ci(github): add stale issue workflow (dry-run) - #15027
Merged
Merged
Conversation
github-actions
Bot
added
github_actions
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| steps: | ||
| - name: Harden Runner | ||
| uses: step-security/harden-runner@v2 |
|
|
||
| steps: | ||
| - name: Harden Runner | ||
| uses: step-security/harden-runner@v2 |
Contributor
|
See the Build Results workflow run for details. |
Nightly actions/stale run that labels issues untouched for 90 days as stale and closes them 30 days later. Feature requests are processed in a separate job so they get their own close message. Milestoned issues and Priority: Critical are exempt; pull requests are not touched. Ships with debug-only enabled so the first runs only log what would be labeled/closed. A follow-up removes debug-only once the dry-run output has been reviewed.
DonLakeFlyer
force-pushed
the
ci-stale-issues
branch
from
September 3, 2026 15:08
9de5f03 to
67197b3
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The dry-run workflow unnecessarily retains write permissions that should be restricted before approval.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
.github/workflows/stale.yml:63
- The feature-request dry run also grants unnecessary write access to issues and Actions caches. Restrict this job to read access now, then elevate it in the follow-up that removes
debug-only.
permissions:
issues: write
actions: write
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Balanced
Comment on lines
+19
to
+22
| permissions: | ||
| issues: write | ||
| # Required to reset the Actions cache entry that persists resume state between capped runs. | ||
| actions: write |
| | `crowdin.yml`, `lupdate.yml` | Translation workflows | | ||
| | `dependency-review.yml` | Dependency security review | | ||
| | `scorecard.yml` | OpenSSF Scorecard | | ||
| | `stale.yml` | Nightly stale-issue labeling and closing (feature requests get their own close message) | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a nightly
actions/staleworkflow to work down the open issue backlog (~976 open, ~630 untouched for over a year, ~540 filed more than 5 years ago). Modeled on PX4-Autopilot'sstale.yml.Behavior
stalelabel (silently — no comment, to avoid a notification flood on the initial sweep).stalelabel.Priority: Critical.operations-per-run: 400per job keeps both jobs under theGITHUB_TOKEN1000 req/hr cap; the initial sweep spreads over a few nights.Rollout
This PR ships with
debug-only: true, so the workflow only logs what it would label/close. Plan:workflow_dispatch, review the log to confirm counts and that exemptions are honored.debug-onlyto go live. First nightly run labels; closes begin 30 days later.Note: 68 open issues already carry a manually applied
stalelabel. Once live, those that have not been updated since labeling will be closed on the first run (no additional grace period).