Repository navigation
ci: robust stale issue lifecycle and consolidated triage labels - #27015
Merged
Merged
Conversation
Contributor
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly improves the reliability of the repository's issue management system. By shifting from timestamp-based stale detection to a granular timeline event analysis, the lifecycle manager now correctly identifies actual inactivity, preventing premature closures. Additionally, the triage process has been streamlined to ensure consistent label usage and improved communication with users when information is requested. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
cocosheng-g
force-pushed
the
new-worktree
branch
2 times, most recently
from
May 13, 2026 19:51
63ab1aa to
5f78138
Compare
![gemini-code-assist[bot]](/web-api/iframe-proxy?url=https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request enhances the GitHub Action scripts for issue and PR management by implementing pagination for searches and a more sophisticated stale-handling logic that checks the issue timeline for human activity. It also introduces specific stale messaging for bug reports and allows comments to be posted when specific labels are added, even if general comments are suppressed. Review feedback identifies a high-severity security risk concerning the lack of sanitization for LLM-generated content, which could permit indirect prompt injection, and recommends including pull request review events in the activity whitelist to prevent active PRs from being marked stale.
I am having trouble creating individual review comments. Click here to see my feedback.
.github/scripts/apply-issue-labels.cjs (214-221)
The script incorporates LLM-generated content (entry.explanation) directly into GitHub issue comments without any validation or sanitization. This creates a vulnerability to Indirect Prompt Injection. An attacker can craft a malicious issue description or comment that tricks the LLM into generating harmful content (e.g., phishing links, malicious markdown, or misleading instructions). When the bot posts this content, it carries the authority of the repository, which can be used to deceive users or maintainers. Additionally, the script relies on the issue_number provided in the LLM output (line 80) to determine which issue to modify. Without verifying that this issue_number corresponds to the issue currently being triaged, an attacker could potentially influence the LLM to perform unauthorized actions (labeling or commenting) on arbitrary issues within the repository.
.github/scripts/gemini-lifecycle-manager.cjs (219)
The current whitelist of meaningful events is missing Pull Request specific activities. Since the search query on line 194 includes both issues and pull requests, a PR that is actively being reviewed (e.g., via a human review or a review request) could be incorrectly closed as stale if no comments or label changes occur.
Please add reviewed, review_requested, and review_request_removed to the whitelist to ensure PRs under active review are protected from stale closure.
if (['commented', 'cross-referenced', 'connected', 'reopened', 'assigned', 'reviewed', 'review_requested', 'review_request_removed'].includes(e.event)) {
|
Size Change: -4 B (0%) Total Size: 33.9 MB
ℹ️ View Unchanged
|
gemini-cli
Bot
added
the
status/need-issue
cocosheng-g
force-pushed
the
new-worktree
branch
11 times, most recently
from
May 13, 2026 21:40
000b613 to
5ad59bc
Compare
cocosheng-g
force-pushed
the
new-worktree
branch
3 times, most recently
from
May 14, 2026 18:46
bf0f8cd to
7534630
Compare
cocosheng-g
force-pushed
the
new-worktree
branch
4 times, most recently
from
May 14, 2026 21:32
bd4641e to
1a18a22
Compare
cocosheng-g
force-pushed
the
new-worktree
branch
6 times, most recently
from
May 14, 2026 22:15
5e5d9b7 to
5a52ed0
Compare
scidomino
reviewed
May 20, 2026
cocosheng-g
enabled auto-merge
May 20, 2026 21:41
software-0ficial
pushed a commit
to software-0ficial/gemini-cli
that referenced
this pull request
Jul 9, 2026
Cleanskiier27
added a commit
to Cleanskiier27/gemini-cli
that referenced
this pull request
Jul 25, 2026
* fix(core): Fix hysteresis in async context management pipelines. (google-gemini#26452) * Tighten private Auto Memory patch allowlist (google-gemini#26535) * fix(cli): hide read-only settings scopes (google-gemini#26249) * fix(ci): preserve executable bit for mac binaries (google-gemini#26600) * fix(cli): improve mcp list UX in untrusted folders (google-gemini#26457) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * fix(core): prevent silent hang during OAuth auth on headless Linux (google-gemini#26571) Co-authored-by: Jack Wotherspoon <[email protected]> * Changelog for v0.42.0-preview.0 (google-gemini#26537) Co-authored-by: gemini-cli-robot <[email protected]> * ci: fix Argument list too long in triage workflows (google-gemini#26603) * refactor(cli): migrate core tools to native ToolDisplay property and fix UI rendering (google-gemini#25186) * don't wrap args unnecessarily (google-gemini#26599) * fix(core): preserve system PATH in Git environment to fix ENOENT (google-gemini#25034) (google-gemini#26587) * fix(routing): fix resolveClassifierModel argument mismatch in ApprovalModeStrategy (google-gemini#26658) Co-authored-by: Tommaso Sciortino <[email protected]> * docs: add vi mode shortcuts and clarify MCP/custom sandbox setup (google-gemini#23853) Co-authored-by: Sam Roberts <[email protected]> * fix(ux): fixed issue with transcribed text not showing after releasing space (google-gemini#26609) * ci: fix json parsing in scheduled triage workflow (google-gemini#26656) * fix(cli): hide /memory add subcommand when memoryV2 is enabled (google-gemini#26605) * fix: prevent false command conflicts when launching from home directory (google-gemini#23069) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Tommaso Sciortino <[email protected]> * fix(core): cache model routing decision in LocalAgentExecutor (google-gemini#26548) * Changelog for v0.42.0-preview.2 (google-gemini#26597) Co-authored-by: gemini-cli-robot <[email protected]> Co-authored-by: Sam Roberts <[email protected]> * skip broken test (google-gemini#26705) * feat: export session to file and import via flag (google-gemini#26514) * Feat: Add Machine Hostname to CLI interface (google-gemini#25637) Signed-off-by: M-DEV-1 <[email protected]> Co-authored-by: Tommaso Sciortino <[email protected]> * docs(extensions): refactor releasing guide and add update mechanisms (google-gemini#26595) * fix(ci): fix maintainer identification in lifecycle manager (google-gemini#26706) * fix(ui): added quotes around session id in resume tip (google-gemini#26669) * Changelog for v0.41.0 (google-gemini#26670) Co-authored-by: g-samroberts <[email protected]> * refactor(core): agent session protocol changes (google-gemini#26661) * fix(context): implement loose boundary policy for gc backstop. (google-gemini#26594) * fix(core): throw explicit error on dropped tool responses (google-gemini#26668) * fix: resolve "function response turn must come immediately after function call" error (google-gemini#26691) Co-authored-by: Tommaso Sciortino <[email protected]> * fix(core): resolve parallel tool call streaming ID collision (google-gemini#26646) * feat(core): add LocalSubagentProtocol behind AgentProtocol (google-gemini#25302) * fix(cli): remove noisy theme registration logs from terminal (google-gemini#25858) Co-authored-by: Jack Wotherspoon <[email protected]> * ci: implement codebase-aware effort level triage (google-gemini#26666) * feat(acp/core): prefix tool call IDs with tool names to support tool rendering in ACP compliant IDEs. (google-gemini#26676) * fix(mcp): treat GET 404 as 405 in StreamableHTTPClientTransport (google-gemini#24847) Co-authored-by: Coco Sheng <[email protected]> Co-authored-by: Spencer <[email protected]> Co-authored-by: Tommaso Sciortino <[email protected]> * feat(core): add RemoteSubagentProtocol behind AgentProtocol (google-gemini#25303) * feat(context): Improvements to the snapshotter. (google-gemini#26655) * fix(context): Change snapshotter model config. (google-gemini#26745) * fix(cli): allow installing extensions from ssh repo (google-gemini#26274) Signed-off-by: Daniel Finimundi <[email protected]> Co-authored-by: Dev Randalpura <[email protected]> * fix(cli): prevent duplicate SessionStart systemMessage render (google-gemini#25827) Co-authored-by: Jacob Richman <[email protected]> * fix(cli/acp): prevent infinite thought loop in ACP mode by disablig nextSpeakerCheck (google-gemini#26874) * fix(cli): use static tool name in confirmation prompt to avoid parsing errors (google-gemini#26866) * fix(routing): Refactor tool turn handling for the conversation history in NumericalClassifierStrategy to prevent 400 Bad Request (google-gemini#26761) * fix(core): handle malformed projects.json in ProjectRegistry (google-gemini#26885) * fix(ui): added a gutter width to the input prompt width calculation (google-gemini#26882) * fix: prevent EISDIR crash when customIgnoreFilePaths contains directories (google-gemini#19868) (google-gemini#19898) Co-authored-by: Tommaso Sciortino <[email protected]> * revert 6b9b778 (google-gemini#26893) * Fix/vscode run current file ts (google-gemini#22894) Co-authored-by: Spencer <[email protected]> * Allow Enter to select session while in search mode in /resume (google-gemini#21523) Co-authored-by: Tommaso Sciortino <[email protected]> * fix(core): ignore .pak and .rpa game archive formats by default (google-gemini#26884) Co-authored-by: Tommaso Sciortino <[email protected]> * fix(cli): enable adk non-interactive session (google-gemini#26895) * fix(cli): restore resume for legacy sessions (google-gemini#26577) Co-authored-by: Tommaso Sciortino <[email protected]> * fix: respect explicit model selection after Flash quota exhaustion (google-gemini#26759) (google-gemini#26872) * feat(context): Introduce adaptive token calculator to more accurately calculate content sizes. (google-gemini#26888) * chore: update checkout action configuration in workflows (google-gemini#26897) * fix (telemetry): inject quota_project_id to prevent fallback to default oauth client (google-gemini#26698) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Tommaso Sciortino <[email protected]> * Exclude extension context from skill extraction agent (google-gemini#26879) * Enable NumericalRouter when using dynamic model configs (google-gemini#26929) * ci: actively triage missing priority labels and intelligently clean up conflicting labels (google-gemini#26865) * refactor(core): introduce SubagentState enum for progress (google-gemini#26934) * fix(ci): replace brittle --no-tag with explicit staging-tmp tag (google-gemini#26940) * Incremental refactor repo agent towards skills-based composition (google-gemini#26717) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * fix(ui): fixed line wrap padding for selection lists (google-gemini#26944) * fix(core): update read_file schema for v1 compatibility (google-gemini#22183) (google-gemini#26922) * fix(ci): configure git remote with token for authentication (google-gemini#26949) * chore(release): bump version to 0.44.0-nightly.20260512.g022e8baef (google-gemini#26957) * Changelog for v0.42.0 (google-gemini#26958) Co-authored-by: gemini-cli-robot <[email protected]> * Refactor: Eliminate `no-unsafe-return` suppressions via strict type validation (google-gemini#20668) Signed-off-by: M-DEV-1 <[email protected]> Co-authored-by: Tommaso Sciortino <[email protected]> * Changelog for v0.43.0-preview.0 (google-gemini#26959) Co-authored-by: gemini-cli-robot <[email protected]> * feat(core): change agent registration to first-wins and prioritize project (google-gemini#26953) * feat(cli): merge Auto modes into a single Auto mode (google-gemini#26714) * fix(core): preserve OAuth refresh tokens during rotation and retrieval (google-gemini#26924) * fix(cli): allow keychain auth for --list-sessions and non-interactive mode (google-gemini#26921) * fix(core): handle EISDIR on virtual drives in memory discovery (google-gemini#26985) * fix(cli): auto-approve shell redirections in AUTO_EDIT mode (google-gemini#27003) * ci: suppress bot comments during standard triage maintenance (google-gemini#27006) * fix(core): isolate subagent thread context (google-gemini#26449) * fix(core): refresh MCP OAuth token usage after re-auth (google-gemini#26312) Co-authored-by: Tommaso Sciortino <[email protected]> * fix(ui): clamped table column widths (google-gemini#26991) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * chore: add execution permission to scripts/review.sh (google-gemini#27009) * fix(core): made context files append instead of replace (google-gemini#26950) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * fix: add system PATH fallback for ripgrep resolution (google-gemini#26777) (google-gemini#26868) * chore: clean up launched memory features (google-gemini#26941) Co-authored-by: Jenna Inouye <[email protected]> * fix(core): throttle shell text output and bound live UI buffer (google-gemini#26955) * fix(cli): don't crash when an @-mention captures a non-path blob (google-gemini#25980) * fix(core): ensure stable fallback for restricted preview models (google-gemini#26999) * feat(core): expose RAG snippets to local log file for debugging (google-gemini#27016) * fix(acp/auth): prevent conflicting credentials on enterprise gateways and support optional API keys natively (google-gemini#27021) * fix(core): respect NO_PROXY for network-based MCP servers (google-gemini#27012) * fix(cli): resolve permission denied in sandbox on NixOS and other distros (google-gemini#27004) * fix(ui): preserve new line at the end of edit window (google-gemini#27057) * fix(core): ensure Vertex AI sets hasAccessToPreviewModels and remove aggressive 404 fallback revocation (google-gemini#27067) * fix(core): ensure stable admin settings comparison across IPC to prevent restart loop (google-gemini#27066) * fix(deps): update vulnerable dependencies (google-gemini#27062) * fix(core): resolve EISDIR errors during file processing (google-gemini#21527) (google-gemini#27041) * docs(extensions): clarify env var sanitization policy for MCP and ext… (google-gemini#22854) Co-authored-by: Jack Wotherspoon <[email protected]> Co-authored-by: Jenna Inouye <[email protected]> * fix(ui): add ENAMETOOLONG and ENOTDIR to exceptions for file parsing errors (google-gemini#27069) * fix(cli): explicitly clear entrypoint when spawning sandbox container (google-gemini#27059) * docs: update sandbox image command (google-gemini#26774) * fix(core): externalize https-proxy-agent to fix proxy support (google-gemini#26361) * security: update dependencies to fix critical and high vulnerabilities (google-gemini#27077) * Fix/web fetch ctrl c abort (google-gemini#24320) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * fix(core): add aliases and thinking config for gemini-3.1 models (google-gemini#27007) * fix(core): use hasAccessToPreview for auto model resolution and fix disappearing models (google-gemini#27112) * feat(core): add adk.agentSessionSubagentEnabled flag (google-gemini#26947) * fix(core): enforce compile-time exhaustiveness in content-utils (google-gemini#27207) * feat(skills): add agent-tui and tui-tester skills (google-gemini#27121) * fix(context): Fix snapshot recovery across sessions. (google-gemini#26939) * fix(core): add unit tests for stableStringify (google-gemini#27212) * fix(core): prefer pwsh.exe over Windows PowerShell 5.1 (google-gemini#25859) (google-gemini#25900) Co-authored-by: Tommaso Sciortino <[email protected]> * feat(core): add LocalSessionInvocation (google-gemini#26665) * refactor: decouple auto model description and configuration from releaseChannel (google-gemini#27227) Co-authored-by: David Pierce <[email protected]> * fix(core): prevent isBinary false-positive on Windows PTY streams (google-gemini#26565) * fix(cli): Prevent unmapped keys in Vim Normal mode from inserting text into prompt Input. (google-gemini#25139) Co-authored-by: Tommaso Sciortino <[email protected]> * fix(a2a-server): Implement default policy loading for parity with CLI (google-gemini#27073) * feat(core): add RemoteSessionInvocation (google-gemini#26937) * fix: allow configured MCP servers in non-interactive mode (google-gemini#27215) * fix(core): add exception handling to migrateFromFileStorage (google-gemini#27229) * fix(cli): bundle ink worker-entry.js (google-gemini#27249) * feat(core): wire AgentSession invocations into agent-tool (google-gemini#26948) * fix(core): prevent path traversal in custome command file injection (google-gemini#27234) * fix(core): respect NO_PROXY in global fetch dispatcher (google-gemini#27216) * fix(core): correctly handle nullable array types in MCP tools (google-gemini#27228) * Proposal: deterministic encoding for child-process I/O (google-gemini#27247) * fix(cli): preserve proxy-agent named exports in ESM bundle (google-gemini#27145) * feat(cli): add Sublime Text and Emacs Client editors, improve error messages and documentation (google-gemini#21090) Co-authored-by: Ananth Kini <[email protected]> * Changelog for v0.43.0-preview.1 (google-gemini#27297) Co-authored-by: gemini-cli-robot <[email protected]> * fix(devtools): bundle devtools package to avoid resolution errors (google-gemini#27250) * fix(cli): integrate PolicyEngine into ACP session to prevent deadlocks (google-gemini#23507) (google-gemini#27252) * fix: robust ripgrep path resolution and 1p hermetic execution support (google-gemini#27253) * refactor: decouple stored session deletion from ChatRecordingService (google-gemini#22920) (google-gemini#27039) * fix(core): improve Alpine shell compatibility (google-gemini#26770) * fix(core): generalize MCP compliance fix for tool results (google-gemini#27045) * fix(scripts): scrub CI env vars in dev to keep interactive mode (google-gemini#27159) * fix(core): Added date field for the GCal MCP (google-gemini#27251) * fix(core): centralize path validation to prevent crashes from malformed prompts (google-gemini#27211) * fix(core): prevent SIGHUP kills in PTY environments (WSL2/Kitty/Alacritty) (google-gemini#27267) * fix(core): dynamic fallback routing for exhausted quota models (google-gemini#27315) * Auto detect pnpm global installation path for macOS and Windows (google-gemini#22748) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Coco Sheng <[email protected]> * fix(windows): resolve interactive shell arrow-key navigation on Windows (google-gemini#23505) * ci: robust stale issue lifecycle and consolidated triage labels (google-gemini#27015) * fix(context): Ensure last message is processed. (google-gemini#27232) * chore/release: bump version to 0.44.0-nightly.20260521.g57c42a5c4 (google-gemini#27324) * fix(ui): added volta to auto update check (google-gemini#27353) * perf: optimize issue triage and lifecycle management (google-gemini#27346) * chore(release): bump version to 0.45.0-nightly.20260521.g854f811be (google-gemini#27362) * fix(cli): prevent Termux relaunch and resize remount loops (google-gemini#27110) Co-authored-by: Spencer <[email protected]> * Feat/a2a expose usage metadata (google-gemini#27288) * feat(context): Complete simplification work. (google-gemini#27345) * fix(core): force update_topic tool to execute sequentially (google-gemini#27357) * Changelog for v0.44.0-preview.0 (google-gemini#27360) Co-authored-by: gemini-cli-robot <[email protected]> * Changelog for v0.43.0 (google-gemini#27361) Co-authored-by: gemini-cli-robot <[email protected]> * Revert "fix(core): prevent SIGHUP kills in PTY environments" (google-gemini#27401) * fix(cli): filter internal session context from history during resumption (google-gemini#27391) * Update default auto routing (google-gemini#27071) * fix(core): bypass routing classifiers to prevent orphaned function response errors (google-gemini#27389) * fix(core): suppress PTY resize EBADF errors (google-gemini#27461) * fix(core): prevent blacklist bypass in mcp list (google-gemini#27377) Co-authored-by: Gal Zahavi <[email protected]> * fix(cli): ignore unmapped vim normal keys (google-gemini#27102) * fix(core): harden PTY resize against native crashes (google-gemini#27496) * Changelog for v0.45.0-preview.0 (google-gemini#27495) Co-authored-by: gemini-cli-robot <[email protected]> * Changelog for v0.44.0 (google-gemini#27569) Co-authored-by: gemini-cli-robot <[email protected]> * fix(cli): prevent spam loop when preferredEditor is invalid (google-gemini#25324) Co-authored-by: Tommaso Sciortino <[email protected]> * Adding quote (google-gemini#27571) * Transition to flash GA model when experiment flag is present. (google-gemini#27570) * chore(ci): add optimized PR size labeler and batch workflows (google-gemini#27616) * fix(ci): use pull_request_target trigger to grant write access on fork PRs (google-gemini#27637) * chore(release): bump version to 0.47.0-nightly.20260602.gcfcecebe8 (google-gemini#27644) * Changelog for v0.46.0-preview.0 (google-gemini#27641) Co-authored-by: gemini-cli-robot <[email protected]> * Respect backend definitions for 3.5 flash and Update auto mode to use 3.5 flash when the flag is enabled. (google-gemini#27645) * fix(policy): add EBUSY fallback and TOML parse recovery (google-gemini#19919) (google-gemini#21541) Signed-off-by: krishdef7 <[email protected]> Co-authored-by: Sikandar <[email protected]> Co-authored-by: Tommaso Sciortino <[email protected]> * Changelog for v0.45.0 (google-gemini#27642) Co-authored-by: gemini-cli-robot <[email protected]> * update the max amount of times the Antigravity transition banner can be displayed. (google-gemini#27676) * chore: remove experimental text from browser agent docs (google-gemini#27746) * fix(core): implement atomic update in MCP tool discovery (google-gemini#27619) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Gal Zahavi <[email protected]> * Vertex ai model mapping fix (google-gemini#27749) * Add documentation and migration commands for Antigravity CLI (google-gemini#27765) Co-authored-by: Gal Zahavi <[email protected]> * Avoid persisting empty resume sessions (google-gemini#27770) * chore(release): bump version to 0.48.0-nightly.20260609.g3a13b8eeb (google-gemini#27779) * ci(dependabot): enable cooldown period for npm packages (google-gemini#27743) * refactor(core): standardize tool output formatting (google-gemini#27772) * ci: update workflow logging and policy configurations (google-gemini#27853) * fix(core): Ensure zero-quota limits fail fast to prevent retry loop hang (google-gemini#27698) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * fix(core): handle multi-line escaped quotes in stripShellWrapper (google-gemini#27467) Co-authored-by: luisfelipe-alt <[email protected]> * fix(cli): prevent path traversal vulnerabilities during skill install… (google-gemini#27767) * Fix/pending tools and trust overrides (google-gemini#27854) * ci: use internal environment for scheduled nightly releases (google-gemini#27865) (google-gemini#27939) * feat(core): Support GDC air-gapped Service Identity after auth library update (google-gemini#27956) * fix(cli): handle tmux false positive background detection (google-gemini#27572) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Gal Zahavi <[email protected]> * Add static eval source analyzer (google-gemini#27631) * fix(config): migrate coreTools setting to tools.core (google-gemini#27947) * fix(core-tools): resolve defensive path resolution for at-reference files (google-gemini#27943) * Revert "fix(core-tools): resolve defensive path resolution for at-reference files" (google-gemini#27992) * chore(release): bump version to 0.49.0-nightly.20260617.g4d3dcdce1 (google-gemini#28003) * Changelog for v0.48.0-preview.0 (google-gemini#27999) Co-authored-by: gemini-cli-robot <[email protected]> * fix(ci): provide fallbacks for package variables in nightly release (google-gemini#28016) * chore(deps): pin dependencies and enforce 14-day update cooldown (google-gemini#27948) * fix(ci): append trailing slash to registry url in npmrc (google-gemini#28038) * feat: add eval:inventory CLI command and reporting logic (google-gemini#28009) * fix: resolve workspace publish failures and scheduler event loop starvation (google-gemini#28063) * fix(ci): use wombat dressing room fallback in nightly release to prevent ENEEDAUTH (google-gemini#28104) * Add JSON output for eval inventory (google-gemini#28058) * fix/verify release npm ci ignore scripts (google-gemini#28116) * fix(ci): prevent workspace binary shadowing in release verification (google-gemini#28132) * Feat/tool registry discovery (google-gemini#28113) * fix(ci): prevent bad NPM releases and promote job crashes (google-gemini#28147) * Changelog for v0.50.0-preview.1 (google-gemini#28150) Co-authored-by: gemini-cli-robot <[email protected]> * chore(release): bump version to 0.51.0-nightly.20260625.g3fbf93e26 (google-gemini#28151) * Fix no_proxy test (google-gemini#28131) Co-authored-by: Jerry Lin <[email protected]> * Vertex base url update (google-gemini#28145) * fix(security): enforce case-insensitive sensitive path blocklist and vscode hitl (google-gemini#27966) Co-authored-by: David Pierce <[email protected]> * fix(core-tools): resolve defensive path resolution for at-reference files and fix macOS tests (google-gemini#28053) Co-authored-by: David Pierce <[email protected]> * feat(caretaker): implement Cloud Run webhook ingestion service (google-gemini#28015) Co-authored-by: Christian Gunderman <[email protected]> * fix(core): resolve symbolic link directory escape in memory import processor (google-gemini#28233) * feat(caretaker): egress cloud run service skeleton (google-gemini#28167) * fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox (google-gemini#28221) Co-authored-by: David Pierce <[email protected]> * fix(core): preserve escape sequences in string literals for modern models (google-gemini#28299) Co-authored-by: David Pierce <[email protected]> * fix(core): strip thoughts from scrubbed history turns and resolve thought leakage (google-gemini#27971) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Gal Zahavi <[email protected]> Co-authored-by: David Pierce <[email protected]> * Refactor: exclude transient CI configuration files from workspace context (google-gemini#28216) * feat(caretaker): add triage worker core foundational modules (google-gemini#28163) * feat(caretaker-egress): implement octokit github action handler for egress service (google-gemini#28303) * chore(release): bump version to 0.52.0-nightly.20260707.g27a3da3e8 (google-gemini#28323) * Changelog for v0.51.0-preview.0 (google-gemini#28320) Co-authored-by: gemini-cli-robot <[email protected]> * Changelog for v0.50.0 (google-gemini#28322) Co-authored-by: gemini-cli-robot <[email protected]> Co-authored-by: David Pierce <[email protected]> * fix(core-tools): bypass LLM correction for JSON and IPYNB files in write_file and replace (google-gemini#28223) Co-authored-by: David Pierce <[email protected]> * fix(core): use unambiguous previous intent label in fallback summary (google-gemini#28343) * feat(caretaker-triage): implement main worker execution loop and egress action publisher (google-gemini#28306) * fix(privacy): show a clear message when the account has no Code Assist tier (google-gemini#28304) * fix(core): enrich shared project quota limit errors with setup hint (google-gemini#28391) * fix(a2a-server): ensure task cancellation aborts execution loop (google-gemini#28316) * fix(core): simplify plan mode write policy to support relative paths (google-gemini#28398) * feat(core): Bump node google-auth-library version to 10.9.0 (google-gemini#28385) Co-authored-by: Jerry Lin <[email protected]> * chore/release: bump version to 0.52.0-nightly.20260715.gfa975395b (google-gemini#28402) * fix(core,a2a): group cancelled tool responses and coalesce consecutive roles to prevent 400 Bad Request (google-gemini#28407) * feat(caretaker-triage): implement LLM triage orchestrator and container build (google-gemini#28345) * refactor(cli): align macOS permissive Seatbelt profiles with deny-default model (google-gemini#28424) * fix(core): mitigate infinite ReAct loops and prompt injection loops (google-gemini#28429) Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * fix(a2a-server): enforce workspace trust and task isolation to prevent RCE (google-gemini#28470) * fix(core): sequentially verify cached credentials and restore GOOGLE_APPLICATION_CREDENTIALS fallback (google-gemini#28472) Co-authored-by: David Pierce <[email protected]> * feat(evals): add eval coverage report command (google-gemini#28169) * Changelog for v0.53.0-preview.0 (google-gemini#28507) Co-authored-by: gemini-cli-robot <[email protected]> * Changelog for v0.52.0 (google-gemini#28508) Co-authored-by: gemini-cli-robot <[email protected]> * chore(release): bump version to 0.54.0-nightly.20260722.gf743ab579 (google-gemini#28510) * fix(caretaker): sanitize and wrap issue title in untrusted_context (google-gemini#28352) * chore(caretaker): update vitest to v3.2.4 and add package-lock.json files (google-gemini#28409) * fix(core): rotate session ID on model fallback to prevent stateful API errors (google-gemini#28469) * feat(caretaker-triage): post comment before auto-closing issues (google-gemini#28411) * fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent cleartext leakage (google-gemini#28517) * fix(core): filter out thought parts from getHistoryTurns when context management is disabled (google-gemini#28509) --------- Signed-off-by: M-DEV-1 <[email protected]> Signed-off-by: Daniel Finimundi <[email protected]> Signed-off-by: krishdef7 <[email protected]> Co-authored-by: joshualitt <[email protected]> Co-authored-by: Sandy Tao <[email protected]> Co-authored-by: Christian Van <[email protected]> Co-authored-by: ruomeng <[email protected]> Co-authored-by: Adib234 <[email protected]> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Rhys Sullivan <[email protected]> Co-authored-by: Jack Wotherspoon <[email protected]> Co-authored-by: gemini-cli-robot <[email protected]> Co-authored-by: gemini-cli-robot <[email protected]> Co-authored-by: Coco Sheng <[email protected]> Co-authored-by: Michael Bleigh <[email protected]> Co-authored-by: Tommaso Sciortino <[email protected]> Co-authored-by: Daniel Weis <[email protected]> Co-authored-by: Christopher Thomas <[email protected]> Co-authored-by: Sam Roberts <[email protected]> Co-authored-by: Dev Randalpura <[email protected]> Co-authored-by: Br1an <[email protected]> Co-authored-by: AK <[email protected]> Co-authored-by: mahadevan <[email protected]> Co-authored-by: Christian Gunderman <[email protected]> Co-authored-by: Adam Weidman <[email protected]> Co-authored-by: Aishanee Shah <[email protected]> Co-authored-by: JAYADITYA <[email protected]> Co-authored-by: Sri Pasumarthi <[email protected]> Co-authored-by: krishdef7 <[email protected]> Co-authored-by: Spencer <[email protected]> Co-authored-by: Daniel Finimundi <[email protected]> Co-authored-by: Aryan Singh <[email protected]> Co-authored-by: Jacob Richman <[email protected]> Co-authored-by: Suhaan Raqeeb Khavas <[email protected]> Co-authored-by: Neil Nair <[email protected]> Co-authored-by: Franco Pieri <[email protected]> Co-authored-by: Eswar809 <[email protected]> Co-authored-by: Kuroda Kayn <[email protected]> Co-authored-by: Gal Zahavi <[email protected]> Co-authored-by: Yulong Wu <[email protected]> Co-authored-by: kevinjwang1 <[email protected]> Co-authored-by: David Pierce <[email protected]> Co-authored-by: Sahil Kirad <[email protected]> Co-authored-by: Jenna Inouye <[email protected]> Co-authored-by: EMERSON BUSSON <[email protected]> Co-authored-by: ifitisit <[email protected]> Co-authored-by: PROTHAM <[email protected]> Co-authored-by: 7. Sun <[email protected]> Co-authored-by: sotokisehiro <[email protected]> Co-authored-by: Anish Sabharwal <[email protected]> Co-authored-by: kaluchi <[email protected]> Co-authored-by: Tirth Naik <[email protected]> Co-authored-by: Rajesh patel <[email protected]> Co-authored-by: Keith Schaab <[email protected]> Co-authored-by: Ramón Medrano Llamas <[email protected]> Co-authored-by: Om Patel <[email protected]> Co-authored-by: ashishch432 <[email protected]> Co-authored-by: Andrea Alberti <[email protected]> Co-authored-by: Ananth Kini <[email protected]> Co-authored-by: Yuvraj Angad Singh <[email protected]> Co-authored-by: Debasish <[email protected]> Co-authored-by: Hashaam Zahid <[email protected]> Co-authored-by: tison <[email protected]> Co-authored-by: adithya32 <[email protected]> Co-authored-by: Syed Ayman Quadri <[email protected]> Co-authored-by: jvargassanchez-dot <[email protected]> Co-authored-by: Billy Biggs <[email protected]> Co-authored-by: Om Patel <[email protected]> Co-authored-by: Mukunda Rao Katta <[email protected]> Co-authored-by: nirali <[email protected]> Co-authored-by: Sikandar <[email protected]> Co-authored-by: Gaurav <[email protected]> Co-authored-by: luisfelipe-alt <[email protected]> Co-authored-by: Cesar Sanchez Coraspe <[email protected]> Co-authored-by: sidhantgoyal-droid <[email protected]> Co-authored-by: amelidev <[email protected]> Co-authored-by: Vedant Mahajan <[email protected]> Co-authored-by: Jerry Lin <[email protected]> Co-authored-by: Jerry Lin <[email protected]> Co-authored-by: Chad <[email protected]> Co-authored-by: Chad <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces a comprehensive overhaul of the Gemini CLI issue triage and lifecycle management infrastructure. These changes fix widespread "triage loops", eliminate aggressive bot comment spam, and ensure strict consistency in issue labeling across the repository.
1. 🛡️ Robust Triage Integrity & Loop Prevention
gemini-scheduled-issue-triage.ymlworkflow now fetches and passes thelabelsfield to the LLM. The LLM is now fully aware of the issue's current state.P2andP3.-label:status/bot-triaged) from the workflow search queries, ensuring the bot catches all untriaged issues without getting stuck in infinite loops.2. 🚨 P0 Safety Standard & Priority Logic
priority/p0. If it identifies a catastrophic blocker, it is mandated to applypriority/p1ANDstatus/manual-triageto force human escalation safely.status/need-informationis present, theapply-issue-labels.cjsscript programmatically handles the downgrade (e.g., P1 -> P2), ensuring the bot's comments perfectly match the applied labels.3. 🔇 "Silence by Default" Anti-Spam Policy
apply-issue-labels.cjsscript now completely silences standard triage chatter. The bot will only post a comment if it is addingstatus/need-informationor performing a deep-diveeffort_analysis.effort_analysisfield, preventing redundant and confusing dual-assessments.4. 🧹 Conflict Cleanup & Stale State Resolution
gemini-automated-issue-triage.ymlworkflow to explicitly strip user-appliedarea/*labels if they conflict with the LLM's assessment, stopping multiple-area conflicts at creation.cleanup-triage-labels.cjsnow intelligently resolves conflicts betweenstatus/manual-triageandstatus/bot-triaged.gemini-lifecycle-manager.cjsno longer relies on the fragileupdatedAttimestamp. It fetches the chronological timeline to find exactly when theStalelabel was added. It automatically removes the label if meaningful human activity (or a PR link) occurs, and closes it exactly 14 days later if not, properly logging the closure withstate_reason: 'not_planned'.status/need-informationwhen it detects a follow-up comment from a human user.Note on Legacy Issues
Alongside this PR, a one-time bulk cleanup script was executed to process over 250 legacy issues—resolving existing label conflicts, migrating P0s to the new standard, and deleting over 150 historical spam comments from the repository timeline.