feat: add Flue spam and off-topic filter agent

[mvvmm]

Summary

Adds a Flue-based spam and off-topic filter agent that automatically evaluates newly opened GitHub issues and pull requests against the cloudflare/cloudflare-docs repository and closes obvious spam or submissions that do not clearly relate to developer documentation.

How it works:

• A GitHub webhook delivers issues.opened and pull_request.opened events to the Orchestrate agent.
• The Orchestrate agent verifies the webhook signature and dispatches to the SpamAndOffTopicFilter agent with { eventType, number }.
• The SpamAndOffTopicFilter agent fetches the canonical issue/PR metadata from the GitHub API (title, body, author, labels) and — for PRs — also fetches the file diff (capped at 25 files, 2,000 chars per patch).
• A skill (spam-and-off-topic-filter/SKILL.md) instructs the model to evaluate the content and return a structured verdict: { is_spam, confidence, reason }.
• Trusted code (not the model) posts a comment and closes the issue/PR when is_spam: true, confidence is medium or high, and the item is still open.
• All GitHub content is treated as untrusted data to mitigate prompt injection.

Structure:

Path	Description
.flue/agents/orchestrate.ts	Webhook receiver; verifies signature and routes to the spam-and-off-topic filter
.flue/agents/spam-and-off-topic-filter.ts	Fetches GitHub context, runs skill, acts on verdict
.flue/lib/github.ts	GitHub API helpers (get issue, get PR, get PR files, post comment, close issue)
.flue/lib/seed-r2.ts	Workaround for flue/issues#153 — seeds .agents/ and AGENTS.md from R2 into the sandbox on cold sessions
.flue/.agents/skills/spam-and-off-topic-filter/SKILL.md	Model instructions for spam/off-topic classification
.flue/roles/cloudflare-docs-bot.md	Role definition for the agent
.flue/wrangler.jsonc	Wrangler config for the Cloudflare Worker

Tested against the latest 20 open PRs and 20 open issues — all legitimate PRs returned is_spam: false, and the three off-topic/support issues that would have been closed were correctly identified.

Screenshots (optional)

Spam PR

Closed by flue agent

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
*	@cloudflare/product-owners
*.ts	@cloudflare/content-engineering, @kodster28
package.json	@cloudflare/content-engineering

[ask-bonk]

3 issues need attention before merge. 4 inline comments posted.

[ask-bonk]

I reviewed PR #30832 and posted a review with inline comments.

Labels applied: engineering, triage

Summary of changes:
This PR adds a Flue-based spam-filter Worker (.flue/) that receives GitHub webhooks for new issues/PRs, uses an LLM skill to classify spam/off-topic content, and automatically closes obvious spam with a comment. It also adds the required npm packages, Flue build/deploy scripts, and R2 seeding logic.

Issues flagged (4 inline comments):

• HIGH package.json:70 — @octokit/rest is added but never imported by the new Flue code. It bloats pnpm-lock.yaml (+13k lines) unnecessarily.
• MEDIUM package.json:116 — just-bash is added as a direct dependency but never imported. @flue/sdk already depends on it transitively.
• MEDIUM .flue/agents/spam-filter.ts:101 — Before closing an issue/PR, the agent should verify item.state === "open". Redelivered webhooks could otherwise post duplicate comments.
• MEDIUM .flue/agents/orchestrate.ts:23 — Webhook signature verification is skipped when GITHUB_WEBHOOK_SECRET is absent. Failing closed prevents accepting forged webhooks if the environment is misconfigured.

Review posted at: #30832 (review)

github run

[github-actions]

Preview URL: https://82cda4b4.preview.developers.cloudflare.com
Preview Branch URL: https://flue-init.preview.developers.cloudflare.com