ci: add Devin on-label automation workflow

[devin-ai-integration]

Summary

Adds a GitHub Actions workflow that automatically creates a Devin session when the devin label is added to any issue in this repo.

How it works

1. Add a devin label to any GitHub issue
2. The workflow calls the Devin API to create a new session
3. A comment is posted on the issue with a link to the Devin session

Prerequisites

• A DEVIN_API_KEY organization secret must be configured in GitHub (Settings → Secrets → Actions → Organization secrets)

---

---

Note

Medium Risk
Adds a new GitHub Actions workflow that triggers on issue label events, calls an external API using DEVIN_API_KEY, and posts issue comments; misconfiguration or secret/permissions issues could impact repo automation behavior.

Overview
Automatically spins up a Devin session when an issue is labeled devin via a new .github/workflows/devin-on-label.yml workflow.

The workflow builds a prompt from the labeled issue’s URL/title/body, creates an idempotent session through https://api.devin.ai/v1/sessions, and (only for newly created sessions) comments the session link back on the issue using issues: write permissions.

^{Reviewed by Cursor Bugbot for commit 52802c6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 52802c6. Configure here.}

[cursor]

Script injection via unsanitized user input in shell

High Severity

User-controlled values github.event.issue.body and github.event.issue.title are interpolated directly into run shell scripts via ${{ }} expressions. GitHub Actions expands these before the shell executes, so an attacker can craft an issue body containing EOF on its own line to terminate the heredoc and execute arbitrary commands — including exfiltrating the DEVIN_API_KEY secret. The title similarly breaks out of double quotes on the jq --arg line. These values need to be passed through env: blocks instead of inline interpolation.

Additional Locations (2)

• .github/workflows/devin-on-label.yml#L20-L21
• .github/workflows/devin-on-label.yml#L42-L43

 

^{Reviewed by Cursor Bugbot for commit 52802c6. Configure here.}

[cursor]

jq alternative operator converts false to true

Medium Severity

The jq expression .is_new_session // true uses the alternative operator, which replaces both null and false with the right-hand side. When the Devin API returns "is_new_session": false for a duplicate session, this expression incorrectly evaluates to true, causing the workflow to always post a comment — even for already-existing sessions.

 

^{Reviewed by Cursor Bugbot for commit 52802c6. Configure here.}