Repository navigation
Prepare public issue/PR intake and triage policy - #348
Merged
Merged
Conversation
- Bug form: required Platform (multi-select) and Impact dropdowns, clearer version/build guidance (Settings > About), duplicate-search and playbook pointers, and a default needs-triage label. - Feature form: needs-triage label; open-ended ideas routed to Discussions Ideas and questions to Q&A via the form text and config contact links. - Add a pull request template asking for linked issue, affected platforms/backends, verification evidence, a privacy checklist, and the AI model/harness used. - Add .github/triage/PLAYBOOK.md for reporters' own coding agents and .github/triage/BOT-POLICY.md for the maintainer's external triage bot (label taxonomy, disclosure banner, allowed/forbidden actions, security fail-closed handling; #265 remains the long-term plan). - Point CONTRIBUTING, REPORTING-BUGS, and SUPPORT at the new intake.
6 of 7 tasks
jlipworth
added a commit
that referenced
this pull request
Oct 16, 2026
## Summary Makes outside pull requests cheap to review by flagging the ones that touch essential surfaces, and says plainly that a PR may be re-implemented rather than merged. - `.github/triage/sensitive-paths.txt` is the single list of sensitive paths, grouped by category: signing and entitlements, auth and credentials, the transcode profile, dependencies, CI and release tooling, App Store text, agent instructions (`CLAUDE.md`, `AGENTS.md`, `.claude/`, `.codex/`), and policies. - `scripts/check-sensitive-paths.py` lists the matching files for a PR (`--pr N`), a branch (`--base REF`), or a list of paths. For PRs it also checks the old path of renamed files. It is read-only and never checks out PR code. - The new `sensitive-paths` label has been created. Under BOT-POLICY the bot applies it and names the matched categories, without judging whether the change is safe. It never removes the label. - `docs/CONTRIBUTING.md` and the PR template: PRs are proposals. The maintainer may merge one or re-implement it with credit, and sensitive-path changes usually get re-implemented. - `CLAUDE.md`: before proposing to merge someone else's PR, run the checker, report every match, and review those files line by line. GitHub Actions is disabled for this repo, and Woodpecker has no token that can label PRs, so the label is applied by the bot (or by hand), not by CI. ## Linked issue None. This is a follow-up to #348. ## Affected surface - Platforms: none (tooling and docs) - Backends: none ## Verification evidence - [x] Commands run and results: - 5 new unit tests pass. - `scripts/ci-hygiene.sh` passes locally: strict MkDocs build, link and Mermaid checks, tooling tests. - Checker on recent PRs: #346 finds nothing; #342 finds the TestFlight script and both skill mirrors; this branch finds 5 files. - [x] Simulator / host / device evidence: not applicable, no app code. - [ ] Not verified (and why): the bot behavior. The bot runs on the maintainer's own accounts. ## Privacy checklist - [x] No tokens, client identifiers, passwords, or signing/team identifiers. - [x] No real server hostnames, IPs, or URLs. - [x] No usernames, media titles, filenames, library paths, or personal home-directory paths. - [x] Security-sensitive changes were discussed privately first (n/a). ## AI assistance Claude Opus via Claude Code wrote the change. The maintainer reviews it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
.github/ISSUE_TEMPLATE/bug_report.yml): new required Platform (multi-select: Apple Vision Pro, iPhone, iPad, Apple TV, Mac) and Impact dropdowns; version/build field now explains where to find it (About section at the bottom of Settings: Version, Build, Build ID — perSettingsView.aboutSection) and asks for App Store / TestFlight / source build; OS field covers tvOS; duplicate-search and playbook pointers; default labelsbug,needs-triage. Privacy check and diagnostic-report guidance unchanged.needs-triage, and routes open-ended ideas to Discussions ▸ Ideas and questions to Q&A.config.ymlcontact links now point at those categories..github/pull_request_template.md): summary, linked issue, platforms/backends, verification evidence (native-test-matrix, core checks, simulator/host smoke, device/live-server labeled separately), privacy checklist, AI model/harness disclosure..github/triage/PLAYBOOK.md: for a reporter's own coding agent — untrusted-data rule, no secrets/personal data, security goes private, explicit user approval before posting, duplicate search first, required facts, redacted diagnostic report viadocs/REPORTING-BUGS.md, agent/model footer used to applyvia-triage..github/triage/BOT-POLICY.md: binding policy for the maintainer's external triage bot — disclosure banner, one edited comment per item, label taxonomy (bot-applicable vs maintainer-only), allowed/forbidden actions, security fail-closed, PR and Discussion handling. References Umbrella: build a conservative ClawSweeper-style maintainer automation system #265 as the long-term plan.docs/CONTRIBUTING.md,docs/REPORTING-BUGS.md, andSUPPORT.md.Labels created
needs-triage,needs-info,accepted,upstream,via-triage,backend:plex,backend:jellyfin,backend:emby. No existing labels changed.Checks run
uv run --with-requirements requirements.txt mkdocs build --strict— okuv run python scripts/check-doc-links.py --site-dir site— okuv run python scripts/check-docs-mermaid.py— okPATH=/usr/bin:$PATH scripts/ci-hygiene.sh— okNo app code changed; no simulator or app build needed.
Maintainer decisions
needs-triageremoval is tied toacceptedor astatus:*label; adjust if you prefer otherwise.