fix(ci): repoint io-triage to wave-foundation-public mirror

[yakimoto]

Symptom

wave-av/sdk-python's issue-ops-triage lane has zero recorded runs at all (gh run list --repo wave-av/sdk-python --workflow issue-ops-triage.yml --json conclusion returns []). Not "it fails" — it never even shows up as an attempt. Issue triage has never run on this repo.

Cause

wave-av/sdk-python is a public repository. issue-ops-triage.yml called a reusable workflow hosted in wave-av/wave-foundation, a private repository. A public repo cannot uses: a reusable workflow in a private one — the call dies at startup_failure: no jobs, no logs, and no check appears on the triggering issue event at all. It doesn't go red; it vanishes, which is exactly why gh run list shows nothing rather than a string of failures. That invisibility is why this went unnoticed.

Fix — three pointers, moved together

1. uses: → wave-av/wave-foundation-public/.github/workflows/io-triage.yml@f63b91566ab311b09599db6195da8c353cab1f69
2. with.scripts_repo: → wave-av/wave-foundation-public
3. with.scripts_ref: → "f63b91566ab311b09599db6195da8c353cab1f69"

Pointers 2 and 3 are not optional. io-triage.yml doesn't embed its scripts — it sparse-checkouts scripts/issue-ops from scripts_repo at scripts_ref at runtime. Moving only uses: clears the startup_failure and dies one step later on a checkout of a private repo this token can't read. All three land together or the lane fails a different way.

Provenance

This exact repoint (same three fields, same pinned mirror SHA) is the pilot fix already proven green at wave-av/adk — its first successful issue-ops-triage run in 9 runs all-time, 2026-09-01T13:07. The pilot took five rounds (startup_failure → bad scripts_ref → missing lib.sh → missing classify.sh/dedup.sh/trust-tier.sh → green); all seven scripts in the closure are now published in the mirror, so this repoint should go green first try.

Verification

By run outcome, not the PR check rollup — a startup_failure produces no rollup entry:

gh run list --repo wave-av/sdk-python --workflow issue-ops-triage.yml --json conclusion

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Note

Low Risk
CI wiring only—no application code, secrets, or permissions change beyond pointing at a published public mirror SHA already validated on another repo.

Overview
Fixes invisible issue triage on this public repo by moving the reusable workflow and runtime script checkout off the private wave-av/wave-foundation repo to the public mirror wave-av/wave-foundation-public, all pinned to commit f63b915.

The change updates three coordinated fields in issue-ops-triage.yml: the uses: workflow reference, with.scripts_repo, and with.scripts_ref. Public repositories cannot call reusable workflows in private repos (startup failure with no runs recorded); the script inputs must move with uses: because io-triage sparse-checkouts scripts/issue-ops from that repo at runtime.

^{Reviewed by Cursor Bugbot for commit f8f0f77. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by Sourcery

Enable issue triage in the public repository by using the pinned workflow and scripts from the public foundation mirror.

Bug Fixes:

• Restore issue triage execution for the public SDK repository by switching it from the inaccessible private workflow and scripts repository to the public mirror.

CI:

• Repoint the issue-ops-triage reusable workflow and its pinned scripts source to the matching public mirror revision.

[codeant-ai]

Your free trial PR review limit of 300 PRs has been reached. Please upgrade your plan to continue using CodeAnt AI.

[qodo-code-review]

ⓘ Qodo reviews are paused because your workspace is out of credits. Ask your workspace admin to add credits to resume reviews. Manage billing

[sourcery-ai]

Sorry @yakimoto, this account has used its review budget of 2,500,000 diff characters for the last 7 days.

You can request another review in 1 day and 4 hours by commenting @sourcery-ai review.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_eda893f5-6559-4a69-808c-39839f5a1b58)

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Fix issue triage startup failures in the public repository by switching all workflow and script dependencies to the public wave-foundation mirror at the same immutable SHA.

File-Level Changes

Change	Details	Files
Repoint the issue-triage reusable workflow and its runtime script source from the private foundation repository to the public mirror using one pinned commit.	Update the reusable workflow reference to the public mirror. Update the scripts repository and scripts revision to the matching mirror commit. Keep the workflow and script pins aligned so runtime sparse checkout can access the required scripts.	.github/workflows/issue-ops-triage.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 15764a0d-c59a-49ea-89ba-dcef23ba35cd

📥 Commits

Reviewing files that changed from the base of the PR and between 52888d4 and f8f0f77.

📒 Files selected for processing (1)

• .github/workflows/issue-ops-triage.yml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: Macroscope - Approvability Check
• GitHub Check: semgrep-cloud-platform/scan

🧰 Additional context used

🪛 zizmor (1.29.0)

.github/workflows/issue-ops-triage.yml

[warning] 17-17: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

🔇 Additional comments (2)

.github/workflows/issue-ops-triage.yml (2)

17-17: 📐 Maintainability & Code Quality | ⚡ Quick win

Document the issues: write permission.

Add a short comment that states why the reusable workflow needs issue write access. Keep the permission reason next to the setting so future source changes remain easy to review.

Proposed change

 permissions:
   contents: read
-  issues: write
+  issues: write # Required for triage labels and issue comments.

Source: Linters/SAST tools

---

14-20: 🩺 Stability & Availability

No qualifying triage run is available.

The workflow history contains no issue-triggered runs, so end-to-end operation remains unestablished.

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated issue triage automation to use the publicly available workflow and supporting scripts.
  • Improved transparency and accessibility of automated issue processing.

Walkthrough

The issue triage job now uses the public wave-foundation-public reusable workflow and scripts repository at commit f63b91566ab311b09599db6195da8c353cab1f69.

Changes

Issue operations triage

Layer / File(s)	Summary
Update triage workflow sources .github/workflows/issue-ops-triage.yml	The triage workflow now references wave-av/wave-foundation-public and its pinned commit instead of the private repository and previous commit.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to f8f0f

This localized CI-only change repoints issue triage to the pinned public mirror without changing application behavior, secrets, or permissions. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI fix and specifies that issue triage now points to the public foundation mirror.
Description check	✅ Passed	The description directly explains the missing triage runs, the private-repository access problem, the three coordinated workflow changes, and the verification method.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/repoint-io-triage-to-mirror

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/repoint-io-triage-to-mirror

---

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Code Review ✅ Approved

Fixes invisible issue triage on this public repo by repointing the issue-ops-triage workflow from the private wave-av/wave-foundation to the public mirror wave-av/wave-foundation-public, updating uses:, with.scripts_repo, and with.scripts_ref to commit f63b915. This exact repoint was already validated green on wave-av/adk. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[macroscopeapp]

Approvability

Verdict: Would Approve

Macroscope's review found this PR approvable — The PR only retargets an existing issue-ops workflow and its pinned script checkout from an inaccessible private repository to the matching public SHA; triggers, permissions, secrets, and application code remain unchanged. Its runtime effect is limited to restoring the intended issue-event triage automation.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}