---
title: Fire on every issue
description: Change the GitHub channel so the pipeline runs on every newly opened issue instead of waiting for the factory label.
type: guide
summary: Swap the label gate on onIssue for an opened-action gate, and understand the trust you give up.
related:
  - /docs/intake
  - /docs/trust-model
---

# Fire on every issue



<CopyPrompt
  className="block"
  text={`Help me customize the eve Software Factory template. I want the factory pipeline to run on every newly opened issue, instead of only on issues labeled with FACTORY_LABEL.

Ground truth first: read AGENTS.md in the repository root, then read agent/channels/github.ts in full, paying attention to the existing onIssue hook, the isTrustedLabeler helper, and the FACTORY_INTAKE_TASK text. Follow the conventions already in that file rather than inventing new ones.

1. Change the onIssue dispatch predicate so it fires when issue.action === "opened", instead of requiring the "labeled" action and a matching FACTORY_LABEL on issue.raw.labels.
2. Keep the bot-sender guard (ctx.sender.type !== "Bot"). Bots opening issues must not start runs.
3. Keep stamping the session with stampAutonomous(defaultGitHubAuth(ctx), issue.issueNumber), so the run stays unattended and comment writes stay scoped to that issue.
4. isTrustedLabeler is no longer reachable from onIssue. Do not delete it if any other hook uses it; if nothing does, remove it and its imports so the file has no dead code.
5. Update the FACTORY_INTAKE_TASK wording so it no longer claims the issue was handed over with a label. It should say the run was started by the issue being opened. Keep every other instruction in that task text unchanged, especially the ones about never asking a question and never attempting an action that needs approval.
6. Leave FACTORY_LABEL in agent/lib/constants.ts alone. It is still read elsewhere.

Finish by running pnpm validate and confirming 0 errors and 0 warnings, then run pnpm eval --tag fast and report the result. Do not deploy.

Full recipe, with the reasoning behind each step: https://ask-foreman.dev/recipes/fire-on-every-issue`}
/>

Foreman ships waiting for a label. Adding `factory` to an issue is what hands it to the pipeline, and the labeler needs at least `triage` permission for the run to start.

Change the `onIssue` hook so every newly opened issue starts a run instead, with no label needed.

## When to use it

Reach for this on a private repository where everyone who can open an issue is already trusted, and where you want the factory attempting work without anyone remembering to label.

<Callout type="warn" title="Do not do this on a public repository">
  The label gate is the only thing standing between an anonymous issue and an unattended run. Remove it on a public repository and anyone with a GitHub account can start a run that reads your code, burns tokens, and pushes a branch.
</Callout>

The permission check exists for a specific reason. GitHub fires the `labeled` action even for labels attached at issue creation, which issue templates let unauthenticated reporters do, so `isTrustedLabeler` asks the API who the sender is and requires `triage` or better. Dispatching on `opened` skips that question entirely, because the sender is whoever opened the issue.

## What it touches

| File                       | Change                                                         |
| -------------------------- | -------------------------------------------------------------- |
| `agent/channels/github.ts` | The `onIssue` dispatch predicate, and the injected intake task |

The run stays unattended, so `stampAutonomous` and the [trust model](/docs/trust-model) still apply. An unattended run can label, comment on its own intake issue, close or reopen, and open a draft pull request. Everything else stays denied.

## Before you run it

Two things worth weighing.

Every issue now costs tokens. Bug reports, questions, duplicates, and spam all enter the pipeline, and the Classifier only triages after the run has already started.

Re-labeling stops being a restart. Today, answering the Classifier's questions and re-applying the label kicks off a fresh run. With the label gate gone that recovery disappears, so a fresh run means a fresh issue unless you keep the labeled path alongside the opened one.

## Verify

```bash
pnpm validate
pnpm eval --tag fast
```

Then open an issue on a scratch repository and confirm a run starts without any label. Watch that the run still posts progress comments on that issue and still stops at a draft pull request.

## What to expect

The Classifier's clarification gate becomes your main filter. On an unattended run it posts its questions and stops rather than guessing, so low-information issues end as a comment rather than a pull request.

## FAQ

<Accordions type="single">
  <Accordion title="Is this safe on a public repository?">
    No. Do not do it. The label gate plus `isTrustedLabeler` is the only thing requiring a human with `triage` permission before an unattended run starts. Dispatching on `opened` removes that check, so anyone with a GitHub account could start runs that read your code, spend tokens, and push branches.

    The trust model still limits what a run can do, since an unattended run is denied everything except labels, comments on its own intake issue, close and reopen, and a draft pull request. But the ability to start a run at all becomes public.
  </Accordion>

  <Accordion title="Can I keep the label path as well?">
    Yes, and it is usually the better change. Rather than replacing the predicate, widen it so the hook dispatches on `opened` or on the existing labeled-and-trusted condition.

    That keeps re-labeling working as the way to restart a run after answering the Classifier's questions, which is otherwise the main thing you lose.
  </Accordion>

  <Accordion title="Does the run still stop at a draft pull request?">
    Yes. Nothing about this recipe changes the trust model. The session is still stamped with `stampAutonomous`, so shipping is still denied and the ceiling is still a draft pull request.
  </Accordion>

  <Accordion title="What happens to low-quality issues?">
    They enter the pipeline and cost tokens before anything filters them. The Classifier is your filter, and it only runs after the session has started.

    In practice most weak issues stop at the clarification gate. On an unattended run the Classifier's questions get posted as a comment and the run ends, so you get a comment rather than a wasted pull request.
  </Accordion>

  <Accordion title="How do I undo it?">
    Restore the original `onIssue` predicate: dispatch only on `issue.action === "labeled"`, require `FACTORY_LABEL` on `issue.raw.labels`, and re-add the `isTrustedLabeler` check. Since the change is confined to `agent/channels/github.ts`, reverting that one file is enough.
  </Accordion>
</Accordions>


---

For a semantic overview of all documentation, see [/sitemap.md](/sitemap.md)

For an index of all available documentation, see [/llms.txt](/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/agents.md](/agents.md)