Merge pull request DomT4#155 from toobuntu/ci/dependabot-hashes

ci: sync stale issues workflow and pin actions to full commit SHA

Author: DomT4

.github/workflows/generate-help-output.yml

@@ -19,12 +19,12 @@ jobs:
           test-bot: false
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.ref_name }}
 
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
             python-version: '3' 
 

.github/workflows/triage-issues.yml .github/workflows/stale-issues.yml

@@ -1,38 +1,44 @@
 # This file is synced from the `.github` repository, do not modify it directly.
-name: Triage issues
+name: Manage stale issues
 
 on:
   push:
     paths:
-      - .github/workflows/triage-issues.yml
+      - .github/workflows/stale-issues.yml
     branches-ignore:
       - dependabot/**
   schedule:
     # Once every day at midnight UTC
     - cron: "0 0 * * *"
   issue_comment:
 
-permissions:
-  issues: write
-  pull-requests: write
+permissions: {}
+
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
 
 concurrency:
-  group: triage-issues
+  group: stale-issues
   cancel-in-progress: ${{ github.event_name != 'issue_comment' }}
 
 jobs:
   stale:
     if: >
-      github.repository_owner == 'Homebrew' && (
+      github.repository_owner == 'DomT4' && (
         github.event_name != 'issue_comment' || (
           contains(github.event.issue.labels.*.name, 'stale') ||
           contains(github.event.pull_request.labels.*.name, 'stale')
         )
       )
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - name: Mark/Close Stale Issues and Pull Requests
-        uses: actions/stale@v9
+        uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 21
@@ -45,19 +51,24 @@ jobs:
             recent activity. It will be closed if no further activity occurs.
           exempt-issue-labels: "gsoc-outreachy,help wanted,in progress"
           exempt-pr-labels: "gsoc-outreachy,help wanted,in progress"
+          delete-branch: true
 
   bump-pr-stale:
     if: >
-      github.repository_owner == 'Homebrew' && (
+      github.repository_owner == 'DomT4' && (
         github.event_name != 'issue_comment' || (
           contains(github.event.issue.labels.*.name, 'stale') ||
           contains(github.event.pull_request.labels.*.name, 'stale')
         )
       )
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - name: Mark/Close Stale `bump-formula-pr` and `bump-cask-pr` Pull Requests
-        uses: actions/stale@v9
+        uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 2
@@ -68,17 +79,4 @@ jobs:
             pull request open, add a `help wanted` or `in progress` label.
           exempt-pr-labels: "help wanted,in progress"
           any-of-labels: "bump-formula-pr,bump-cask-pr"
-
-  lock-threads:
-    if: github.repository_owner == 'Homebrew' && github.event_name != 'issue_comment'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Lock Outdated Threads
-        uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          process-only: 'issues, prs'
-          issue-inactive-days: 30
-          add-issue-labels: outdated
-          pr-inactive-days: 30
-          add-pr-labels: outdated
+          delete-branch: true