ci: add workflow to clean up stale PRs and issues#792
Conversation
✅ Docs preview has no changesThe preview was not built because there were no changes. Build ID: e25faf9d07b2aa66196ac8a0 ✅ AI Style Review — No Changes DetectedNo MDX files were changed in this pull request. Review Log: View detailed log
|
📝 WalkthroughWalkthroughAdds a daily and manually triggered GitHub Actions workflow that marks inactive issues and pull requests stale after 60 days and closes them 14 days later, with label and draft exemptions. ChangesStale cleanup workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
DaleSeo
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/stale.yml:
- Line 15: Update the actions/stale workflow step to reference a specific full
commit SHA instead of the mutable v10 tag, preserving the existing action
configuration and permissions.
- Around line 11-13: Update the workflow permissions block to add actions: write
alongside the existing issues and pull-requests permissions, ensuring the job
grants actions/stale@v10 the required Actions scope.
- Around line 2-5: Add a workflow-level concurrency configuration alongside the
triggers in the stale workflow, using a shared group and setting
cancel-in-progress to false so scheduled and manually dispatched runs queue
rather than overlap. Keep the existing schedule and workflow_dispatch triggers
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 7f921e1d-3f44-4366-ac61-e3616e90480c
📒 Files selected for processing (1)
.github/workflows/stale.yml
| on: | ||
| schedule: | ||
| - cron: "0 0 * * *" | ||
| workflow_dispatch: |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,220p' .github/workflows/stale.yml | cat -nRepository: apollographql/apollo-mcp-server
Length of output: 1739
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if [ -f .github/workflows/stale.yml ]; then
cat -n .github/workflows/stale.yml
else
echo "missing"
fiRepository: apollographql/apollo-mcp-server
Length of output: 1739
🏁 Script executed:
rg -n "^concurrency:|cancel-in-progress:" .github/workflowsRepository: apollographql/apollo-mcp-server
Length of output: 648
Serialize scheduled and manual runs. Add a workflow-level concurrency group with cancel-in-progress: false so schedule and workflow_dispatch runs queue instead of overlapping and racing duplicate stale comments or label/close mutations.
Proposed fix
on:
schedule:
- cron: "0 0 * * *"
workflow_dispatch:
+concurrency:
+ group: stale-cleanup
+ cancel-in-progress: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on: | |
| schedule: | |
| - cron: "0 0 * * *" | |
| workflow_dispatch: | |
| on: | |
| schedule: | |
| - cron: "0 0 * * *" | |
| workflow_dispatch: | |
| concurrency: | |
| group: stale-cleanup | |
| cancel-in-progress: false |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/stale.yml around lines 2 - 5, Add a workflow-level
concurrency configuration alongside the triggers in the stale workflow, using a
shared group and setting cancel-in-progress to false so scheduled and manually
dispatched runs queue rather than overlap. Keep the existing schedule and
workflow_dispatch triggers unchanged.
Source: MCP tools
| permissions: | ||
| issues: write | ||
| pull-requests: write |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- .github/workflows/stale.yml ---'
cat -n .github/workflows/stale.yml
echo
echo '--- search for stale action usage/docs in repo ---'
rg -n "actions/stale|operation limit|actions: write|permissions:" .github/workflows . -g '!**/node_modules/**' || trueRepository: apollographql/apollo-mcp-server
Length of output: 3146
🌐 Web query:
actions/stale v10 permissions actions write cache state operation limit
💡 Result:
To resolve issues with the actions/stale v10+ action regarding cache state and operation limits, you must explicitly grant the actions: write permission in your workflow configuration [1][2][3]. Background and Permissions The actions/stale action utilizes the GitHub Actions Cache to maintain state between workflow runs [2][4]. When the number of processed items exceeds the configured operations-per-run limit (default: 30), the action stores its progress in the cache [5][4]. If a subsequent run needs to update or replace this cache, it may trigger an error (e.g., 403 Forbidden) if the workflow lacks sufficient permissions to manage cache entries [4][3][6]. Granting actions: write allows the action to delete and update existing cache entries as needed [2][4][3]. Recommended Configuration The official recommendation for actions/stale is to include the following permissions block in your workflow file [1][7]: permissions: actions: write contents: write # Required if using the delete-branch option issues: write pull-requests: write Note that while actions: write is essential for cache state management, contents: write is specifically required only if you have enabled the delete-branch feature [1][8]. The issues: write and pull-requests: write permissions are necessary for the action's core functionality of labeling, commenting on, and closing issues or pull requests [1][5]. If your repository has restricted default token permissions, omitting these explicit settings will likely result in "Insufficient permissions" or "Resource not accessible by integration" errors during cache operations or when attempting to modify repository items [5][9][10].
Citations:
- 1: https://github.com/actions/stale?tab=readme-ov-file
- 2: Update README.md actions/stale#1248
- 3: Error delete _state: [403] Resource not accessible by integration actions/stale#1133
- 4: Stale workflow fails to override cache. actions/stale#1131
- 5: ci: declare minimum permissions on stale-issues workflow redis/redis-py#4065
- 6: Unable to reserve cache with key _state actions/stale#1090
- 7: https://github.com/actions/stale/tree/refs/heads/main
- 8: https://github.com/actions/stale/blob/b5d41d4e1d5dceea10e7104786b73624c18a190f/README.md
- 9: Sporadically, the workflow errors with
Insufficient permissions to update the state_reason.actions/stale#1321 - 10: "issues: write" permissions required despite not dealing with stale issues actions/stale#840
Add actions: write to the job permissions. actions/stale@v10 uses Actions cache state once it hits its operation limit; without that scope, large backlogs can keep restarting from the same items instead of making progress.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/stale.yml around lines 11 - 13, Update the workflow
permissions block to add actions: write alongside the existing issues and
pull-requests permissions, ensuring the job grants actions/stale@v10 the
required Actions scope.
Source: MCP tools
| issues: write | ||
| pull-requests: write | ||
| steps: | ||
| - uses: actions/stale@v10 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files .github/workflows/stale.yml
echo '---'
cat -n .github/workflows/stale.ymlRepository: apollographql/apollo-mcp-server
Length of output: 1771
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/stale.yml')
print(p.exists())
if p.exists():
text = p.read_text()
for i, line in enumerate(text.splitlines(), 1):
if 'actions/stale' in line or 'uses:' in line:
print(f"{i}: {line}")
PYRepository: apollographql/apollo-mcp-server
Length of output: 210
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the workflow and nearby context.
sed -n '1,80p' .github/workflows/stale.ymlRepository: apollographql/apollo-mcp-server
Length of output: 1494
Pin actions/stale to a full commit SHA.
actions/stale@v10 is mutable, and this workflow has write access to issues and pull requests.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/stale.yml at line 15, Update the actions/stale workflow
step to reference a specific full commit SHA instead of the mutable v10 tag,
preserving the existing action configuration and permissions.
Source: MCP tools
2 participants
Adds a scheduled GitHub Actions workflow that keeps the issue and PR backlog tidy by marking inactive items stale and closing them if they stay quiet. It runs
actions/stale@v10daily so that items with no activity for 60 days get aStalelabel plus an explanatory comment, and are closed 14 days later if still inactive.