[DISCUSS] Adopting Dosu (AI triage/documentation bot) for apache/iggy

[hubcio]

Hey,

Wondering if we should give Dosu (https://dosu.dev, https://github.com/apps/dosubot) a try on iggy. It's a GitHub App that auto-labels, triages, detects duplicates, and can draft first replies on issues/discussions. Free for ASF projects.

Already used by Superset, Airflow, HugeGraph, OpenDAL, APISIX, DevLake.

I'd start conservative: auto-labeling only issues + maybe PRs, nothing else.
If it behaves OK, we can expand later.

Refs:

• Example of issue labeling + reply: bug: Python : Unable to connect to ADLS - dfs endpoint with Service Principal (SP) credentials opendal#7459
• Airflow dev@ thread: https://lists.apache.org/thread/z2swt104dwtsmsqsmtrdxl22cb15dc4x
• Superset case study: https://dosu.dev/blog/how-preset-keeps-apache-superset-healthy

Any objections? If lazy consensus holds I'll write to dosu.dev and file the INFRA ticket.

br,
Hubert

[T1B0]

it could be very powerful indeed, my only concern would be security, especially things around prompt injection since those attack are extremely hard to prevent, mitigate and globally guard against. maybe we should see what benefits it can still bring with conservative permission set first ?

[hubcio]

yes, these recent LLM supply chains attacks are scary

i checked and dosubot requests contents:write + pull_requests:write + issues:write + discussions:write at install (checked via gh api /apps/dosubot). so worst-case attack surface from a successful injection is probably PR spam, so IMHO there is nothing to gain from attacker pov. i dont think credentials leak is possible, cannot it read GitHub Actions secrets.

so agreeing with your framing: annoying not devastating.worst realistic outcome is spam of PRs which we'll reject or maybe mass invalid labeling. i think...

refs:

• https://docs.github.com/en/apps/using-github-apps/installing-a-github-app-from-a-third-party
• https://dosu.dev/blog/august-2025-dosu-drop

[slbotbm]

I support the coservative approach. If it works well, we can expand its usage.

[krishvishal]

The plan sounds good. +1

[lukaszzborek]

It might be very good experiment for that, if we can try it +1