diff --git a/.github/scripts/ci-selection/inventory.json b/.github/scripts/ci-selection/inventory.json index 36abf261..e57e1948 100644 --- a/.github/scripts/ci-selection/inventory.json +++ b/.github/scripts/ci-selection/inventory.json @@ -19,7 +19,6 @@ "preserved": { "test-triage-stale-issues": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"}, "test-triage-stale-issues-workflow": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"}, - "test-triage-stale-issues-disabled": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"}, "test-check-ci-run-budget": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"}, "test-apply-signed-fixes-verifies-without-a-patch": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"}, "test-dependency-review-workflow": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"}, @@ -56,7 +55,6 @@ "jobs": { "test-triage-stale-issues": ["actions/triage-stale-issues/"], "test-triage-stale-issues-workflow": ["actions/triage-stale-issues/"], - "test-triage-stale-issues-disabled": ["actions/triage-stale-issues/"], "test-validate-retired-repo-links": ["actions/validate-retired-repo-links/"], "test-validate-retired-repo-links-disabled": ["actions/validate-retired-repo-links/"], "test-validate-shell-pipelines": ["actions/validate-shell-pipelines/"], diff --git a/.github/tests/test-triage-stale-issues.sh b/.github/tests/test-triage-stale-issues.sh index 5e733175..62fb7a2f 100644 --- a/.github/tests/test-triage-stale-issues.sh +++ b/.github/tests/test-triage-stale-issues.sh @@ -171,17 +171,6 @@ BASH fi echo 'stale-issues test: loopback fixture prepared (13 independent issue/PR cases)' ;; -verify-opt-out) - [[ -f "$work/cli-requests" && -s "$work/scenario.json" && -s "$work/pid" ]] || fail 'opt-out fixture was not prepared' - pid="$(cat "$work/pid")" - if [[ ! "$pid" =~ ^[1-9][0-9]*$ ]] || ! kill -0 "$pid" 2>/dev/null; then - fail 'opt-out fixture is not running' - fi - for trace in cli-requests requests.jsonl blocked-hosts; do - [[ ! -s "$work/$trace" ]] || fail 'explicit opt-out used authority' - done - echo 'stale-issues test: explicit opt-out performed no API or CLI requests' - ;; verify) pid="$(cat "$work/pid")" [[ "$pid" =~ ^[0-9]+$ ]] || fail 'invalid fixture process' @@ -193,7 +182,7 @@ verify) done [[ -s "$work/completed.json" ]] || fail 'API fixture has no clean completion receipt' [[ ! -s "$work/blocked-hosts" ]] || fail 'action attempted external network access' - [[ "$(wc -l <"$work/cli-requests" | tr -d ' ')" == 3 ]] || fail 'live preflights were skipped or explicit opt-out performed a read' + [[ "$(wc -l <"$work/cli-requests" | tr -d ' ')" == 3 ]] || fail 'live preflights were skipped or duplicated' for request in \ "api repos/$GITHUB_REPOSITORY/labels/stale" \ "api repos/$GITHUB_REPOSITORY/labels/keep-open" \ diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 8914c1fb..bf65f615 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1779,23 +1779,6 @@ jobs: - name: Prepare the loopback issue lifecycle fixture id: stale-fixture run: bash .github/tests/test-triage-stale-issues.sh prepare - - name: Verify explicit rollout opt-out performs no triage - uses: $/actions/triage-stale-issues - with: - enabled: "false" - github-token: offline-fixture-token - env: - PATH: ${{ steps.stale-fixture.outputs.fixture-path }} - STALE_OFFLINE_SCENARIO: ${{ steps.stale-fixture.outputs.scenario-file }} - NODE_OPTIONS: --require=${{ github.workspace }}/.github/tests/fixtures/offline-github-env.cjs - OFFLINE_GITHUB_API_URL: ${{ steps.stale-fixture.outputs.api-url }} - OFFLINE_GITHUB_REPOSITORY: offline/fixture - OFFLINE_GITHUB_EVENT_NAME: schedule - OFFLINE_GITHUB_EVENT_PATH: ${{ steps.stale-fixture.outputs.event-path }} - OFFLINE_BLOCKED_HOSTS_FILE: ${{ steps.stale-fixture.outputs.blocked-hosts-file }} - OFFLINE_ACTION_LOG_FILE: ${{ steps.stale-fixture.outputs.action-log-file }} - - name: Verify the explicit opt-out used no authority - run: bash .github/tests/test-triage-stale-issues.sh verify-opt-out - name: Exercise the actual shared action with synthetic authority uses: $/actions/triage-stale-issues with: @@ -1824,17 +1807,6 @@ jobs: issues: write actions: write - test-triage-stale-issues-disabled: - if: "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}" - name: "[Test] Stale Issues - Explicit Opt Out" - uses: $/.github/workflows/triage-stale-issues.yaml - # Explicit opt-out leaves both callee jobs skipped, with no authority used. - with: - enabled: false - permissions: - issues: write - actions: write - # ── upsert-issue (offline issue lifecycle) ───────────────── test-upsert-issue: timeout-minutes: 5 @@ -5236,7 +5208,6 @@ jobs: - test-upsert-issue - test-triage-stale-issues - test-triage-stale-issues-workflow - - test-triage-stale-issues-disabled - test-run-dotnet-tests-missing-working-directory - lint-readme-parity - lint-shell-pipelines @@ -5360,7 +5331,6 @@ jobs: ${{ needs.test-upsert-issue.result }} ${{ needs.test-triage-stale-issues.result }} ${{ needs.test-triage-stale-issues-workflow.result }} - ${{ needs.test-triage-stale-issues-disabled.result }} ${{ needs.test-run-dotnet-tests-missing-working-directory.result }} ${{ needs.lint-readme-parity.result }} ${{ needs.lint-shell-pipelines.result }} diff --git a/.github/workflows/triage-stale-issues.yaml b/.github/workflows/triage-stale-issues.yaml index 117fa258..3d4970b8 100644 --- a/.github/workflows/triage-stale-issues.yaml +++ b/.github/workflows/triage-stale-issues.yaml @@ -3,11 +3,6 @@ name: 🗂️ Triage Stale Issues on: workflow_call: inputs: - enabled: - description: Temporary rollout gate; defaults on, explicit false performs no triage. - type: boolean - required: false - default: true dry-run: description: Read-only preview; no issue changes or saved progress. type: boolean @@ -18,7 +13,7 @@ permissions: {} jobs: preview: - if: ${{ inputs.enabled && inputs.dry-run }} + if: ${{ inputs.dry-run }} runs-on: ubuntu-latest timeout-minutes: 10 permissions: @@ -32,7 +27,6 @@ jobs: - name: Preview stale-issue triage uses: $/actions/triage-stale-issues with: - enabled: "true" dry-run: "true" triage: @@ -40,7 +34,7 @@ jobs: concurrency: group: stale-issues-${{ github.repository }} cancel-in-progress: false - if: ${{ inputs.enabled && !inputs.dry-run }} + if: ${{ !inputs.dry-run }} runs-on: ubuntu-latest timeout-minutes: 10 permissions: @@ -54,5 +48,3 @@ jobs: egress-policy: audit - name: Triage stale issues uses: $/actions/triage-stale-issues - with: - enabled: "true" diff --git a/README.md b/README.md index b1b403ea..8a85cfa4 100644 --- a/README.md +++ b/README.md @@ -1273,18 +1273,17 @@ provides repeated repository-local issue triage with the [shared policy and exemptions](actions/triage-stale-issues/README.md). The caller supplies its daily schedule and repository-scoped token ceiling. The workflow serializes live passes while previews run independently, uses no checkout or App key, -and leaves pull requests alone. The temporary rollout gate now defaults on; explicit false still opts out. +and leaves pull requests alone. -This is a breaking change for omitted activation settings: integrations upgrading -from the default-off interface must explicitly pass `enabled: false` to retain no-op -behavior. The permanent read-only `dry-run` option is unchanged. The temporary input -will be removed after the completed rollout, as tracked in [#808](https://github.com/devantler-tech/.github/issues/808). +The temporary `enabled` input has been removed. When upgrading from a rollout +version, update the immutable source pin and remove that argument together. If an +integration previously used `enabled: false`, disable its caller or choose read-only +preview before upgrading. The permanent `dry-run` option is unchanged. #### Inputs | Key | Type | Default | Required | Description | | --- | --- | --- | --- | --- | -| `enabled` | Input (boolean) | `true` | No | Temporary rollout gate; explicit false performs no triage | | `dry-run` | Input (boolean) | `false` | No | Preview with read-only permissions and no issue or cursor mutation | There are no secrets to forward. The live job uses `issues: write` and @@ -1320,8 +1319,8 @@ jobs: Replace the example pin with the reviewed published release commit. Manual runs default to preview; scheduled runs apply the approved policy after caller activation. Declare and verify `stale`/`keep-open` labels first, and protect intentionally deferred -tracking before activation. Pilot execution and complete portfolio adoption are -tracked in [#806](https://github.com/devantler-tech/.github/issues/806). +tracking before activation. Rollout and interface retirement are tracked in +[#806](https://github.com/devantler-tech/.github/issues/806) and [#808](https://github.com/devantler-tech/.github/issues/808). diff --git a/actions/triage-stale-issues/README.md b/actions/triage-stale-issues/README.md index ae04db05..9c572c97 100644 --- a/actions/triage-stale-issues/README.md +++ b/actions/triage-stale-issues/README.md @@ -34,17 +34,14 @@ daily runs. `actions: write` permits replacing that progress cache; `issues: wri permits labels, reminders and closure. No contents or pull-request write permission is needed. A dry-run uses only issues/actions read and never persists its cursor. -The temporary rollout gate defaults on after validation. This changes omitted-input -behavior from no-op to live triage when upgrading from the default-off interface. -Pass `enabled: "false"` explicitly to preserve opt-out behavior during this bridge -release. The permanent `dry-run` preview option is unchanged. Removal is tracked in -[#808](https://github.com/devantler-tech/.github/issues/808). +The temporary `enabled` input has been removed. Update the immutable source pin +and remove the argument together. Integrations previously using `enabled: "false"` +must disable their caller or choose the permanent read-only preview before upgrading. ## Inputs | Name | Description | Required | Default | | --- | --- | --- | --- | -| `enabled` | Temporary rollout gate; explicit false runs no triage | No | `true` | | `dry-run` | Preview proposed actions without issue or cursor changes | No | `false` | | `github-token` | Repository-scoped token; read-only for preview, issues/actions write for live triage | No | `github.token` | diff --git a/actions/triage-stale-issues/action.yaml b/actions/triage-stale-issues/action.yaml index 02912cd5..58c0b98b 100644 --- a/actions/triage-stale-issues/action.yaml +++ b/actions/triage-stale-issues/action.yaml @@ -3,10 +3,6 @@ description: Remind after 90 inactive days, then close after 30 more days withou author: devantler-tech inputs: - enabled: - description: Temporary rollout gate. Defaults on; explicit false performs no triage. - required: false - default: "true" dry-run: description: Report proposed changes without changing issues or saved progress. required: false @@ -21,7 +17,7 @@ runs: steps: - name: Require deployed lifecycle label definitions id: labels-ready - if: ${{ inputs.enabled == 'true' && inputs.dry-run != 'true' }} + if: ${{ inputs.dry-run != 'true' }} shell: bash env: GH_TOKEN: ${{ inputs.github-token }} @@ -43,7 +39,7 @@ runs: done - name: Protect automation-owned issue lifecycles id: automation-owned - if: ${{ inputs.enabled == 'true' && inputs.dry-run != 'true' }} + if: ${{ inputs.dry-run != 'true' }} shell: bash env: GH_TOKEN: ${{ inputs.github-token }} @@ -76,7 +72,6 @@ runs: exit 1 } - name: Triage inactive issues - if: ${{ inputs.enabled == 'true' }} uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: repo-token: ${{ inputs.github-token }}