Implement AI moderator workflow with spam detection and comment minimization by Copilot · Pull Request #5907 · github/gh-aw

Copilot · 2025-12-08T21:35:06Z

Implementation Plan: AI Moderator Workflow ✅

Creating an agentic workflow that replicates the github/ai-moderator features:

Key Features

Built-in Safe Outputs

Uses gh-aw's built-in minimize-comment safe output for comment moderation, eliminating the need for custom GraphQL code.

Team Member Optimization

The workflow automatically skips spam detection for repository team members (users with admin, maintainer, or write access) to optimize resource usage:

Includes a custom check_external_user job that checks user permissions via GitHub API
Skips the agent job (and spam detection) for team members
Only runs for external users (read access or non-collaborators)
Workflow_dispatch always runs (manual triggers bypass team member check)
Team members' content is trusted and not scanned

Custom Moderation Prompts

Supports optional custom moderation rules via .github/prompts/custom-moderation.md:

Simple markdown format for easy editing
AI agent reads the file as additional system prompt instructions
Allows repository-specific spam detection criteria
Combines custom rules with built-in detection tasks

Example custom moderation file:

# Custom Moderation Rules

Additional spam indicators for this repository:
- Posts mentioning competitor products (CompetitorX, CompetitorY)
- Off-topic gaming discussions (this is a development tools project)
- Cryptocurrency or blockchain mentions (not relevant to this project)
- Generic "me too" comments without substance
- Links to specific domains we don't allow: example-spam-site.com

Manual Moderation via workflow_dispatch

Allows manual triggering to moderate specific content:

Supports workflow_dispatch with issue_url input parameter
Can provide any issue or discussion URL to analyze
Useful for retroactively checking content or moderating specific posts
Always runs for manual triggers (bypasses team member check)

Security

User-provided content marked with <unsafe_user_input> XML tags for clarity
Content automatically sanitized by activation job before reaching agent
Uses default permissions (minimal access)
Safe-outputs for all write operations

Changes Summary

Consolidated documentation into the workflow file as an XML comment
Used built-in minimize-comment safe output instead of custom implementation
Added intelligent team member detection to skip unnecessary scans
Added support for custom moderation prompts (simple markdown format)
Added workflow_dispatch support for manual moderation
Workflow only processes content from external users for efficiency
Uses needs.activation.outputs.text for content (auto-fetched by framework)
Marked user content with unsafe_user_input XML tags for security clarity
Removed unnecessary permissions block (uses defaults)
Removed unnecessary tools

Custom agent used: create-agentic-workflow
Design agentic workflows using GitHub Agentic Workflows (gh-aw) extension with interactive guidance on triggers, tools, and security best practices.

Original prompt

Create an agentic workflow that implements the same features as https://github.com/github/ai-moderator

Custom agent used: create-agentic-workflow
Design agentic workflows using GitHub Agentic Workflows (gh-aw) extension with interactive guidance on triggers, tools, and security best practices.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2025-12-08T23:20:57Z

@copilot use minimize-comment safe output type instead of custom job

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-08T23:28:12Z

@copilot use minimize-comment safe output type instead of custom job

Updated to use the built-in minimize-comment safe output type instead of a custom job. The workflow now uses the simpler configuration:

safe-outputs:
  minimize-comment:
    max: 5

This eliminates ~80 lines of custom GraphQL code and provides a cleaner API for the AI agent.

Commit: dd4b0e1

pelikhan · 2025-12-08T23:32:26Z

@copilot move readme as xml comment in ai-moderator.md

Moved README content as an XML comment at the end of ai-moderator.md and deleted the separate README-ai-moderator.md file.

Commit: 04e8339

pelikhan · 2025-12-08T23:33:56Z

+## How to fetch the Node ID
+
+If you need to minimize a comment, you'll need its GraphQL node ID. You can fetch this using the GitHub MCP server tools:
+
+**For issue comments**, use the GitHub REST API to get the comment:
+```
+GET /repos/<owner>/<repo>/issues/comments/<comment_id>
+```
+Replace `<owner>`, `<repo>`, and `<comment_id>` with actual values from your workflow context.
+The response will include a `node_id` field.
+
+**For PR review comments**, use:
+```
+GET /repos/<owner>/<repo>/pulls/comments/<comment_id>
+```
+Replace `<owner>`, `<repo>`, and `<comment_id>` with actual values.
+The response will include a `node_id` field.
+
+The node ID is a base64-like encoded string used by GitHub's GraphQL API (e.g., `IC_kwDOABcD1M5ZJfGH`).
+
+Once you have the node ID, call the minimize_comment tool:
+```
+minimize_comment(comment_id="IC_kwDOABcD1M5ZJfGH")
+```
+


@copilot this section is automatically handled by the minimize-comment tool, remove

Removed the "How to fetch the Node ID" section. The minimize-comment tool handles GraphQL node ID fetching automatically.

Commit: 16bc26d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2025-12-08T23:39:01Z

@copilot Add a custom step in the pre-activation job that skips the workflow is the actor is owner/maintainer/write access since we don't need to scan team member messages.

pelikhan · 2025-12-08T23:43:24Z

@copilot add an optional import in the prompt body to include custom moderation prompt. Use the same file location as in the original actions/ai-moderator action.

- Remove "How to fetch the Node ID" section (handled automatically by minimize-comment tool) - Add roles: all to allow all users to trigger the workflow - Add custom check_external_user job to skip workflow for team members (admin/maintain/write) - Add if condition to agent job to only run for external users Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-08T23:53:01Z

@copilot Add a custom step in the pre-activation job that skips the workflow is the actor is owner/maintainer/write access since we don't need to scan team member messages.

Added custom check_external_user job that skips the workflow for users with owner/maintainer/write access. The workflow now:

Sets roles: all to allow all users to trigger it
Adds a custom job that checks user permissions via GitHub API
Skips the agent job (and spam detection) for team members
Only runs for external users (read access or non-collaborators)

This optimizes resources by not scanning content from trusted team members.

Commit: 16bc26d

- Add optional custom prompt file support at .github/prompts/custom-moderation.prompt.yml - Follows same YAML format as original github/ai-moderator action - AI agent checks if file exists and applies additional rules if present - Updated documentation with example custom prompt configuration Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-09T00:02:58Z

@copilot add an optional import in the prompt body to include custom moderation prompt. Use the same file location as in the original actions/ai-moderator action.

Added support for optional custom moderation prompts. The workflow now:

Checks for a custom prompt file at .github/prompts/custom-moderation.prompt.yml (same location as original ai-moderator)
Uses the same YAML format with messages, model, responseFormat, and jsonSchema
AI agent reads and applies custom rules if the file exists
Combines custom rules with built-in detection tasks

Updated documentation includes an example custom prompt showing the format.

Commit: 45dd92d

pelikhan · 2025-12-09T00:01:04Z

+    allowed: [spam, ai-generated, link-spam]
+  minimize-comment:
+    max: 5
+roles: all


@copilot

remove roles: all line

Removed roles: all line.

Commit: ba802a6

pelikhan · 2025-12-09T00:01:46Z

+engine: copilot
+if: needs.check_external_user.outputs.is_external == 'true'
+tools:
+  github:


@copilot disable GitHub

Removed GitHub tools configuration.

Commit: ba802a6

pelikhan · 2025-12-09T00:02:52Z

+
+For issues, the issue title is: ${{ github.event.issue.title }}
+
+The content body to analyze is available through the GitHub context. Use the GitHub tools to fetch the full context of the issue, comment, or pull request review comment that triggered this workflow.


@copilot use the needs.activation.outputs.text value

Updated to use needs.activation.outputs.text for content. The activation job auto-fetches content from the appropriate event context.

Commit: ba802a6

pelikhan · 2025-12-09T00:03:03Z

+
+**Content to analyze**:
+
+For issues, the issue title is: ${{ github.event.issue.title }}


@copilot remove entry

Removed the issue title line.

Commit: ba802a6

pelikhan · 2025-12-09T00:03:19Z

+
+Analyze the following content that was just posted in repository ${{ github.repository }}:
+
+**Issue Number** (if applicable): #${{ github.event.issue.number }}


@copilot use template conditionals

Simplified context display to show all fields directly (Issue Number, PR Number, Comment ID, Author, Manual URL). Content now comes from needs.activation.outputs.text.

Commit: ba802a6

pelikhan · 2025-12-09T00:06:52Z

@copilot simplify custom prompt to just markdown

pelikhan · 2025-12-09T00:07:45Z

@copilot do not use import to read the custom rules, tell the agent to read these instruction as system prompt.

- Remove roles: all line (comment 2600564134) - Add workflow_dispatch support with issue_url input (comment 2600564504) - Remove GitHub tools (comment 2600565242) - Remove models: read permission (comment 2600565644) - Use needs.activation.outputs.text for content (comment 2600568773) - Remove issue title line (comment 2600569278) - Simplify context info display (comment 2600569830) - Workflow_dispatch always runs (no team member check for manual triggers) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2025-12-09T00:15:38Z

+
+**Content to analyze**:
+
+${{ needs.activation.outputs.text }}


@copilot enclose line in xml tags "unsafe_user_input"

Enclosed the line with <unsafe_user_input> XML tags to mark user-provided content.

Commit: 96aa199

pelikhan · 2025-12-09T00:15:56Z

+**Pull Request Number** (if applicable): #${{ github.event.pull_request.number }}
+**Comment ID** (if applicable): ${{ github.event.comment.id }}
+**Author**: ${{ github.actor }}
+**Manual URL** (if workflow_dispatch): ${{ github.event.inputs.issue_url }}


@copilot use conditional templates

Updated to "if provided via workflow_dispatch" for better clarity about when this field is populated.

Commit: 96aa199

- Change custom prompt file from .yml to .md (comment 3629579123) - Instruct agent to read file as system prompt instead of importing (comment 3629581953) - Use simple markdown format instead of complex YAML structure - Updated documentation with markdown example Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-09T00:20:04Z

@copilot do not use import to read the custom rules, tell the agent to read these instruction as system prompt.

Updated to instruct the agent to read the custom moderation file as additional system prompt instructions, rather than using import logic. The agent now simply reads .github/prompts/custom-moderation.md and applies the rules directly.

Commit: 5777d9b

@copilot simplify custom prompt to just markdown

Simplified custom prompt to markdown format. Changed from .github/prompts/custom-moderation.prompt.yml (YAML) to .github/prompts/custom-moderation.md (markdown).

Commit: 5777d9b

- Enclose needs.activation.outputs.text in unsafe_user_input XML tags (comment 2600594358) - Update Manual URL description to be more descriptive (comment 2600595146) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2025-12-09T00:57:27Z

+        description: 'Issue or discussion URL to moderate (e.g., https://github.com/owner/repo/issues/123)'
+        required: true
+        type: string
+permissions:


@copilot no need for any permissions

Removed the permissions block. The workflow now uses default permissions.

Commit: e43d236

- Remove all permissions (comment 2600673054) - Workflow will use default permissions Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Initial plan

accbb56

Copilot AI assigned Copilot and pelikhan Dec 8, 2025

Copilot started work on behalf of pelikhan December 8, 2025 21:35 View session

Copilot AI and others added 4 commits December 8, 2025 21:43

Add AI moderator workflow implementation

4f9bd2f

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add documentation and update github-script to v8

b958923

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Fix GraphQL security issues and improve documentation

bbe2712

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Improve error messages and label creation documentation

ced08bf

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Implement features from ai-moderator project~~ Implement AI moderator workflow with spam detection and comment minimization Dec 8, 2025

Copilot AI requested a review from pelikhan December 8, 2025 22:04

Copilot finished work on behalf of pelikhan December 8, 2025 22:04

Merge branch 'main' into copilot/implement-ai-moderator-features

9da831b

Copilot started work on behalf of pelikhan December 8, 2025 23:21 View session

Replace custom minimize-comment job with built-in safe output

dd4b0e1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan December 8, 2025 23:31

pelikhan reviewed Dec 8, 2025

View reviewed changes

Copilot started work on behalf of pelikhan December 8, 2025 23:32 View session

pelikhan reviewed Dec 8, 2025

View reviewed changes

Move README content as XML comment in ai-moderator.md

04e8339

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan December 8, 2025 23:39

Copilot finished work on behalf of pelikhan December 8, 2025 23:39

Copilot started work on behalf of pelikhan December 8, 2025 23:40 View session

Copilot finished work on behalf of pelikhan December 8, 2025 23:55

Copilot started work on behalf of pelikhan December 8, 2025 23:55 View session

pelikhan reviewed Dec 9, 2025

View reviewed changes

Copilot AI requested a review from pelikhan December 9, 2025 00:05

Copilot finished work on behalf of pelikhan December 9, 2025 00:05

Copilot started work on behalf of pelikhan December 9, 2025 00:05 View session

Copilot finished work on behalf of pelikhan December 9, 2025 00:15

Copilot started work on behalf of pelikhan December 9, 2025 00:15 View session

pelikhan reviewed Dec 9, 2025

View reviewed changes

Copilot AI requested a review from pelikhan December 9, 2025 00:22

Copilot finished work on behalf of pelikhan December 9, 2025 00:22

Copilot started work on behalf of pelikhan December 9, 2025 00:23 View session

Copilot finished work on behalf of pelikhan December 9, 2025 00:28

pelikhan reviewed Dec 9, 2025

View reviewed changes

Copilot started work on behalf of pelikhan December 9, 2025 00:58 View session

Remove permissions block

e43d236

- Remove all permissions (comment 2600673054) - Workflow will use default permissions Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan December 9, 2025 01:04

Copilot finished work on behalf of pelikhan December 9, 2025 01:04

pelikhan marked this pull request as ready for review December 9, 2025 02:07

pelikhan merged commit 81b9380 into main Dec 9, 2025
5 checks passed

pelikhan deleted the copilot/implement-ai-moderator-features branch December 9, 2025 02:07

This was referenced Dec 9, 2025

Smoke Test Results: Copilot No Firewall - Run 20053662427 #5923

Closed

[docs] Update glossary - daily scan #5936

Merged


		For issues, the issue title is: ${{ github.event.issue.title }}

		The content body to analyze is available through the GitHub context. Use the GitHub tools to fetch the full context of the issue, comment, or pull request review comment that triggered this workflow.


		Content to analyze:

		For issues, the issue title is: ${{ github.event.issue.title }}


		Analyze the following content that was just posted in repository ${{ github.repository }}:

		Issue Number (if applicable): #${{ github.event.issue.number }}

Uh oh!

Conversation

Copilot AI commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Plan: AI Moderator Workflow ✅

Key Features

Built-in Safe Outputs

Team Member Optimization

Custom Moderation Prompts

Manual Moderation via workflow_dispatch

Security

Changes Summary

Uh oh!

pelikhan commented Dec 8, 2025

Uh oh!

Copilot AI commented Dec 8, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Dec 8, 2025

Uh oh!

pelikhan commented Dec 8, 2025

Uh oh!

Copilot AI commented Dec 8, 2025

Uh oh!

Copilot AI commented Dec 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Dec 9, 2025

Uh oh!

pelikhan commented Dec 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Copilot AI commented Dec 8, 2025 •

edited

Loading

Copilot AI commented Dec 9, 2025 •

edited

Loading