9df5a07640
Pin every third-party GitHub Action to its current commit SHA with a version comment, eliminating supply chain risk from mutable version tags. Mutable tags (v4, v2, etc.) can be force-pushed by upstream maintainers; SHA digests are immutable. 18 unique actions pinned across 9 workflow files. Closes #357 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
44 lines
1.6 KiB
YAML
44 lines
1.6 KiB
YAML
name: Stale
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "20 2 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
stale:
|
|
permissions:
|
|
issues: write
|
|
pull-requests: write
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Mark stale issues and pull requests
|
|
uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
|
|
with:
|
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
|
days-before-issue-stale: 21
|
|
days-before-issue-close: 7
|
|
days-before-pr-stale: 14
|
|
days-before-pr-close: 7
|
|
stale-issue-label: stale
|
|
stale-pr-label: stale
|
|
exempt-issue-labels: security,pinned,no-stale,maintainer
|
|
exempt-pr-labels: no-stale,maintainer
|
|
remove-stale-when-updated: true
|
|
exempt-all-assignees: true
|
|
operations-per-run: 300
|
|
stale-issue-message: |
|
|
This issue was automatically marked as stale due to inactivity.
|
|
Please provide an update, reproduction details, or current status to keep it open.
|
|
close-issue-message: |
|
|
Closing this issue due to inactivity.
|
|
If the problem still exists on the latest `main`, please open a new issue with fresh repro steps.
|
|
close-issue-reason: not_planned
|
|
stale-pr-message: |
|
|
This PR was automatically marked as stale due to inactivity.
|
|
Please rebase/update and post the latest validation results.
|
|
close-pr-message: |
|
|
Closing this PR due to inactivity.
|
|
Maintainers can reopen once the branch is updated and validation is provided.
|