# A minimal, mechanism-faithful reproduction of the CVE-2026-44246 shape.
#
# This is NOT nnU-Net's file. It is a reduced fixture written to carry the four
# conditions a detector has to notice, and nothing else:
#
#   1. `on: issues`            - the trigger, whose text anyone can author
#   2. `issues: write`         - a repository write scope on the job
#   3. `allowed_non_write_users` - the explicit opt-out of the action's own
#                                  actor-permission check, so an author without
#                                  write access can reach the agent
#   4. `${{ github.event.issue.title }}` / `.body` interpolated into `prompt`
#                              - untrusted text in the instruction channel
#
# The agent's allowlist also grants the mutation commands, so the write scope is
# reachable by the agent and not only by the job. Removing any one of the four
# conditions is a different workflow with a different severity; see fixed.yml.
#
# Do not deploy this. It exists to be detected.
name: Issue Triage

on:
  issues:
    types: [opened]

jobs:
  triage:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run triage agent
        uses: anthropics/claude-code-action@v1
        with:
          allowed_non_write_users: ${{ github.event.issue.user.login }}
          claude_args: --allowedTools "Read,Bash(gh issue comment:*),Bash(gh issue edit:*),Bash(gh search issues:*),Bash(grep:*),Bash(ls:*)"
          prompt: |
            Triage the following issue. If it is a bug report, label it and
            leave a short comment.

            TITLE: ${{ github.event.issue.title }}
            BODY: ${{ github.event.issue.body }}