[neubig]

HUMAN:

This hasn't been tested but will be upon merge.

---

AGENT:

Why

The issue-triage automation already vets scope and acceptance criteria and applies ready-for-dev using an account with repository write access. Repository writers must also be able to record an explicit readiness decision. The current workflow independently reevaluates either decision and can reverse it.

Summary

• retain ready-for-dev when GitHub reports the applying actor has write, maintain, or admin permission
• preserve linked-PR check refreshes for authorized additions and all removals
• remove the superseded readiness evaluator, feedback commenter, and their tests

Issue Number

Closes #5211

How to Test

• uv run pytest -q tests/cross/test_check_pr_description.py tests/cross/test_refresh_linked_pr_checks.py (26 passed)
• parsed .github/workflows/issue-readiness-check.yml with PyYAML and verified the label-policing job has only issues: write
• queried GitHub's collaborator-permission API and confirmed all-hands-bot has write permission on all four repositories
• pre-commit YAML formatting and policy checks passed during commit

Video/Screenshots

Not applicable; this changes GitHub issue-label policy.

Design Doc

Not needed for this workflow simplification.

Type

• Bug fix
• Feature
• Refactor
• Breaking change
• Docs / chore

Notes

The live issue-triage automation covers OpenHands/software-agent-sdk and receives unlabeled events. The HUMAN: section remains untouched.

---

🐳 Agent Server images for this PR — GHCR package, pull/run commands, and all pushed tags (click to expand)

• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server

Variants & Base Images

Variant	Architectures	Base Image	Docs / Tags
java	amd64, arm64	eclipse-temurin:17-jdk	Link
python-slim	amd64, arm64	python-node-runtime	Link
python-minimal	amd64, arm64	python-node-runtime	Link
python	amd64, arm64	python-node-runtime	Link
golang	amd64, arm64	golang:1.21-bookworm	Link

Pull (multi-arch manifest)

# Each variant is a multi-arch manifest supporting both amd64 and arm64
docker pull ghcr.io/openhands/agent-server:901f072-python

Run

docker run -it --rm \
  -p 8000:8000 \
  --name agent-server-901f072-python \
  ghcr.io/openhands/agent-server:901f072-python

All tags pushed for this build

ghcr.io/openhands/agent-server:901f072-golang-amd64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-golang-amd64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-golang-amd64
ghcr.io/openhands/agent-server:901f072-golang_tag_1.21-bookworm-amd64
ghcr.io/openhands/agent-server:901f072-golang-arm64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-golang-arm64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-golang-arm64
ghcr.io/openhands/agent-server:901f072-golang_tag_1.21-bookworm-arm64
ghcr.io/openhands/agent-server:901f072-java-amd64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-java-amd64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-java-amd64
ghcr.io/openhands/agent-server:901f072-eclipse-temurin_tag_17-jdk-amd64
ghcr.io/openhands/agent-server:901f072-java-arm64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-java-arm64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-java-arm64
ghcr.io/openhands/agent-server:901f072-eclipse-temurin_tag_17-jdk-arm64
ghcr.io/openhands/agent-server:901f072-python-amd64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-python-amd64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-python-amd64
ghcr.io/openhands/agent-server:901f072-python-node-runtime-amd64
ghcr.io/openhands/agent-server:901f072-python-arm64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-python-arm64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-python-arm64
ghcr.io/openhands/agent-server:901f072-python-node-runtime-arm64
ghcr.io/openhands/agent-server:901f072-python-minimal-amd64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-python-minimal-amd64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-python-minimal-amd64
ghcr.io/openhands/agent-server:901f072-python-node-runtime-minimal-amd64
ghcr.io/openhands/agent-server:901f072-python-minimal-arm64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-python-minimal-arm64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-python-minimal-arm64
ghcr.io/openhands/agent-server:901f072-python-node-runtime-minimal-arm64
ghcr.io/openhands/agent-server:901f072-python-slim-amd64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-python-slim-amd64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-python-slim-amd64
ghcr.io/openhands/agent-server:901f072-python-node-runtime-slim-amd64
ghcr.io/openhands/agent-server:901f072-python-slim-arm64
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-python-slim-arm64
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-python-slim-arm64
ghcr.io/openhands/agent-server:901f072-python-node-runtime-slim-arm64
ghcr.io/openhands/agent-server:901f072-golang
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-golang
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-golang
ghcr.io/openhands/agent-server:901f072-golang_tag_1.21-bookworm
ghcr.io/openhands/agent-server:901f072-java
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-java
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-java
ghcr.io/openhands/agent-server:901f072-eclipse-temurin_tag_17-jdk
ghcr.io/openhands/agent-server:901f072-python-minimal
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-python-minimal
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-python-minimal
ghcr.io/openhands/agent-server:901f072-python-node-runtime-minimal
ghcr.io/openhands/agent-server:901f072-python-slim
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-python-slim
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-python-slim
ghcr.io/openhands/agent-server:901f072-python-node-runtime-slim
ghcr.io/openhands/agent-server:901f072-python
ghcr.io/openhands/agent-server:901f07294613d80a973ca34ba824992257e12429-python
ghcr.io/openhands/agent-server:fix-triage-owned-ready-label-python
ghcr.io/openhands/agent-server:901f072-python-node-runtime

About Multi-Architecture Support

• Each variant tag (e.g., 901f072-python) is a multi-arch manifest supporting both amd64 and arm64
• Docker automatically pulls the correct architecture for your platform
• Individual architecture tags (e.g., 901f072-python-amd64) are also available if needed

[github-actions]

REST API breakage checks (OpenAPI) — ✅ PASSED

Result: ✅ PASSED

Action log

[neubig]

Live confirmation of the conflict this PR removes: on SDK issue #5225, issue triage posted two unresolved design questions and explicitly withheld ready-for-dev. At 21:11–21:13 UTC on 2026-09-22, all-hands-bot removed that label repeatedly and github-actions[bot] re-added it within seconds (see the issue label-event history). The issue currently carries a misleading ready-for-dev label. Please include this before/after behavior in the PR validation once the policy workflow is merged. No merge from this comment.

[all-hands-bot]

This review was posted by an AI agent (OpenHands).

Review summary

Scope is an in-repository GitHub Actions label policy change: .github/workflows/issue-readiness-check.yml now acts only as a permission guard, and the superseded readiness evaluator, feedback commenter, and their tests are removed. Repository-owned CI/workflow policy belongs in this repository, so no repository move is warranted.

Linked issue #5211 (enhancement, priority:high, ready-for-dev, open) is the source of the acceptance criteria. All of its criteria are met on this head:

• Authorized actors (write/maintain/admin) retain ready-for-dev; the permission API maps maintain->write and triage->read, so read/triage/none fall through to removal.
• No bot-specific exception: all-hands-bot is an ordinary user with write on this repository, so it is retained by the same generic rule.
• The workflow never adds the label and no longer evaluates issue content independently.
• Linked-PR gate refreshes are preserved for authorized additions (labeled -> refresh) and external removals (unlabeled -> refresh). The one path that skips a refresh is the auto-removal of an unauthorized addition; that path can only run when the label was absent immediately beforehand, so the resulting label state equals the pre-event state and a re-run of the gate would be equivalent. Behavior is consistent.
• The removed evaluator/commenter have no remaining callers.
• Least privilege is preserved/improved: per-job issues: write for the policy job and contents/pull-requests read plus actions: write for the refresh job.

Verification performed on head 901f072

• Head SHA matches; PR is open with no prior reviews or review threads; linked issue state/labels re-read immediately before posting and unchanged.
• Current-head CI: 28 checks successful, 2 skipped (artifact cleanup jobs), none failing or pending.
• Focused tests pass: uv run pytest -q tests/cross/test_check_pr_description.py tests/cross/test_refresh_linked_pr_checks.py -> 26 passed.
• No dangling references to .github/scripts/check_issue_readiness.py or .github/scripts/post-readiness-comment.mjs; .github/scripts/markdown_sections.py is retained and still consumed by check_pr_description.py.
• Workflow YAML parses; job outputs gate the refresh job correctly.
• Actor/repository/issue values are passed to the shell through env, not interpolated ${{ }} inside run:, so there is no script-injection surface.
• Collaborator-permission lookup against the API confirms the write|maintain|admin case behaves as intended for this repository's actors.

Non-blocking residual risk: the retention decision depends on the running Actions environment and the collaborator-permission API, which cannot be exercised before merge. Confirm the live behavior after merge as the PR notes.

✅ APPROVED