chore: setup stale bot workflow

[psanyalaich]

#63

Summary

Added a stale bot workflow using actions/stale@v9 to manage inactive issues and pull requests automatically.

Changes Made

• Added .github/workflows/stale.yml
• Configured stale checks with GitHub Actions
• Added stale and close reminder messages
• Validated the YAML configuration before submission
• Set:
  • days-before-stale: 14
  • days-before-close: 7

Result

This helps keep the repository cleaner by automatically marking and closing inactive issues and PRs after a period of inactivity.

Notes for Reviewer/Moderator

Please add gssoc:approved label so that it gets counted for GSSoC'26

Edits Made

Updated actions/stale with a full commit SHA instead of using @v9

Summary by CodeRabbit

Summary by CodeRabbit

• Chores
  • Added automated repository maintenance to detect and manage inactive issues and pull requests.
  • Inactive items are marked as stale after 14 days with a reminder; items are closed after an additional 7 days if no activity.
  • Maintenance runs daily and can also be triggered manually.

[github-actions]

🚀 PR Received Successfully

Hello @psanyalaich,

Thank you for taking the initiative to contribute to this project.

Please ensure that your PR follows all project guidelines properly before requesting review.

⚠️ Important Instructions

• Maintain proper code quality and structure
• Do not make unnecessary changes/files
• Ensure responsiveness across devices
• Follow existing project conventions strictly
• Attach screenshots/videos for UI-related changes
• Resolve merge conflicts before requesting review
• Avoid AI-generated low quality PRs or copied implementations

📌 Mandatory for GSSoC'26 Participants

Joining the community group and announcement channel is compulsory for all contributors participating through GSSoC'26.

• Telegram Group: https://t.me/c/3991077814/1
• Telegram Channel: https://t.me/+g4esQdo-DyNlZWE1

Failure to follow contribution guidelines may lead to PR rejection.

We appreciate your effort and wish you a great open-source journey ahead. ✨

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: eb18dda7-cf0c-4e4b-b42d-fd835f924352

📥 Commits

Reviewing files that changed from the base of the PR and between 4879f17 and ff06bf0.

📒 Files selected for processing (1)

• .github/workflows/stale.yml

---

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow (.github/workflows/stale.yml) that runs daily or on manual dispatch to mark issues/PRs stale after 14 days and close them after 7 more days using a pinned actions/stale configuration with write permissions.

Changes

Automated stale issue management workflow

Layer / File(s)	Summary
Automated stale issue management workflow .github/workflows/stale.yml	New scheduled workflow using a pinned actions/stale configured to mark inactive issues and pull requests stale after 14 days, post stale messages, then close them after an additional 7 days with close messages; runs daily via cron and supports workflow_dispatch, granting issues: write and pull-requests: write permissions.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• [chore] Setup Stale Bot Workflow for Managing Inactive Issues and Pull Requests #63: Same repository issue requesting addition of an automated stale workflow for marking/closing inactive issues and PRs.

Poem

🐰 I nibble through issues with soft little paws,
Marking the quiet with gentle applause,
Fourteen days wait, then seven to part,
I tidy the meadow, one ticket, one heart.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: setup stale bot workflow' accurately describes the main change—adding a GitHub Actions workflow for a stale bot to manage inactive issues and pull requests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/stale.yml:
- Line 18: The workflow currently references a floating tag "uses:
actions/stale@v9" which can change unexpectedly; replace that with an immutable
commit SHA from the actions/stale repository (e.g., "uses:
actions/stale@<full-commit-sha>") so the workflow is pinned; locate the
occurrence of "uses: actions/stale@v9" in the workflow and update it to the
chosen full commit SHA, commit the change, and optionally add a brief comment
noting the upstream repo and the pinned commit for future updates.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 771af72e-aac4-4ea9-bd95-6a44ce5aaf07

📥 Commits

Reviewing files that changed from the base of the PR and between 4879f17 and bc13653.

📒 Files selected for processing (1)

• .github/workflows/stale.yml

[kunalverma2512]

@psanyalaich
Good work on the workflow implementation.

One improvement is still needed before merge. Please look into the CodeRabbit suggestion regarding pinning actions/stale with a full commit SHA instead of using the floating @v9 tag.

Take some time to understand the reasoning behind it as well — especially around workflow security, reproducibility, and avoiding unexpected upstream changes in CI/CD pipelines.

Once you have analyzed it properly, push the required changes.

[kunalverma2512]

@coderabbitai please perform a full review of the PR and check the implementation properly before merge.

[coderabbitai]

🧩 Analysis chain

---

🏁 Script executed:

#!/bin/bash
cat .github/workflows/stale.yml

Length of output: 922

---

@kunalverma2512 — full review of PR #69 below.

---

Review: .github/workflows/stale.yml

✅ SHA Pinning — Addressed Correctly

The SHA 5bef64f19d7facfb25b37b414482c7164d639639 is confirmed to correspond to actions/stale v9.1.0 (a newer patch within the v9 series). This guarantees that the exact pinned code is used, even if the version tag or the action's code is modified later — commit SHA offers the highest level of security as it tags to a specific point in time using a unique identifier.

Minor suggestion: Add a comment next to the SHA for human readability so maintainers know what version it corresponds to:

uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0

---

✅ Trigger Configuration

The workflow runs on a daily cron (0 0 * * *) and supports workflow_dispatch for manual runs — both are appropriate.

---

✅ Permissions — Least Privilege at Job Level

The job grants issues: write and pull-requests: write, which is the minimum required for the action to label and close items.

Minor hardening suggestion: Consider adding a top-level permissions: {} block to explicitly deny all permissions not granted at the job level. This is a security best practice to prevent accidental privilege escalation:

permissions: {}  # Deny all at top level; job-level permissions override as needed

jobs:
  stale:
    permissions:
      issues: write
      pull-requests: write

---

✅ Stale/Close Messages

All four required messages are present:

• stale-issue-message ✅
• stale-pr-message ✅
• close-issue-message ✅
• close-pr-message ✅

---

✅ Timing Configuration

• days-before-stale: 14 ✅
• days-before-close: 7 ✅

---

ℹ️ Optional: Explicit Stale Labels

stale-issue-label and stale-pr-label are not set, so the action defaults to using "Stale" as the label name. This is fine for most repositories, but you may want to explicitly define them for clarity, especially if you want different labels for issues vs. PRs:

stale-issue-label: stale
stale-pr-label: stale

---

Summary

Check	Status
SHA pinned (full 40-char)	✅ Pass
Correct SHA (v9.1.0)	✅ Pass
Daily schedule + manual dispatch	✅ Pass
Minimum permissions (job-level)	✅ Pass
All 4 stale/close messages	✅ Pass
Timing (14 + 7 days)	✅ Pass
SHA version comment	⚠️ Optional improvement
Top-level permissions: {}	⚠️ Optional hardening
Explicit stale labels	⚠️ Optional clarity

The implementation is ready to merge from a functional and security standpoint. The three items flagged above are optional improvements and not blockers. 🐇

✅ Actions performed

Full review triggered.

[kunalverma2512]

Well done @psanyalaich
Implementation looks clean and properly handled. The requested workflow security improvements were addressed correctly. Ready for merge.