Proposed RFC Suggestion: Bot for escalating and auto-closing issues w/ no sig/ label

[forhalle]

Summary:

Per the first item on the Joint SIG:TSC Agenda 2022/05/24 agenda, I am creating this suggestion to implement a bot that performs the following activities:
(1) Searches for issues that have not been assigned a sig/ label x-days of creation
(2) Emails the issue list to SIG chairs, indicating the issues will be auto-closed in y-days if no sig/ label is assigned
(3) Auto-closes any issue that does not have a sig/ label within z-days of creation, where x+y=z

This process should run on an expedited cadence for priority/critical issues, and a slower cadence for all other issues.
This bot could be expanded to consider other types of stale issues (e.g. issues that haven't been updated in x-days, regardless of existence of sig/ label, etc.)

What is the motivation for this suggestion?

Historically, new incoming issues have been manually triaged into SIG backlogs (i.e. are given the appropriate sig/ label) via. a recurring cross-sig triage process (i.e. members from each SIG meet bi-weekly to review and 'claim' each incoming issue). As we move away from this process to instead put the onus on each SIG to individually review incoming issues for potential addition to their backlog (target 5/31/2022), the likelihood of issues not getting picked up by any SIG increases.

Why is this important?
We should increase the visibility of issues that have yet to be picked up by a sig/ to ensure they are either picked up or closed as not applicable.

[lmbr-pip]

I would disagree with any bot that autocloses issues which are being ignored due to process failures. Otherwise, we are going to reject valid issues just because we couldn't find a SIG, which does not seem like a friendly process.

I would suggest having the following automations (should probably be split into own requests):

• A bot/process that identifies issues without a SIG that are more than x days old and escalates with SIG-chairs. As most users can't set priority, I don't believe we need priority escalation here.

• A bot/process that identifies issues stuck in needs-more-information for more than 30 days and emails the SIG chair(s) about issues. Bot can auto-closes issues stuck in "needs-more-information" state for more than 60 days as stale.

• An escalation process for blockers and criticals being ignored in SIG triage. Blockers and criticals need to be triaged in a timely manner. IMHO SIG-Security should own setting SLAs. Should escalate issues to SIG maintainers, other SIG chair(s).

• A bot/process to find blockers in backlog that have not been updated in last x days, as they are either not being priorities or are not blockers.

[Ulrick28]

+1 to Pip's suggestions and hesitance for any automation that auto-closes tickets, particularly due to things like lack of a sig. We should have automation that identifies stale issues, as sigs should discuss if these issues will ever be addressed or are no longer relevant.