Questions and troubleshooting¶
What the issue assistant costs, which data leaves GitHub, why an issue got no comment, and how to fix what keeps it from working. Get started describes the set-up step by step, and the discussions take every question that this page leaves open.
FAQ¶
What does it cost?¶
The action is free and open source. A repository pays for its engine and, when it is private, for the minutes of its runners, which GitHub gives public repositories for free. One triage, measured on a feature request in Paperless Sync on 2026-10-12:
| Measure | Value |
|---|---|
| From the new issue to the comment | 2 min 39 s |
| Time on runners | 78 s: 5 s event, 65 s analyze, 8 s apply; the rest was the wait for a firewall runner |
| The AI | Claude Opus 5.5, 15 turns, $0.20 at the prices of the API |
A reply to a maintainer's comment, which only judges whether the issue now waits for its reporter, took Claude Opus 5.5 3 turns, 4.4 s and $0.08. The summary of every run's job shows what it cost, in one line.
With the token of a Claude subscription instead of an API key, an analysis counts toward the usage limits of the subscription instead of being billed by the token. A smaller model costs less per token, and follow-ups and the other tasks read less than a first analysis:
| Model | Input, per million tokens | Output, per million tokens | For |
|---|---|---|---|
Claude Opus 5.5, claude-opus-5-5 |
$4.00 | $20.00 | the default: the most careful analyses |
Claude Sonnet 5.5, claude-sonnet-5-5 |
$2.00 | $10.00 | repositories with many issues: half the price per token |
Claude Haiku 5.5, claude-haiku-5-5 |
$0.10, up to 100K tokens per prompt; $0.50 beyond | $0.50, up to 100K tokens per prompt; $2.50 beyond | the replies to one comment, at the least cost |
For a repository with many issues, model = "claude-sonnet-5-5" halves the price of every token, and light_model lets the replies to one comment, which only say yes or no, run on a cheaper model than the analyses. These are the prices of Anthropic's API in October 2026; its page of prices has today's.
What strangers can spend has limits: by default 20 analyses, follow-ups and replies after a release a day, about $4 at the prices of the API. An engine secret of the repository's own caps the rest: an API key of a workspace with a monthly spend limit, rather than the token of a subscription that other repositories or people use too, so that a flood in one repository never stops the others.
Can I change the model?¶
Yes, with model under [engine] in .github/issue-assistant/config.toml, such as model = "sonnet" for a faster and cheaper one. Without it, the engine's default runs, claude-opus-5-5 for Claude. light_model runs the replies to one comment, which only say yes or no, and effort sets how much a model thinks; max_turns and max_budget_usd bound each run, as What one run may cost shows. check refuses a name that could add arguments to the command line of the engine.
Can I change when issues are reminded, closed or locked?¶
Yes, with [lifecycle] in .github/issue-assistant/config.toml: the days until the reminder, the closing and the closing of a duplicate, the window after a release, the follow-ups of the AI, the issues that are exempt by label, assignee or 👍, and the locking of issues closed long ago, which is off by default. The comments name the days that you set. Say the same days in the descriptions of needs-info, stale and possible-duplicate in labels.toml, or none, and in your SUPPORT.md; check fails on a label that names other days.
Which languages does it answer in?¶
Every language. English, German, French, Spanish, Portuguese, Italian and Dutch have a catalog of the assistant's own words, and in any other language the AI writes its part in the reporter's language between headings and a footer in English. One more file in locales/ adds a language, as Languages describes.
How do I know whether the assistant does well?¶
Open the summary of the morning sweep on the first day of a month, or start the sweep by hand: it counts the labels of the AI that the maintainers kept and those they had to add, the time from a new issue to its analysis, what became of the duplicate notices and of the questions to reporters, and the 👍 and 👎 on the analyses, for the 30 days before. Every morning, it also lists what waits on the maintainers, on reporters and on a release.
Which data leaves GitHub?¶
The analyze job sends the vendor of the engine, Anthropic for Claude, what the AI reads: the issue and its comments, at most 20,000 characters of each text, short excerpts of the other issues and of the discussions, the labels, .github/issue-assistant/project.md and the files of the default branch that the AI opens. The engine runs with its telemetry and error reports turned off. What the vendor may do with the data follows your agreement with it: for Claude, the terms of your API account or of your subscription, and the privacy settings of that account. The jobs without AI tell StepSecurity, the maker of Harden-Runner, the repository, the run and the hosts that their steps reach, as the security design says. The action keeps no database and no service of its own, and the notice in SUPPORT.md tells reporters which AI reads their issue.
Does it work in private repositories?¶
Yes, with three differences. The runners' minutes count toward the plan of the account. Harden-Runner blocks every host but GitHub's in the jobs without AI only with a subscription or trial of StepSecurity, and lets them run unblocked otherwise. And the AI reads private code, which reaches the vendor of the engine as above.
Why didn't my own issue get an analysis?¶
Issues that a maintainer opens, that is the owner, a member of the organization or a collaborator, get the labels of their form and needs-triage, but no analysis: the assistant writes for reporters who don't know the code. For an analysis anyway, write /assistant again in a comment, or run the workflow by hand under Actions → Issue assistant → Run workflow with the number of the issue, the task triage and the dry run turned off.
What happens to spam?¶
An issue that the AI takes for spam, such as advertising or nonsense, gets the label invalid with the AI's reason on its timeline, and no comment, so that its author gets no answer. Closing or deleting it stays with the maintainer. A flood of spam meets the limits of the AI runs first: after 3 issues of one author, or 20 issues and answers of everyone in a day, the issues only get their labels, until the maintainer has a look.
What if an issue shows a secret or personal data?¶
The analysis starts with a warning. For a secret, such as a token, a key or a password, it asks the reporter to remove it from the post and from the post's edit history, and to replace it, since others may have seen it. For personal data, such as an e-mail address, a public IP address or the address of a private server, it says how to remove it. The AI never repeats such data, and an answer with something like a token is never posted.
What if an issue reports a vulnerability?¶
The comment only asks the reporter to report it privately, as the security policy of the repository describes, and to remove the details from the issue. It has no summary, no analysis, no questions and no duplicates, and the reason for its labels on the timeline is a fixed sentence instead of the AI's words.
How do I turn it off?¶
Set the repository variable ISSUE_ASSISTANT_AI to off, for example with gh variable set ISSUE_ASSISTANT_AI --body off, and the AI stays off while labels, reminders and closing keep working; removing the engine's secret does the same. For one issue, a comment /assistant mute keeps the AI from starting on its own there. To turn off everything, disable or delete the four workflows.
Why must the workflows equal the templates?¶
The security of the assistant lives in its workflows: the permissions of each job, the runner with the firewall and the order of the steps. So check fails when a workflow differs from its template in anything but the commit hashes of its actions, as decisions 0006 and 0007 explain. A change that a repository needs is welcome as an issue here, and reaches every repository with a release.
Does it need Claude?¶
Claude is the only engine so far. Everything but one step of one job is independent of the AI, and Engines says what another engine needs.
Troubleshooting¶
The summary of each run says what the assistant did and why; the runs are under Actions → Issue assistant.
| Symptom | Cause | Fix |
|---|---|---|
| No comment on an issue that you or another maintainer opened | Issues of the owner, members and collaborators get labels only | Run the workflow by hand with the task triage and the dry run turned off |
| No comment, and the run notes No credentials for Claude are configured | The engine's secret is missing | Add CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY to the environment issue-assistant, as Set up a repository shows |
No comment, and the job analyze is skipped |
The repository variable ISSUE_ASSISTANT_AI is off |
gh variable delete ISSUE_ASSISTANT_AI |
No comment, and the issue has the label invalid |
The AI took the issue for spam | Remove the label; to get an analysis, run the workflow by hand |
| No comment, and the run notes Daily limit of AI runs reached or Daily limit of analyses for this reporter reached | More new issues, follow-ups and replies after a release came in during the 24 hours before than max_per_day allows, or the reporter opened more than max_per_author_per_day issues in them |
Run the workflow by hand with the task triage. If your repository usually gets more issues a day, raise the limit under [engine] in config.toml |
| A comment after the release left the issue closed, and the run notes Limit of comments read after the release reached | The AI reads only release_replies comments of the reporter after each release |
Read the comment and reopen the issue yourself, or run the workflow by hand with the task release-reply |
No comment, and the job apply shows an error |
The checks refused the AI's answer, such as one that broke its schema or held something like a secret; nothing was posted | The error names the reason; run the workflow by hand to try again |
analyze waits for a runner |
The runs of one issue wait for each other, first in, first out; or the runner ubuntu-24.04-firewall is not available to the repository |
Wait for the run before it. A job that finds no runner fails after 24 hours: check the preview's README, and set ISSUE_ASSISTANT_AI to off meanwhile |
analyze waits for a review |
The environment issue-assistant requires reviewers |
Remove the reviewers; the rule that only the default branch may use the environment is the protection it needs |
A step of analyze fails to connect, and the summary of the run lists a denied host |
The egress firewall blocked a host that the engine's action needs, often after an update of the action | Update to the latest release and run install again. It keeps your firewall policy, and check then names each host of the template that the policy misses, to add there |
| Every run fails with is no valid TOML or must be a whole number, a string, a list of strings or true or false | A settings file isn't TOML, or a value has the wrong type, such as a number in quotes | Fix the file and the key that the error names; run check to see every problem at once |
| Runs warn of an unknown key or a key that belongs in the section of another | A key has a typo or stands in the wrong section, so the assistant keeps its default | Rename or move the key as the warning suggests; check fails on it in your CI |
check says replace the starter's first line of project.md |
The file still describes no project, and the AI reads it before every task | Write what the project does and for whom, and where its code and documentation are |
check says that labels differ only in case |
GitHub takes bug and Bug for one label |
Keep one of them in .github/labels.toml |
check says that a workflow differs from the template of the issue assistant |
The workflow was changed by hand, or comes from another release than the action of the check | Run the commands that the message names, which install the templates of the check's release |
| An issue closed when its fix was merged, not with the release | GitHub closes the issues that a merged pull request names | Under Settings → General → Issues, clear Auto-close issues with merged linked pull requests; a repository without releases sets close_with_release = false |
An issue with fixed-in-next-release stays open after a release |
The release is a draft or a pre-release, it doesn't contain every pull request that fixes the issue, or a maintainer set the label by hand after it, which waits for the next one | Publish a final release that contains the fixes; the sweep of the next morning closes the issue, or start Issue lifecycle by hand |
| An issue still waits for its reporter after they changed the title | Only a comment or an edit of the text answers the questions | Nothing to fix: the reporter answers in a comment or in the text. To end the waiting yourself, remove needs-info |
A label of .github/labels.toml is missing in the repository |
The Labels workflow runs when labels.toml changes on main, not before |
Run it by hand: gh workflow run labels.yml |
actionlint calls ubuntu-24.04-firewall an unknown label |
actionlint doesn't know the runner of the preview | Run install again, which lists it in .github/actionlint.yaml, as What install writes says |