feat: add maintainer go/no-go issue-decision workflows

[Elizabeth Maher (EMaher)]

Summary

Adds the maintainer go/no-go decision stage of issue triage, picking up where issue-triage.md (runs on newly-opened issues) leaves off. Three focused workflows replace the single deterministic squad-issue-assign.yml:

Trigger	Workflow	Kind	Behavior
go:yes	issue-assign.md	agentic (gh-aw)	Assigns the issue to the maintainer who applied the label, routes to squad areas, hands off to Copilot
go:needs-research	issue-clarify.md	agentic (gh-aw)	Posts one comment with clarifying questions
go:no	issue-nogo.yml	deterministic	Closes the issue as not_planned and applies close:wont-fix

What each workflow does

issue-assign.md (go:yes)

• Assigns the issue to the maintainer who applied go:yes (the label event sender) — the agent does not pick the assignee.
• Reads the prior triage analysis comment plus .squad/routing-table.json and .squad/issue-routing.json to decide which squad areas the issue touches.
• Applies squad (always) + one squad:{member} label per matched area + squad:copilot to hand off to the Copilot coding agent, and posts a rationale comment.
• Safe outputs: assign-to-user (max 1), add-labels (allowed [squad, squad:*], blocked [go:*, priority:*, override:*, type:*], max 5), add-comment (max 1).
• A deterministic post-check job (needs: [agent, safe_outputs]) verifies the assignee includes the go:yes sender and that every applied squad:* label maps to the routing tables (with squad:copilot always allowed); the run fails otherwise.

issue-clarify.md (go:needs-research)

• Posts at most one comment with 2–5 focused clarifying questions, or sharpens the maintainer's existing questions instead of duplicating them.

issue-nogo.yml (go:no)

• Verifies the sender is an admin/maintainer, adds close:wont-fix, and closes the issue as not_planned. No AI, no comment (the maintainer supplies rationale manually).

Security / correctness

• Role gating: agentic workflows use gh-aw's roles: [admin, maintainer] + names: label filters; issue-nogo.yml checks the cumulative permission booleans (admin/maintain) rather than the legacy permission field, which collapses the maintain role to write (so a bare permission === 'maintain' check would wrongly reject maintainers).
• Prompt-injection isolation: untrusted issue title/body/comments go into a context-role: user file; trusted policy + routing tables into a context-role: system file; a contract-test step enforces the separation.
• Reopening an issue does not re-trigger triage — issue-triage.md stays types: [opened] (reopen fires reopened).

Notes

• "won't-fix" is mapped to the existing managed label close:wont-fix (there is no bare wont-fix label in issue-labels-sync.yml).
• The .lock.yml files are compiled output (gh aw compile), pinned to gh-aw v0.80.9 to match doc-freshness.lock.yml; the actions-lock.json change only adds the actions/github-script@v8 pin.
• A code review was performed on the source workflows; the one finding (the issue-nogo.yml maintain→write permission bug) has been fixed in this branch.

Related

• Supersedes the deterministic squad-issue-assign.yml (originally feat: implement issue assignment agentic workflow (go:yes trigger) #186), now deleted.

Files

• Added: issue-assign.md (+ .lock.yml), issue-clarify.md (+ .lock.yml), issue-nogo.yml
• Modified: .github/aw/actions-lock.json
• Deleted: squad-issue-assign.yml

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com