feat(stale): reusable stale-PR workflow + name the repo in the Slack digest (BE-2776)#26
Conversation
…ack digest (BE-2776)
Consolidates the per-repo stale-PR sweeper (duplicated in cloud + comfy-infra)
into one reusable workflow, and names the source repo in the Slack digest
header so batches from different repos posted to the same channel are no longer
ambiguous ("#158" alone could be any repo).
Ports the actions/stale + chat.postMessage logic verbatim, parameterizing what
differs per repo (Slack channel, stale/close thresholds, messages, exempt
labels) as inputs, with SLACK_BOT_TOKEN passed through secrets.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 32 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
…usable # Conflicts: # README.md
mattmillerai
added
cursor-review
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔍 Cursor Review — Consolidated panel
Triggered by @mattmillerai.
Found 6 finding(s).
| Severity | Count |
|---|---|
| 🟠 High | 1 |
| 🟡 Medium | 2 |
| 🟢 Low | 3 |
Panel: 6/8 reviewers contributed findings.
Reviewers that did not contribute: kimi-k2.5:adversarial (empty), kimi-k2.5:edge-case (empty)
Address cursor-review panel findings on the reusable stale-PR workflow: - Escape Slack mrkdwn control chars (& < >) in interpolated PR titles so a crafted title can't inject <!channel>/<!here> pings or masked <url|label> phishing links (High). - Skip the Slack post entirely when SLACK_BOT_TOKEN is unset instead of firing a curl with an empty Bearer header that still ships repo name + PR titles to Slack's API; honors the secret's documented optional contract (Medium). - Reword default stale/close messages to drop hardcoded day counts and the label name so they stay correct when a caller overrides days_before_pr_* or stale_pr_label without also overriding the messages (Medium). - Add curl --connect-timeout/--max-time and a job timeout-minutes so a stalled Slack endpoint can't hang the runner (Low). - Suppress the "auto-closes in N days" line when days_before_pr_close <= 0 (actions/stale's never-close sentinel), which otherwise read "-1 days" (Low). - Capture curl HTTP status so a transport/non-JSON failure yields a real reason instead of an empty "Slack notification failed:" warning (Low). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2 participants
ELI-5
Two repos (cloud and comfy-infra) each had their own copy of the same "stale PR bot" workflow, and both post to the same Slack channel. Their digests looked identical — a bare
#158doesn't say which repo it's from, so the two batches were impossible to tell apart. This adds one shared reusable version of that workflow to this repo (so there's no more copy-paste drift), and makes the Slack header name the source repo so each batch is unambiguous.What this PR does
.github/workflows/stale.ymlas a reusable (on: workflow_call). It ports the existingactions/stale+ Slackchat.postMessagelogic verbatim, parameterizing what differs per repo:slack_channel(defaultC08V9NDB3B4),days_before_pr_stale/days_before_pr_close,stale_pr_message/close_pr_message,stale_pr_label,exempt_pr_labels, and adry_runpass-through.SLACK_BOT_TOKENis passed viasecrets:(optional — the sweep still runs without it).schedule+workflow_dispatchdry-run toggle (a reusable can't declare those triggers); the header documents the caller pattern.*Stale PR bot — <owner/repo>*) so two repos' batches in the same channel are distinguishable. Per-PR link lines are unchanged — they already resolve viagithub.repository.actionlint(+shellcheckon the inline script) is clean.Follow-ups (must land after this merges)
Per the "land the reusable first, then flip callers" sequencing (a caller referencing a not-yet-merged path fails), these are separate PRs in their own repos, pinned to this PR's merge SHA:
Comfy-Org/cloud/.github/workflows/stale.ymlwith a thin caller.Comfy-Org/comfy-infra/.github/workflows/stale.ymlwith a thin caller.bump-stale-callers.ymldispatcher (mirroringbump-cursor-review-callers.yml) to keep those callers pinned — deferred because the callers don't exist yet.stale-issues.ymlare a different issue-triage bot, out of scope).Judgment calls
exempt_pr_labelsdefault is cloud's superset (includesdo-not-merge); comfy-infra's current copy omits it. Broadening to exemptdo-not-mergeis arguably an improvement (don't nag/close a deliberately-held PR), but the comfy-infra caller can override the input to its exact prior set if desired.days_before_pr_closeinstead of a hardcoded "14"; the closed-digest line drops the "(~4 weeks inactive)" parenthetical since it was only accurate at the default 14/14 thresholds.