Triage: 15 open issues have a PR ready; #256 already shipped (partial) — labeling + auto-close gap

[Rish-it]

Summary

Cross-referenced all 66 open issues against open/merged PR bodies (closing keywords: closes/fixes/resolves #N, HTML-comment-stripped so the PR template's own "Closes #123" example doesn't match as a false positive).

Issues with an open PR ready for review

Issue	PR	CI / merge signal	Ready to close
#396	#421	mergeable, clean	No — merge #421 first
#427	#443	mergeable, clean	No — merge #443 first
#438	#450	mergeable, clean	No — merge #450 first
#389	#409	CI pass	No — merge #409 first
#123	#232	CI pass	No — merge #232 first
#379	#386	no CI signal	No — merge #386 first
#401	#406	no CI signal	No — merge #406 first
#402	#405	no CI signal	No — merge #405 first
#415	#416	no CI signal	No — merge #416 first
#381	#425	conflicting, needs rebase	No — rebase #425 first
#392	#423	conflicting, needs rebase	No — rebase #423 first
#410	#414	conflicting, needs rebase	No — rebase #414 first
#434	#435	conflicting, needs rebase	No — rebase #435 first
#220	#222	CI failing	No — fix CI on #222 first
#408	#422	CI failing	No — fix CI on #422 first

Already shipped (partial) — close or rescope

Issue	Shipped via	What landed	What's missing	Ready to close
#256	#380	Core env-var-based alternate-CA + EAB mechanism, merged 2026-08-02	openship certs ca … CLI + dashboard CA picker from the original ask — #380's own description says those stay unmerged drafts on the contributor's fork	Yes — close with a comment linking #380, or reopen re-scoped to just the CLI/dashboard layer

#380 referenced the issue as a bare #256, not Closes #256, so GitHub's native auto-close never fired despite the change landing.

Ask

1. Review/merge-or-request-changes on the 15 PRs above before they go stale — 4 already have merge conflicts (fix(adapters): use POSIX path module for remote nginx/certbot paths #425, fix(mail): scope outbound-relay TLS to the relay transport #423, fix(dashboard): enable rollback for success-mapped deployment rows #414, fix(backups): fail fast and allow cancel when backup restore-apply hangs with no managed container #435), 2 have failing CI (Webmail: block remote CSS fetches when remote images are off #222, fix(adapters): probe Docker daemon with docker version --format '{{.Server.Version}}' #422).
2. A label sweep — in review or has-pr — on the 15 issues above would make this visible without re-reading every thread. Repo currently has no such label, and this account only has pull access, not triage, so it can't be applied directly.
3. Close or rescope Support ACME External Account Binding (EAB / HMAC) for certificate issuance #256 per the table above.

Automating this going forward

A pull_request Action (opened / synchronize / closed) reading closingIssuesReferences via GraphQL — more reliable than regex, ignores template comments — could auto-label linked issues in review on PR open, and lean on GitHub's native auto-close on merge. The #256 gap above is exactly the failure mode that would catch: a PR that ships the fix but references the issue without a closing keyword, so it never auto-closes. Happy to send that workflow as a PR if useful.

[Hydralerne]

thank you for this, gonna check this now