feat(auto-triage): assign community label for non-contributor and read-only issues

[Copilot]

Auto-triage now applies a community label to issues opened by external community members, including users with read-only contributor roles.

Changes

• Community label classification rule — applies community label when author_association is NONE, FIRST_TIME_CONTRIBUTOR, FIRST_TIMER, or CONTRIBUTOR; skips bots (user.type == "Bot" or login ending in [bot])
• CONTRIBUTOR included — per review feedback, users with prior contributions but no org/write membership (effectively read-only) are also tagged
• Single add_labels call — community check runs in step 2 of issue event handling so the community label is batched with content-based labels

Logic

if author_association in [NONE, FIRST_TIME_CONTRIBUTOR, FIRST_TIMER, CONTRIBUTOR]
   AND user.type != "Bot"
   AND login does not end with "[bot]"
→ include "community" in labels

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -embedcfg /tmp/go-build844365865/b334/embedcfg -pack (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683 --jq .object.sha (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v7
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c --jq .object.sha (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v5 --jq .object.sha (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/anchore/sbom-action/git/ref/tags/v0
  • Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
• https://api.github.com/repos/docker/build-push-action/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/docker/login-action/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq .object.sha (http block)
• https://api.github.com/repos/docker/metadata-action/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v5 --jq .object.sha (http block)
• https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb --jq .object.sha (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[q] feat(auto-triage): assign community label for non-contributor issues</issue_title>
<issue_description>## Summary

Updates the Auto-Triage Issues workflow to apply a community label to issues opened by non-contributors who are not bots.

Changes Made

.github/workflows/auto-triage-issues.md

New classification rule — Community Label:

• Apply community label when author_association is NONE, FIRST_TIME_CONTRIBUTOR, or FIRST_TIMER
• Skip if the author is a bot (user.type == "Bot" or login ends with [bot])

Updated issue event handling — Step 2 now checks community status before classifying, so the community label is included with other labels in a single add_labels call.

Logic

if author_association in [NONE, FIRST_TIME_CONTRIBUTOR, FIRST_TIMER]
   AND user.type != "Bot"
   AND login does not end with "[bot]"
→ add "community" label

Validation

✅ auto-triage-issues compiled successfully

Note: .lock.yml files will be regenerated automatically after merge.

🎩 Equipped by Q

• expires on Feb 27, 2026, 1:01 PM UTC

---

[!NOTE]
This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available in the agent-artifacts artifact in the workflow run linked above.

To apply the patch locally:

# Download the artifact from the workflow run https://github.com/github/gh-aw/actions/runs/22397807840
# (Use GitHub MCP tools if gh CLI is not available)
gh run download 22397807840 -n agent-artifacts -D /tmp/agent-artifacts-22397807840

# The patch file will be at agent-artifacts/tmp/gh-aw/aw-q-auto-triage-community-label.patch after download
# Apply the patch (--3way handles cross-repo patches where files may already exist)
git am --3way /tmp/agent-artifacts-22397807840/aw-q-auto-triage-community-label.patch

Show patch preview (56 of 56 lines)

From 4e756a7c29144e22af389052bb7016820f40557f Mon Sep 17 00:00:00 2001
From: Copilot <copilot@github.com>
Date: Wed, 25 Feb 2026 12:59:40 +0000
Subject: [PATCH] feat(auto-triage): add community label for non-contributor
 issues

Apply 'community' label to issues opened by non-contributors
(author_association: NONE, FIRST_TIME_CONTRIBUTOR, FIRST_TIMER)
that are not bots (user.type != Bot, login doesn't end with [bot]).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/auto-triage-issues.md | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/auto-triage-issues.md b/.github/workflows/auto-triage-issues.md
index 087e529..b70d15d 100644
--- a/.github/workflows/auto-triage-issues.md
+++ b/.github/workflows/auto-triage-issues.md
@@ -122,9 +122,14 @@ When triggered by an issue event (opened/edited) or scheduled run, analyze issue
 When an issue is opened or edited:
 
 1. **Analyze the issue** that triggered this workflow (available in `github.event.issue`)
-2. **Classify the issue** based on its title and body content
-3. **Apply appropriate labels** using the `add_labels` tool
-4. If uncertain, add the `needs-triage` label for human review
+2. **Check if the author is a community member** (non-contributor, non-bot):
+   - Check `github.event.issue.author_association` - non-contributors have: `NONE`, `FIRST_TIME_CONTRIBUTOR`, or `FIRST_TIMER`
+   - Check `github.event.issue.user.type` - bots have type `Bot`
+   - Also check if the login ends with `[bot]` (e.g., `dependabot[bot]`)
+   - If the author is a non-contributor AND not a bot → add the `community` label
+3. **Classify the issue** based on its title and body content
+4. **Apply appropriate labels** using the `add_labels` tool
+5. If uncertain, add the `needs-triage` label for human review
 
 ### On Scheduled Runs (Every 6 Hours)
 
@@ -186,6 +191,14 @@ Apply component labels based on mentioned areas:
 - `dependencies` - M
... (truncated)

Comments on the Issue (you are @copilot in this section)

@pelikhan Apply also to user with read only roles

• Fixes [q] feat(auto-triage): assign community label for non-contributor issues #18351

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

Updates the Auto-Triage Issues agent workflow instructions to apply a community label for issues opened by external community members (including CONTRIBUTOR author association) while skipping bot authors, and to batch the label application into a single add_labels call.

Changes:

• Add a community-member check to issue event handling so community can be included in the same labeling operation.
• Document a new “Community Label” classification rule based on author_association plus bot detection.
• Expand the rule to include CONTRIBUTOR authors (read-only contributors) per prior feedback.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Step 2 hard-codes the full community/bot criteria inline, but the same rule is repeated later under “### Community Label”. Keeping the criteria in two places risks them drifting; consider making step 2 reference the “Community Label” rule (or otherwise centralize the criteria) and keep the detailed condition in only one section.

Suggested change

	2. **Check if the author is a community member** — if `author_association` is `NONE`, `FIRST_TIME_CONTRIBUTOR`, `FIRST_TIMER`, or `CONTRIBUTOR`, and the author is **not** a bot (`user.type != "Bot"` and login does not end with `[bot]`), include `community` in the labels to apply
	2. **Determine community status** — if the author meets the **Community Label** criteria (see [Community Label](#community-label) below), include `community` in the labels to apply

[Copilot]

The bot check uses user.type and “login” without specifying the JSON path. To avoid ambiguity (and to match step 1’s github.event.issue reference), spell these out as github.event.issue.user.type and github.event.issue.user.login (and similarly github.event.issue.author_association).

Suggested change

	- `author_association` is `NONE`, `FIRST_TIME_CONTRIBUTOR`, `FIRST_TIMER`, or `CONTRIBUTOR`
	- **AND** the author is **not** a bot (`user.type != "Bot"` and login does not end with `[bot]`)
	- `github.event.issue.author_association` is `NONE`, `FIRST_TIME_CONTRIBUTOR`, `FIRST_TIMER`, or `CONTRIBUTOR`
	- **AND** the author is **not** a bot (`github.event.issue.user.type != "Bot"` and `github.event.issue.user.login` does not end with `[bot]`)