mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-08-31 09:13:33 +02:00
731c79f2b7
- A (security): authenticate the ai-plan comment selector — only accept a plan from a trusted author (OWNER/MEMBER/COLLABORATOR), so a reporter can't inject a plan that executes on approval. Fail-safe to no-plan otherwise. - B: clear ai:approved in the no-plan branch so a later real plan can be re-approved (re-adding a present label fires no labeled event). - C: claim ai:needs-info via a live re-check inside the serialized job so queued reporter replies can't each run a classification; restore the flag if no verdict was produced so the issue doesn't drop out of the retry path. - D: gate workflow_dispatch of the tier-3 executor to github.actor == alexbelgium. - E: exempt ai:approved from the stale bot. - F: filter catch-up candidates server-side (search) instead of capping at the 100 newest issues, so older untriaged issues aren't silently missed. - G: run ai_guard_paths.sh from the trusted default-branch copy, not the in-tree copy a job could have modified. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
37 lines
1.3 KiB
YAML
37 lines
1.3 KiB
YAML
# This workflow warns and then closes issues and PRs
|
|
# that have had no activity for a specified amount of time.
|
|
#
|
|
# You can adjust the behavior by modifying this file.
|
|
# For more information, see:
|
|
# https://github.com/actions/stale
|
|
---
|
|
name: Mark stale issues and pull requests
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 12 * * 0'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
stale:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
issues: write
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- uses: actions/stale@v10
|
|
with:
|
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
|
stale-issue-message: 'This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.'
|
|
stale-pr-message: 'Stale pull request message'
|
|
stale-issue-label: 'stale'
|
|
stale-pr-label: 'stale'
|
|
days-before-stale: '5'
|
|
days-before-close: '2'
|
|
# AI triage labels are exempt: an issue waiting on @alexbelgium's
|
|
# `ai:approved`, or queued for the tier-2 sweep, must not be auto-closed
|
|
# out from under the pipeline before it is acted on.
|
|
exempt-issue-labels: 'prevent stale,ai-triage,ai:plan-pending,ai:approved,ai:needs-info,ai:needs-human'
|
|
remove-stale-when-updated: true
|