[Ed Fricker (beastawakens)]

User description

Assign PR authors and flag inactive PRs consistently across active repositories.

Calls the shared workflows in central-workflows at v1. PRs receive a stale label after 14 inactive days. Issues are excluded and nothing is closed automatically.

Validation: the distributor checked the caller diff for whitespace errors. Check this repository's Actions runs after merging; this PR does not prove the workflows have run here.

---

PR Type

Other

---

Description

• Replace inline workflows with shared central-workflows@v1 calls

• Auto author assign now uses reusable workflow

  • Drops issues: write permission and local .github/auto-assign.yml config

• Stale workflow now flags PRs only

  • Removes 60-day stale and 14-day auto-close settings
  • Moves cron from 0 1 * * * to 30 16 * * *

---

Diagram Walkthrough

flowchart LR
  pr["PR opened / reopened"]
  sched["Daily schedule / manual dispatch"]
  assign["auto-author-assign.yml caller"]
  stale["stale.yml caller"]
  central["central-workflows@v1 reusable workflows"]
  pr -- "pull_request_target" --> assign
  sched -- "cron 30 16 * * *" --> stale
  assign -- "uses" --> central
  stale -- "uses" --> central

Loading

File Walkthrough

Relevant files

Configuration changes

auto-author-assign.yml Delegate author assignment to the shared reusable workflow .github/workflows/auto-author-assign.yml Replaced the inline kentaro-m/auto-assign-action step (SHA-pinned at v2.0.2) with a call to the reusable smileidentity/central-workflows/.github/workflows/auto-author-assign.yml@v1 Removed the issues: write permission and kept only pull-requests: write Dropped the reference to the local .github/auto-assign.yml configuration Renamed the workflow and its job (assign-author to assign) and removed the explanatory header comment +3/-12    stale.yml Delegate stale PR flagging to the shared reusable workflow .github/workflows/stale.yml Replaced the inline actions/stale step (SHA-pinned at v11.0.0) with a call to the reusable smileidentity/central-workflows/.github/workflows/stale.yml@v1 Removed the local settings: 60-day stale threshold, 14-day auto-close, custom messages and exempt labels (pinned, security) Changed the schedule from 0 1 * * * to 30 16 * * * and renamed the workflow to Flag stale PRs Kept the issues: write and pull-requests: write permissions +3/-21

---

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[prfectionist]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🏅 Score: 85

🧪 No relevant tests

🔒 Security concerns Supply-chain / unpinned dependency: both callers now use smileidentity/central-workflows@v1, a mutable tag, instead of the previous commit-SHA pins. The auto-assign workflow runs on pull_request_target with a write-scoped token, so a moved tag or a compromised upstream repo would execute unreviewed code with write access to this repository's PRs and issues. Pinning to a full SHA restores the prior guarantee.

🔀 No multiple PR themes

⚡ Recommended focus areas for review Mutable workflow ref The reusable workflow is referenced by the movable tag @v1 rather than a commit SHA. The removed comment cited the org's SHA-pinning convention, and the previous action was pinned to a full SHA. This caller runs on pull_request_target, so the called workflow gets a pull-requests: write token in the base-repo context, including for fork PRs. Anyone who can move or retag v1 in central-workflows changes what runs here with no review in this repository. Pin to a full commit SHA (with a # v1 comment) and let Dependabot or Renovate bump it. uses: smileidentity/central-workflows/.github/workflows/auto-author-assign.yml@v1 Mutable workflow ref Same as the auto-assign caller: @v1 replaces a SHA-pinned actions/stale. A retag upstream silently changes behaviour, such as re-enabling auto-close, under this repo's issues: write / pull-requests: write token. Pin to a commit SHA. uses: smileidentity/central-workflows/.github/workflows/stale.yml@v1

[github-actions]

🔍 Semgrep Security Scan Results

✅ No security findings detected by p/security-audit ruleset.

[prfectionist]

Suggestion: This reusable workflow runs under pull_request_target, which has a write-scoped token and runs for fork PRs. It is pinned to the mutable @v1 tag, so anyone who can move that tag can change the code that runs with write access here. The repo's SHA-pinning convention applies, so pin to the full commit SHA that v1 currently points to and keep the tag as a comment. [security, importance: 6]

Suggested change

	uses: smileidentity/central-workflows/.github/workflows/auto-author-assign.yml@v1
	uses: smileidentity/central-workflows/.github/workflows/auto-author-assign.yml@<full-40-char-commit-sha-of-v1> # v1

[prfectionist]

Suggestion: A called reusable workflow can never get more permissions than the caller grants. Adding assignees goes through the Issues API and needs issues: write. With that permission removed, the central workflow's assign step will likely fail with a 403, unless it only uses PR-scoped endpoints. Restore issues: write, or confirm the central workflow's required permissions. [possible issue, importance: 5]

Suggested change

	permissions:
	# Adding assignees goes through the issues API; reviewers through pull-requests.
	issues: write
	pull-requests: write
	permissions:
	issues: write
	pull-requests: write

[prfectionist]

Suggestion: This workflow gets issues: write and pull-requests: write, but it is referenced by the mutable @v1 tag. That drops the org's SHA-pinning convention and exposes the repo to tag-retargeting supply-chain changes. Pin it to the full commit SHA of v1. [security, importance: 5]

Suggested change

	uses: smileidentity/central-workflows/.github/workflows/stale.yml@v1
	uses: smileidentity/central-workflows/.github/workflows/stale.yml@<full-40-char-commit-sha-of-v1> # v1