chore: enable Issue management automation

.github/issue-management/policy.mjs

@@ -180,6 +180,20 @@ export function parseReferences({ body, repository }) {
   }
 }
 
+/**
+ * Retain only references that resolve to Issues rather than pull requests.
+ * @param {{all: number[], resolving: number[], related: number[]}} references Parsed references.
+ * @param {Map<number, unknown>} issues Resolved same-repository Issues.
+ * @returns {{all: number[], resolving: number[], related: number[]}} Issue-only references.
+ */
+export function retainIssueReferences(references, issues) {
+  return {
+    all: references.all.filter((number) => issues.has(number)),
+    resolving: references.resolving.filter((number) => issues.has(number)),
+    related: references.related.filter((number) => issues.has(number)),
+  }
+}
+
 /**
  * Validate one Issue with its Project status.
  * @param {{title: string, body: string, assignees: string[], labels: string[], type: string|null, priority: string|null, status: string|null, state: string, stateReason: string|null}} issue Issue snapshot.
@@ -472,7 +486,7 @@ async function pullRequestSnapshot(number) {
     reviewRequestCount: reviewRequests.users.length + reviewRequests.teams.length,
     reviewCount: reviews.length,
     labels: pull.labels.map((label) => label.name),
-    references,
+    references: retainIssueReferences(references, issues),
     issues,
   }
 }

.github/issue-management/policy.test.mjs

@@ -4,6 +4,7 @@ import test from 'node:test'
 import {
   countVisibleUnits,
   parseReferences,
+  retainIssueReferences,
   requiresPullRequestPolicy,
   validateBody,
   validateIssue,
@@ -117,6 +118,24 @@ test('separates resolving and informational references', () => {
   )
 })
 
+test('does not treat pull request references as Issue associations', () => {
+  const references = {
+    all: [123, 1180, 1181],
+    resolving: [123, 1180],
+    related: [1181],
+  }
+  const issues = new Map([
+    [1180, {}],
+    [1181, {}],
+  ])
+
+  assert.deepEqual(retainIssueReferences(references, issues), {
+    all: [1180, 1181],
+    resolving: [1180],
+    related: [1181],
+  })
+})
+
 test('allows informational references without cross-object constraints', () => {
   const errors = validatePullRequest({
     isDraft: false,

.github/workflows/issue-lifecycle.yml

@@ -0,0 +1,58 @@
+name: Issue lifecycle
+
+on:
+  issues:
+    types:
+      - opened
+      - edited
+      - assigned
+      - unassigned
+      - labeled
+      - unlabeled
+      - closed
+      - reopened
+      - field_added
+      - field_removed
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+      - ready_for_review
+      - review_requested
+  pull_request_review:
+    types:
+      - submitted
+
+permissions:
+  contents: read
+
+concurrency:
+  group: issue-lifecycle-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  lifecycle:
+    name: Issue lifecycle
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out trusted policy
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - name: Create project token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.DSH_ISSUE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.DSH_ISSUE_APP_PRIVATE_KEY }}
+          owner: deepseek-harness
+          repositories: deepseek-harness
+      - name: Handle repository event
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: node .github/issue-management/policy.mjs lifecycle

.github/workflows/issue-policy.yml

@@ -0,0 +1,27 @@
+name: Issue policy
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened, labeled, unlabeled, ready_for_review, review_requested]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
+jobs:
+  policy:
+    name: Issue policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out trusted policy
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - name: Validate pull request
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node .github/issue-management/policy.mjs pr