Files
Thomas Vincent e2a5f32ee9 fix(ci): [develop] harden dependency installs and Docker build boundaries (#8294)
* security(ci): constrain dependency installs and container build boundaries

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(docker): retain shipped runtime libraries in build context

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(tooling): quote gettext paths and honor Docker base selection

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(auth): use certificate expiry truth in rendering assertions

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(tooling): finish Docker layer and regex scan findings

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(ci): preserve documentation badge anchors without alternation

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(ci): preserve contributor badges and enforce Python coverage

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: share changed-code coverage contracts and enforce shell policy

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(ci): enforce private review files and run path regressions

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: measure changed gettext shell coverage

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: pin coverage to the reviewed PR revision

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
2026-10-14 22:52:37 -04:00

97 lines
4.1 KiB
YAML

# +-------------------------------------------------------------------------+
# | Copyright (C) 2004-2026 The Cacti Group |
# | |
# | This program is free software; you can redistribute it and/or |
# | modify it under the terms of the GNU General Public License |
# | as published by the Free Software Foundation; either version 2 |
# | of the License, or (at your option) any later version. |
# | |
# | This program is distributed in the hope that it will be useful, |
# | but WITHOUT ANY WARRANTY; without even the implied warranty of |
# | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
# | GNU General Public License for more details. |
# +-------------------------------------------------------------------------+
# | Cacti: The Complete RRDtool-based Graphing Solution |
# +-------------------------------------------------------------------------+
# | This code is designed, written, and maintained by the Cacti Group. See |
# | about.php and/or the AUTHORS file for specific developer information. |
# +-------------------------------------------------------------------------+
# | http://www.cacti.net/ |
# +-------------------------------------------------------------------------+
name: "Maintain old issues"
on:
schedule:
- cron: '0 0 * * *'
permissions: {}
jobs:
stale:
permissions:
issues: write
pull-requests: write
runs-on: ubuntu-slim
timeout-minutes: 10
steps:
- uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
days-before-stale: 365
days-before-close: 30
remove-stale-when-updated: true
exempt-issue-labels: 'pinned, security, type:security, enhancement, type:enhancement, future release'
stale-issue-label: 'outdated'
stale-issue-message: >
This issue has been automatically marked as stale because it has
not had recent activity. It will be closed if no further activity
occurs. Thank you for your contributions.
exempt-pr-labels: 'pinned, security, type:security, enhancement, type:enhancement, future release'
stale-pr-label: 'outdated'
stale-pr-message: >
This pull request has been automatically marked as stale because
it has not had recent activity. It will be closed if no further
activity occurs. Thank you for your contributions.
lock:
permissions:
issues: write
pull-requests: write
runs-on: ubuntu-slim
timeout-minutes: 10
steps:
- uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
with:
github-token: ${{ github.token }}
repo-token: ${{ secrets.GITHUB_TOKEN }}
issue-lock-inactive-days: '90'
issue-exclude-created-before: ''
issue-exclude-labels: 'future release'
issue-lock-labels: ''
# issue-lock-comment: >
# This issue tracker has been automatically locked since there
# has not been any recent activity after it was closed. Please
# open a new issue for related bugs.
# issue-lock-reason: 'resolved'
issue-lock-reason: ''
pr-lock-inactive-days: '90'
pr-exclude-created-before: ''
pr-exclude-labels: 'future release'
pr-lock-labels: ''
# pr-lock-comment: >
# This pull request has been automatically locked since there
# has not been any recent activity after it was closed. Please
# open a new issue for related bugs.
pr-lock-reason: ''
# Empty means every thread type, including discussions, which the
# job has no permission for and which failed the run every night.
process-only: 'issues, prs'
debug-run: true