mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-12 14:16:28 +03:00
Paul BakausandGitHub
36e4cea693
Pin existing action versions to verified commit SHAs, restrict CI to a read-only repository token, and document the optional live-edit validation script. Preserve required sync/sheriff permissions and existing runtime behavior. Related to #480; extension permission assessment remains separate. AI assistance: Codex, under maintainer direction.
74 lines
2.0 KiB
YAML
74 lines
2.0 KiB
YAML
name: PR Sheriff
|
|
|
|
on:
|
|
issues:
|
|
types: [opened, reopened]
|
|
schedule:
|
|
# Daily UTC afternoon pass. The script uses an aggressive 7/14 day window:
|
|
# warn contributor-blocked PRs after 7 days open, close after 14.
|
|
- cron: "17 15 * * *"
|
|
workflow_dispatch:
|
|
inputs:
|
|
dry_run:
|
|
description: "Print planned changes without mutating GitHub"
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
actions: read
|
|
checks: read
|
|
contents: read
|
|
issues: write
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: pr-sheriff
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
issue-inbox:
|
|
if: github.event_name == 'issues'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Mark issue for triage
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
run: |
|
|
gh label create "needs triage" \
|
|
--repo "$GH_REPO" \
|
|
--color "d4c5f9" \
|
|
--description "New or reopened issue awaiting maintainer triage" \
|
|
--force
|
|
gh issue edit "$ISSUE_NUMBER" --repo "$GH_REPO" --add-label "needs triage"
|
|
|
|
sheriff:
|
|
if: github.event_name != 'issues'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 24
|
|
|
|
- name: Run sheriff
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
mode="--apply"
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.dry_run }}" = "true" ]; then
|
|
mode="--dry-run"
|
|
fi
|
|
|
|
node scripts/github/sheriff.mjs "$mode" \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--warning-days 7 \
|
|
--close-days 14 \
|
|
--maintainers "pbakaus" \
|
|
--regular-contributors "pbakaus,abdulwahabone" \
|
|
--auto-close-regulars
|