stale-prs.yml

# This file is deployed to all repos managed by the protected_repo module
# (enable_stale_pr_checker = true by default). It runs daily and warns/closes
# PRs that have been inactive for too long. Issues are never affected.
#
# Default behavior:
#   Day 21: Adds 'stale' label + posts a warning comment
#   Day 28: Closes the PR if no new activity since the warning
#
# To reset the stale timer: push a commit, leave a comment, or update a label.
# To permanently exempt a PR: add the 'pinned' or 'do-not-close' label.
# To opt this repo out: set enable_stale_pr_checker = false in terraform-github.

name: "Stale PR Checker"

on:
  schedule:
    - cron: '0 14 * * *'  # Every day at 9am ET (UTC-5 / UTC-4 during DST)
  workflow_dispatch:

permissions:
  pull-requests: write
  issues: write

jobs:
  stale:
    runs-on: github-arc-runner-prod
    steps:
      - uses: actions/stale@v10
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-pr-stale: 21
          days-before-pr-close: 7
          stale-pr-label: 'stale'
          exempt-pr-labels: 'pinned,security,do-not-close'
          stale-pr-message: |
            :warning: **This PR has been inactive for 21 days.**

            It will be automatically closed in **7 days** if there is no new activity.

            To keep this PR open, you can:
            - Push a new commit
            - Leave a comment
            - Add the `pinned` or `do-not-close` label if this PR should never be auto-closed
          close-pr-message: |
            This PR has been automatically closed due to 21 days of inactivity after being marked stale.

            If this work is still needed, please reopen the PR or create a new one.
          operations-per-run: 100
          days-before-issue-stale: -1
          days-before-issue-close: -1