Skip to content

ci: fix broken workflows, tighten permissions, add community health files #1374

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Hunter275 wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

ci: fix broken workflows, tighten permissions, add community health files #1374

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
# Code owners are requested for review automatically when a PR touches their
# paths. Combined with a branch protection rule requiring code owner review,
# this is what stops an unreviewed change to the release or publishing
# workflows from landing.
#
# ─────────────────────────────────────────────────────────────────────────────
# ACTION REQUIRED: the rules below are commented out because they need real
# GitHub handles or team slugs. Replace @meshtastic/OWNERS with the actual
# owner(s) and uncomment. Rules naming a nonexistent user or team are silently
# ignored by GitHub, so it is better to leave them off than to guess.
#
# Later rules win over earlier ones, so keep the catch-all first.
# ─────────────────────────────────────────────────────────────────────────────

# Default owners for everything in the repo
# * @meshtastic/OWNERS

# CI, release, and publishing pipelines — these hold the credentials that push
# to GHCR, npm, and JSR, so they warrant the tightest review.
# /.github/workflows/ @meshtastic/OWNERS
# /.github/dependabot.yml @meshtastic/OWNERS
# /.github/CODEOWNERS @meshtastic/OWNERS

# Container build and deployment
# /apps/web/infra/ @meshtastic/OWNERS

# Transport layer — device connectivity (BLE / Serial / HTTP)
# /packages/transport-*/ @meshtastic/OWNERS

# Protocol definitions
# /packages/protobufs/ @meshtastic/OWNERS

# Translation sources. Crowdin owns the non-English locales; changes to the
# English source strings should still get a maintainer's eyes.
# /apps/web/public/i18n/locales/en/ @meshtastic/OWNERS
17 changes: 17 additions & 0 deletions .github/ISSUE_TEMPLATE/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
blank_issues_enabled: false
contact_links:
- name: 💬 Meshtastic Discord
url: https://discord.gg/meshtastic
about: Real-time help with setup, connection problems, and general usage. Start here if you're not sure it's a bug.
- name: 🗣️ Meshtastic Forum
url: https://meshtastic.discourse.group
about: Longer-form discussion, ideas, and community support.
- name: 📚 Documentation
url: https://meshtastic.org/docs/software/web-client
about: Web client docs, including connection setup and troubleshooting.
- name: 🔌 Firmware or device issues
url: https://github.com/meshtastic/firmware/issues
about: Report problems with the device firmware itself, not the web client.
- name: 🔐 Report a security vulnerability
url: https://github.com/meshtastic/web/security/advisories/new
about: Please report security issues privately, not as a public issue.
53 changes: 53 additions & 0 deletions .github/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
# Security Policy

## Supported Versions

Security fixes land on `main` and ship in the next release. Only the most
recent release and the `nightly` container image receive fixes; older tags are
not patched.

| Version | Supported |
| -------------------------------- | ------------------ |
| Latest release / `stable` branch | :white_check_mark: |
| `nightly` | :white_check_mark: |
| Older tagged releases | :x: |

## Reporting a Vulnerability

**Please do not open a public issue for security vulnerabilities.**

Report privately through GitHub Security Advisories:

<https://github.com/meshtastic/web/security/advisories/new>
Comment on lines +19 to +21

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
status="$(gh api repos/meshtastic/web \
  --jq '.security_and_analysis.private_vulnerability_reporting.status')"
printf 'private_vulnerability_reporting=%s\n' "$status"
test "$status" = enabled

Repository: meshtastic/web

Length of output: 185

🌐 Web query:

GitHub private vulnerability reporting enabled feature request reporting secrets advisory form repository security_advisories new

💡 Result:

GitHub's private vulnerability reporting (PVR) is an opt-in feature that allows security researchers to privately disclose vulnerabilities to repository maintainers directly on the platform [1][2]. For Repository Maintainers To enable this feature, repository owners or administrators can navigate to the repository's security settings [3]: 1. Go to the repository's main page on GitHub. 2. Navigate to Settings and then to Code security and analysis [3]. 3. Under the Advanced Security section, locate Private vulnerability reporting and click Enable [3]. Once enabled, a Report a vulnerability button appears on the repository's Security tab (specifically under the Advisories section), providing a structured form for researchers to submit findings [3]. When a report is submitted, administrators and security managers are notified [3][4]. Maintainers can then review the report, request additional information, or accept the report to initiate a private, collaborative fix—which can include creating a temporary private fork for code development [4]. For Security Researchers When a repository has PVR enabled, you can privately report a vulnerability using the following steps [3][5]: 1. Navigate to the repository on GitHub. 2. Click the Security tab and then click Advisories [3]. 3. Click the Report a vulnerability button to access the private reporting form [3]. 4. Fill out the required details regarding the vulnerability [2]. If a repository does not have PVR enabled, you should follow the repository's documented security policy (typically found in a SECURITY.md file) or contact the maintainers directly [6]. Additionally, GitHub provides a REST API that allows researchers to privately report vulnerabilities programmatically [3][6].

Citations:

Add a private fallback contact for security reports.

Private vulnerability reporting is not enabled for this repository, so both .github/SECURITY.md#L19-L21 and .github/ISSUE_TEMPLATE/config.yml#L15-L17 should add another private contact if this URL does not provide the advisory form.

📍 Affects 2 files
  • .github/SECURITY.md#L19-L21 (this comment)
  • .github/ISSUE_TEMPLATE/config.yml#L15-L17
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/SECURITY.md around lines 19 - 21, Add a private fallback
security-report contact alongside the GitHub Security Advisories URL in
.github/SECURITY.md lines 19-21, and add the same fallback contact in
.github/ISSUE_TEMPLATE/config.yml lines 15-17 when the advisory form is
unavailable; preserve the existing advisory guidance.


Please include:

- A description of the issue and its impact
- Steps to reproduce, or a proof of concept
- The affected version, browser, and connection type (HTTP / Bluetooth / Serial)
- Any suggested mitigation

We aim to acknowledge reports within 7 days and to provide a remediation plan
within 30 days. We will credit you in the advisory unless you prefer otherwise.

## Scope

This repository is the Meshtastic **web client**. In scope:

- Cross-site scripting, injection, or other client-side vulnerabilities
- Mishandling of channel PSKs, private keys, or other device secrets
- Flaws in the Bluetooth, Serial, or HTTP transport implementations
- Supply-chain issues in this repository's build and release workflows

Out of scope — report these to the relevant repository instead:

- Device firmware: <https://github.com/meshtastic/firmware>
- Protocol design: <https://github.com/meshtastic/protobufs>
- Findings that require physical access to an already-unlocked device
- Vulnerabilities in the user's browser or operating system

## Handling Device Secrets

The web client handles channel pre-shared keys and node private keys. When
reporting an issue, please redact any real keys from logs, screenshots, and
reproduction steps.
22 changes: 22 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,25 @@ updates:
directory: "/"
schedule:
interval: "weekly"
# Action bumps are low-risk and were the single largest source of PR churn;
# batch them into one PR per week.
groups:
github-actions:
patterns:
- "*"
labels:
- "dependencies"
- "github-actions"

- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 3 # 1 day after pnpm's cutoff, prevent a race
open-pull-requests-limit: 10 # Increase PR limit
labels:
- "dependencies"
Comment on lines +24 to +25

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== dependabot.yml =="
cat -n .github/dependabot.yml 2>/dev/null || true

echo
echo "== repo automation references to npm label =="
rg -n '"npm"|: "npm"|github-actions/npm|npm|dependencies' .github workflows . 2>/dev/null | head -200 || true

echo
echo "== docs excerpt for labels =="
python3 - <<'PY'
try:
    import urllib.request
    url = "https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/customizing-dependabot-prs"
    req = urllib.request.Request(url, headers={"User-Agent":"CodeRabbit-verifier"})
    with urllib.request.urlopen(req, timeout=20) as resp:
        text = resp.read().decode("utf-8","replace")
    for token in ["labels:", "npm", "dependencies", "github-actions"]:
        print(f"-- occurrences of [{token}] --")
        hits = [line.strip() for line in text.splitlines() if token in line]
        print("\n".join(hits[:40]))
except Exception as e:
    print(f"DOC_FETCH_ERROR: {e}")
PY

Repository: meshtastic/web

Length of output: 13752

🌐 Web query:

GitHub Dependent PR labels default labels npm package ecosystem labels only configuration

💡 Result:

By default, GitHub Dependabot automatically applies labels to pull requests: a dependencies label, an ecosystem-specific label (e.g., npm, java), and SemVer labels if they exist in the repository [1][2]. These default labels are created automatically if they do not exist [1][2]. You can override this behavior by using the labels option within your dependabot.yml file for a specific package ecosystem [1][3]. When you define the labels option: 1. The labels you specify replace the default labels entirely for that package ecosystem [1][4]. 2. SemVer labels (major, minor, patch) will continue to be applied automatically, in addition to your custom labels, if they exist in your repository [1][4]. 3. The custom labels you specify must already exist in your repository; if a label is not defined, Dependabot will ignore it [1][2]. 4. To remove all labels, including defaults, you can set an empty list: labels: [] [1][4]. There is no configuration setting to explicitly restrict Dependabot to only apply ecosystem labels (e.g., npm) while keeping other defaults; you must manually define the specific set of labels you want to use (including the ecosystem label if you wish to keep it) in the configuration file [1][2].

Citations:

Preserve the npm ecosystem label on npm updates.

labels replaces Dependabot’s default labels entirely for that ecosystem, so this npm config currently applies only dependencies instead of also applying the default npm label. Add npm if you want Dependabot PRs to keep the ecosystem label.

Proposed fix 
 labels:
   - "dependencies"
+  - "npm"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
labels:
- "dependencies"
labels:
- "dependencies"
- "npm"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 24 - 25, Update the npm ecosystem
configuration’s labels list to include both the existing dependencies label and
the default npm ecosystem label, preserving both labels on Dependabot npm update
pull requests.

groups:
tanstack:
patterns:
Expand All @@ -23,3 +35,13 @@ updates:
- react
- react-dom
- "@types/react*"
# Catch-all for tooling, so lint/format/test/build bumps land together
# instead of one PR per package.
dev-dependencies:
dependency-type: "development"
patterns:
- "*"
exclude-patterns:
- "@tanstack/*"
- "@radix-ui/*"
- "@types/react*"
13 changes: 10 additions & 3 deletions .github/pull_request_template.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,15 @@ If your changes affect the UI, include screenshots or screencasts showing the be
Check all that apply. If an item doesn't apply to your PR, you can leave it unchecked or remove it.
-->

- [ ] Code follows project style guidelines
- [ ] `pnpm run check` passes (lint + format)
- [ ] `pnpm --filter ./apps/web run typecheck` passes
- [ ] `pnpm exec vitest run` passes
Comment on lines +46 to +48

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
rg -n -C 3 \
  'check:fix|pnpm run check|typecheck|continue-on-error' \
  --glob 'package.json' \
  --glob '.github/workflows/*.yml' \
  --glob '.github/workflows/*.yaml' \
  --glob 'CONTRIBUTING.md' \
  --glob '.github/pull_request_template.md'

Repository: meshtastic/web

Length of output: 152

🏁 Script executed:

#!/usr/bin/envbash
set -u

printf 'Tracked relevant files:\n'
git ls-files | rg '(^package\.json$|CONTRIBUTING\.md$|\.github/pull_request_template\.md$|\.github/workflows/.*\.ya?ml$)' || true

printf '\npackage.json scripts relevant to check/lint/typecheck/tests:\n'
if [ -f package.json ]; then
  python3 - <<'PY'
import json
from pathlib import Path
p=Path('package.json')
data=json.loads(p.read_text())
for k,v in data.get('scripts',{}).items():
    s_k=k.lower()
    s_v=str(v).lower()
    if 'check' in s_k or any(x in ('check','lint','format','typecheck','test','vitest') for x in (k,v.split(maxsplit=3)) if str(x).lower()):
        print(f'{k}: {v}')
PY
fi

printf '\nSearch all tracked text matching keywords:\n'
rg -n -C 2 \
  'check:fix|`pnpm run check|pnpm run check|typecheck|continue-on-error|CI runs|green PR|non-blocking|formatting' . || true

Repository: meshtastic/web

Length of output: 4654

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- .github/pull_request_template.md ---\n'
cat -n .github/pull_request_template.md | sed -n '1,90p'

printf '\n--- CONTRIBUTING.md ---\n'
cat -n CONTRIBUTING.md | sed -n '1,50p'

printf '\n--- .github/pr.yml relevant validation blocks ---\n'
rg -n -C 4 'check|typecheck|format|lint|continue-on-error|pnpm run|pnpm exec|checks' .github/workflows/pr.yml .github/workflows/ci.yml package.json apps/web/package.json || true

printf '\n--- PR-NOTS.md objective context ---\n'
cat -n PR-NOTES.md | sed -n '45,70p'

Repository: meshtastic/web

Length of output: 243

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- .github/pull_request_template.md ---'
cat -n .github/pull_request_template.md | sed -n '1,90p'

printf '%s\n' ''
printf '%s\n' '--- CONTRIBUTING.md ---'
cat -n CONTRIBUTING.md | sed -n '1,50p'

printf '%s\n' ''
printf '%s\n' '--- .github/pr.yml relevant validation blocks ---'
rg -n -C 4 'check|typecheck|format|lint|continue-on-error|pnpm run|pnpm exec|checks' .github/workflows/pr.yml .github/workflows/ci.yml package.json apps/web/package.json || true

printf '%s\n' ''
printf '%s\n' '--- PR-NOTES.md objective context ---'
cat -n PR-NOTES.md | sed -n '45,70p'

Repository: meshtastic/web

Length of output: 11774

Align contributor guidance with the blocking checks.

.github/pr.yml makes formatting and typechecking non-blocking with continue-on-error, but the PR checklist and quick start present those same checks as required for merge/green PR.

  • .github/pull_request_template.md#L46-L48: note that formatting and typechecking were run and are currently non-blocking.
  • CONTRIBUTING.md#L24-L33: document that lint/format check, unit tests, and web typecheck are required; clarify that formatting and typecheck are currently non-blocking with a fix-task link and distinguish pnpm run check:fix from CI validation.
📍 Affects 2 files
  • .github/pull_request_template.md#L46-L48 (this comment)
  • CONTRIBUTING.md#L24-L33
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/pull_request_template.md around lines 46 - 48, Update
.github/pull_request_template.md lines 46-48 to state that lint/format
validation and web typechecking were run, while noting both are currently
non-blocking. Update CONTRIBUTING.md lines 24-33 to document lint/format checks,
unit tests, and web typechecking as required contributor checks; distinguish
pnpm run check:fix from CI validation and link to the task tracking the
non-blocking formatting and typecheck status.

- [ ] Documentation has been updated or added
- [ ] Tests have been added or updated
- [ ] All i18n translation labels have been added (read
CONTRIBUTING_I18N_DEVELOPER_GUIDE.md for more details)
- [ ] All i18n translation labels have been added (see the
[i18n developer guide](../apps/web/CONTRIBUTING_I18N_DEVELOPER_GUIDE.md))

<!--
New here? See the [contributing guide](../CONTRIBUTING.md).
-->

9 changes: 7 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,18 @@ on:
branches:
- main

# This workflow only builds; it publishes nothing.
permissions:
contents: write
packages: write
contents: read

concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true

jobs:
build-and-package:
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- name: Checkout code
uses: actions/checkout@v7
Expand Down
10 changes: 10 additions & 0 deletions .github/workflows/crowdin-download.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,19 @@ on:
- cron: "0 0 * * 0"
workflow_dispatch: # Allow manual triggering

# Needed to push the translation branch and open the PR.
permissions:
contents: write
pull-requests: write
Comment on lines +8 to +11

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

file=".github/workflows/crowdin-download.yml"

if rg -nP '^\s*uses:\s+(crowdin/github-action|actions/checkout)@(?![0-9a-f]{40}\s*$)' "$file"; then
  echo "Mutable action reference found" >&2
  exit 1
fi

Repository: meshtastic/web

Length of output: 262

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

file=".github/workflows/crowdin-download.yml"
echo "== File exists and relevant lines =="
wc -l "$file"
sed -n '1,70p' "$file" | cat -n

echo
echo "== Action refs in workflows =="
rg -n '^\s*uses:\s+' .github/workflows || true

Repository: meshtastic/web

Length of output: 5717

Pin the Crowdin and checkout actions before granting write permissions.

Lines 24 and 27 use actions/checkout@v7 and crowdin/github-action@v2, both mutable tags. This job has contents: write, pull-requests: write, and exposes GITHUB_TOKEN, CROWDIN_PROJECT_ID, and CROWDIN_PERSONAL_TOKEN. Use reviewed full-length commit SHAs for these workflow actions.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/crowdin-download.yml around lines 8 - 11, Pin the actions
used by the Crowdin workflow, specifically actions/checkout and
crowdin/github-action, to reviewed full-length commit SHAs instead of the
mutable v7 and v2 tags. Keep the existing write permissions and action
configuration unchanged.


concurrency:
group: crowdin-download
cancel-in-progress: false

jobs:
synchronize-with-crowdin:
runs-on: ubuntu-latest
timeout-minutes: 20

steps:
- name: Checkout
Expand Down
14 changes: 12 additions & 2 deletions .github/workflows/crowdin-upload-sources.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,26 @@ name: Crowdin Upload Sources Action

on:
push:
# Monitor all .json files within the /i18n/locales/en/ directory.
# Monitor all .json files within the English locale directory.
# This ensures the workflow triggers if any the English namespace files are modified on the main branch.
# NOTE: path filters are relative to the repo root and must NOT start with "/",
# otherwise the glob never matches and this workflow silently never runs.
paths:
- "/apps/web/public/i18n/locales/en/*.json"
- "apps/web/public/i18n/locales/en/*.json"
branches: [main]
workflow_dispatch: # Allow manual triggering

permissions:
contents: read

concurrency:
group: crowdin-upload-sources
cancel-in-progress: false

jobs:
synchronize-with-crowdin:
runs-on: ubuntu-latest
timeout-minutes: 15

steps:
- name: Checkout
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/crowdin-upload-translations.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,17 @@ name: Crowdin Upload Translations Action
on:
workflow_dispatch: # Allow manual triggering

permissions:
contents: read

concurrency:
group: crowdin-upload-translations
cancel-in-progress: false

jobs:
synchronize-with-crowdin:
runs-on: ubuntu-latest
timeout-minutes: 15

steps:
- name: Checkout
Expand Down
32 changes: 32 additions & 0 deletions .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,21 @@
- "playwright.config.ts"
- ".github/workflows/e2e.yml"

permissions:
contents: read

# This is the most expensive workflow in the repo (Docker mesh + Playwright).
# Superseded runs on the same PR are pointless, so cancel them.
concurrency:
group: e2e-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

jobs:
e2e:
runs-on: ubuntu-latest
timeout-minutes: 30
# Drafts don't need a 30-minute device suite on every push.
if: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false }}
env:
CI: "true"
steps:
Expand All @@ -32,12 +43,33 @@
- name: Install workspace deps
run: pnpm install --frozen-lockfile

# Key the browser cache on the resolved Playwright version so a dependency
# bump invalidates it instead of restoring a mismatched browser build.
- name: Resolve Playwright version
id: pw
run: echo "version=$(pnpm exec playwright --version | awk '{print $2}')" >> "$GITHUB_OUTPUT"

- name: Cache Playwright browsers
id: pw-cache
uses: actions/cache@v4

Check failure

Code scanning / zizmor

unpinned action reference: action is not pinned to a hash (required by blanket policy) Error

unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
path: ~/.cache/ms-playwright
key: ${{ runner.os }}-playwright-${{ steps.pw.outputs.version }}

- name: Install Chromium
if: steps.pw-cache.outputs.cache-hit != 'true'
run: pnpm exec playwright install --with-deps chromium

# Cached browsers still need their OS-level shared libraries.
- name: Install Chromium system deps
if: steps.pw-cache.outputs.cache-hit == 'true'
run: pnpm exec playwright install-deps chromium

- uses: actions/setup-python@v7
with:
python-version: "3.11"
cache: pip
cache-dependency-path: e2e/peer/requirements.txt

- name: Install Python mesh peer
run: |
Expand Down
17 changes: 15 additions & 2 deletions .github/workflows/inactive-issue.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,22 @@
name: Close inactive issues
on:
schedule:
- cron: "0 */4 * * *" # every 4 hours
- cron: "30 1 * * *" # daily at 01:30 UTC
workflow_dispatch: # allow manual runs

# Issues take 60 days to go stale; running more than once a day just burns
# minutes against the action's per-run operations budget.
permissions:
contents: read

concurrency:
group: stale
cancel-in-progress: false

jobs:
close-issues:
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
issues: write
pull-requests: write
Expand All @@ -20,5 +31,7 @@ jobs:
close-issue-message: "This issue was closed because it has been inactive for 14 days since being marked as stale."
days-before-pr-stale: -1
days-before-pr-close: -1
only-issue-labels: "Bug"
# Must match the label applied by .github/ISSUE_TEMPLATE/bug.yml.
only-issue-labels: "bug"
exempt-issue-labels: "pinned,security,help wanted"
remove-stale-when-updated: true
Loading
Loading