Auto-triage new GitHub PRs with risk labels and Slack summary

Build me an agent workflow that triages every new GitHub pull request the moment it is opened. I want plain-language summaries, risk flags, labels, and a Slack heads-up so reviewers know what they are walking into.

Trigger: a GitHub webhook on the pull_request event, filtered to the action 'opened'. The webhook payload tells the agent the repo and PR number.

First, skip the PR entirely if the author is a bot. Specifically ignore dependabot, dependabot[bot], renovate, renovate[bot], github-actions[bot], and any author whose login ends in -bot or -release. Exit cleanly with no comment, no label, no Slack message.

For human PRs, call Get a Pull Request on GitHub to fetch the title, body, author, base and head branches, additions, deletions, and the list of changed files. Use the changed file paths to reason about scope and risk.

Draft a short review comment with three sections. One: a plain-language summary of what the change does, written so a non-author reviewer can skim it in fifteen seconds. Two: an apparent risk level of low, medium, or high, with a one-line justification. Treat changes touching database migrations, auth or session code, payments or billing, secrets or environment config, infrastructure as code, or shared core libraries as elevated risk. Treat docs, tests, and copy-only changes as low risk. Three: a suggested reviewer focus, naming the two or three things a human should actually verify.

Post that draft on the PR using GitHub Create a Pull Request Review with event set to COMMENT. Do not approve and do not request changes. The review should be a single body comment, not inline comments.

Then label the PR using GitHub Add Labels to an Issue. Apply one risk label (risk:low, risk:medium, or risk:high) and one or more area labels inferred from the changed paths (for example area:frontend, area:backend, area:infra, area:docs, area:migrations, area:auth, area:payments). If a label does not exist, create it first with a sensible color.

Finally, post the same summary to Slack using Slack Bot Send a Message in the channel I configure (default #code-review). The Slack message should include the PR title as a link to the PR URL, the author, the risk level with an emoji (green for low, yellow for medium, red for high), the plain-language summary, and the suggested reviewer focus. Keep it tight, one Slack post per PR.

Make the bot author list, the risk path rules, the label naming, and the Slack channel easy to edit at the top of the workflow so I can tune it per repo without rewriting the agent.