Automating issue triage with GitHub and Recast.AI

export RECASTAI_TOKEN = your_recastai_token_here
export RECASTAI_DEV_TOKEN = your_recastai_dev_token_here

export RECASTAI_TOKEN = your_recastai_token_here
export RECASTAI_DEV_TOKEN = your_recastai_dev_token_here

gem install octokit
gem install httparty

gem install octokit
gem install httparty

require 'octokit'
require 'jwt'
require 'httparty'

# some configuration that you should change to reflect your own Recast.AI account
RECASTAI_USERNAME = 'degoodmanwilson'
RECASTAI_BOTNAME = 'triagebot'
RECASTAI_DEV_TOKEN = ENV['RECASTAI_DEV_TOKEN']

# We will time each request in order to avoid GitHub's rate limiter.
# We are allowed 10 requests per minute without authenticating.
time_between_calls = 60 / 10

# Repeat the following for each label we want to build an intent for:
for label in ['bug', 'enhancement', 'question']

    page = 1

    # GitHub currently caps search results to 1,000 entries, but we're not going to count. We'll let GitHub do the
    # counting for us—so, loop forever.
    loop do
        before = Time.now

        begin
            # Here is the centerpiece of this code: The call to the Search API.
            issues = Octokit::Client.search_issues("label:#{label}", page: page)
        rescue Octokit::UnprocessableEntity => ex
            # GitHub will only return 1,000 results. Any requests that page beyond 1,000 will result in a 422 error
            # instead of a 200. Octokit throws an exception when we get a 422. If this happens, it's because we've seen
            # all the results.
            puts "Got all the results for #{label}. Let's move on to the next one."
            break
        rescue Octokit::TooManyRequests => ex
            puts "Rate limit exceeded"
            # `kernel#sleep` often doesn't sleep for as long as you'd like. This means that sometimes we hit the rate
            # limit despite taking the necessary precautions to avoid this. If this happens, just sleep a little longer,
            # and try again.
            sleep(time_between_calls)
            next # try endpoint again
        end

        # Notice that we also have to specify the language. There is a non-trivial chance that we have several
        # non-English issue titles in our collection, but GitHub doesn't have any data on the languages the issues are
        # written in (and why should it?). For now, we will (wrongly, but not unjustifiably) assume English. Although,
        # a better implementation would be to run these titles through a separate API that can help guess the correct
        # language.
        expressions = []
        for expression in issues['items'] do
            expressions.push({source: expression['title'], language: {isocode: 'en'}})
        end

        # And now we bulk-post the tagged titles to Recast.AI. Their otherwise excellent gem doesn't support this
        # endpoint, so we need to use raw HTTP requests to upload the data.
        result = HTTParty.post("https://api.recast.ai/v2/users/#{RECASTAI_USERNAME}/bots/#{RECASTAI_BOTNAME}/intents/#{label}/expressions/bulk_create",
                               body: {expressions: expressions},
                               headers: {'Authorization' => "Token #{RECASTAI_DEV_TOKEN}"}
        )

        # Go to the next page of search results from GitHub.
        page += 1

        # Now that we have completed the call to the GitHub Search API and the Recast.AI API, let's measure how long it
        # took. We can always sleep if we need to, in order to avoid hitting the rate limiter.
        after = Time.now
        sleepy_time = time_between_calls - (after - before)
        slept = sleep(sleepy_time) unless sleepy_time <= 0

    end
end

require 'octokit'
require 'jwt'
require 'httparty'

# some configuration that you should change to reflect your own Recast.AI account
RECASTAI_USERNAME = 'degoodmanwilson'
RECASTAI_BOTNAME = 'triagebot'
RECASTAI_DEV_TOKEN = ENV['RECASTAI_DEV_TOKEN']

# We will time each request in order to avoid GitHub's rate limiter.
# We are allowed 10 requests per minute without authenticating.
time_between_calls = 60 / 10

# Repeat the following for each label we want to build an intent for:
for label in ['bug', 'enhancement', 'question']

    page = 1

    # GitHub currently caps search results to 1,000 entries, but we're not going to count. We'll let GitHub do the
    # counting for us—so, loop forever.
    loop do
        before = Time.now

        begin
            # Here is the centerpiece of this code: The call to the Search API.
            issues = Octokit::Client.search_issues("label:#{label}", page: page)
        rescue Octokit::UnprocessableEntity => ex
            # GitHub will only return 1,000 results. Any requests that page beyond 1,000 will result in a 422 error
            # instead of a 200. Octokit throws an exception when we get a 422. If this happens, it's because we've seen
            # all the results.
            puts "Got all the results for #{label}. Let's move on to the next one."
            break
        rescue Octokit::TooManyRequests => ex
            puts "Rate limit exceeded"
            # `kernel#sleep` often doesn't sleep for as long as you'd like. This means that sometimes we hit the rate
            # limit despite taking the necessary precautions to avoid this. If this happens, just sleep a little longer,
            # and try again.
            sleep(time_between_calls)
            next # try endpoint again
        end

        # Notice that we also have to specify the language. There is a non-trivial chance that we have several
        # non-English issue titles in our collection, but GitHub doesn't have any data on the languages the issues are
        # written in (and why should it?). For now, we will (wrongly, but not unjustifiably) assume English. Although,
        # a better implementation would be to run these titles through a separate API that can help guess the correct
        # language.
        expressions = []
        for expression in issues['items'] do
            expressions.push({source: expression['title'], language: {isocode: 'en'}})
        end

        # And now we bulk-post the tagged titles to Recast.AI. Their otherwise excellent gem doesn't support this
        # endpoint, so we need to use raw HTTP requests to upload the data.
        result = HTTParty.post("https://api.recast.ai/v2/users/#{RECASTAI_USERNAME}/bots/#{RECASTAI_BOTNAME}/intents/#{label}/expressions/bulk_create",
                               body: {expressions: expressions},
                               headers: {'Authorization' => "Token #{RECASTAI_DEV_TOKEN}"}
        )

        # Go to the next page of search results from GitHub.
        page += 1

        # Now that we have completed the call to the GitHub Search API and the Recast.AI API, let's measure how long it
        # took. We can always sleep if we need to, in order to avoid hitting the rate limiter.
        after = Time.now
        sleepy_time = time_between_calls - (after - before)
        slept = sleep(sleepy_time) unless sleepy_time <= 0

    end
end

require 'sinatra'
require 'logger'
require 'json'
require 'openssl'
require 'octokit'
require 'jwt'
require 'time' # This is necessary to get the ISO 8601 representation of a Time object
require 'recastai'

set :port, 3000

# Read more about GitHub Apps at https://developer.github.com/apps/
#
# Have fun and reach out to us if you have any questions, or if you just want to show
# off what you've built!

class GHAapp < Sinatra::Application

    # Never, ever, hardcode app tokens or other secrets in your code!
    # Always extract from a runtime source, such as an environment variable.

    # Notice that the private key must be in PEM format, but the newlines should
    # be stripped and replaced with the literal `n`. This can be done in the
    # terminal:
    # export GITHUB_PRIVATE_KEY=`awk '{printf "%s\n", $0}' private-key.pem`
    PRIVATE_KEY = OpenSSL::PKey::RSA.new(ENV['GITHUB_PRIVATE_KEY'].gsub('n', "**n**")) # convert newlines

    # You set the webhook secret when you create your app. This verifies that the
    # webhook is really coming from GitHub.
    WEBHOOK_SECRET = ENV['GITHUB_WEBHOOK_SECRET']

    # Get the app identifier—an integer—from your app page after you create your
    # app. This isn't actually a secret,
    # but it’s easier to configure at runtime.
    APP_IDENTIFIER = ENV['GITHUB_APP_IDENTIFIER']

    RECASTAI_TOKEN = ENV['RECASTAI_TOKEN']

    ########## Configure Sinatra
    #
    # Let's turn on verbose logging during development
    #
    configure :development do
        set :logging, Logger::DEBUG
    end

    ########## Before each request to our app
    #
    # Before each request to our app, we want to do two things:
    # 1) Verify that this request actually came from GitHub by validating the
    # attached signature
    # 2) Create a new Octokit client. Doing so requires that we construct a JWT.
    # https://jwt.io/introduction/
    # We have to also sign that JWT with our private key, so GitHub can be sure that:
    #  a) it came from us
    #  b) it hasn't been altered by a malicious third party
    #
    before do
        request.body.rewind
        payload_raw = request.body.read # We need the raw text of the body to check
        # the webhook signature
        begin
            @payload = JSON.parse payload_raw
        rescue
            halt 401
        end

        # Check X-Hub-Signature to confirm that this webhook was generated by
        # GitHub, and not a malicious third party. The way this works is: We have
        # registered with GitHub a secret, and we have stored it locally in
        # WEBHOOK_SECRET. GitHub will cryptographically sign the request payload
        # with this secret. We will do the same, and if the results match, then we
        # know that the request is from GitHub (or, at least, from someone who knows
        # the secret!). If they don't match, this request is an attack, and we should
        # reject it. The signature comes in with header x-hub-signature, and looks
        # like "sha1=123456". We should take the left-hand side as the signature
        # method, and the right-hand side as the HMAC digest (the signature), itself.
        their_signature_header = request.env['HTTP_X_HUB_SIGNATURE'] || 'sha1='
        method, their_digest = their_signature_header.split('=')
        our_digest = OpenSSL::HMAC.hexdigest(method, WEBHOOK_SECRET, payload_raw)
        halt 401 unless their_digest == our_digest

        #---------------------
        # OK, so this request came from GitHub. Great.
        # Now, construct a JWT and use that to authenticate a new Client object

        jwt_payload = {
                # The time that this JWT was issued, i.e. now.
                iat: Time.now.to_i,

                # How long is the JWT good for (in seconds)?
                # Let's say it can be used for 10 minutes before it needs to be refreshed.
                # TODO we don't actually cache this token, we regenerate a new one every time.
                exp: Time.now.to_i + (10 * 60),

                # Your GitHub App's identifier number, so GitHub knows who issued the JWT, and know what permissions
                # are available using the token.
                iss: APP_IDENTIFIER
        }

        # Cryptographically sign the JWT
        jwt = JWT.encode(jwt_payload, PRIVATE_KEY, 'RS256')

        # Create the Octokit client, using the JWT as the auth token.
        # Notice that this client will not have sufficient permissions to do many interesting things.
        # We might, for particular endpoints, need to generate an installation token (using the JWT), and instantiate
        # a new client object.
        @app_client ||= Octokit::Client.new(bearer_token: jwt)

        # And here we check whether we need that new client, that I mentioned just above. We check if there is an
        # installation associated with this event, and if there is, we instantiate a new Client object with the
        # installation token.
        unless @payload['installation'].nil? || @payload['installation']['id'].nil?
            installation_id ||= @payload['installation']['id']
            installation_token = @app_client.create_app_installation_access_token(installation_id)[:token]
            @client ||= Octokit::Client.new(bearer_token: installation_token)
        end
    end

    ########## Events
    #
    # This is the webhook endpoint that GitHub will call with events, and where we will do our event handling.
    #

    post '/' do
        case request.env['HTTP_X_GITHUB_EVENT']
        when 'issues'
            # `issue` events can have several actions associated. We are interested in issues that have been opened.
            handle_issue_opened_event(@payload) if @payload['action'] == 'opened'
        end

        'ok' # we have to return something ;)
    end

    ########## Helpers
    #
    # These functions are going to help us with tasks that we don't want clogging up the happy paths above, or
    # that need to be done repeatedly. You can add anything you like here.
    #

    helpers do

        #######
        # This is our issue opened event handler.
        def handle_issue_opened_event(payload)
            repo = payload['repository']['full_name']
            issue_number = payload['issue']['number']
            title = payload['issue']['title']

            recast_request = RecastAI::Request.new(RECASTAI_TOKEN)

            recast_result = recast_request.analyse_text(title)

            # Recast.AI will return a list of possible intents—labels—rated by their likelihood. We don't know what
            # order they’re in, so we need to search through this list for the label with the greatest likelihood.
            best_intent = nil
            best_intent_score = 0
            for intent in recast_result.intents
                if intent.confidence > best_intent_score
                    best_intent_score = intent.confidence
                    best_intent = intent.slug
                end
            end

            return true if best_intent.nil?

            @client.add_labels_to_an_issue(repo, issue_number, [best_intent])
            true
        end

    end

    # Finally this section holds the logic, which allows us to run this server directly from the command line, or with
    # Rack. Don't worry too much about this code, but for the curious:
    # $PROGRAM_NAME is the executed file
    # __FILE__ is the current file
    # If they are the same—that is, we are running this file directly, call the Sinatra run method.
    run! if $PROGRAM_NAME == __FILE__
end

require 'sinatra'
require 'logger'
require 'json'
require 'openssl'
require 'octokit'
require 'jwt'
require 'time' # This is necessary to get the ISO 8601 representation of a Time object
require 'recastai'

set :port, 3000

# Read more about GitHub Apps at https://developer.github.com/apps/
#
# Have fun and reach out to us if you have any questions, or if you just want to show
# off what you've built!

class GHAapp < Sinatra::Application

    # Never, ever, hardcode app tokens or other secrets in your code!
    # Always extract from a runtime source, such as an environment variable.

    # Notice that the private key must be in PEM format, but the newlines should
    # be stripped and replaced with the literal `n`. This can be done in the
    # terminal:
    # export GITHUB_PRIVATE_KEY=`awk '{printf "%s\n", $0}' private-key.pem`
    PRIVATE_KEY = OpenSSL::PKey::RSA.new(ENV['GITHUB_PRIVATE_KEY'].gsub('n', "**n**")) # convert newlines

    # You set the webhook secret when you create your app. This verifies that the
    # webhook is really coming from GitHub.
    WEBHOOK_SECRET = ENV['GITHUB_WEBHOOK_SECRET']

    # Get the app identifier—an integer—from your app page after you create your
    # app. This isn't actually a secret,
    # but it’s easier to configure at runtime.
    APP_IDENTIFIER = ENV['GITHUB_APP_IDENTIFIER']

    RECASTAI_TOKEN = ENV['RECASTAI_TOKEN']

    ########## Configure Sinatra
    #
    # Let's turn on verbose logging during development
    #
    configure :development do
        set :logging, Logger::DEBUG
    end

    ########## Before each request to our app
    #
    # Before each request to our app, we want to do two things:
    # 1) Verify that this request actually came from GitHub by validating the
    # attached signature
    # 2) Create a new Octokit client. Doing so requires that we construct a JWT.
    # https://jwt.io/introduction/
    # We have to also sign that JWT with our private key, so GitHub can be sure that:
    #  a) it came from us
    #  b) it hasn't been altered by a malicious third party
    #
    before do
        request.body.rewind
        payload_raw = request.body.read # We need the raw text of the body to check
        # the webhook signature
        begin
            @payload = JSON.parse payload_raw
        rescue
            halt 401
        end

        # Check X-Hub-Signature to confirm that this webhook was generated by
        # GitHub, and not a malicious third party. The way this works is: We have
        # registered with GitHub a secret, and we have stored it locally in
        # WEBHOOK_SECRET. GitHub will cryptographically sign the request payload
        # with this secret. We will do the same, and if the results match, then we
        # know that the request is from GitHub (or, at least, from someone who knows
        # the secret!). If they don't match, this request is an attack, and we should
        # reject it. The signature comes in with header x-hub-signature, and looks
        # like "sha1=123456". We should take the left-hand side as the signature
        # method, and the right-hand side as the HMAC digest (the signature), itself.
        their_signature_header = request.env['HTTP_X_HUB_SIGNATURE'] || 'sha1='
        method, their_digest = their_signature_header.split('=')
        our_digest = OpenSSL::HMAC.hexdigest(method, WEBHOOK_SECRET, payload_raw)
        halt 401 unless their_digest == our_digest

        #---------------------
        # OK, so this request came from GitHub. Great.
        # Now, construct a JWT and use that to authenticate a new Client object

        jwt_payload = {
                # The time that this JWT was issued, i.e. now.
                iat: Time.now.to_i,

                # How long is the JWT good for (in seconds)?
                # Let's say it can be used for 10 minutes before it needs to be refreshed.
                # TODO we don't actually cache this token, we regenerate a new one every time.
                exp: Time.now.to_i + (10 * 60),

                # Your GitHub App's identifier number, so GitHub knows who issued the JWT, and know what permissions
                # are available using the token.
                iss: APP_IDENTIFIER
        }

        # Cryptographically sign the JWT
        jwt = JWT.encode(jwt_payload, PRIVATE_KEY, 'RS256')

        # Create the Octokit client, using the JWT as the auth token.
        # Notice that this client will not have sufficient permissions to do many interesting things.
        # We might, for particular endpoints, need to generate an installation token (using the JWT), and instantiate
        # a new client object.
        @app_client ||= Octokit::Client.new(bearer_token: jwt)

        # And here we check whether we need that new client, that I mentioned just above. We check if there is an
        # installation associated with this event, and if there is, we instantiate a new Client object with the
        # installation token.
        unless @payload['installation'].nil? || @payload['installation']['id'].nil?
            installation_id ||= @payload['installation']['id']
            installation_token = @app_client.create_app_installation_access_token(installation_id)[:token]
            @client ||= Octokit::Client.new(bearer_token: installation_token)
        end
    end

    ########## Events
    #
    # This is the webhook endpoint that GitHub will call with events, and where we will do our event handling.
    #

    post '/' do
        case request.env['HTTP_X_GITHUB_EVENT']
        when 'issues'
            # `issue` events can have several actions associated. We are interested in issues that have been opened.
            handle_issue_opened_event(@payload) if @payload['action'] == 'opened'
        end

        'ok' # we have to return something ;)
    end

    ########## Helpers
    #
    # These functions are going to help us with tasks that we don't want clogging up the happy paths above, or
    # that need to be done repeatedly. You can add anything you like here.
    #

    helpers do

        #######
        # This is our issue opened event handler.
        def handle_issue_opened_event(payload)
            repo = payload['repository']['full_name']
            issue_number = payload['issue']['number']
            title = payload['issue']['title']

            recast_request = RecastAI::Request.new(RECASTAI_TOKEN)

            recast_result = recast_request.analyse_text(title)

            # Recast.AI will return a list of possible intents—labels—rated by their likelihood. We don't know what
            # order they’re in, so we need to search through this list for the label with the greatest likelihood.
            best_intent = nil
            best_intent_score = 0
            for intent in recast_result.intents
                if intent.confidence > best_intent_score
                    best_intent_score = intent.confidence
                    best_intent = intent.slug
                end
            end

            return true if best_intent.nil?

            @client.add_labels_to_an_issue(repo, issue_number, [best_intent])
            true
        end

    end

    # Finally this section holds the logic, which allows us to run this server directly from the command line, or with
    # Rack. Don't worry too much about this code, but for the curious:
    # $PROGRAM_NAME is the executed file
    # __FILE__ is the current file
    # If they are the same—that is, we are running this file directly, call the Sinatra run method.
    run! if $PROGRAM_NAME == __FILE__
end