feat(ci): daily merge-train/spartan stale-PR notifier (#23189)

When the open merge-train/spartan PR has been open >24h, post a one-line
alert to #team-alpha. The cron fires once per day, so the channel sees
at most one notification per stuck day. Silent on healthy days.

## Files

- `ci3/merge_train_stale_check` — bash script: queries the open PR for a
merge-train branch, computes age from `created_at`, and posts a
`:warning:` Slack message via `ci3/slack_notify` if age >=
`$STALE_HOURS` (default 24).
- `.github-new/workflows/merge-train-stale-check.yml` — daily schedule
(`7 9 * * *`, 09:07 UTC) + `workflow_dispatch`. Calls the script for
`merge-train/spartan` → `#team-alpha`.

## ⚠ Move workflow into `.github/workflows/` before merging

The workflow is under `.github-new/` because this session was not
started with the `ci-allow` prefix (the prefix needs to be the first
token of the prompt; mid-message `ci-allow` was not picked up by the
session parser, so `.github/` was still blocked). Before merging, move
the file:

git mv .github-new/workflows/merge-train-stale-check.yml
.github/workflows/merge-train-stale-check.yml

Scheduled workflows only execute from the default branch, so the
notifier only starts firing once it has landed on `next`.

## Behaviour

| State of the open `merge-train/spartan` PR | Action |
|---|---|
| No open PR (just merged, awaiting auto-recreate) | Silent — no Slack
post. |
| Open < 24 h (`STALE_HOURS`) | Silent — within expected merge window. |
| Open ≥ 24 h | One `:warning:` line to `#team-alpha` with PR link +
`mergeable_state`. |

## Reuse

Other teams can wire in their own merge-train by adding a job that calls
`./ci3/merge_train_stale_check <branch> <channel>`. Threshold and base
branch are overridable via `STALE_HOURS` / `BASE_BRANCH` env vars.

## Motivation

Driven by a Slack request: merge-train/spartan PR
#22980 has been
stuck on conflicts for ~6 days with no automated notification.

ClaudeBox log: https://claudebox.work/s/e4b1d8ae8d5c867b?run=2

---------

Co-authored-by: Santiago Palladino <santiago@aztec-labs.com>

Author: spalladino

.github/workflows/merge-train-stale-check.yml

@@ -0,0 +1,22 @@
+name: Merge-Train Stale Check
+
+on:
+  schedule:
+    # Daily at 09:15 UTC — once per day, off the round-minute mark.
+    - cron: "15 9 * * *"
+  workflow_dispatch:
+
+jobs:
+  spartan:
+    name: Check merge-train/spartan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Run stale check
+        env:
+          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        run: ./ci3/merge_train_stale_check merge-train/spartan '#team-alpha'

ci3/merge_train_stale_check

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Check whether the open PR for a merge-train branch has been open longer
+# than a threshold (default 24h). If so, post a one-line alert to a Slack
+# channel. Intended to be called from a daily scheduled GitHub Actions job.
+#
+# Usage: merge_train_stale_check <merge-train-branch> <slack-channel>
+#
+# Example:
+#   merge_train_stale_check merge-train/spartan '#team-alpha'
+#
+# Required env vars:
+#   GH_TOKEN        — GitHub API token (used by `gh api`)
+#   SLACK_BOT_TOKEN — Slack bot token (consumed by ci3/slack_notify)
+#
+# Optional env vars:
+#   STALE_HOURS — alert threshold in hours (default 24)
+#   BASE_BRANCH — PR base branch to filter on (default "next")
+
+set -euo pipefail
+
+REF_NAME="${1:?Usage: $0 <merge-train-branch> <slack-channel>}"
+CHANNEL="${2:?Usage: $0 <merge-train-branch> <slack-channel>}"
+STALE_HOURS="${STALE_HOURS:-24}"
+BASE_BRANCH="${BASE_BRANCH:-next}"
+
+pr_json=$(gh api "repos/AztecProtocol/aztec-packages/pulls?head=AztecProtocol:${REF_NAME}&state=open&base=${BASE_BRANCH}" --jq '.[0] // empty')
+
+if [[ -z "$pr_json" ]]; then
+  echo "$REF_NAME: no open PR targeting $BASE_BRANCH — nothing to alert."
+  exit 0
+fi
+
+pr_number=$(jq -r '.number' <<<"$pr_json")
+pr_url=$(jq -r '.html_url' <<<"$pr_json")
+created_at=$(jq -r '.created_at' <<<"$pr_json")
+
+now_s=$(date -u +%s)
+created_s=$(date -u -d "$created_at" +%s)
+age_hours=$(( (now_s - created_s) / 3600 ))
+
+echo "$REF_NAME PR #$pr_number opened $age_hours hour(s) ago (created $created_at)"
+
+if (( age_hours < STALE_HOURS )); then
+  echo "Within ${STALE_HOURS}h window — no alert."
+  exit 0
+fi
+
+mergeable_state=$(gh api "repos/AztecProtocol/aztec-packages/pulls/$pr_number" --jq '.mergeable_state // "unknown"')
+days=$(( age_hours / 24 ))
+
+message=$(printf ':warning: `%s` has not merged into `%s` in %d day(s). <%s|PR #%d> is in state `%s`.' \
+  "$REF_NAME" "$BASE_BRANCH" "$days" "$pr_url" "$pr_number" "$mergeable_state")
+
+TOPDIR=$(git rev-parse --show-toplevel)
+"$TOPDIR/ci3/slack_notify" "$message" "$CHANNEL"
+
+echo "Alert sent to $CHANNEL: $message"