feat: add agentic issue and PR processing workflows

.github/workflows/pr-lint.yml

@@ -4,11 +4,7 @@ name: 'PR'
 
 on:
   pull_request_target:
-    types:
-      - opened
-      - reopened
-      - edited
-      - synchronize
+    types: [opened, reopened, edited, synchronize]
 
 permissions:
   contents: read

.github/workflows/pr-quality-check.yml

@@ -0,0 +1,45 @@
+name: PR Quality Check
+on:
+  pull_request:
+    types: [opened, reopened]
+
+concurrency:
+  group: pr-quality-check-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  pr_quality_check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # GitHub withholds secrets from fork pull_request runs, so the agent can only
+    # authenticate for same-repo PRs opened by collaborators and members.
+    if: >
+      github.event.pull_request.user.type != 'Bot' &&
+      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install litellm PyGithub
+      - name: Run PR quality check agent
+        env:
+          MODEL: ${{ vars.MODEL }} # e.g: "claude-sonnet-5", "gpt-4o", etc.
+          DEBUG_AI_WORKFLOWS: ${{ vars.DEBUG_AI_WORKFLOWS }} # Enable token/cost logging
+
+          # Only API key for the chosen model is required
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+
+          # Obtained automatically by GH Actions
+          AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+          AUTHOR_USERNAME: ${{ github.event.pull_request.user.login }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          REPO_NAME: ${{ github.repository }}
+        run: python scripts/agents/pr_checker_agent.py

.github/workflows/security-review.yml

@@ -0,0 +1,55 @@
+name: Security Review
+
+on:
+  pull_request:
+    types: [opened, reopened]
+  issue_comment:
+    types: [created]
+
+concurrency:
+  group: security-review-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: true
+
+jobs:
+  security-review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # Runs on PR creation by a collaborator/member
+    # or when collaborator/member comments "/security-review"
+    if: >
+      (
+        github.event_name == 'pull_request' &&
+        github.event.pull_request.user.type != 'Bot' &&
+        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)
+      ) || (
+        github.event_name == 'issue_comment' &&
+        github.event.issue.pull_request != null &&
+        startsWith(github.event.comment.body, '/security-review') &&
+        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+      )
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install litellm PyGithub
+      - name: Run security review agent
+        env:
+          IGNORED_PATTERNS: package-lock.json,yarn.lock,dist/*,build/*
+          MODEL: ${{ vars.MODEL }} # e.g: "claude-sonnet-5", "gpt-4o", etc.
+          DEBUG_AI_WORKFLOWS: ${{ vars.DEBUG_AI_WORKFLOWS }} # Enable token/cost logging
+
+          # Only API key for the chosen model is required
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+
+          # Obtained automatically by GH Actions
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
+          REPO_NAME: ${{ github.repository }}
+          TRIGGER: ${{ github.event_name }}
+        run: python scripts/agents/security_review_agent.py

.github/workflows/triage.yml

@@ -0,0 +1,41 @@
+name: Issue Triage
+on:
+  issues:
+    types: [opened, reopened]
+
+concurrency:
+  group: issue-triage-${{ github.event.issue.number }}
+  cancel-in-progress: true
+
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.event.issue.user.type != 'Bot'
+    permissions:
+      issues: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install litellm PyGithub
+      - name: Run triage agent
+        env:
+          AVAILABLE_LABELS: automation,bug,dependencies,documentation,enhancement,good-first-issue,meeting,needs-info,plugins,protocol,question,security,tech-debt,testing
+          LATEST_ISSUES_LIMIT: 100 # Number of issues to check for duplicates
+          MODEL: ${{ vars.MODEL }} # e.g: "claude-sonnet-4-6", "gpt-4o", etc.
+          DEBUG_AI_WORKFLOWS: ${{ vars.DEBUG_AI_WORKFLOWS }} # Enable token/cost logging
+
+          # Only API key for the chosen model is required
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+
+          # Obtained automatically by GH Actions
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+          REPO_NAME: ${{ github.repository }}
+        run: python scripts/agents/triage_agent.py