feat(issues)!: retire completed stale triage rollout input

.github/scripts/ci-selection/inventory.json

@@ -19,7 +19,6 @@
   "preserved": {
     "test-triage-stale-issues": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"},
     "test-triage-stale-issues-workflow": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"},
-    "test-triage-stale-issues-disabled": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"},
     "test-check-ci-run-budget": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"},
     "test-apply-signed-fixes-verifies-without-a-patch": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"},
     "test-dependency-review-workflow": {"if": "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"},
@@ -56,7 +55,6 @@
   "jobs": {
     "test-triage-stale-issues": ["actions/triage-stale-issues/"],
     "test-triage-stale-issues-workflow": ["actions/triage-stale-issues/"],
-    "test-triage-stale-issues-disabled": ["actions/triage-stale-issues/"],
     "test-validate-retired-repo-links": ["actions/validate-retired-repo-links/"],
     "test-validate-retired-repo-links-disabled": ["actions/validate-retired-repo-links/"],
     "test-validate-shell-pipelines": ["actions/validate-shell-pipelines/"],

.github/tests/test-triage-stale-issues.sh

@@ -171,17 +171,6 @@ BASH
   fi
   echo 'stale-issues test: loopback fixture prepared (13 independent issue/PR cases)'
   ;;
-verify-opt-out)
-  [[ -f "$work/cli-requests" && -s "$work/scenario.json" && -s "$work/pid" ]] || fail 'opt-out fixture was not prepared'
-  pid="$(cat "$work/pid")"
-  if [[ ! "$pid" =~ ^[1-9][0-9]*$ ]] || ! kill -0 "$pid" 2>/dev/null; then
-    fail 'opt-out fixture is not running'
-  fi
-  for trace in cli-requests requests.jsonl blocked-hosts; do
-    [[ ! -s "$work/$trace" ]] || fail 'explicit opt-out used authority'
-  done
-  echo 'stale-issues test: explicit opt-out performed no API or CLI requests'
-  ;;
 verify)
   pid="$(cat "$work/pid")"
   [[ "$pid" =~ ^[0-9]+$ ]] || fail 'invalid fixture process'
@@ -193,7 +182,7 @@ verify)
   done
   [[ -s "$work/completed.json" ]] || fail 'API fixture has no clean completion receipt'
   [[ ! -s "$work/blocked-hosts" ]] || fail 'action attempted external network access'
-  [[ "$(wc -l <"$work/cli-requests" | tr -d ' ')" == 3 ]] || fail 'live preflights were skipped or explicit opt-out performed a read'
+  [[ "$(wc -l <"$work/cli-requests" | tr -d ' ')" == 3 ]] || fail 'live preflights were skipped or duplicated'
   for request in \
     "api repos/$GITHUB_REPOSITORY/labels/stale" \
     "api repos/$GITHUB_REPOSITORY/labels/keep-open" \

.github/workflows/ci.yaml

@@ -1779,23 +1779,6 @@ jobs:
       - name: Prepare the loopback issue lifecycle fixture
         id: stale-fixture
         run: bash .github/tests/test-triage-stale-issues.sh prepare
-      - name: Verify explicit rollout opt-out performs no triage
-        uses: $/actions/triage-stale-issues
-        with:
-          enabled: "false"
-          github-token: offline-fixture-token
-        env:
-          PATH: ${{ steps.stale-fixture.outputs.fixture-path }}
-          STALE_OFFLINE_SCENARIO: ${{ steps.stale-fixture.outputs.scenario-file }}
-          NODE_OPTIONS: --require=${{ github.workspace }}/.github/tests/fixtures/offline-github-env.cjs
-          OFFLINE_GITHUB_API_URL: ${{ steps.stale-fixture.outputs.api-url }}
-          OFFLINE_GITHUB_REPOSITORY: offline/fixture
-          OFFLINE_GITHUB_EVENT_NAME: schedule
-          OFFLINE_GITHUB_EVENT_PATH: ${{ steps.stale-fixture.outputs.event-path }}
-          OFFLINE_BLOCKED_HOSTS_FILE: ${{ steps.stale-fixture.outputs.blocked-hosts-file }}
-          OFFLINE_ACTION_LOG_FILE: ${{ steps.stale-fixture.outputs.action-log-file }}
-      - name: Verify the explicit opt-out used no authority
-        run: bash .github/tests/test-triage-stale-issues.sh verify-opt-out
       - name: Exercise the actual shared action with synthetic authority
         uses: $/actions/triage-stale-issues
         with:
@@ -1824,17 +1807,6 @@ jobs:
       issues: write
       actions: write
 
-  test-triage-stale-issues-disabled:
-    if: "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') }}"
-    name: "[Test] Stale Issues - Explicit Opt Out"
-    uses: $/.github/workflows/triage-stale-issues.yaml
-    # Explicit opt-out leaves both callee jobs skipped, with no authority used.
-    with:
-      enabled: false
-    permissions:
-      issues: write
-      actions: write
-
   # ── upsert-issue (offline issue lifecycle) ─────────────────
   test-upsert-issue:
     timeout-minutes: 5
@@ -5236,7 +5208,6 @@ jobs:
       - test-upsert-issue
       - test-triage-stale-issues
       - test-triage-stale-issues-workflow
-      - test-triage-stale-issues-disabled
       - test-run-dotnet-tests-missing-working-directory
       - lint-readme-parity
       - lint-shell-pipelines
@@ -5360,7 +5331,6 @@ jobs:
             ${{ needs.test-upsert-issue.result }}
             ${{ needs.test-triage-stale-issues.result }}
             ${{ needs.test-triage-stale-issues-workflow.result }}
-            ${{ needs.test-triage-stale-issues-disabled.result }}
             ${{ needs.test-run-dotnet-tests-missing-working-directory.result }}
             ${{ needs.lint-readme-parity.result }}
             ${{ needs.lint-shell-pipelines.result }}

.github/workflows/triage-stale-issues.yaml

@@ -3,11 +3,6 @@ name: 🗂️ Triage Stale Issues
 on:
   workflow_call:
     inputs:
-      enabled:
-        description: Temporary rollout gate; defaults on, explicit false performs no triage.
-        type: boolean
-        required: false
-        default: true
       dry-run:
         description: Read-only preview; no issue changes or saved progress.
         type: boolean
@@ -18,7 +13,7 @@ permissions: {}
 
 jobs:
   preview:
-    if: ${{ inputs.enabled && inputs.dry-run }}
+    if: ${{ inputs.dry-run }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -32,15 +27,14 @@ jobs:
       - name: Preview stale-issue triage
         uses: $/actions/triage-stale-issues
         with:
-          enabled: "true"
           dry-run: "true"
 
   triage:
     # Only live writes share the repository progress cursor.
     concurrency:
       group: stale-issues-${{ github.repository }}
       cancel-in-progress: false
-    if: ${{ inputs.enabled && !inputs.dry-run }}
+    if: ${{ !inputs.dry-run }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -54,5 +48,3 @@ jobs:
           egress-policy: audit
       - name: Triage stale issues
         uses: $/actions/triage-stale-issues
-        with:
-          enabled: "true"

README.md

@@ -1273,18 +1273,17 @@ provides repeated repository-local issue triage with the
 [shared policy and exemptions](actions/triage-stale-issues/README.md).
 The caller supplies its daily schedule and repository-scoped token ceiling.
 The workflow serializes live passes while previews run independently, uses no checkout or App key,
-and leaves pull requests alone. The temporary rollout gate now defaults on; explicit false still opts out.
+and leaves pull requests alone.
 
-This is a breaking change for omitted activation settings: integrations upgrading
-from the default-off interface must explicitly pass `enabled: false` to retain no-op
-behavior. The permanent read-only `dry-run` option is unchanged. The temporary input
-will be removed after the completed rollout, as tracked in [#808](https://github.com/devantler-tech/.github/issues/808).
+The temporary `enabled` input has been removed. When upgrading from a rollout
+version, update the immutable source pin and remove that argument together. If an
+integration previously used `enabled: false`, disable its caller or choose read-only
+preview before upgrading. The permanent `dry-run` option is unchanged.
 
 #### Inputs
 
 | Key | Type | Default | Required | Description |
 | --- | --- | --- | --- | --- |
-| `enabled` | Input (boolean) | `true` | No | Temporary rollout gate; explicit false performs no triage |
 | `dry-run` | Input (boolean) | `false` | No | Preview with read-only permissions and no issue or cursor mutation |
 
 There are no secrets to forward. The live job uses `issues: write` and
@@ -1320,8 +1319,8 @@ jobs:
 Replace the example pin with the reviewed published release commit. Manual runs
 default to preview; scheduled runs apply the approved policy after caller activation.
 Declare and verify `stale`/`keep-open` labels first, and protect intentionally deferred
-tracking before activation. Pilot execution and complete portfolio adoption are
-tracked in [#806](https://github.com/devantler-tech/.github/issues/806).
+tracking before activation. Rollout and interface retirement are tracked in
+[#806](https://github.com/devantler-tech/.github/issues/806) and [#808](https://github.com/devantler-tech/.github/issues/808).
 
 </details>
 

actions/triage-stale-issues/README.md

@@ -34,17 +34,14 @@ daily runs. `actions: write` permits replacing that progress cache; `issues: wri
 permits labels, reminders and closure. No contents or pull-request write permission
 is needed. A dry-run uses only issues/actions read and never persists its cursor.
 
-The temporary rollout gate defaults on after validation. This changes omitted-input
-behavior from no-op to live triage when upgrading from the default-off interface.
-Pass `enabled: "false"` explicitly to preserve opt-out behavior during this bridge
-release. The permanent `dry-run` preview option is unchanged. Removal is tracked in
-[#808](https://github.com/devantler-tech/.github/issues/808).
+The temporary `enabled` input has been removed. Update the immutable source pin
+and remove the argument together. Integrations previously using `enabled: "false"`
+must disable their caller or choose the permanent read-only preview before upgrading.
 
 ## Inputs
 
 | Name | Description | Required | Default |
 | --- | --- | --- | --- |
-| `enabled` | Temporary rollout gate; explicit false runs no triage | No | `true` |
 | `dry-run` | Preview proposed actions without issue or cursor changes | No | `false` |
 | `github-token` | Repository-scoped token; read-only for preview, issues/actions write for live triage | No | `github.token` |
 

actions/triage-stale-issues/action.yaml

@@ -3,10 +3,6 @@ description: Remind after 90 inactive days, then close after 30 more days withou
 author: devantler-tech
 
 inputs:
-  enabled:
-    description: Temporary rollout gate. Defaults on; explicit false performs no triage.
-    required: false
-    default: "true"
   dry-run:
     description: Report proposed changes without changing issues or saved progress.
     required: false
@@ -21,7 +17,7 @@ runs:
   steps:
     - name: Require deployed lifecycle label definitions
       id: labels-ready
-      if: ${{ inputs.enabled == 'true' && inputs.dry-run != 'true' }}
+      if: ${{ inputs.dry-run != 'true' }}
       shell: bash
       env:
         GH_TOKEN: ${{ inputs.github-token }}
@@ -43,7 +39,7 @@ runs:
         done
     - name: Protect automation-owned issue lifecycles
       id: automation-owned
-      if: ${{ inputs.enabled == 'true' && inputs.dry-run != 'true' }}
+      if: ${{ inputs.dry-run != 'true' }}
       shell: bash
       env:
         GH_TOKEN: ${{ inputs.github-token }}
@@ -76,7 +72,6 @@ runs:
           exit 1
         }
     - name: Triage inactive issues
-      if: ${{ inputs.enabled == 'true' }}
       uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
       with:
         repo-token: ${{ inputs.github-token }}