Skip to content

build(deps): bump actions/stale from 10 to 11 in the github-actions group across 1 directory - #175

Merged
steipete merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-84c3d95bcf
Aug 2, 2026
Merged

build(deps): bump actions/stale from 10 to 11 in the github-actions group across 1 directory#175
steipete merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-84c3d95bcf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 1 update in the / directory: actions/stale.

Updates actions/stale from 10 to 11

Release notes

Sourced from actions/stale's releases.

v11.0.0

What's Changed

Enhancement

Dependency Update

Full Changelog: actions/stale@v10...v11.0.0

v10.4.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10.3.0...v10.4.0

v10.3.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10...v10.3.0

v10.2.0

What's Changed

Bug Fix

Dependency Updates

New Contributors

Full Changelog: actions/stale@v10...v10.2.0

... (truncated)

Changelog

Sourced from actions/stale's changelog.

Changelog

[10.1.0]

What's Changed

[10.0.0]

What's Changed

Breaking Changes

Enhancement

Dependency Upgrades

Documentation changes

[9.1.0]

What's Changed

[9.0.0]

Breaking Changes

  1. Action is now stateful: If the action ends because of operations-per-run then the next run will start from the first unprocessed issue skipping the issues processed during the previous run(s). The state is reset when all the issues are processed. This should be considered for scheduling workflow runs.
  2. Version 9 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.

... (truncated)

Commits
  • 4391f3d Fix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...
  • eaf9131 refactor: update imports to use ES module syntax and improve test structure (...
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump actions/stale
8e59a66 
Bumps the github-actions group with 1 update in the / directory: [actions/stale](https://github.com/actions/stale).


Updates `actions/stale` from 10 to 11
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@v10...v11)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: '11'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 2, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 2, 2026 06:18
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 2, 2026
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. labels Aug 2, 2026
@clawsweeper

clawsweeper Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 2:21 AM ET / 06:21 UTC.

ClawSweeper review

What this changes

Updates all three actions/stale workflow steps from major version 10 to 11 without changing the repository’s stale-item policy settings.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

The patch is a clean, configuration-preserving Dependabot upgrade, but it changes the scheduled workflow that automatically labels and closes repository items. Current source shows the workflow uses GitHub-hosted ubuntu-latest, which avoids the self-hosted-runner compatibility concern noted for the Node 24-based action release; merge review should still acknowledge the bounded automation risk because normal CI does not exercise the daily scheduled path.

Priority: P3
Reviewed head: 8e59a66de6b2d356d1247f7d0c589878c23c8733

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A focused, cleanly mergeable dependency update that preserves the existing workflow policy, with the remaining consideration limited to scheduled automation behavior.
Proof confidence 🌊 off-meta tidepool Not applicable: This is an automated Dependabot workflow-dependency PR; the external-contributor real-behavior-proof gate does not apply. Successful checks supplement source review, while a controlled manual dispatch remains the appropriate optional live automation proof.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: This is an automated Dependabot workflow-dependency PR; the external-contributor real-behavior-proof gate does not apply. Successful checks supplement source review, while a controlled manual dispatch remains the appropriate optional live automation proof.
Evidence reviewed 4 items Current workflow boundary: Current main runs this workflow on GitHub-hosted ubuntu-latest, grants only issue and pull-request write permissions, and invokes the stale action three times with the repository’s existing policy inputs.
Narrow patch: The proposed branch changes only the three action references from v10 to v11; all with settings, permissions, labels, messages, and schedule remain unchanged.
Feature provenance: The stale workflow and its original actions/stale@v10 configuration were introduced in the repository automation commit; later release work carried the same workflow into the current branch.
Findings None None.
Security None None.

How this fits together

The stale workflow runs daily and on manual dispatch to apply the repository’s inactive-item policy. It feeds GitHub issue and pull-request activity into three action invocations for unassigned items, assigned issues, and assigned pull requests.

flowchart LR
  A[Repository activity] --> B[Scheduled stale workflow]
  B --> C[Unassigned items]
  B --> D[Assigned issues]
  B --> E[Assigned pull requests]
  C --> F[Stale action v11]
  D --> F
  E --> F
  F --> G[Labels and closure messages]
Loading

Before merge

  • Resolve merge risk (P1) - actions/stale v11 is a major runtime upgrade for a workflow that can label and close repository items; CI does not exercise the scheduled daily execution path. The current ubuntu-latest runner avoids the known self-hosted-runner compatibility condition, but maintainers should accept this limited automation upgrade risk before merge.
  • Complete next step (P2) - No concrete repair is needed; this is a clean dependency-update PR awaiting normal maintainer merge review and acceptance of its bounded automation risk.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Workflow references 3 changed in 1 workflow file Every stale-policy invocation moves together, while the permissions and all policy inputs remain unchanged.

Merge-risk options

Maintainer options:

  1. Accept the bounded workflow upgrade risk (recommended)
    Merge with the existing GitHub-hosted ubuntu-latest runner and unchanged policy inputs, acknowledging that the daily scheduled path is not covered by the pull-request checks.
  2. Pause for a controlled live run
    If stronger assurance is preferred, manually dispatch the workflow in a controlled repository state and verify that stale labeling behavior remains unchanged before merging.

Technical review

Best possible solution:

Keep the existing three stale-policy configurations intact and merge the v11 upgrade after acknowledging that the GitHub-hosted runner is the intended supported execution environment.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-update PR rather than a report of broken product behavior. Source inspection confirms the exact workflow surface and that the patch changes only its action version references.

Is this the best way to solve the issue?

Yes. Updating the three existing references is the narrowest maintainable path because it preserves the repository’s established stale-policy configuration and permission boundary.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 74935a58c387.

Labels

Label changes:

  • add P3: This is a small maintenance upgrade with no reported user-facing breakage.
  • add merge-risk: 🚨 automation: The patch upgrades the third-party action that performs scheduled labeling and closure automation, a path ordinary PR checks do not execute.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is an automated Dependabot workflow-dependency PR; the external-contributor real-behavior-proof gate does not apply. Successful checks supplement source review, while a controlled manual dispatch remains the appropriate optional live automation proof.

Label justifications:

  • P3: This is a small maintenance upgrade with no reported user-facing breakage.
  • merge-risk: 🚨 automation: The patch upgrades the third-party action that performs scheduled labeling and closure automation, a path ordinary PR checks do not execute.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is an automated Dependabot workflow-dependency PR; the external-contributor real-behavior-proof gate does not apply. Successful checks supplement source review, while a controlled manual dispatch remains the appropriate optional live automation proof.

Evidence

What I checked:

  • Current workflow boundary: Current main runs this workflow on GitHub-hosted ubuntu-latest, grants only issue and pull-request write permissions, and invokes the stale action three times with the repository’s existing policy inputs. (.github/workflows/stale.yml:12, 74935a58c387)
  • Narrow patch: The proposed branch changes only the three action references from v10 to v11; all with settings, permissions, labels, messages, and schedule remain unchanged. (.github/workflows/stale.yml:18, 8e59a66de6b2)
  • Feature provenance: The stale workflow and its original actions/stale@v10 configuration were introduced in the repository automation commit; later release work carried the same workflow into the current branch. (.github/workflows/stale.yml:18, 637d2bd1cf81)
  • Current release provenance: The checked-out main commit is eight commits beyond the latest release v0.7.1; the proposed dependency bump is not present on current main or in that release. (.github/workflows/stale.yml:18, 74935a58c387)

Likely related people:

  • Vincent Koc: Introduced the stale workflow and its three-policy structure in the repository automation commit. (role: workflow introducer; confidence: high; commits: 637d2bd1cf81; files: .github/workflows/stale.yml)
  • Peter Steinberger: Current blame attributes the workflow’s action references to the release commit that carried the workflow into the current history. (role: recent workflow owner; confidence: medium; commits: f6e00010cc2a; files: .github/workflows/stale.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • If desired, manually dispatch the stale workflow in a controlled state and redact any private repository details from the resulting logs.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@steipete
steipete merged commit f34569f into main Aug 2, 2026
15 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-84c3d95bcf branch August 2, 2026 06:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete