openclaw/.github/workflows/auto-response.yml

name: Auto response

on:
  issues:
    types: [opened, edited, labeled]
  issue_comment:
    types: [created]
  pull_request_target: # zizmor: ignore[dangerous-triggers] maintainer-owned label automation; trusted base checkout only, no untrusted PR code execution
    types: [opened, edited, synchronize, reopened, labeled, unlabeled]

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

permissions: {}

jobs:
  auto-response:
    if: >-
      ${{ (
        !contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association || github.event.pull_request.author_association) &&
        (github.event_name != 'issue_comment' || github.event.comment.user.type != 'Bot') &&
        (github.event.action != 'edited' || !github.event.changes ||
          github.event.changes.title || github.event.changes.body || github.event.changes.base) &&
        (
          github.event_name != 'pull_request_target' ||
          (github.event.action != 'labeled' && github.event.action != 'unlabeled') ||
          (github.actor != 'clawsweeper[bot]' && github.actor != 'openclaw-clawsweeper[bot]')
        )
      ) }}
    concurrency:
      group: ${{ github.workflow }}-${{ github.event.issue.number || github.event.pull_request.number }}
      cancel-in-progress: ${{ github.event_name == 'pull_request_target' && github.event.action == 'synchronize' }}
    permissions:
      contents: read
      issues: write
      pull-requests: write
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
        id: app-token
        continue-on-error: true
        with:
          app-id: "2729701"
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          permission-issues: write
          permission-members: read
          permission-metadata: read
          permission-pull-requests: write
      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
        id: app-token-fallback
        if: steps.app-token.outcome == 'failure'
        with:
          app-id: "2971289"
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }}
          permission-issues: write
          permission-members: read
          permission-metadata: read
          permission-pull-requests: write
      - name: Run Barnacle auto-response
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        with:
          github-token: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token }}
          script: |
            const { pathToFileURL } = require("node:url");
            const moduleUrl = pathToFileURL(
              `${process.env.GITHUB_WORKSPACE}/scripts/github/barnacle-auto-response.mjs`,
            );
            const { runBarnacleAutoResponse } = await import(moduleUrl.href);

            await runBarnacleAutoResponse({ github, context, core });