Changes:
- Renamed workflow from "issue-triage" to "classify-issue-severity"
- Replaced keyword-based analysis with Claude AI for intelligent issue classification
- Added comprehensive prompting to account for customers overstating issues
- AI analyzes actual impact vs. customer claims, considering:
  * What functionality is actually broken
  * How many users are affected
  * Whether workarounds exist
  * Whether critical workflows are blocked
  * Overall business impact

The workflow now uses Claude 3.5 Sonnet via the Anthropic API to provide
thoughtful, context-aware severity assessments that look beyond keywords.

Requires ANTHROPIC_API_KEY to be configured as a repository secret.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

…ity classification

Changes:
- Integrated anthropics/claude-code-action@v1 GitHub Action
- Replaced custom API implementation with official action
- Enhanced prompt with comprehensive analysis framework encouraging deep reasoning:
  * What is actually broken vs. what customer claims
  * Realistic user impact assessment
  * Workaround analysis
  * Critical workflow impact evaluation
  * Business risk and urgency assessment

The action now uses Claude Code to:
1. Think deeply through the issue using a 5-point analysis framework
2. Reason through severity level comparison (s0-s4)
3. Post an intelligent comment via GitHub CLI with justified recommendation
4. Show work by explaining why one severity was chosen over others

This provides genuine analytical thinking rather than keyword matching,
accounting for customers who may overstate issue severity.

Requires ANTHROPIC_API_KEY repository secret.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Added a new section that allows Claude to decline classification when
there isn't enough information to make a confident assessment.

Changes:
- Added "Insufficient Information Fail-Safe" section to prompt
- Defined common scenarios where classification should be declined:
  * No description or minimal details
  * Unclear what feature/component is affected
  * Missing reproduction steps or error messages
  * Ambiguous issue type
  * Missing user impact information

- Provided two comment formats:
  1. Format 1: Confident classification (existing behavior)
  2. Format 2: Insufficient information - requests specific details needed

- Emphasizes honesty over forced classification
- Guides Claude to explain what's missing and suggest next steps

This prevents misclassification of vague issues and prompts reporters
to provide the necessary context for proper severity assessment.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Address security feedback from Zizmor audit tool.

Changed from:
  uses: anthropics/claude-code-action@v1

To:
  uses: anthropics/claude-code-action@f0c8eb2 # v1.0.23

This pins the action to a specific commit hash (v1.0.23) to prevent
potential supply chain attacks from compromised or updated action versions,
following GitHub's security best practices for third-party actions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Added header comment to clarify:
- This is a work-in-progress workflow
- Main use case is to assist in evaluating issue severity
- Helps with triaging incoming tickets

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

…cution

Addresses security feedback by implementing a two-job architecture:

**Job 1: AI Analysis (No Tool Access)**
- Claude analyzes issue and outputs structured JSON only
- No bash/command execution capabilities
- Removes prompt injection attack vector
- Output format validated: {"status": "classified|insufficient_info", "severity": "s0-s4", "reasoning": "..."}

**Job 2: Safe Comment Posting**
- Parses and validates JSON using jq
- Whitelists only valid severity values (s0-s4)
- Executes deterministic gh issue comment command
- No LLM involvement in command execution

**Security Improvements:**
1. Removed unnecessary id-token: write permission
2. Eliminated prompt injection vulnerability - user-controlled fields (title, body) no longer directly control command execution
3. LLM has no tool access - can only analyze and return data
4. All commands are deterministic and validated before execution

This separates analytical function from operational access, preventing malicious issue content from being executed as commands.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>