From 7c96c33799e1fed1b7e806f5afc06ac81fcf0b36 Mon Sep 17 00:00:00 2001 From: SatoshiQaziMuhammed Date: Fri, 13 Nov 2026 18:44:56 +0400 Subject: [PATCH] ci: move Lock Threads to dessant/lock-threads v6.0.2 (#35) * ci: move Lock Threads to dessant/lock-threads v6.0.2 The pinned v4.0.0 rejects the job token: it validates github-token at 100 characters or fewer, and Actions tokens are now longer, so every scheduled run fails with '"github-token" length must be less than or equal to 100 characters long'. v6.0.2 accepts them. The workflow now matches the one phishing already runs: empty top-level permissions, issues/pull-requests write on the job only, process-only issues and PRs (discussions write is no longer granted), and a 10 minute timeout. Each repository keeps its schedule. * ci: remove workflows that cannot run push-master.yml listens on master, which no longer exists here (the default branch is main), and needs GH_PAT_BOT and NPM_TOKEN, which are not set. It has never run. Releases are published by hand to the next tag first and verified against the registry before latest moves, so this job is not the release path and would bypass that order if it were revived. auto-approve.yml and auto-merge.yml come from upstream: they approve PRs by two upstream maintainers and merge on a label, both through GH_PAT_BOT, which is not set, so the merge job fails on every label event. Merges here are done by a maintainer. --- .github/workflows/auto-approve.yml | 21 ----------------- .github/workflows/auto-merge.yml | 21 ----------------- .github/workflows/lock.yml | 14 ++++++------ .github/workflows/push-master.yml | 36 ------------------------------ 4 files changed, 7 insertions(+), 85 deletions(-) delete mode 100644 .github/workflows/auto-approve.yml delete mode 100644 .github/workflows/auto-merge.yml delete mode 100644 .github/workflows/push-master.yml diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml deleted file mode 100644 index 2bf9db9..0000000 --- a/.github/workflows/auto-approve.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: bot - -on: - pull_request: - types: [labeled] - - -# Writes go through a separate bot token or app token; GITHUB_TOKEN stays read-only. -permissions: - contents: read - -jobs: - approve: - if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)" - runs-on: ubuntu-latest - steps: - - uses: jacogr/action-approve@795afd1dd096a2071d7ec98740661af4e853b7da - with: - authors: jacogr, TarikGul - labels: -auto - token: ${{ secrets.GH_PAT_BOT }} diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml deleted file mode 100644 index ea0feef..0000000 --- a/.github/workflows/auto-merge.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: bot - -on: - pull_request: - types: [labeled] - - -# Writes go through a separate bot token or app token; GITHUB_TOKEN stays read-only. -permissions: - contents: read - -jobs: - merge: - runs-on: ubuntu-latest - steps: - - uses: jacogr/action-merge@d2d64b4545acd93b0a9575177d3d215ae3f92029 - with: - checks: pr (build),pr (docs),pr (lint),pr (test) - labels: -auto - strategy: squash - token: ${{ secrets.GH_PAT_BOT }} diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml index 2fe98a3..bbd834e 100644 --- a/.github/workflows/lock.yml +++ b/.github/workflows/lock.yml @@ -4,22 +4,22 @@ on: schedule: - cron: '30 1/3 * * *' - -# dessant/lock-threads locks closed issues, PRs and discussions. -permissions: - issues: write - pull-requests: write - discussions: write +permissions: {} jobs: lock: runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + issues: write + pull-requests: write env: YARN_ENABLE_SCRIPTS: false steps: - - uses: dessant/lock-threads@c1b35aecc5cdb1a34539d14196df55838bb2f836 + - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2 with: github-token: ${{ github.token }} + process-only: 'issues, prs' issue-inactive-days: '7' issue-comment: > This thread has been automatically locked since there has not been diff --git a/.github/workflows/push-master.yml b/.github/workflows/push-master.yml deleted file mode 100644 index 3c4ba2c..0000000 --- a/.github/workflows/push-master.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Master -on: - push: - branches: - - master - - -# Writes go through a separate bot token or app token; GITHUB_TOKEN stays read-only. -permissions: - contents: read - -jobs: - master: - if: "! startsWith(github.event.head_commit.message, '[CI Skip]')" - strategy: - matrix: - step: ['build:release'] - runs-on: ubuntu-latest - env: - YARN_ENABLE_SCRIPTS: false - CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }} - GH_PAT: ${{ secrets.GH_PAT_BOT }} - GH_RELEASE_GITHUB_API_TOKEN: ${{ secrets.GH_PAT_BOT }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - token: ${{ secrets.GH_PAT_BOT }} - - uses: actions/setup-node@v4 - with: - node-version: 'lts/*' - - name: ${{ matrix.step }} - run: | - yarn install --immutable - yarn ${{ matrix.step }}