributors","recommended_fix":"Update workflow and docs","proposed_test_case":"test_docs","requires_workflow_changes":true},"comment":"## Triage Summary\n\nThis requires workflow changes."}' \
+  "gh api repos/test-org/test-repo/issues/42/labels -f labels[]=triaged --silent"
+
+# Performance with requires_workflow_changes=true should get triaged instead of ready-to-code.
+run_test "workflow-changes-performance-gets-triaged" \
+  '{"action":"sufficient","reasoning":"all clear","clarity_scores":{"symptom":0.9,"cause":0.85,"reproduction":0.9,"impact":0.8,"overall":0.87},"triage_summary":{"title":"Speed up CI","severity":"medium","category":"performance","problem":"Slow CI","root_cause_hypothesis":"No parallelism","reproduction_steps":["step 1"],"environment":"Linux","impact":"All users","recommended_fix":"Add parallel steps","proposed_test_case":"test_speed","requires_workflow_changes":true},"comment":"## Triage Summary\n\nThis requires workflow changes."}' \
+  "gh api repos/test-org/test-repo/issues/42/labels -f labels[]=triaged --silent"
+
+# Bug without requires_workflow_changes still gets ready-to-code (regression guard).
+run_test "no-workflow-flag-bug-still-gets-ready-to-code" \
+  '{"action":"sufficient","reasoning":"all clear","clarity_scores":{"symptom":0.9,"cause":0.85,"reproduction":0.9,"impact":0.8,"overall":0.87},"triage_summary":{"title":"Fix crash","severity":"high","category":"bug","problem":"Crash","root_cause_hypothesis":"Buffer overflow","reproduction_steps":["step 1"],"environment":"Linux","impact":"All users","recommended_fix":"Fix buffer","proposed_test_case":"test_crash"},"comment":"## Triage Summary\n\nReady."}' \
+  "gh api repos/test-org/test-repo/issues/42/labels -f labels[]=ready-to-code --silent"
+
+# Bug with requires_workflow_changes=false still gets ready-to-code.
+run_test "workflow-false-bug-gets-ready-to-code" \
+  '{"action":"sufficient","reasoning":"all clear","clarity_scores":{"symptom":0.9,"cause":0.85,"reproduction":0.9,"impact":0.8,"overall":0.87},"triage_summary":{"title":"Fix crash","severity":"high","category":"bug","problem":"Crash","root_cause_hypothesis":"Buffer overflow","reproduction_steps":["step 1"],"environment":"Linux","impact":"All users","recommended_fix":"Fix buffer","proposed_test_case":"test_crash","requires_workflow_changes":false},"comment":"## Triage Summary\n\nReady."}' \
+  "gh api repos/test-org/test-repo/issues/42/labels -f labels[]=ready-to-code --silent"
+
+# Workflow changes warning appears in stdout.
+run_test_stdout "workflow-changes-warning-emitted" \
+  '{"action":"sufficient","reasoning":"all clear","clarity_scores":{"symptom":0.9,"cause":0.85,"reproduction":0.9,"impact":0.8,"overall":0.87},"triage_summary":{"title":"Fix CI caching","severity":"high","category":"bug","problem":"CI cache miss","root_cause_hypothesis":"Missing cache key","reproduction_steps":["step 1"],"environment":"Linux","impact":"All users","recommended_fix":"Update workflow","proposed_test_case":"test_cache","requires_workflow_changes":true},"comment":"## Triage Summary\n\nThis requires workflow changes."}' \
+  "::warning::Skipping ready-to-code — triage detected workflow file changes required (#325)"
+
 # --- Summary ---
 
 echo ""

scripts/post-triage.sh

@@ -312,24 +312,48 @@ ${FAILED_CREATES}"
     # ready-to-code, which triggers the code agent. Feature work and anything
     # else receives the triaged label and waits for human prioritization
     # (per #561, only feature issues should require human review before coding).
+    #
+    # Workflow-change guard (#325): if triage detected that the fix requires
+    # modifying workflow files (.github/workflows/, .fullsend/.github/workflows/,
+    # or shim workflows), skip ready-to-code regardless of category. The code
+    # agent cannot modify workflow files under current permissions.
+    REQUIRES_WORKFLOW=$(jq -r '.triage_summary.requires_workflow_changes // false' "${RESULT_FILE}")
     CATEGORY=$(jq -r '.triage_summary.category // "unknown"' "${RESULT_FILE}")
     echo "Category: ${CATEGORY}"
+    if [[ "${REQUIRES_WORKFLOW}" == "true" ]]; then
+      echo "::warning::Skipping ready-to-code — triage detected workflow file changes required (#325)"
+    fi
     case "${CATEGORY}" in
       bug)
         echo "Applying bug label..."
         add_label "bug"
-        echo "Deferring ready-to-code label (${CATEGORY}) until after label_actions..."
-        DEFERRED_LABEL="ready-to-code"
+        if [[ "${REQUIRES_WORKFLOW}" == "true" ]]; then
+          echo "Applying triaged label (workflow changes required)..."
+          add_label "triaged"
+        else
+          echo "Deferring ready-to-code label (${CATEGORY}) until after label_actions..."
+          DEFERRED_LABEL="ready-to-code"
+        fi
         ;;
       documentation)
         echo "Applying documentation label..."
         add_label "documentation"
-        echo "Deferring ready-to-code label (${CATEGORY}) until after label_actions..."
-        DEFERRED_LABEL="ready-to-code"
+        if [[ "${REQUIRES_WORKFLOW}" == "true" ]]; then
+          echo "Applying triaged label (workflow changes required)..."
+          add_label "triaged"
+        else
+          echo "Deferring ready-to-code label (${CATEGORY}) until after label_actions..."
+          DEFERRED_LABEL="ready-to-code"
+        fi
         ;;
       performance)
-        echo "Deferring ready-to-code label (${CATEGORY}) until after label_actions..."
-        DEFERRED_LABEL="ready-to-code"
+        if [[ "${REQUIRES_WORKFLOW}" == "true" ]]; then
+          echo "Applying triaged label (workflow changes required)..."
+          add_label "triaged"
+        else
+          echo "Deferring ready-to-code label (${CATEGORY}) until after label_actions..."
+          DEFERRED_LABEL="ready-to-code"
+        fi
         ;;
       feature)
         echo "Applying feature + triaged labels..."