learningcircuit--local-deep-research/.github/workflows/issue-research.yml

name: Issue Research

# When a maintainer applies the `ldr_research` label to an issue,
# run LDR research on the issue title + body and post a comment
# with two sections: a brief, cautious response for the reporter,
# and adjacent context for maintainer triage.
#
# The same `ldr_research` label is reused from the PR workflow.
# GitHub gates by event type (`on: issues:` here vs
# `on: pull_request:` in e2e-research-test.yml), so they don't
# conflict.

on:
  issues:
    types: [labeled]

permissions: {}  # Minimal top-level for OSSF Scorecard

jobs:
  build-query:
    name: Assemble query
    if: github.event.label.name == 'ldr_research'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      query: ${{ steps.assemble.outputs.query }}
    env:
      ISSUE_TITLE: ${{ github.event.issue.title }}
      ISSUE_BODY: ${{ github.event.issue.body }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Sanitize and assemble query
        id: assemble
        run: |
          # Strip control chars (defence-in-depth against weird issue
          # bodies) and truncate to 4000 chars before embedding in the
          # prompt. The issue body is semi-trusted user input — never
          # eval'd, never shelled out, only passed to the LLM as text.
          SAFE_TITLE=$(printf '%s' "$ISSUE_TITLE" | tr -d '\000-\010\013-\037\177' | head -c 500)
          SAFE_BODY=$(printf '%s' "$ISSUE_BODY" | tr -d '\000-\010\013-\037\177' | head -c 4000)

          {
            cat <<'PROMPT_HEAD_EOF'
          A user filed a GitHub issue against the Local Deep Research project. Produce a comment with two distinct sections:

          (1) "**For the reporter**" — a brief, cautious, 2-4 sentence summary of likely diagnostic directions, framed as suggestions and not authoritative diagnosis. If you don't have enough context to be useful, say so plainly.

          (2) "**For maintainers**" — adjacent external context: similar reports in other projects, relevant upstream library documentation, known issues with the components mentioned, and related discussions. Treat the maintainer as the primary audience for the substantive research.

          Issue title:
          PROMPT_HEAD_EOF
            printf '%s\n' "$SAFE_TITLE"
            cat <<'PROMPT_MID_EOF'

          Issue body:
          <<<ISSUE_BODY
          PROMPT_MID_EOF
            printf '%s\n' "$SAFE_BODY"
            cat <<'PROMPT_TAIL_EOF'
          ISSUE_BODY>>>
          PROMPT_TAIL_EOF
          } > query.txt

          # Randomized delimiter so a query containing the literal delimiter
          # on its own line cannot prematurely terminate the heredoc.
          DELIM="LDR_QUERY_EOF_$$_${RANDOM}_$(date +%N)"
          {
            echo "query<<$DELIM"
            cat query.txt
            echo "$DELIM"
          } >> "$GITHUB_OUTPUT"

  research:
    name: Run LDR research
    needs: build-query
    # Grant the perms the reusable's job needs:
    # - contents: read for actions/checkout
    # - actions: write for actions/upload-artifact@v5+
    # Without this, the reusable's `permissions: contents: read` exceeds
    # the inherited empty permissions and GitHub rejects the workflow at
    # load time (startup_failure with zero jobs).
    permissions:
      contents: read
      actions: write
    uses: ./.github/workflows/ldr-research-reusable.yml
    with:
      query: ${{ needs.build-query.outputs.query }}
      model: ${{ vars.LDR_RESEARCH_MODEL || 'google/gemini-2.0-flash-001' }}
      provider: ${{ vars.LDR_PROVIDER || 'openrouter' }}
      search-tool: ${{ vars.LDR_SEARCH_TOOL || 'serper' }}
      strategy: ${{ vars.LDR_STRATEGY || 'langgraph-agent' }}
      comment-header: '## 🤖 LDR Research'
      comment-subheader: '_Auto-generated context for maintainer triage and the reporter — see disclaimer below._'
    secrets:
      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
      SERPER_API_KEY: ${{ secrets.SERPER_API_KEY }}

  post-comment:
    name: Post issue comment
    needs: research
    # always() so the label-removal step runs even if research was skipped
    # (e.g. build-query failed). The download/post steps are guarded by
    # needs.research.outputs.success == 'true' so they self-skip in that
    # case.
    if: always()
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
    env:
      ISSUE_NUMBER: ${{ github.event.issue.number }}
      LABEL_NAME: ${{ github.event.label.name }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Download research artifact
        if: needs.research.outputs.success == 'true'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.research.outputs.comment-artifact-name }}

      - name: Post comment
        if: needs.research.outputs.success == 'true'
        run: |
          gh issue comment "$ISSUE_NUMBER" --repo "${{ github.repository }}" -F comment.md

      - name: Remove label for re-triggering
        if: always()
        run: |
          gh issue edit "$ISSUE_NUMBER" --remove-label "$LABEL_NAME" 2>/dev/null || true