feat(stale): reusable stale-PR workflow + name the repo in the Slack digest (BE-2776)

.github/workflows/stale.yml

@@ -0,0 +1,218 @@
+name: Stale PRs (reusable)
+
+# Reusable stale-PR sweeper. Keeps a repo's PR queue tidy and posts a Slack
+# digest of what it touched, so the same logic isn't copy-pasted (and left to
+# drift) across repos. Powered by https://github.com/actions/stale
+#   • PR inactive `days_before_pr_stale` days → labeled `stale` + reminder comment
+#   • Still inactive `days_before_pr_close` days later → closed
+#   • Any new commit/comment removes `stale` and resets the clock
+#   • Issues are left untouched (days-before-issue-* = -1)
+#
+# The Slack digest header names the source repo (`github.repository`) so two
+# repos' batches posted to the same channel are unambiguous — a bare "#158"
+# looks identical whether it's from cloud or comfy-infra.
+#
+# Caller pattern (place in source repo at .github/workflows/stale.yml). The
+# caller owns the schedule + the workflow_dispatch dry-run toggle; this reusable
+# does the sweep + the Slack post:
+#
+#   name: Stale PRs
+#   on:
+#     schedule:
+#       - cron: "0 3 * * *"   # daily 03:00 UTC
+#     workflow_dispatch:
+#       inputs:
+#         dry-run:
+#           description: "Preview without applying"
+#           type: boolean
+#           default: false
+#   permissions:
+#     pull-requests: write
+#     issues: write            # required by actions/stale even for PR-only runs
+#   concurrency:
+#     group: stale
+#     cancel-in-progress: false
+#   jobs:
+#     stale:
+#       uses: Comfy-Org/github-workflows/.github/workflows/stale.yml@<sha>  # v1
+#       with:
+#         # Optional overrides — see inputs below. Defaults post to #proj-cloud.
+#         dry_run: ${{ inputs.dry-run || false }}
+#       secrets:
+#         SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+on:
+  workflow_call:
+    inputs:
+      slack_channel:
+        description: >-
+          Slack channel ID the digest is posted to. The bot behind
+          SLACK_BOT_TOKEN must be a member. Defaults to #proj-cloud.
+        type: string
+        required: false
+        default: C08V9NDB3B4
+      days_before_pr_stale:
+        description: Days of PR inactivity before it's marked stale.
+        type: number
+        required: false
+        default: 14
+      days_before_pr_close:
+        description: Days after being marked stale before the PR is closed.
+        type: number
+        required: false
+        default: 14
+      stale_pr_label:
+        description: Label applied to a stale PR (and watched for removal to reset the clock).
+        type: string
+        required: false
+        default: stale
+      exempt_pr_labels:
+        description: >-
+          Comma-separated labels that exempt a PR from being marked stale.
+        type: string
+        required: false
+        default: pinned,security,work-in-progress,wip,dependencies,do-not-merge
+      stale_pr_message:
+        description: Comment posted when a PR is marked stale.
+        type: string
+        required: false
+        # Intentionally omits specific day counts / the label name so it stays
+        # correct when a caller overrides days_before_pr_* or stale_pr_label
+        # without also overriding this message (the exact deadline lives in the
+        # Slack digest, which is derived from the actual inputs).
+        default: >
+          This PR has been automatically marked **stale** due to inactivity and
+          will be closed if there's no further activity. Push a commit or leave
+          a comment to keep it open.
+      close_pr_message:
+        description: Comment posted when a stale PR is closed.
+        type: string
+        required: false
+        default: >
+          Closing this PR as stale after an extended period of inactivity. Feel
+          free to reopen when you pick it back up.
+      dry_run:
+        description: >-
+          Preview only — actions/stale runs in debug-only mode and no Slack
+          digest is sent. Wire the caller's workflow_dispatch dry-run input here.
+        type: boolean
+        required: false
+        default: false
+    secrets:
+      SLACK_BOT_TOKEN:
+        description: >-
+          Bot token used to post the digest via chat.postMessage. If omitted,
+          the sweep still runs; only the Slack heads-up is skipped.
+        required: false
+
+permissions:
+  pull-requests: write
+  issues: write # required by actions/stale even for PR-only runs
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - id: stale
+        uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          days-before-issue-stale: -1 # issues disabled
+          days-before-issue-close: -1
+          days-before-pr-stale: ${{ inputs.days_before_pr_stale }}
+          days-before-pr-close: ${{ inputs.days_before_pr_close }}
+          stale-pr-label: ${{ inputs.stale_pr_label }}
+          exempt-pr-labels: ${{ inputs.exempt_pr_labels }}
+          exempt-draft-pr: true
+          exempt-all-milestones: true
+          remove-stale-when-updated: true
+          operations-per-run: 30
+          ascending: true
+          stale-pr-message: ${{ inputs.stale_pr_message }}
+          close-pr-message: ${{ inputs.close_pr_message }}
+          debug-only: ${{ inputs.dry_run || false }}
+
+      # Surface what the bot did in Slack, not just in-PR. The header names the
+      # source repo so batches from different repos posted to the same channel
+      # are visually distinguishable.
+      - name: Slack heads-up (marked stale / closed)
+        # Skip during dry-run previews and when no PR was touched this run. If
+        # no SLACK_BOT_TOKEN is configured the curl below degrades to a warning
+        # rather than failing the run.
+        if: >-
+          ${{ inputs.dry_run != true &&
+            ( (steps.stale.outputs.staled-issues-prs != '' && steps.stale.outputs.staled-issues-prs != '[]') ||
+              (steps.stale.outputs.closed-issues-prs != '' && steps.stale.outputs.closed-issues-prs != '[]') ) }}
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_CHANNEL: ${{ inputs.slack_channel }}
+          REPO: ${{ github.repository }}
+          SERVER_URL: ${{ github.server_url }}
+          DAYS_TO_CLOSE: ${{ inputs.days_before_pr_close }}
+          STALED: ${{ steps.stale.outputs.staled-issues-prs }}
+          CLOSED: ${{ steps.stale.outputs.closed-issues-prs }}
+        run: |
+          set -euo pipefail
+
+          # No token configured → skip entirely rather than firing a curl with an
+          # empty `Authorization: Bearer` header, which would still ship the repo
+          # name + PR titles to Slack's API. The secret is documented as optional
+          # ("only the Slack heads-up is skipped"), so honor that here.
+          if [ -z "${SLACK_BOT_TOKEN:-}" ]; then
+            echo "SLACK_BOT_TOKEN not set — skipping Slack heads-up"
+            exit 0
+          fi
+
+          # actions/stale outputs JSON arrays of the PRs it staled/closed this run.
+          # Build "• <url|#N> title" lines; derive the URL from repo + number so we
+          # don't depend on html_url being present in the output objects. Escape
+          # Slack mrkdwn control chars (& < >) in the title so a crafted title
+          # can't inject <!channel>/<!here> pings or masked <url|label> links.
+          fmt() {
+            echo "${1:-[]}" | jq -r --arg base "$SERVER_URL/$REPO/pull" '
+              def slack_escape: gsub("&";"&amp;") | gsub("<";"&lt;") | gsub(">";"&gt;");
+              .[]? | "• <\($base)/\(.number)|#\(.number)> \((.title // "") | slack_escape)"'
+          }
+          WARN_LINES=$(fmt "$STALED")
+          CLOSE_LINES=$(fmt "$CLOSED")
+
+          # Name the repo in the header so two repos' batches in the same channel
+          # aren't confused (a bare "#158" is ambiguous). Per-PR links already
+          # resolve correctly via $REPO above.
+          TEXT=":hourglass_flowing_sand: *Stale PR bot — ${REPO}*"
+          if [ -n "$WARN_LINES" ]; then
+            # actions/stale treats days-before-pr-close <= 0 as "never close", so
+            # only promise a deadline when the close window is a positive count.
+            if [ "${DAYS_TO_CLOSE}" -gt 0 ] 2>/dev/null; then
+              STALE_HEADER="*Marked stale* — auto-closes in ${DAYS_TO_CLOSE} days without activity:"
+            else
+              STALE_HEADER="*Marked stale* (auto-close disabled):"
+            fi
+            TEXT="${TEXT}"$'\n\n'"${STALE_HEADER}"$'\n'"${WARN_LINES}"
+          fi
+          if [ -n "$CLOSE_LINES" ]; then
+            TEXT="${TEXT}"$'\n\n'"*Closed as stale:*"$'\n'"${CLOSE_LINES}"
+          fi
+
+          PAYLOAD=$(jq -nc --arg channel "$SLACK_CHANNEL" --arg text "$TEXT" \
+            '{channel: $channel, text: $text}')
+          # Capture body + HTTP status separately with connect/total timeouts so a
+          # stalled Slack endpoint can't hang the runner for hours, and so a
+          # transport failure yields a real reason instead of an empty warning.
+          HTTP_CODE=$(curl -sS -X POST \
+            --connect-timeout 10 --max-time 30 \
+            -H "Authorization: Bearer ${SLACK_BOT_TOKEN}" \
+            -H 'Content-Type: application/json; charset=utf-8' \
+            --data "$PAYLOAD" \
+            -o /tmp/slack_response.json -w '%{http_code}' \
+            https://slack.com/api/chat.postMessage || echo "000")
+          RESPONSE=$(cat /tmp/slack_response.json 2>/dev/null || true)
+
+          if [ "$(echo "$RESPONSE" | jq -r '.ok // false' 2>/dev/null)" = "true" ]; then
+            echo "Slack heads-up sent"
+          else
+            REASON=$(echo "$RESPONSE" | jq -r '.error // empty' 2>/dev/null || true)
+            [ -z "$REASON" ] && REASON="transport/HTTP failure (http_code=${HTTP_CODE})"
+            echo "::warning::Slack notification failed: ${REASON}"
+          fi

README.md

@@ -13,6 +13,7 @@ This repo is **public** so any repo — public or private, inside or outside the
 | [`cursor-review-auto-label.yml`](.github/workflows/cursor-review-auto-label.yml) | Companion to `cursor-review.yml`. On PR assignment, applies the review label for an opted-in reviewer (via the CLOUD_CODE_BOT app token, so the label actually triggers the review). The opt-in roster lives in the caller's `vars.CURSOR_REVIEW_OPTED_IN_LOGINS` — no roster is baked into the workflow. Requires `vars.APP_ID` + `CLOUD_CODE_BOT_PRIVATE_KEY`. |
 | [`assign-reviewers.yml`](.github/workflows/assign-reviewers.yml) | Auto-requests expertise-aware, load-balanced PR reviewers with new-folk randomization. Matches changed paths against a caller-repo `.github/reviewers.yml` (path-glob → reviewers, plus a `default_pool`), drops the author + `vars.REVIEWER_EXCLUDE`, ranks candidates by open review load (steering off anyone at/over `vars.REVIEWER_LOAD_CAP`), and may swap a slot for a `vars.REVIEWER_GROWTH_POOL` member. Requests go through the CLOUD_CODE_BOT app token so they work on fork PRs. Requires `vars.APP_ID` + `CLOUD_CODE_BOT_PRIVATE_KEY`. |
 | [`assign-prs-to-author.yml`](.github/workflows/assign-prs-to-author.yml) | Housekeeping — assigns every open PR with no assignees to its author (bot-authored PRs skipped by default). Run on a schedule from a thin caller; useful when a team tracks PR ownership via assignees. The calling job needs `pull-requests: write` and `issues: write`. |
+| [`stale.yml`](.github/workflows/stale.yml) | Stale-PR sweeper (`actions/stale`) plus a Slack digest of what it touched. PRs inactive for N days are labeled `stale`; still-inactive PRs are closed. The digest header names the source repo so batches from different repos posted to the same channel are unambiguous. Thresholds, messages, exempt labels, and the Slack channel are inputs; the caller owns the schedule + dry-run toggle. The calling job needs `pull-requests: write` and `issues: write`. Optional `SLACK_BOT_TOKEN`. |
 | [`agents-md-integrity.yml`](.github/workflows/agents-md-integrity.yml) | Enforces the Comfy `AGENTS.md` standard on the caller repo: a top-level `AGENTS.md` must exist and stay under a hard line ceiling (`max_lines`, default 200; warns over `warn_lines`, default 150), a `CLAUDE.md` (if present) must be a thin `@AGENTS.md` shim rather than a divergent copy, no legacy `.cursorrules` (gated `forbid_cursorrules`), every nested monorepo `AGENTS.md` needs a sibling `@AGENTS.md` shim and to be under the ceiling (gated `check_nested`), and `AGENTS.md` should have a CODEOWNERS DRI (`require_codeowners`, warn-only by default). Fails with a non-zero exit + GitHub annotations so it wires in as a required status check. The checker lives in [`.github/agents-md-integrity/`](.github/agents-md-integrity) (pin `workflows_ref` to the same ref as `uses:`); no secrets required. |
 
 ## Usage