🕰️ Mark Stale Issues and PRs #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) 2026 SnowdreamTech. All rights reserved. | |
| # Licensed under the MIT License. See LICENSE file in the project root for full license information. | |
| --- | |
| # Mark Stale Issues and PRs | |
| # Purpose: Maintains repository health by identifying and closing inactive issues and pull requests. | |
| # Trigger: Daily cron schedule (01:30 UTC) and manual backup. | |
| # Permissions: | |
| # - issues: write (Required to label and close stagnant issues). | |
| # - pull-requests: write (Required to label and close stagnant PRs). | |
| # Concurrency: | |
| # - group: ${{ github.workflow }}-${{ github.ref }} (Prevents overlapping maintenance runs). | |
| # - cancel-in-progress: true (Maintenance can be safely restarted). | |
| # Design: | |
| # - Safeguards sensitive items by exempting 'pinned', 'security', and 'bug' labels. | |
| # - Non-disruptive: Provides a 7-day grace period after stale marking. | |
| name: "🕰️ Mark Stale Issues and PRs" | |
| "on": | |
| schedule: | |
| # Staggered to run during low-traffic hours | |
| - cron: "30 1 * * *" | |
| workflow_dispatch: | |
| permissions: {} | |
| env: | |
| UNIRTM_LOCKED: 1 | |
| jobs: | |
| stale: | |
| name: "⏳ Inactivity Management" | |
| runs-on: ubuntu-latest | |
| concurrency: | |
| group: stale-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| issues: write # Required to label and close stagnant issues | |
| pull-requests: write # Required to label and close stagnant PRs | |
| timeout-minutes: 40 # Maintenance tasks are usually fast API operations | |
| steps: | |
| - name: "🔒 Harden Runner" | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| raw.githubusercontent.com:443 | |
| objects.githubusercontent.com:443 | |
| pkg-containers.githubusercontent.com:443 | |
| avatars.githubusercontent.com:443 | |
| github.com:443 | |
| packages.microsoft.com:443 | |
| archive.ubuntu.com:80 | |
| archive.ubuntu.com:443 | |
| security.ubuntu.com:80 | |
| security.ubuntu.com:443 | |
| ports.ubuntu.com:80 | |
| ports.ubuntu.com:443 | |
| keyserver.ubuntu.com:80 | |
| keyserver.ubuntu.com:443 | |
| changelogs.ubuntu.com:80 | |
| changelogs.ubuntu.com:443 | |
| deb.debian.org:80 | |
| deb.debian.org:443 | |
| security.debian.org:80 | |
| security.debian.org:443 | |
| snapshot.debian.org:80 | |
| snapshot.debian.org:443 | |
| dl.rockylinux.org:443 | |
| mirrors.rockylinux.org:443 | |
| mirror.centos.org:443 | |
| vault.centos.org:443 | |
| isv-data.centos.org:443 | |
| mirrorlist.centos.org:80 | |
| mirrorlist.centos.org:443 | |
| cdn.redhat.com:443 | |
| cdn-ubi.redhat.com:443 | |
| access.redhat.com:443 | |
| sso.redhat.com:443 | |
| dl-cdn.alpinelinux.org:443 | |
| registry.npmjs.org:443 | |
| registry.yarnpkg.com:443 | |
| pypi.org:443 | |
| files.pythonhosted.org:443 | |
| proxy.golang.org:443 | |
| sum.golang.org:443 | |
| index.crates.io:443 | |
| static.rust-lang.org:443 | |
| packagist.org:443 | |
| repo.maven.apache.org:443 | |
| golang.org:443 | |
| pkg.go.dev:443 | |
| dl.google.com:443 | |
| rubygems.org:443 | |
| registry.terraform.io:443 | |
| formulae.brew.sh:443 | |
| repo.yarnpkg.com:443 | |
| ghcr.io:443 | |
| production.cloudflare.docker.com:80 | |
| production.cloudflare.docker.com:443 | |
| registry-1.docker.io:443 | |
| auth.docker.io:443 | |
| docker.io:443 | |
| quay.io:443 | |
| cdn.quay.io:443 | |
| docker-images-prod.s3.us-west-2.amazonaws.com:443 | |
| docker-images-prod.s3.us-east-1.amazonaws.com:443 | |
| docker-images-prod.s3.amazonaws.com:443 | |
| s3.amazonaws.com:443 | |
| s3.us-west-2.amazonaws.com:443 | |
| s3.us-east-1.amazonaws.com:443 | |
| osv-vulnerabilities.storage.googleapis.com:443 | |
| api.osv.dev:443 | |
| get.trivy.dev:443 | |
| aquasecurity.github.io:443 | |
| tuf-repo-cdn.sigstore.dev:443 | |
| oauth2.sigstore.dev:443 | |
| rekor.sigstore.dev:443 | |
| fulcio.sigstore.dev:443 | |
| api.sigstore.dev:443 | |
| - name: "🧹 Mark Inactive Issues & PRs (Stale)" | |
| uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 | |
| with: | |
| # Automatically identifies and labels stagnant items to maintain repository focus. | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| stale-issue-message: > | |
| This issue is stale because it has been open for 60 days with no activity. | |
| Remove the stale label or comment, otherwise this will be closed in 7 days. | |
| stale-pr-message: > | |
| This pull request is stale because it has been open for 60 days with no activity. | |
| Remove the stale label or comment, otherwise this will be closed in 7 days. | |
| stale-issue-label: "stale" | |
| stale-pr-label: "stale" | |
| days-before-issue-stale: 60 | |
| days-before-pr-stale: 60 | |
| days-before-issue-close: 7 | |
| days-before-pr-close: 7 | |
| exempt-issue-labels: "pinned,security,bug" | |
| exempt-pr-labels: "pinned,security,bug" |