mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-10-05 15:51:07 +01:00
Jon Ross-Perkins
97816a3598
This is coming out of advice from https://securityscorecards.dev/viewer/?uri=github.com/carbon-language/carbon-lang Updates action versions and pins by checksum. This is something we already do in other places, and doing it with actions just seems consistent. Trying to add token permissions at the same time. step-security/harden-runner is being set up to monitor network traffic for actions, with the idea that we'd set it to block unexpected traffic in the future. Note, https://app.stepsecurity.io/secureworkflow generates the pinned checksums and adds the harden-runner. In some cases it added token permissions, but we have a couple it doesn't recognize (`gh` executions, other custom commands, jlumbroso/free-disk-space, reviewdog/action-setup as examples) so I'm trying to guess my best. Because these are workflows, testing is limited.
60 lines
2.3 KiB
YAML
60 lines
2.3 KiB
YAML
# Part of the Carbon Language project, under the Apache License v2.0 with LLVM
|
|
# Exceptions. See /LICENSE for license information.
|
|
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
|
|
name: 'Triage inactive issues and PRs'
|
|
on:
|
|
schedule:
|
|
- cron: '30 1 * * *'
|
|
|
|
permissions:
|
|
issues: write # For actions/stale to close stale issues.
|
|
pull-requests: write # For actions/stale to close stale PRs.
|
|
|
|
jobs:
|
|
stale:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
|
|
with:
|
|
stale-issue-message: >
|
|
We triage inactive PRs and issues in order to make it easier to find
|
|
active work. If this issue should remain active or becomes active
|
|
again, please comment or remove the `inactive` label. The `long
|
|
term` label can also be added for issues which are expected to take
|
|
time.
|
|
|
|
|
|
This issue is labeled `inactive` because the last activity was over
|
|
90 days ago.
|
|
stale-pr-message: >
|
|
We triage inactive PRs and issues in order to make it easier to find
|
|
active work. If this PR should remain active, please comment or
|
|
remove the `inactive` label.
|
|
|
|
|
|
This PR is labeled `inactive` because the last activity was over 90
|
|
days ago. This PR will be closed and archived after 14 additional
|
|
days without activity.
|
|
close-pr-message: >
|
|
We triage inactive PRs and issues in order to make it easier to find
|
|
active work. If this PR should remain active or becomes active
|
|
again, please reopen it.
|
|
|
|
|
|
This PR was closed and archived because there has been no new
|
|
activity in the 14 days since the `inactive` label was added.
|
|
stale-issue-label: 'inactive'
|
|
stale-pr-label: 'inactive'
|
|
exempt-issue-labels:
|
|
'long term,design idea,design update,good first issue,leads question'
|
|
days-before-stale: 90
|
|
days-before-close: 14
|
|
days-before-issue-close: -1
|
|
operations-per-run: 100
|