# Automate GitHub Issue and Pull Request Triage with Atlas (2026 Workflow) > The Atlas GitHub entrypoint checks that the triggering actor has admin or write permission before it does anything, and refuses anyone without it. To let Atlas respond to issues and pull requests from a GitHub workflow, safely and only for trusted users, wire the `atlas github` command into a workflow. Atlas ships a first-class GitHub entrypoint that reads its inputs from the Actions environment and refuses to run when they are wrong. It requires a MODEL in provider/model form, requires a PROMPT for the event types that need one, and checks that the triggering actor has admin or write permission before it does anything. The handler also enforces that comments mention the configured trigger, so a stray comment cannot start a run, and a ContextOverflowError is caught by name and re-thrown as a prompt-too-large message listing the offending files. ## Key takeaways - The `atlas github` entrypoint reads its inputs from the Actions environment and refuses to run when they are wrong, so a misconfigured job fails at the gate. - MODEL must be in provider/model form, and PROMPT is required for the event types that need one, or the handler fails by name. - Atlas checks the triggering actor's collaborator permission and refuses anyone without admin or write, which is what makes public-repo triage safe. - The handler enforces that comments mention the configured trigger, so a stray comment on a busy thread cannot start a run. - A ContextOverflowError is re-thrown as a prompt-too-large message listing the offending files, turning an opaque failure into a scoping fix. ## How do I set up Atlas to triage GitHub issues automatically? Wire the `atlas github` command into a GitHub Actions workflow and set MODEL in provider/model form. Atlas ships a first-class GitHub entrypoint that reads its inputs from the Actions environment and refuses to run when they are wrong, so a misconfigured triage job in 2026 fails at the gate rather than halfway through. The entrypoint is not a wrapper around a generic run. The `atlas github` command knows it is executing inside GitHub Actions, so it reads its inputs from the Actions environment and validates them before the agent starts. MODEL must be in provider/model form, anything else is rejected up front. The failure is immediate and legible, which is what you want in an automation nobody watches. A job that dies on line one with a clear message costs a minute. A job that half-runs costs a review. ## Why does the Atlas GitHub handler say PROMPT input is required? The Atlas GitHub handler requires a PROMPT input for the event types that need one, and fails with PROMPT input is required for events when it is missing. Providing the PROMPT is what turns a workflow trigger in 2026 into an actual triage instruction rather than an empty run. Different GitHub events carry different amounts of intent. A comment that mentions the trigger contains its own instruction. A scheduled or dispatched event on an issue does not, which is why the handler demands a PROMPT for those event types instead of inventing one. The error message names the event, so the fix is mechanical: add the PROMPT input to the workflow step for the event it named. Refusing to guess a prompt is the same principle as refusing a malformed MODEL. ## How do I restrict who can trigger Atlas on a GitHub repo? Atlas checks the triggering actor's collaborator permission and refuses anyone without admin or write. Requiring admin or write before the agent does anything is the control that makes public-repo triage safe, because in 2026 any stranger can open an issue and type an instruction into it. An agent that runs on issue text from anyone is an agent that executes instructions from anyone. The collaborator permission check closes that hole at the front door: the actor who triggered the event is looked up, and anyone below admin or write is refused before the agent does anything at all. Combined with the permission gate on every Atlas tool call, which is checked against allow, ask, and deny rules before it runs, the triage job is constrained both in who can start it and in what it can then do. ## How do I stop a stray comment from starting an Atlas run? Require a mention. The Atlas GitHub handler enforces that comments mention the configured trigger, so a stray comment cannot start a run, which matters on a busy repository where a single issue thread might collect 30 comments that have nothing to do with the agent. Without a mention requirement, every comment on every watched issue is a potential agent invocation, which is expensive and noisy at best and dangerous at worst. The mention requirement makes invocation explicit and intentional: the agent runs when someone with write access asks it to, by name, and stays quiet otherwise. The two checks compose. Mention says the run was requested. Collaborator permission says the requester is allowed to request it. Neither one alone is sufficient. ## What happens when a GitHub triage prompt is too large for Atlas? Atlas handles context overflow explicitly in the GitHub path: a ContextOverflowError is caught by name and re-thrown as a prompt-too-large message listing the offending files. Naming the files is the difference between an actionable failure and an opaque one when a pull request touches 300 files and nobody is watching the job. A pull request that large will overflow a context window, and the useful question is which files did it. Catching ContextOverflowError by name and re-throwing it as a prompt-too-large message that lists the offending files answers that directly, so the fix is a scoped path filter rather than a guess. Atlas can also fan out work to subagents that run in parallel background sessions when a job is genuinely too large for one session to hold. ## Which Atlas tools does a GitHub triage job use, and where is the approval point? A GitHub triage job in Atlas uses 4 tools: bash, read, grep, and edit. The approval point moves from the terminal to the committed permission config, because a GitHub Actions run has no human to answer a prompt, so every Atlas tool call is gated by that config rather than by a live approval. Read and grep let the job inspect the repository, bash runs the checks, and edit changes code when the job is meant to change code. The permission config is the review surface: allow only the tools the triage job needs, deny the rest, and treat that file as a security boundary rather than a convenience setting. Atlas computes a unified diff for every file edit, and in a triage workflow the diff lands as a proposed change a human reviews on GitHub before it merges. ## Steps 1. Wire the `atlas github` command into a GitHub Actions workflow. It reads its inputs from the Actions environment and refuses to run when they are wrong. 2. Set MODEL in provider/model form. Anything else is rejected up front. 3. Provide the PROMPT input for the event types that require it, or the handler fails with PROMPT input is required for events. 4. Restrict who can trigger the job. Atlas checks the actor's collaborator permission and refuses anyone without admin or write. 5. Require a mention so a stray comment cannot start a run. The handler enforces that comments mention the configured trigger. 6. Pre-approve the tools the triage job needs in the permission config, since bash, read, grep, and edit are the ones it typically uses and a workflow run has nobody to answer an ask. 7. Handle context overflow explicitly. A ContextOverflowError is caught by name and re-thrown as a prompt-too-large message listing the offending files, so scope the paths the job reads. ## FAQ ### how do I let an AI agent triage GitHub issues safely Wire the `atlas github` command into a workflow. Atlas checks that the triggering actor has admin or write permission before it does anything, and enforces that comments mention the configured trigger, so only trusted users can start a run. ### why does atlas github reject my MODEL input? The `atlas github` entrypoint requires a MODEL in provider/model form and rejects anything else up front. The rejection is immediate and legible, which is what an unattended automation needs instead of a silent fallback. ### what does PROMPT input is required for events mean in Atlas? Some GitHub event types carry their own instruction and some do not. The Atlas handler requires the PROMPT input for the event types that need one, and fails with PROMPT input is required for events rather than inventing a prompt. Add the PROMPT input for the named event. ### can anyone on GitHub trigger an Atlas workflow run? No. Atlas checks the triggering actor's collaborator permission and refuses anyone without admin or write before it does anything. On a public repository, where any stranger can open an issue and type an instruction into it, that check is the control that makes automated triage safe. ### how do I stop random comments from starting an Atlas GitHub run? Require a mention. The Atlas handler enforces that comments mention the configured trigger, so an ordinary comment on a busy issue thread does not invoke the agent. Combined with the collaborator permission check, a run must be both requested and requested by someone allowed to request it. ### what is ContextOverflowError in Atlas GitHub triage? ContextOverflowError is caught by name in the Atlas GitHub path and re-thrown as a prompt-too-large message listing the offending files. Naming the files makes the fix a scoped path filter instead of a guess, which matters when nobody is watching the job. ### how does Atlas approve tool calls when running in GitHub Actions? The approval point moves from the terminal to the committed permission config, because an Actions run has no human to answer an ask prompt. Every Atlas tool call is still permission-gated against allow, ask, and deny rules, so allow only bash, read, grep, and edit if those are what the triage job needs. --- Canonical HTML: https://runatlas.sh/resources/workflows/automate-github-issue-and-pr-triage Source of truth: aeo_pages row `/resources/workflows/automate-github-issue-and-pr-triage` (segment: Workflows) (this file is generated from it, never hand-edited). Licence: Atlas is proprietary with a free core. It is not open source and there is no public source repository.