Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/workflows/stale.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Stale issues

on:
workflow_dispatch:
schedule:
- cron: "21 4 * * *"

jobs:
stale:
permissions:
actions: write
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The job requests actions: write, but actions/stale only needs to read/update issues (and optionally pull requests). Granting actions: write is broader than necessary; please remove it to follow least-privilege permissions.

Suggested change
actions: write

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is intentional as its required to clean stale cache. See actions/stale#1248

issues: write
runs-on: ubuntu-latest

steps:
- uses: actions/stale@v10
with:
stale-issue-message: 'This issue is stale because it has been open 90 days with no activity. This issue will be closed in 30 days unless new comments are made or the stale label is removed. To skip these checks, apply the "feature, enhancement or lifecycle/frozen" labels.'
stale-issue-label: 'lifecycle/stale'
exempt-issue-labels: 'lifecycle/frozen,feature,enhancement'
Comment on lines +10 to +20
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/stale processes pull requests by default. This workflow only grants issues: write, so runs may fail when the action tries to label/close PRs. If the intent is issues-only, set only-issues: true (or disable PR handling); otherwise add pull-requests: write permission and configure the PR-specific settings/messages.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor Author

@rahulait rahulait Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is incorrect suggestion. There is no only-issues: true option and this workflow is not touching PRs, its only labeling/closing issues here as configured. See https://github.com/actions/stale?tab=readme-ov-file#all-options

If someone wants to label PRs as well in future, those permissions should be set then.

days-before-stale: 90
close-issue-message: 'This issue was automatically closed due to inactivity.'
days-before-issue-close: 30
remove-stale-when-updated: true
operations-per-run: 300
Loading