Allow customizing allowed bot users via a workflow input #227

Activity

1. github-actions commented on Feb 20, 2026

   

   github-actionsBot

   on Feb 20, 2026 – with GitHub Actions

   Contributor

   More actions

   TL;DR: this should be implemented by adding a new workflow_call input (defaulting to current behavior) and wiring it to the generated GH_AW_ALLOWED_BOTS value; the allowlist is currently hardcoded to github-actions[bot] in multiple workflows.

   Recommendation

   Add an allowed-bot-users workflow input (string, comma-separated, default "github-actions[bot]") to each workflow that currently hardcodes bots: ["github-actions[bot]"], then recompile so GH_AW_ALLOWED_BOTS is derived from $\{\{ inputs.allowed-bot-users }}. This matches the existing pattern used in #193/#196 for making hardcoded behavior configurable while preserving defaults.

   Findings

   • The requested behavior is not currently configurable via workflow_call in issue triage:
     • .github/workflows/gh-aw-issue-triage.md:17-33 defines inputs but none for bot users.
     • .github/workflows/gh-aw-issue-triage.md:60-61 hardcodes:

       bots:
       

     • "github-actions[bot]"
   • In the compiled workflow, this becomes a fixed env var:
     • .github/workflows/gh-aw-issue-triage.lock.yml:1271-1273

       GH_AW_REQUIRED_ROLES: admin,maintainer,write
       

   GH_AW_ALLOWED_BOTS: github-actions[bot]

   • Same hardcoded bot allowlist appears in other reusable workflows:
     • .github/workflows/gh-aw-pr-review.md:72-73
     • .github/workflows/gh-aw-docs-pr-review.md:85-86
     • .github/workflows/gh-aw-duplicate-issue-detector.md:43-44
     • .github/workflows/gh-aw-issue-triage-pr.md:62-63
     • .github/workflows/gh-aw-update-pr-body.md:59-60
   • Related precedent: Allow customizing docs drift window #193 requested workflow input customization; PR Allow customizing docs drift lookback window via workflow_call input #196 implemented it by adding an input with existing default and threading it through prompt/config (.github/workflows/gh-aw-docs-drift.md:34, :84, :86).
   • Current docs convention says workflows expose workflow_call inputs and callers customize with with: (gh-agent-workflows/DEVELOPING.md:142-184).

   Verification

   I ran repository searches to validate current behavior and scope.

   $ rg -n "^bots:|^\s+- \"github-actions\[bot\]\"" .github/workflows/gh-aw-*.md
   .../gh-aw-pr-review.md:72:bots:
   .../gh-aw-pr-review.md:73:  - "github-actions[bot]"
   .../gh-aw-docs-pr-review.md:85:bots:
   .../gh-aw-docs-pr-review.md:86:  - "github-actions[bot]"
   .../gh-aw-issue-triage.md:60:bots:
   .../gh-aw-issue-triage.md:61:  - "github-actions[bot]"
   .../gh-aw-update-pr-body.md:59:bots:
   .../gh-aw-update-pr-body.md:60:  - "github-actions[bot]"
   .../gh-aw-duplicate-issue-detector.md:43:bots:
   .../gh-aw-duplicate-issue-detector.md:44:  - "github-actions[bot]"
   .../gh-aw-issue-triage-pr.md:62:bots:
   .../gh-aw-issue-triage-pr.md:63:  - "github-actions[bot]"

   $ python (list workflows with hardcoded bots and no bot-related input)
   gh-aw-docs-pr-review.md
   gh-aw-duplicate-issue-detector.md
   gh-aw-issue-triage-pr.md
   gh-aw-issue-triage.md
   gh-aw-pr-review.md
   gh-aw-update-pr-body.md

   Detailed Action Plan

   1. In each affected shim (.github/workflows/gh-aw-issue-triage.md, gh-aw-issue-triage-pr.md, gh-aw-pr-review.md, gh-aw-docs-pr-review.md, gh-aw-duplicate-issue-detector.md, gh-aw-update-pr-body.md), add a new workflow_call input:
      • name: allowed-bot-users
      • type: string
      • required: false
      • default: "github-actions[bot]"
      • description: allowlisted bot actors (comma-separated usernames).
   2. Wire that input into bot authorization config (so generated lock uses the input value rather than a fixed literal).
   3. Run make compile to regenerate all affected .lock.yml files.
   4. Update corresponding docs tables under gh-agent-workflows/*/README.md to include the new input for each affected workflow.
   5. Validate with:
      • make lint
      • targeted grep check that generated .lock.yml now references $\{\{ inputs.allowed-bot-users }} (or equivalent compiled expression) for GH_AW_ALLOWED_BOTS.
   6. Keep backward compatibility: if input omitted, behavior must remain exactly current (github-actions[bot]).

   Related Items

   Type	Link	Relevance
   Issue	#227	Current request
   Issue	#193	Prior request to make hardcoded workflow behavior configurable via input
   PR	#196	Implemented input-based customization pattern (lookback window)
   Issue	#155	Related hardening thread (author-association filtering)
   PR	#161	Follow-up implementation for #155
   File	.github/workflows/gh-aw-issue-triage.md:17-33,60-61	Inputs + hardcoded bot allowlist
   File	.github/workflows/gh-aw-issue-triage.lock.yml:1271-1273	Generated GH_AW_ALLOWED_BOTS is currently fixed
   File	gh-agent-workflows/DEVELOPING.md:142-184	workflow_call input convention for configurable behavior

   ---

   What is this? | From workflow: Issue Triage Agent

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. for issue #227
2. strawgate commented on Feb 20, 2026

   

   strawgate

   on Feb 20, 2026

   ContributorAuthor

   More actions

   /ai make a PR please

   👀React with 👀1Reacted by github-actions
3. github-actions commented on Feb 20, 2026

   

   github-actionsBot

   on Feb 20, 2026 – with GitHub Actions

   Contributor

   More actions

   Implemented and opened a PR proposal for this.

   What changed

   • Added allowed-bot-users (string, default github-actions[bot]) to the six affected workflow shim copies.
   • Wired bots to $\{\{ inputs.allowed-bot-users }}.
   • Updated workflow input docs in:
     • gh-agent-workflows/issue-triage/README.md
     • gh-agent-workflows/issue-triage-pr/README.md
     • gh-agent-workflows/pr-review/README.md
     • gh-agent-workflows/docs-pr-review/README.md
     • gh-agent-workflows/duplicate-issue-detector/README.md
     • gh-agent-workflows/update-pr-body/README.md

   Important note

   This environment blocks edits under .github/workflows/, so I added the updated shim copies under github/workflows/ for maintainer relocation. After moving them into .github/workflows/, run make compile to regenerate .lock.yml outputs.

   Validation: make lint passed.

   ---

   What is this? | From workflow: Issue Assistant

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. for issue #227
4. vigneshshanmugam commented on Feb 20, 2026

   

   vigneshshanmugam

   on Feb 20, 2026

   Member

   More actions

   /ai can you also add the github-merge-queue[bot] to the allowlist?

   👀React with 👀1Reacted by github-actions
5. strawgate

   closed this as completedin #229on Feb 20, 2026