From 36f24ca6a8a41cb780809fa40e0c995f022dcb6b Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Thu, 9 Jul 2026 12:12:03 -0700 Subject: [PATCH 1/2] feat(stale): add reusable stale-PR workflow + name the repo in the Slack digest (BE-2776) Consolidates the per-repo stale-PR sweeper (duplicated in cloud + comfy-infra) into one reusable workflow, and names the source repo in the Slack digest header so batches from different repos posted to the same channel are no longer ambiguous ("#158" alone could be any repo). Ports the actions/stale + chat.postMessage logic verbatim, parameterizing what differs per repo (Slack channel, stale/close thresholds, messages, exempt labels) as inputs, with SLACK_BOT_TOKEN passed through secrets. --- .github/workflows/stale.yml | 187 ++++++++++++++++++++++++++++++++++++ README.md | 1 + 2 files changed, 188 insertions(+) create mode 100644 .github/workflows/stale.yml diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml new file mode 100644 index 0000000..2aab011 --- /dev/null +++ b/.github/workflows/stale.yml @@ -0,0 +1,187 @@ +name: Stale PRs (reusable) + +# Reusable stale-PR sweeper. Keeps a repo's PR queue tidy and posts a Slack +# digest of what it touched, so the same logic isn't copy-pasted (and left to +# drift) across repos. Powered by https://github.com/actions/stale +# • PR inactive `days_before_pr_stale` days → labeled `stale` + reminder comment +# • Still inactive `days_before_pr_close` days later → closed +# • Any new commit/comment removes `stale` and resets the clock +# • Issues are left untouched (days-before-issue-* = -1) +# +# The Slack digest header names the source repo (`github.repository`) so two +# repos' batches posted to the same channel are unambiguous — a bare "#158" +# looks identical whether it's from cloud or comfy-infra. +# +# Caller pattern (place in source repo at .github/workflows/stale.yml). The +# caller owns the schedule + the workflow_dispatch dry-run toggle; this reusable +# does the sweep + the Slack post: +# +# name: Stale PRs +# on: +# schedule: +# - cron: "0 3 * * *" # daily 03:00 UTC +# workflow_dispatch: +# inputs: +# dry-run: +# description: "Preview without applying" +# type: boolean +# default: false +# permissions: +# pull-requests: write +# issues: write # required by actions/stale even for PR-only runs +# concurrency: +# group: stale +# cancel-in-progress: false +# jobs: +# stale: +# uses: Comfy-Org/github-workflows/.github/workflows/stale.yml@ # v1 +# with: +# # Optional overrides — see inputs below. Defaults post to #proj-cloud. +# dry_run: ${{ inputs.dry-run || false }} +# secrets: +# SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} + +on: + workflow_call: + inputs: + slack_channel: + description: >- + Slack channel ID the digest is posted to. The bot behind + SLACK_BOT_TOKEN must be a member. Defaults to #proj-cloud. + type: string + required: false + default: C08V9NDB3B4 + days_before_pr_stale: + description: Days of PR inactivity before it's marked stale. + type: number + required: false + default: 14 + days_before_pr_close: + description: Days after being marked stale before the PR is closed. + type: number + required: false + default: 14 + stale_pr_label: + description: Label applied to a stale PR (and watched for removal to reset the clock). + type: string + required: false + default: stale + exempt_pr_labels: + description: >- + Comma-separated labels that exempt a PR from being marked stale. + type: string + required: false + default: pinned,security,work-in-progress,wip,dependencies,do-not-merge + stale_pr_message: + description: Comment posted when a PR is marked stale. + type: string + required: false + default: > + This PR has been automatically marked **stale** after 14 days of + inactivity. It will be closed in 14 days if there's no further + activity. Push a commit, comment, or remove the `stale` label to + keep it open. + close_pr_message: + description: Comment posted when a stale PR is closed. + type: string + required: false + default: > + Closing this PR as stale after ~4 weeks of inactivity. Feel free to + reopen when you pick it back up. + dry_run: + description: >- + Preview only — actions/stale runs in debug-only mode and no Slack + digest is sent. Wire the caller's workflow_dispatch dry-run input here. + type: boolean + required: false + default: false + secrets: + SLACK_BOT_TOKEN: + description: >- + Bot token used to post the digest via chat.postMessage. If omitted, + the sweep still runs; only the Slack heads-up is skipped. + required: false + +permissions: + pull-requests: write + issues: write # required by actions/stale even for PR-only runs + +jobs: + stale: + runs-on: ubuntu-latest + steps: + - id: stale + uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 + with: + repo-token: ${{ secrets.GITHUB_TOKEN }} + days-before-issue-stale: -1 # issues disabled + days-before-issue-close: -1 + days-before-pr-stale: ${{ inputs.days_before_pr_stale }} + days-before-pr-close: ${{ inputs.days_before_pr_close }} + stale-pr-label: ${{ inputs.stale_pr_label }} + exempt-pr-labels: ${{ inputs.exempt_pr_labels }} + exempt-draft-pr: true + exempt-all-milestones: true + remove-stale-when-updated: true + operations-per-run: 30 + ascending: true + stale-pr-message: ${{ inputs.stale_pr_message }} + close-pr-message: ${{ inputs.close_pr_message }} + debug-only: ${{ inputs.dry_run || false }} + + # Surface what the bot did in Slack, not just in-PR. The header names the + # source repo so batches from different repos posted to the same channel + # are visually distinguishable. + - name: Slack heads-up (marked stale / closed) + # Skip during dry-run previews and when no PR was touched this run. If + # no SLACK_BOT_TOKEN is configured the curl below degrades to a warning + # rather than failing the run. + if: >- + ${{ inputs.dry_run != true && + ( (steps.stale.outputs.staled-issues-prs != '' && steps.stale.outputs.staled-issues-prs != '[]') || + (steps.stale.outputs.closed-issues-prs != '' && steps.stale.outputs.closed-issues-prs != '[]') ) }} + env: + SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} + SLACK_CHANNEL: ${{ inputs.slack_channel }} + REPO: ${{ github.repository }} + SERVER_URL: ${{ github.server_url }} + DAYS_TO_CLOSE: ${{ inputs.days_before_pr_close }} + STALED: ${{ steps.stale.outputs.staled-issues-prs }} + CLOSED: ${{ steps.stale.outputs.closed-issues-prs }} + run: | + set -euo pipefail + + # actions/stale outputs JSON arrays of the PRs it staled/closed this run. + # Build "• title" lines; derive the URL from repo + number so we + # don't depend on html_url being present in the output objects. + fmt() { + echo "${1:-[]}" | jq -r --arg base "$SERVER_URL/$REPO/pull" \ + '.[]? | "• <\($base)/\(.number)|#\(.number)> \(.title // "")"' + } + WARN_LINES=$(fmt "$STALED") + CLOSE_LINES=$(fmt "$CLOSED") + + # Name the repo in the header so two repos' batches in the same channel + # aren't confused (a bare "#158" is ambiguous). Per-PR links already + # resolve correctly via $REPO above. + TEXT=":hourglass_flowing_sand: *Stale PR bot — ${REPO}*" + if [ -n "$WARN_LINES" ]; then + TEXT="${TEXT}"$'\n\n'"*Marked stale* — auto-closes in ${DAYS_TO_CLOSE} days without activity:"$'\n'"${WARN_LINES}" + fi + if [ -n "$CLOSE_LINES" ]; then + TEXT="${TEXT}"$'\n\n'"*Closed as stale:*"$'\n'"${CLOSE_LINES}" + fi + + PAYLOAD=$(jq -nc --arg channel "$SLACK_CHANNEL" --arg text "$TEXT" \ + '{channel: $channel, text: $text}') + RESPONSE=$(curl -sS -X POST \ + -H "Authorization: Bearer ${SLACK_BOT_TOKEN}" \ + -H 'Content-Type: application/json; charset=utf-8' \ + --data "$PAYLOAD" \ + https://slack.com/api/chat.postMessage || true) + + if [ "$(echo "$RESPONSE" | jq -r '.ok')" = "true" ]; then + echo "Slack heads-up sent" + else + echo "::warning::Slack notification failed: $(echo "$RESPONSE" | jq -r '.error // "unknown error"')" + fi diff --git a/README.md b/README.md index 9f473ac..308930d 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,7 @@ This repo is **public** so any repo — public or private, inside or outside the | [`cursor-review-auto-label.yml`](.github/workflows/cursor-review-auto-label.yml) | Companion to `cursor-review.yml`. On PR assignment, applies the review label for an opted-in reviewer (via the CLOUD_CODE_BOT app token, so the label actually triggers the review). The opt-in roster lives in the caller's `vars.CURSOR_REVIEW_OPTED_IN_LOGINS` — no roster is baked into the workflow. Requires `vars.APP_ID` + `CLOUD_CODE_BOT_PRIVATE_KEY`. | | [`assign-reviewers.yml`](.github/workflows/assign-reviewers.yml) | Auto-requests expertise-aware, load-balanced PR reviewers with new-folk randomization. Matches changed paths against a caller-repo `.github/reviewers.yml` (path-glob → reviewers, plus a `default_pool`), drops the author + `vars.REVIEWER_EXCLUDE`, ranks candidates by open review load (steering off anyone at/over `vars.REVIEWER_LOAD_CAP`), and may swap a slot for a `vars.REVIEWER_GROWTH_POOL` member. Requests go through the CLOUD_CODE_BOT app token so they work on fork PRs. Requires `vars.APP_ID` + `CLOUD_CODE_BOT_PRIVATE_KEY`. | | [`assign-prs-to-author.yml`](.github/workflows/assign-prs-to-author.yml) | Housekeeping — assigns every open PR with no assignees to its author (bot-authored PRs skipped by default). Run on a schedule from a thin caller; useful when a team tracks PR ownership via assignees. The calling job needs `pull-requests: write` and `issues: write`. | +| [`stale.yml`](.github/workflows/stale.yml) | Stale-PR sweeper (`actions/stale`) plus a Slack digest of what it touched. PRs inactive for N days are labeled `stale`; still-inactive PRs are closed. The digest header names the source repo so batches from different repos posted to the same channel are unambiguous. Thresholds, messages, exempt labels, and the Slack channel are inputs; the caller owns the schedule + dry-run toggle. The calling job needs `pull-requests: write` and `issues: write`. Optional `SLACK_BOT_TOKEN`. | ## Usage From e75e2f2214c3d6d71d637f9094e18693368856ed Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Mon, 20 Jul 2026 23:38:49 -0700 Subject: [PATCH 2/2] fix(stale): harden Slack digest step per review panel (BE-2776) Address cursor-review panel findings on the reusable stale-PR workflow: - Escape Slack mrkdwn control chars (& < >) in interpolated PR titles so a crafted title can't inject / pings or masked phishing links (High). - Skip the Slack post entirely when SLACK_BOT_TOKEN is unset instead of firing a curl with an empty Bearer header that still ships repo name + PR titles to Slack's API; honors the secret's documented optional contract (Medium). - Reword default stale/close messages to drop hardcoded day counts and the label name so they stay correct when a caller overrides days_before_pr_* or stale_pr_label without also overriding the messages (Medium). - Add curl --connect-timeout/--max-time and a job timeout-minutes so a stalled Slack endpoint can't hang the runner (Low). - Suppress the "auto-closes in N days" line when days_before_pr_close <= 0 (actions/stale's never-close sentinel), which otherwise read "-1 days" (Low). - Capture curl HTTP status so a transport/non-JSON failure yields a real reason instead of an empty "Slack notification failed:" warning (Low). Co-Authored-By: Claude Opus 4.8 --- .github/workflows/stale.yml | 59 ++++++++++++++++++++++++++++--------- 1 file changed, 45 insertions(+), 14 deletions(-) diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 2aab011..d7e1284 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -76,18 +76,21 @@ on: description: Comment posted when a PR is marked stale. type: string required: false + # Intentionally omits specific day counts / the label name so it stays + # correct when a caller overrides days_before_pr_* or stale_pr_label + # without also overriding this message (the exact deadline lives in the + # Slack digest, which is derived from the actual inputs). default: > - This PR has been automatically marked **stale** after 14 days of - inactivity. It will be closed in 14 days if there's no further - activity. Push a commit, comment, or remove the `stale` label to - keep it open. + This PR has been automatically marked **stale** due to inactivity and + will be closed if there's no further activity. Push a commit or leave + a comment to keep it open. close_pr_message: description: Comment posted when a stale PR is closed. type: string required: false default: > - Closing this PR as stale after ~4 weeks of inactivity. Feel free to - reopen when you pick it back up. + Closing this PR as stale after an extended period of inactivity. Feel + free to reopen when you pick it back up. dry_run: description: >- Preview only — actions/stale runs in debug-only mode and no Slack @@ -109,6 +112,7 @@ permissions: jobs: stale: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - id: stale uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 @@ -151,12 +155,24 @@ jobs: run: | set -euo pipefail + # No token configured → skip entirely rather than firing a curl with an + # empty `Authorization: Bearer` header, which would still ship the repo + # name + PR titles to Slack's API. The secret is documented as optional + # ("only the Slack heads-up is skipped"), so honor that here. + if [ -z "${SLACK_BOT_TOKEN:-}" ]; then + echo "SLACK_BOT_TOKEN not set — skipping Slack heads-up" + exit 0 + fi + # actions/stale outputs JSON arrays of the PRs it staled/closed this run. # Build "• title" lines; derive the URL from repo + number so we - # don't depend on html_url being present in the output objects. + # don't depend on html_url being present in the output objects. Escape + # Slack mrkdwn control chars (& < >) in the title so a crafted title + # can't inject / pings or masked links. fmt() { - echo "${1:-[]}" | jq -r --arg base "$SERVER_URL/$REPO/pull" \ - '.[]? | "• <\($base)/\(.number)|#\(.number)> \(.title // "")"' + echo "${1:-[]}" | jq -r --arg base "$SERVER_URL/$REPO/pull" ' + def slack_escape: gsub("&";"&") | gsub("<";"<") | gsub(">";">"); + .[]? | "• <\($base)/\(.number)|#\(.number)> \((.title // "") | slack_escape)"' } WARN_LINES=$(fmt "$STALED") CLOSE_LINES=$(fmt "$CLOSED") @@ -166,7 +182,14 @@ jobs: # resolve correctly via $REPO above. TEXT=":hourglass_flowing_sand: *Stale PR bot — ${REPO}*" if [ -n "$WARN_LINES" ]; then - TEXT="${TEXT}"$'\n\n'"*Marked stale* — auto-closes in ${DAYS_TO_CLOSE} days without activity:"$'\n'"${WARN_LINES}" + # actions/stale treats days-before-pr-close <= 0 as "never close", so + # only promise a deadline when the close window is a positive count. + if [ "${DAYS_TO_CLOSE}" -gt 0 ] 2>/dev/null; then + STALE_HEADER="*Marked stale* — auto-closes in ${DAYS_TO_CLOSE} days without activity:" + else + STALE_HEADER="*Marked stale* (auto-close disabled):" + fi + TEXT="${TEXT}"$'\n\n'"${STALE_HEADER}"$'\n'"${WARN_LINES}" fi if [ -n "$CLOSE_LINES" ]; then TEXT="${TEXT}"$'\n\n'"*Closed as stale:*"$'\n'"${CLOSE_LINES}" @@ -174,14 +197,22 @@ jobs: PAYLOAD=$(jq -nc --arg channel "$SLACK_CHANNEL" --arg text "$TEXT" \ '{channel: $channel, text: $text}') - RESPONSE=$(curl -sS -X POST \ + # Capture body + HTTP status separately with connect/total timeouts so a + # stalled Slack endpoint can't hang the runner for hours, and so a + # transport failure yields a real reason instead of an empty warning. + HTTP_CODE=$(curl -sS -X POST \ + --connect-timeout 10 --max-time 30 \ -H "Authorization: Bearer ${SLACK_BOT_TOKEN}" \ -H 'Content-Type: application/json; charset=utf-8' \ --data "$PAYLOAD" \ - https://slack.com/api/chat.postMessage || true) + -o /tmp/slack_response.json -w '%{http_code}' \ + https://slack.com/api/chat.postMessage || echo "000") + RESPONSE=$(cat /tmp/slack_response.json 2>/dev/null || true) - if [ "$(echo "$RESPONSE" | jq -r '.ok')" = "true" ]; then + if [ "$(echo "$RESPONSE" | jq -r '.ok // false' 2>/dev/null)" = "true" ]; then echo "Slack heads-up sent" else - echo "::warning::Slack notification failed: $(echo "$RESPONSE" | jq -r '.error // "unknown error"')" + REASON=$(echo "$RESPONSE" | jq -r '.error // empty' 2>/dev/null || true) + [ -z "$REASON" ] && REASON="transport/HTTP failure (http_code=${HTTP_CODE})" + echo "::warning::Slack notification failed: ${REASON}" fi