Skip to content

ci: add workflow to clean up stale PRs and issues #792

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DaleSeo merged 1 commit into from
Jul 21, 2026
+35 −0
Merged

ci: add workflow to clean up stale PRs and issues #792

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions .github/workflows/stale.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
name: Clean Up Stale PRs and Issues
on:
schedule:
- cron: "0 0 * * *"
workflow_dispatch:
Comment on lines +2 to +5

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,220p' .github/workflows/stale.yml | cat -n

Repository: apollographql/apollo-mcp-server

Length of output: 1739

🏁 Script executed:

#!/bin/bash
set -euo pipefail
if [ -f .github/workflows/stale.yml ]; then
  cat -n .github/workflows/stale.yml
else
  echo "missing"
fi

Repository: apollographql/apollo-mcp-server

Length of output: 1739

🏁 Script executed:

rg -n "^concurrency:|cancel-in-progress:" .github/workflows

Repository: apollographql/apollo-mcp-server

Length of output: 648

Serialize scheduled and manual runs. Add a workflow-level concurrency group with cancel-in-progress: false so schedule and workflow_dispatch runs queue instead of overlapping and racing duplicate stale comments or label/close mutations.

Proposed fix 
 on:
   schedule:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+concurrency:
+  group: stale-cleanup
+  cancel-in-progress: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
on:
schedule:
- cron: "0 0 * * *"
workflow_dispatch:
on:
schedule:
- cron: "0 0 * * *"
workflow_dispatch:
concurrency:
group: stale-cleanup
cancel-in-progress: false
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/stale.yml around lines 2 - 5, Add a workflow-level
concurrency configuration alongside the triggers in the stale workflow, using a
shared group and setting cancel-in-progress to false so scheduled and manually
dispatched runs queue rather than overlap. Keep the existing schedule and
workflow_dispatch triggers unchanged.

Source: MCP tools


jobs:
stale:
name: Clean Up
runs-on: ubuntu-24.04
permissions:
issues: write
pull-requests: write
Comment on lines +11 to +13

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- .github/workflows/stale.yml ---'
cat -n .github/workflows/stale.yml

echo
echo '--- search for stale action usage/docs in repo ---'
rg -n "actions/stale|operation limit|actions: write|permissions:" .github/workflows . -g '!**/node_modules/**' || true

Repository: apollographql/apollo-mcp-server

Length of output: 3146

🌐 Web query:

actions/stale v10 permissions actions write cache state operation limit

💡 Result:

To resolve issues with the actions/stale v10+ action regarding cache state and operation limits, you must explicitly grant the actions: write permission in your workflow configuration [1][2][3]. Background and Permissions The actions/stale action utilizes the GitHub Actions Cache to maintain state between workflow runs [2][4]. When the number of processed items exceeds the configured operations-per-run limit (default: 30), the action stores its progress in the cache [5][4]. If a subsequent run needs to update or replace this cache, it may trigger an error (e.g., 403 Forbidden) if the workflow lacks sufficient permissions to manage cache entries [4][3][6]. Granting actions: write allows the action to delete and update existing cache entries as needed [2][4][3]. Recommended Configuration The official recommendation for actions/stale is to include the following permissions block in your workflow file [1][7]: permissions: actions: write contents: write # Required if using the delete-branch option issues: write pull-requests: write Note that while actions: write is essential for cache state management, contents: write is specifically required only if you have enabled the delete-branch feature [1][8]. The issues: write and pull-requests: write permissions are necessary for the action's core functionality of labeling, commenting on, and closing issues or pull requests [1][5]. If your repository has restricted default token permissions, omitting these explicit settings will likely result in "Insufficient permissions" or "Resource not accessible by integration" errors during cache operations or when attempting to modify repository items [5][9][10].

Citations:

Add actions: write to the job permissions. actions/stale@v10 uses Actions cache state once it hits its operation limit; without that scope, large backlogs can keep restarting from the same items instead of making progress.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/stale.yml around lines 11 - 13, Update the workflow
permissions block to add actions: write alongside the existing issues and
pull-requests permissions, ensuring the job grants actions/stale@v10 the
required Actions scope.

Source: MCP tools

steps:
- uses: actions/stale@v10

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files .github/workflows/stale.yml
echo '---'
cat -n .github/workflows/stale.yml

Repository: apollographql/apollo-mcp-server

Length of output: 1771

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/stale.yml')
print(p.exists())
if p.exists():
    text = p.read_text()
    for i, line in enumerate(text.splitlines(), 1):
        if 'actions/stale' in line or 'uses:' in line:
            print(f"{i}: {line}")
PY

Repository: apollographql/apollo-mcp-server

Length of output: 210

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the workflow and nearby context.
sed -n '1,80p' .github/workflows/stale.yml

Repository: apollographql/apollo-mcp-server

Length of output: 1494

Pin actions/stale to a full commit SHA.
actions/stale@v10 is mutable, and this workflow has write access to issues and pull requests.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/stale.yml at line 15, Update the actions/stale workflow
step to reference a specific full commit SHA instead of the mutable v10 tag,
preserving the existing action configuration and permissions.

Source: MCP tools

with:
days-before-stale: 60
days-before-close: 14
exempt-issue-labels: keep,security,pinned
exempt-pr-labels: keep,security,pinned
exempt-draft-pr: true
stale-issue-message: >
This issue has had no activity for 60 days and is now marked as stale.
It will be closed in 14 days if there is no further activity. Add the
`keep` label to keep it open.
close-issue-message: >
Closing this issue after 14 days of inactivity since it was marked stale.
Feel free to reopen if it is still relevant.
stale-pr-message: >
This pull request has had no activity for 60 days and is now marked as stale.
It will be closed in 14 days if there is no further activity. Add the
`keep` label to keep it open.
close-pr-message: >
Closing this pull request after 14 days of inactivity since it was marked stale.
Feel free to reopen if you plan to continue the work.
Loading