[BUG] Bot closing valid issues

[svrooij]

Hi @et1975, we deeply appreciate your input into this project. Regrettably, this issue has remained inactive for over 2 years, leading us to the decision to close it. We've implemented this policy to maintain the relevance of our issue queue and facilitate easier navigation for new contributors. If you still believe this topic requires attention, please feel free to create a new issue, referencing this one. Thank you for your understanding and ongoing support.

Originally posted by @github-actions[bot] in https://github.com/Azure/azure-sdk-for-net/issues/19167#issuecomment-1977327411

I think you should really fix your bot, closing valid issues like 19167 because there is not enough activity, is a terrible developer experience.

Can you maybe document what the policy is or how user should do Important Security feature requests? My personal opinion is that security related feature requests should never be closed without human intervention.

This issue 19167 specifically, because all the so called "solutions" require the user to again start setting up user secrets during development. Which will eventually lead to them accidentally committing those secrets to the repository again, something you try to discourage. If you instead facilitate the use of DefaultAzureCredential in docker, there would be no need to setup the service principal in the first place.

[svrooij]

And for people looking for a solution to use DefaultAzureCredentials in Docker, I've already posted a third-party solution here

Drumroll 🥁 ..... I've managed to use DefaultAzureCredentials in docker with the use of an open-source proxy (build by myself). https://svrooij.io/2023/08/03/emulate-managed-identities/ I know this is not a real solution but at least you can start testing your apps running in docker.

[jsquire]

Hi @svrooij. Thanks for reaching out and we regret that you're experiencing difficulties. I've routed this over to the team member best able to assist.

[ronniegeraghty]

Hi @svrooij, I sincerely apologize for the frustration you've encountered with our issue management process. The Azure SDK team recognizes that our large issue backlog has hindered our ability to plan and address work effectively. To mitigate this, we've implemented an automation to close stale issues, which we hope will enhance our efficiency in resolving issues more promptly.

Upon review of the original issue, it's clear that it remains relevant and unresolved. To ensure continued tracking, I will be opening a new issue where we can focus on the core problem without the clutter of previous comments and updates. I'll also make sure it is assigned properly and is given a priority that correctly reflects the community interest behind it. This approach aims to streamline our efforts and address your concerns more directly.

I understand your concerns regarding the auto-closure of stale issues. While we've considered allowing issue authors to exempt their issues from this rule, we must avoid potential abuse of such a workaround that could lead us back to our current predicament. We believe that the process of authors opening a new issue strikes a balance between preventing irrelevant issues from resurfacing and ensuring that pertinent issues are revisited.

Your feedback on the transparency of our new automation is appreciated. The bot targets issues created over two years ago with no updates in the last month. We are committed to improving clarity around our processes and I will be adding a detailed explanations of this automation to the CONTRIBUTING.md files across our repositories. I'll update and close out this issue once the updates are made.

Please do not hesitate to share any additional feedback you may have. Your feedback is valuable to us and assists in improving our processes to enhance your experience.

[svrooij]

@ronniegeraghty thanks for clarifying. If you create a new issue for those that are still relevant the experience for the developer won't change.

This specific issue will get closed, every developer who responded to it will get a message that it's closed without a solution. Then they don't follow the new issue and my workaround will get lost in a closed issue to not be found ever again.

Regular users are not able to add tags to issues, that is restricted to contributors. So it might be as easy to create a special tag "no-auto-close", and exempt those from being closed by the bot. And there won't be any misuse.

[ronniegeraghty]

@svrooij, thank you for your input. We understand the importance of ensuring that valuable workarounds and discussions are not lost when transitioning issues. To address this, we will ensure that everyone who has commented on the original issue is mentioned in the new issue, so they are aware that it is being tracked and managed in a new location. We recognize that developers often look at issues for potential workarounds; however, the primary goal of an issue should be to find a comprehensive solution rather than to serve as a repository for various workarounds.

Regarding the suggestion of using a "no-auto-close" label, we acknowledge the idea, but it is not feasible in this case. The reason being, there is a significant number of individuals who have the necessary permissions to add labels and are part of teams outside our SDK team. We are also asking these teams to review their stale issues, which complicates the use of such a label to prevent auto-closure. We are committed to finding a balanced approach that preserves important information while maintaining a clear and focused issue tracking system.

[ronniegeraghty]

Writing back with an update. I have added a section to the SUPPORT.md file in each of the Azure SDK language repos with information on our issue auto close process.