Victor Lyuboslavsky
95c349be96
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41198 Also fixed the currently failing check on main. Final zizmor PR <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security & Infrastructure** * Enhanced credential handling in automated workflows by disabling unnecessary credential persistence * Strengthened security scanning configuration to enforce additional checks on GitHub Actions workflows while maintaining a curated allowlist for compatibility <!-- end of auto-generated comment: release notes by coderabbit.ai -->
68 lines
2.7 KiB
YAML
68 lines
2.7 KiB
YAML
name: Close stale eng-initiated issues
|
|
|
|
# Marks open engineering-initiated issues (label `~engineering-initiated`) as stale after 365 days of
|
|
# no activity, then closes them after 14 more days of inactivity once labeled stale. Activity (any
|
|
# comment or update) bumps `updated_at` and resets both clocks, and removes the stale label.
|
|
#
|
|
# Runs the shared `stale-issues-core.js` engine via `stale-eng-issues.js`. This replaced the
|
|
# off-the-shelf `actions/stale` action so the stale comment can @-mention the issue author, which
|
|
# `actions/stale`'s static `stale-issue-message` cannot do.
|
|
|
|
on:
|
|
schedule:
|
|
# Daily at 8:10pm CDT (1:10am UTC) -- run during off-hours to prevent hitting GitHub API rate limit
|
|
- cron: "10 1 * * *"
|
|
workflow_dispatch: # Manual
|
|
inputs:
|
|
dry_run:
|
|
description: 'If true, log candidates without writing labels, comments, or closing issues.'
|
|
type: boolean
|
|
default: true
|
|
max_operations:
|
|
description: 'Maximum GitHub API write operations per run. Each modified issue costs 2 writes (comment + label, or comment + close).'
|
|
type: number
|
|
default: 400
|
|
|
|
# This allows a subsequently queued workflow run to interrupt previous runs
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
|
shell: bash
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
close-stale-issues:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout repo
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Stale and close eng-initiated issues
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
# Schedule runs always run live. Manual runs honor the dry_run input (default true).
|
|
DRY_RUN: ${{ (github.event_name == 'workflow_dispatch' && inputs.dry_run == true) && 'true' || 'false' }}
|
|
# Forwarded verbatim so an explicit `0` (the no-writes kill switch) survives. On schedule
|
|
# runs the input is empty and parseMaxOps in the script applies the 400 default.
|
|
MAX_OPERATIONS: ${{ inputs.max_operations }}
|
|
with:
|
|
script: |
|
|
const run = require('./.github/scripts/stale-eng-issues.js');
|
|
await run({ github, context, core });
|