feat(review): read-only conversational /ask for non-write users
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 42/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 技术栈
- github, java
调研方向
Start with ManualReviewAuthorizer, MaintainerReplyService, TriggerDetector, and WebhookController.maybeDispatchConversationalMention; trace how authorization and mention routing work, then review the related spend cap and pause behavior in #42. Done means the config, README, and tests cover read-only question routing while slash commands remain write-gated and the ask path creates no reviews, findings, or check runs.
由索引模型根据 Issue 内容生成。
描述
Problem Statement
Today all commands except /help require write access (CommentCommandService.HELP_TEXT, ManualReviewAuthorizer). Conversational @mention replies on PRs and review threads use the same authorizer (MaintainerReplyService → ManualReviewAuthorizer.isAuthorized), so read-only collaborators cannot ask questions without triggering spend-heavy review commands.
This is an intentional simplicity tradeoff (prevent drive-by AI spend) documented in PLAN.md → Simplicity tradeoffs, but teams with many read-only reviewers (docs, QA, security readers) want a question-only path that does not post findings, suggestions, check runs, or merge-blocking verdicts.
Proposed Solution
Add a read-only ask mode for conversational mentions (not slash commands):
- Eligible users: any collaborator with read access (or higher) on the repo — confirmed via GitHub collaborator permission API (same pattern as write check in
ManualReviewAuthorizer, but acceptread/triage/write/admin). - Trigger: bare
@bot …mention on a PR comment or review thread (WebhookController.maybeDispatchConversationalMention/ review-thread path) where the body is a question (no command verb likereview,describe, etc. — reuseTriggerDetectorcommand detection to reject command-shaped mentions). - Behavior: single conversational reply (
MaintainerReplyService) — no check run, no inline findings, no REQUEST_CHANGES, no label mutations. Optional disclosure footer: "Read-only ask — for a full review, a maintainer with write access can run/review." - Spend controls: honor #42 caps and
/pause; consider a separate lower token budget config for ask-only replies. - 👀 ack: if #315 lands first, read-only asks should not get 👀 (per #315 scope: commands only) — document clearly.
Config knob, e.g. thrillhousebot.review.read-only-ask-enabled (default: false to preserve current fail-closed behavior).
Related issues
- #315 — 👀 on commands only (explicitly excludes conversational asks)
- #322–#323 — other simplicity-tradeoff knobs (same milestone theme)
- #42 — spend cap
- #50 — model config / budgets
Acceptance criteria
- Read-only collaborator can get a conversational answer when
read-only-ask-enabled=true - Read-only user still cannot run
/review,/describe, or other write-gated slash commands - Ask path never creates or updates check runs, PR reviews, or inline finding comments
- Write users unchanged — existing authorized conversational + command behavior
- Config + README documented; tests for auth gate and command-vs-ask routing
Alternatives considered
- Allow
/askslash command — clearer UX but expands command surface; mention-only keeps parity with "ask the bot a question" flow. - Open conversational replies to everyone — rejected; still need collaborator check to limit spam.
Priority
Important — simplicity tradeoff evolution; target v0.5.0 with other configurability work (#322, #324).
Code of Conduct
- I have searched for existing issues and this is not a duplicate.
- 主要语言
- Java
- 星标
- 35
- 派生
- 7
- 平均合并
- 7 小时 7 分钟
- 30 天内合并 PR
- 225
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
devops-thiago/ThrillhouseBot 的其他 Issue
-
documentation enhancement
难度 2/5 1-3 小时 新手友好度 68/100
devops-thiago/ThrillhouseBot#321 ·
维护者通常 1 天内回复
-
feat(webhook): skip automatic reviews by pull request author可能已有人在做 @devops-thiago 于 1 天前认领。 未关闭enhancement
devops-thiago/ThrillhouseBot#1278 · 已指派 1 人 ·
维护者通常 1 天内回复
-
enhancement java
难度 5/5 一周以上 新手友好度 38/100
devops-thiago/ThrillhouseBot#1271 ·
维护者通常 1 天内回复
-
refactor(review): identify the bot's own read-back text by marker, not English wording可能已有人在做 @devops-thiago 于 4 天前认领。 未关闭enhancement java rework
devops-thiago/ThrillhouseBot#1260 · 已指派 1 人 ·
维护者通常 1 天内回复
-
feat(webhook): translate command replies, learning replies and on-request generator text可能已有人在做 @devops-thiago 于 4 天前认领。 未关闭enhancement java
devops-thiago/ThrillhouseBot#1259 · 已指派 1 人 ·
维护者通常 1 天内回复
查看 devops-thiago/ThrillhouseBot 的全部 Issue
相似的 Issue
-
priority: medium Review effort [1-5]: 3 status: needs-triage type: bug
难度 2/5 1-3 小时 新手友好度 78/100
carlos-emr/carlos#5431 ·
维护者通常 1 天内回复
-
Integration tests: jetty:run fails with WELD-001408 for CountryJpaService可能已有人在做 @viniciusmachak 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 66/100
primefaces/primefaces#15431 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 80/100
OpenAPITools/openapi-generator#25454 ·
维护者通常 1 天内回复
-
Component - Build
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100