mirror of
https://github.com/Twigpine/node.git
synced 2026-11-09 13:31:25 -10:00
beardthelion
1960f6b28f
* ci(triage): run PR triage on pull_request_target so fork PRs can be labeled Fork PRs run the triage job with a read-only GITHUB_TOKEN under the pull_request event regardless of the workflow's declared write permissions, so addLabels/createComment fail with 403 'Resource not accessible by integration' for every external contributor (e.g. #103). Switch the trigger to pull_request_target, which runs in the base-repo context with the declared write token. The job never checks out or runs PR head code (it only reads context.payload and the pulls/files API and manages labels), so it carries none of the untrusted-code-execution risk that makes pull_request_target dangerous. * ci(stale): drop needs-issue from auto-close trigger, keep it advisory needs-issue flags PRs that link no issue, but linking one is a SHOULD in CONTRIBUTING (required only for protocol-level changes), and many legitimate small PRs (docs, obvious fixes) have none. Coupling it to the 14/21-day auto-close was overreach: a substantive, well-described PR could be closed purely for missing an issue reference. Keep needs-issue as an advisory label and guidance nudge; leave only needs-description (an empty/thin body, a far stronger low-effort signal) as the auto-close trigger. * ci(stale): align stale message with description-only close condition The auto-close trigger narrowed to needs-description, but the stale message still told contributors a PR could close for a missing linked issue. Drop that clause so the warning matches what actually closes a PR. * style(ci): replace em dashes in triage/stale contributor messages * docs(contributing): match stale close policy to description-only trigger Auto-close is driven by needs-description only; a missing issue link stays advisory. Align the contributor docs with the workflow so the OR wording no longer implies a missing issue link can close a PR.
41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
name: Stale PRs
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "30 1 * * *" # daily at 01:30 UTC
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
|
|
jobs:
|
|
stale:
|
|
name: Flag and close ignored PRs
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
|
|
with:
|
|
days-before-stale: 14
|
|
days-before-close: 7
|
|
# Act on PRs only; never on issues.
|
|
days-before-issue-stale: -1
|
|
days-before-issue-close: -1
|
|
# Only PRs the triage step flagged as missing a real description.
|
|
# needs-issue is advisory-only (linking an issue is a SHOULD, and many
|
|
# legitimate small PRs have none) so it does not drive auto-close.
|
|
only-pr-labels: "needs-description"
|
|
stale-pr-label: "stale"
|
|
exempt-pr-labels: "workflow-change,security,pinned"
|
|
remove-stale-when-updated: true
|
|
stale-pr-message: >
|
|
This PR has been inactive for 14 days and is still missing a description.
|
|
It will be closed in 7 days if there's no update. Push a change or leave a
|
|
comment to keep it open. No hard feelings, you can reopen anytime.
|
|
close-pr-message: >
|
|
Closing due to inactivity. Reopen whenever you're ready to update it. See
|
|
CONTRIBUTING.md for what helps us review quickly.
|
|
ascending: true
|