ci: robust stale issue lifecycle and consolidated triage labels

[cocosheng-g]

Description

This PR introduces a comprehensive overhaul of the Gemini CLI issue triage and lifecycle management infrastructure. These changes fix widespread "triage loops", eliminate aggressive bot comment spam, and ensure strict consistency in issue labeling across the repository.

1. 🛡️ Robust Triage Integrity & Loop Prevention

• State-Awareness: The gemini-scheduled-issue-triage.yml workflow now fetches and passes the labels field to the LLM. The LLM is now fully aware of the issue's current state.
• Anti-Toggle Rule: Added strict prompt instructions commanding the LLM to retain existing priority labels on ambiguous or empty tickets, preventing it from constantly toggling between P2 and P3.
• Search Query Hardening: Removed flawed exclusions (-label:status/bot-triaged) from the workflow search queries, ensuring the bot catches all untriaged issues without getting stuck in infinite loops.

2. 🚨 P0 Safety Standard & Priority Logic

• P0 Migration: The LLM is now strictly forbidden from automatically applying priority/p0. If it identifies a catastrophic blocker, it is mandated to apply priority/p1 AND status/manual-triage to force human escalation safely.
• Programmatic Downgrades: Removed the manual "bump down" rule from the LLM prompt. The LLM now evaluates the true architectural priority. If status/need-information is present, the apply-issue-labels.cjs script programmatically handles the downgrade (e.g., P1 -> P2), ensuring the bot's comments perfectly match the applied labels.

3. 🔇 "Silence by Default" Anti-Spam Policy

• Strict Commenting: The apply-issue-labels.cjs script now completely silences standard triage chatter. The bot will only post a comment if it is adding status/need-information or performing a deep-dive effort_analysis.
• Effort Analysis Purity: Updated the effort triage prompt to strictly forbid the LLM from evaluating or mentioning priorities within the effort_analysis field, preventing redundant and confusing dual-assessments.

4. 🧹 Conflict Cleanup & Stale State Resolution

• Initial Triage Fix: Updated the gemini-automated-issue-triage.yml workflow to explicitly strip user-applied area/* labels if they conflict with the LLM's assessment, stopping multiple-area conflicts at creation.
• Manual vs. Bot Resolution: cleanup-triage-labels.cjs now intelligently resolves conflicts between status/manual-triage and status/bot-triaged.
• Smart Stale Closures: gemini-lifecycle-manager.cjs no longer relies on the fragile updatedAt timestamp. It fetches the chronological timeline to find exactly when the Stale label was added. It automatically removes the label if meaningful human activity (or a PR link) occurs, and closes it exactly 14 days later if not, properly logging the closure with state_reason: 'not_planned'.
• User Response Detection: The script automatically removes status/need-information when it detects a follow-up comment from a human user.

Note on Legacy Issues

Alongside this PR, a one-time bulk cleanup script was executed to process over 250 legacy issues—resolving existing label conflicts, migrating P0s to the new standard, and deleting over 150 historical spam comments from the repository timeline.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the reliability of the repository's issue management system. By shifting from timestamp-based stale detection to a granular timeline event analysis, the lifecycle manager now correctly identifies actual inactivity, preventing premature closures. Additionally, the triage process has been streamlined to ensure consistent label usage and improved communication with users when information is requested.

Highlights

• Robust Stale Closure Logic: Refactored the stale issue lifecycle to use precise timeline events instead of the 'updatedAt' timestamp, preventing accidental closures caused by automated bot activity.
• Meaningful Activity Detection: Implemented a filter for timeline events to distinguish between meaningful human/bot interactions and automated noise, ensuring the 'Stale' label is only removed when genuine progress occurs.
• Consolidated Triage Labels: Updated the triage bot to use 'status/need-information' instead of 'status/need-retesting', aligning with existing lifecycle workflows for automated closure.
• Enhanced Commenting Logic: Modified the label application script to guarantee that a clarifying comment is always posted when the 'status/need-information' label is applied.

Ignored Files

• Ignored by pattern: .github/workflows/** (1)
  • .github/workflows/gemini-scheduled-issue-triage.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request enhances the GitHub Action scripts for issue and PR management by implementing pagination for searches and a more sophisticated stale-handling logic that checks the issue timeline for human activity. It also introduces specific stale messaging for bug reports and allows comments to be posted when specific labels are added, even if general comments are suppressed. Review feedback identifies a high-severity security risk concerning the lack of sanitization for LLM-generated content, which could permit indirect prompt injection, and recommends including pull request review events in the activity whitelist to prevent active PRs from being marked stale.

I am having trouble creating individual review comments. Click here to see my feedback.

.github/scripts/apply-issue-labels.cjs (214-221)

The script incorporates LLM-generated content (entry.explanation) directly into GitHub issue comments without any validation or sanitization. This creates a vulnerability to Indirect Prompt Injection. An attacker can craft a malicious issue description or comment that tricks the LLM into generating harmful content (e.g., phishing links, malicious markdown, or misleading instructions). When the bot posts this content, it carries the authority of the repository, which can be used to deceive users or maintainers. Additionally, the script relies on the issue_number provided in the LLM output (line 80) to determine which issue to modify. Without verifying that this issue_number corresponds to the issue currently being triaged, an attacker could potentially influence the LLM to perform unauthorized actions (labeling or commenting) on arbitrary issues within the repository.

.github/scripts/gemini-lifecycle-manager.cjs (219)

The current whitelist of meaningful events is missing Pull Request specific activities. Since the search query on line 194 includes both issues and pull requests, a PR that is actively being reviewed (e.g., via a human review or a review request) could be incorrectly closed as stale if no comments or label changes occur.

Please add reviewed, review_requested, and review_request_removed to the whitelist to ensure PRs under active review are protected from stale closure.

        if (['commented', 'cross-referenced', 'connected', 'reopened', 'assigned', 'reviewed', 'review_requested', 'review_request_removed'].includes(e.event)) {

[github-actions]

Size Change: -4 B (0%)

Total Size: 33.9 MB

Filename	Size	Change
./bundle/chunk-5SN7FENN.js	0 B	-12.5 kB (removed)	🏆
./bundle/chunk-7DDGGNJQ.js	0 B	-2.79 MB (removed)	🏆
./bundle/chunk-ANUYIKHX.js	0 B	-659 kB (removed)	🏆
./bundle/chunk-ARNSVPQS.js	0 B	-49.2 kB (removed)	🏆
./bundle/chunk-EROD64R6.js	0 B	-16.4 MB (removed)	🏆
./bundle/chunk-NH5P5UNF.js	0 B	-3.77 kB (removed)	🏆
./bundle/chunk-ONHFXHMW.js	0 B	-3.43 kB (removed)	🏆
./bundle/chunk-XDYVOFSZ.js	0 B	-19.5 kB (removed)	🏆
./bundle/core-TXN4VBXO.js	0 B	-49.5 kB (removed)	🏆
./bundle/devtoolsService-RVR2EXUG.js	0 B	-28 kB (removed)	🏆
./bundle/gemini-NHC2LMZZ.js	0 B	-589 kB (removed)	🏆
./bundle/interactiveCli-JRQB5SR4.js	0 B	-1.3 MB (removed)	🏆
./bundle/liteRtServerManager-YZVEMXM7.js	0 B	-2.08 kB (removed)	🏆
./bundle/oauth2-provider-LEJ3OAUM.js	0 B	-9.12 kB (removed)	🏆
./bundle/chunk-26VS4YAG.js	3.77 kB	+3.77 kB (new file)	🆕
./bundle/chunk-FBUDWDXG.js	16.4 MB	+16.4 MB (new file)	🆕
./bundle/chunk-KNUESG2X.js	3.43 kB	+3.43 kB (new file)	🆕
./bundle/chunk-NKTBRCVY.js	659 kB	+659 kB (new file)	🆕
./bundle/chunk-PLAKFSFB.js	19.5 kB	+19.5 kB (new file)	🆕
./bundle/chunk-WCHM2BMP.js	2.79 MB	+2.79 MB (new file)	🆕
./bundle/chunk-X4MIYL33.js	49.2 kB	+49.2 kB (new file)	🆕
./bundle/chunk-XCZDLALU.js	12.5 kB	+12.5 kB (new file)	🆕
./bundle/core-77GK33ZS.js	49.5 kB	+49.5 kB (new file)	🆕
./bundle/devtoolsService-JEUKYJZR.js	28 kB	+28 kB (new file)	🆕
./bundle/gemini-OLISWJAI.js	589 kB	+589 kB (new file)	🆕
./bundle/interactiveCli-3MT5XGBP.js	1.3 MB	+1.3 MB (new file)	🆕
./bundle/liteRtServerManager-BP3YAUJF.js	2.08 kB	+2.08 kB (new file)	🆕
./bundle/oauth2-provider-BRL42DZC.js	9.12 kB	+9.12 kB (new file)	🆕

ℹ️ View Unchanged

Filename	Size	Change
./bundle/bundled/third_party/index.js	8 MB	0 B
./bundle/chunk-34MYV7JD.js	2.45 kB	0 B
./bundle/chunk-5AUYMPVF.js	858 B	0 B
./bundle/chunk-5PS3AYFU.js	1.18 kB	0 B
./bundle/chunk-6HI7VNOG.js	124 kB	0 B
./bundle/chunk-DAHVX5MI.js	206 kB	0 B
./bundle/chunk-IUUIT4SU.js	56.5 kB	0 B
./bundle/chunk-TUDYL3X4.js	40.3 kB	0 B
./bundle/cleanup-RPIIEKDD.js	0 B	-902 B (removed)	🏆
./bundle/devtools-V7NE4CQA.js	696 kB	0 B
./bundle/events-XB7DADIJ.js	418 B	0 B
./bundle/examples/hooks/scripts/on-start.js	188 B	0 B
./bundle/examples/mcp-server/example.js	1.43 kB	0 B
./bundle/gemini.js	5.07 kB	0 B
./bundle/getMachineId-bsd-TXG52NKR.js	1.55 kB	0 B
./bundle/getMachineId-darwin-7OE4DDZ6.js	1.55 kB	0 B
./bundle/getMachineId-linux-SHIFKOOX.js	1.34 kB	0 B
./bundle/getMachineId-unsupported-5U5DOEYY.js	1.06 kB	0 B
./bundle/getMachineId-win-6KLLGOI4.js	1.72 kB	0 B
./bundle/https-proxy-agent-AVGR4LHR.js	490 B	0 B
./bundle/multipart-parser-KPBZEGQU.js	11.7 kB	0 B
./bundle/sandbox-macos-permissive-open.sb	890 B	0 B
./bundle/sandbox-macos-permissive-proxied.sb	1.31 kB	0 B
./bundle/sandbox-macos-restrictive-open.sb	3.36 kB	0 B
./bundle/sandbox-macos-restrictive-proxied.sb	3.56 kB	0 B
./bundle/sandbox-macos-strict-open.sb	4.82 kB	0 B
./bundle/sandbox-macos-strict-proxied.sb	5.02 kB	0 B
./bundle/src-LG4OHBW7.js	233 kB	0 B
./bundle/src-QVCVGIUX.js	47 kB	0 B
./bundle/start-KBNME2HZ.js	0 B	-622 B (removed)	🏆
./bundle/tree-sitter-7U6MW5PS.js	274 kB	0 B
./bundle/tree-sitter-bash-34ZGLXVX.js	1.84 MB	0 B
./bundle/worker/worker-entry.js	361 kB	0 B
./bundle/cleanup-AGBJIVPV.js	902 B	+902 B (new file)	🆕
./bundle/start-Z4XHMITT.js	622 B	+622 B (new file)	🆕

_{compressed-size-action}

[SandyTao520]

Approved.