issue-comment.yml

name: Auto-comment on Issues with Diagnostics Links

# =============================================================================
# PURPOSE: Automatically respond to new issues with helpful templates
# 
# This workflow:
# 1. Detects the type of issue (bug, question, security CVE, etc.)
# 2. Posts an appropriate template comment with guidance
# 3. For security issues (CVE/GHSA), closes and labels for admin deletion
#
# Template files are stored in .github/issue-comments/
# =============================================================================

# Triggers on newly opened issues
on:
  issues:
    types: [opened]

permissions:
  contents: read   # Read template files from repository
  issues: write    # Post comments, add labels, close issues

jobs:
  comment-on-issue:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 1  # Shallow clone - only need template files

      - name: Comment on bug reports
        uses: actions/github-script@v8
        with:
          script: |
            const fs = require('fs');
            const path = require('path');
            const workspace = process.env.GITHUB_WORKSPACE || process.cwd();

            // =========================================================
            // STEP 1: Load all comment templates from .github/issue-comments/
            // 
            // Template files:
            //   - bug.md        : For bug reports (has "describe the issue")
            //   - question.md   : For questions (has "how can we help")
            //   - generic.md    : Fallback for unrecognized issue types
            //   - system-info.md: When in-app reporter was used
            //   - security.md   : For CVE/GHSA security disclosures
            // =========================================================
            let bugComment = '';
            let questionComment = '';
            let genericComment = '';
            let systemInfoComment = '';
            let securityComment = '';
            try {
              bugComment = fs.readFileSync(path.join(workspace, '.github/issue-comments/bug.md'), 'utf8');
            } catch (e) {
              console.log('Could not read bug.md:', e.message);
            }
            try {
              questionComment = fs.readFileSync(path.join(workspace, '.github/issue-comments/question.md'), 'utf8');
            } catch (e) {
              console.log('Could not read question.md:', e.message);
            }
            try {
              genericComment = fs.readFileSync(path.join(workspace, '.github/issue-comments/generic.md'), 'utf8');
            } catch (e) {
              console.log('Could not read generic.md:', e.message);
            }
            try {
              systemInfoComment = fs.readFileSync(path.join(workspace, '.github/issue-comments/system-info.md'), 'utf8');
            } catch (e) {
              console.log('Could not read system-info.md:', e.message);
            }
            try {
              securityComment = fs.readFileSync(path.join(workspace, '.github/issue-comments/security.md'), 'utf8');
            } catch (e) {
              console.log('Could not read security.md:', e.message);
            }

            // =========================================================
            // STEP 2: Extract issue content for classification
            // =========================================================
            const issue = context.payload.issue || {};
            const title = (issue.title || '');
            const body = (issue.body || '');
            const titleLower = title.toLowerCase();
            const bodyLower = body.toLowerCase();
            
            // =========================================================
            // STEP 3: Detect issue type using content patterns
            // 
            // SECURITY CHECK (highest priority):
            //   - CVE pattern: CVE-2025-1234 or just CVE-
            //   - GHSA pattern: GHSA-xxxx-xxxx-xxxx (GitHub Security Advisory)
            //   These should NEVER be disclosed publicly in issues!
            //
            // SYSTEM INFO CHECK:
            //   - "Collected Value Title" indicates the in-app bug reporter
            //     was used, which automatically captures system info
            //
            // ISSUE TYPE CHECK:
            //   - "describe the issue" = bug report template
            //   - "how can we help" = question template
            // =========================================================
            const cvePattern = /cve-(\d{4}-\d+)?/i;
            const ghsaPattern = /ghsa-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/i;
            const hasCVE = cvePattern.test(title) || cvePattern.test(body) || ghsaPattern.test(title) || ghsaPattern.test(body);
            
            const hasSystemInfo = bodyLower.includes('collected value title');
            
            const isBug = bodyLower.includes('describe the issue');
            const isQuestion = bodyLower.includes('how can we help');
            
            console.log('Issue Classification Results:');
            console.log('  hasCVE:', hasCVE, '(security vulnerability disclosure)');
            console.log('  hasSystemInfo:', hasSystemInfo, '(in-app reporter used)');
            console.log('  isBug:', isBug);
            console.log('  isQuestion:', isQuestion);

            // =========================================================
            // STEP 4: Select appropriate template
            // 
            // Priority order (highest to lowest):
            //   1. Security (CVE/GHSA) - Must be handled immediately
            //   2. System-info - User used in-app reporter, thank them
            //   3. Bug report - Standard bug template
            //   4. Question - Help/support template
            //   5. Generic - Fallback for unrecognized issues
            // =========================================================
            let comment = '';
            if (hasCVE && securityComment) {
              console.log('Posting security comment - CVE detected');
              comment = securityComment;
            } else if (hasSystemInfo && systemInfoComment) {
              console.log('Posting system-info comment');
              comment = systemInfoComment;
            } else if (isBug && bugComment) {
              console.log('Posting bug comment');
              comment = bugComment;
            } else if (isQuestion && questionComment) {
              console.log('Posting question comment');
              comment = questionComment;
            } else if (genericComment) {
              console.log('Posting generic comment');
              comment = genericComment;
            }

            // =========================================================
            // STEP 5: Post comment and handle security issues
            // =========================================================
            if (comment) {
              await github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: comment
              });
              
              // ---------------------------------------------------------
              // SECURITY HANDLING: CVE/GHSA issues must be closed immediately
              // to prevent public disclosure of vulnerabilities.
              //
              // Actions taken:
              //   1. Add 'security' and 'security-delete-required' labels
              //   2. Close the issue with 'not_planned' reason
              //   3. Log for admin to manually delete (API can't delete issues)
              //
              // The security.md template directs users to:
              //   https://github.com/ChurchCRM/CRM/security/advisories
              // ---------------------------------------------------------
              if (hasCVE) {
                console.log('⚠️ SECURITY: Closing issue due to CVE/GHSA disclosure');
                
                await github.rest.issues.addLabels({
                  issue_number: context.issue.number,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  labels: ['security', 'security-delete-required']
                });
                
                await github.rest.issues.update({
                  issue_number: context.issue.number,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  state: 'closed',
                  state_reason: 'not_planned'
                });
                
                // Note: GitHub REST API doesn't support issue deletion
                // Issues can only be deleted by repository admins via the UI
                // The 'security-delete-required' label flags this for admin action
                console.log('Issue closed and labeled - manual deletion required by admin');
              }
            } else {
              console.log('No comment template available to post.');
            }