Add gh-aw agentic AI Moderator workflow for spam triage - #3402
Open
salmanmkc wants to merge 1 commit into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces a GitHub Agentic Workflows (gh-aw) based “AI Moderator” workflow for spam triage, along with the repo scaffolding needed to compile/run it (MCP config, agent/skill router, and generated lock workflow).
Changes:
- Add an agentic AI moderator workflow definition (
.md) plus the generated compiled workflow lock file (.lock.yml). - Add gh-aw/Copilot-agent setup scaffolding (Copilot setup workflow, MCP config, actions lock, agent/skill dispatcher docs).
- Mark compiled lock workflows as generated / merge-ours via
.gitattributes.
Show a summary per file
| File | Description |
|---|---|
| .vscode/settings.json | Enables Copilot for Markdown in VS Code workspace settings. |
| .github/workflows/copilot-setup-steps.yml | Adds Copilot Agent setup steps to install gh-aw tooling. |
| .github/workflows/ai-moderator-agent.md | Defines the agentic AI moderator workflow behavior and safe outputs. |
| .github/workflows/ai-moderator-agent.lock.yml | Generated compiled workflow produced by gh aw compile. |
| .github/skills/agentic-workflows/SKILL.md | Adds a dispatcher skill for routing gh-aw workflow tasks. |
| .github/mcp.json | Configures a local MCP server for gh aw mcp-server with selected tools. |
| .github/aw/actions-lock.json | Pins gh-aw action versions/shas used for compilation/runtime. |
| .github/agents/agentic-workflows.md | Adds an “Agentic Workflows” dispatcher agent description/instructions. |
| .gitattributes | Marks *.lock.yml as generated and resolves merges with merge=ours. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Suppressed comments (1)
.github/workflows/ai-moderator-agent.md:151
- The workflow instructions tell the agent to call
hide-commentwith reason'spam', but the safe-output tool’sreasonenum in the compiled workflow is uppercase (e.g.SPAM). If the agent follows these instructions, the safe output is likely to fail validation.
- If any type of spam, link spam, or AI-generated spam is detected:
- Use the `hide-comment` safe output to hide the comment with reason 'spam'
- Also add appropriate labels to the parent issue as described above
- Files reviewed: 9/9 changed files
- Comments generated: 3
- Review effort level: Lite
Comment on lines
+53
to
+55
| hide-comment: | ||
| max: 5 | ||
| allowed-reasons: [spam] |
Comment on lines
+21
to
+22
| - name: Checkout repository | ||
| uses: actions/checkout@v6 |
Comment on lines
+56
to
+57
| noop: | ||
| threat-detection: false |
Adds the AI Moderator as a GitHub Agentic Workflow (gh-aw) so new issues, comments and pull requests are triaged for spam, link spam and AI-generated content, applying labels and hiding detected comments via safe outputs. The workflow definition is the same one running in github/gh-aw (.github/workflows/ai-moderator.md); the prompt body is identical and the frontmatter differs only where it has to: no gh-aw-internal `private`, `imports` or `evals`, and `engine: copilot` (with the matching `copilot-requests: write` permission) instead of codex. Only the files needed to run the workflow are included: the agentic source, its compiled lock file, the gh-aw actions lock, and a .gitattributes entry marking lock files as generated.
salmanmkc
force-pushed
the
add-ai-moderator-agentic
branch
from
August 6, 2026 12:54
7c4d7fe to
9e8fa6f
Compare
4 tasks
|
@copilot Fix the code for all comments in this review thread. When a review comment includes a suggested change, apply the suggestion exactly. Do not make changes beyond what is described in the linked review thread. |
flynnjustin24
approved these changes
Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the AI Moderator as a GitHub Agentic Workflow (gh-aw) so new issues, comments and pull requests in this repository are triaged for spam, link spam and AI-generated content — applying labels and hiding detected comments through gh-aw safe outputs.
Note
This is a workflow for this repository, not a new starter-workflow template. It adds files under
.github/workflows/, so it runs onactions/starter-workflowsitself for spam triage. It does not add anything to the starter workflow gallery (noautomation/template orproperties/entry), so the "only accepting new starter workflows for Code Scanning" guidance in CONTRIBUTING doesn't apply here.What's included
Only the files required to run the workflow:
.github/workflows/ai-moderator.md.github/workflows/ai-moderator.lock.ymlgh aw compile.github/aw/actions-lock.json.gitattributes*.lock.ymlas generatedAn earlier revision of this PR also added Copilot agent/skill definitions,
.github/mcp.json,copilot-setup-steps.ymland.vscode/settings.json. Those are authoring conveniences, not runtime requirements, so they've been dropped to keep the change reviewable.Relationship to github/gh-aw
This is the same workflow that runs in
github/gh-aw. The prompt body is byte-identical; the frontmatter differs only where it must:private: true,imports: shared/otlp.mdandevals:— gh-aw-internal onlyengine: copilotinstead ofcodex, with the matchingcopilot-requests: writepermissionBehaviour is unchanged otherwise:
skip-bots/skip-roles/skip-author-associationskeep it off maintainer and bot activity,user-rate-limitcaps runs per user, andsafe-outputsrestricts the agent to adding a fixed label set and hiding comments — it has no write access to code.Compiled with
gh aw compilev0.85.4 — schema v4,strict: true, all actions SHA-pinned.Note on CI
The
agentcheck runs the workflow against this PR. It fails with a Copilot provider401because pull requests from forks don't receive Copilot inference credentials — an artifact of running from a fork, not a problem with the workflow definition. Happy to adjust thepull_requesttrigger if maintainers would rather it not attempt to run on fork PRs at all.