feat: add stale bot and release notification workflows by abhizipstack · Pull Request #42 · Zipstack/visitran

abhizipstack · 2026-04-06T09:25:41Z

What

Add stale bot workflow to auto-label and close inactive issues/PRs
Add release notification workflow to post to Slack on new releases

Why

Stale issues/PRs accumulate and clutter the backlog for community contributors
Team should be notified on Slack when a release is published

How

Stale bot (.github/workflows/stale.yml):

Runs daily at midnight UTC
Marks issues/PRs as stale after 60 days of inactivity
Auto-closes after 7 more days if no further activity
Exempts labels: pinned, security, bug
Uses existing stale label

Release notification (.github/workflows/release-notification.yml):

Triggers on GitHub release published event
Posts to Slack via incoming webhook
Requires SLACK_WEBHOOK_URL secret (skips gracefully if not configured)

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

No — both are new workflows. Stale bot only affects issues/PRs with 60+ days of inactivity. Release notification only fires on release events.

Database Migrations

None

Env Config

SLACK_WEBHOOK_URL — needs to be added as repo secret for release notifications (optional, workflow skips if not set)

Notes on Testing

Stale bot: can be triggered manually via workflow_dispatch after merge
Release notification: will fire on next GitHub release (needs SLACK_WEBHOOK_URL secret)

Checklist

I have read and understood the Contribution Guidelines.

Stale bot: - Runs daily, marks issues/PRs as stale after 60 days of inactivity - Auto-closes after 7 more days if no activity - Exempts pinned, security, and bug labels - Uses existing 'stale' label (created in PR #15) Release notification: - Posts to Slack when a GitHub release is published - Requires SLACK_WEBHOOK_URL secret (skips if not configured) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

greptile-apps · 2026-04-06T09:29:14Z

Greptile Summary

This PR adds two new GitHub Actions workflows — a stale-bot to auto-label/close inactive issues and PRs, and a release notification workflow that posts to Slack when a new release is published. Both workflows are well-structured and the previously-flagged script-injection, JSON-injection, missing close-pr-message, and inconsistent exempt-pr-labels issues have all been addressed. The only remaining finding is that both actions (actions/stale@v9 and slackapi/slack-github-action@v2.1.0) are pinned to mutable version tags rather than immutable commit SHAs, which is a minor supply-chain hygiene concern.

stale.yml: Correct least-privilege permissions (issues: write, pull-requests: write), full message set (stale + close messages for both issues and PRs), consistent exempt labels (pinned,security,bug) across issues and PRs, and exempt-all-milestones: true to protect milestoned items.
release-notification.yml: Event data is safely passed through env: variables to prevent shell injection; the job is conditionally skipped when SLACK_WEBHOOK_URL is not configured; uses slackapi/slack-github-action with incoming-webhook mode.
Both action references use floating version tags (@v9, @v2.1.0) — consider pinning to full commit SHAs for stronger supply-chain guarantees (P2).

Confidence Score: 5/5

Safe to merge — all previously flagged issues have been resolved and only minor supply-chain hygiene suggestions remain.

All P0/P1 concerns from prior review rounds (script injection, JSON injection, missing close-pr-message, inconsistent exempt labels) have been addressed. The only remaining findings are P2 style suggestions (mutable action version tags), which do not block merge.

No files require special attention; optional hardening is to pin action version tags to commit SHAs in both workflow files.

Vulnerabilities

Previously identified script-injection risk (direct ${{ }} interpolation in run: blocks) has been mitigated by routing all event data through env: variables in release-notification.yml.
Both workflows use unpinned, mutable action version tags (actions/stale@v9, slackapi/slack-github-action@v2.1.0). If either tag is moved or compromised upstream, the workflow will silently execute different code. Pinning to full commit SHAs eliminates this risk.
SLACK_WEBHOOK_URL is consumed only via the secrets context and never echoed or logged — no accidental exposure risk.
stale.yml correctly scopes GITHUB_TOKEN permissions to the minimum required (issues: write, pull-requests: write).

Important Files Changed

Filename	Overview
.github/workflows/release-notification.yml	New workflow that posts to Slack on release; previously-flagged script- and JSON-injection issues are addressed via env: variables, but the Slack action version tag is unpinned (P2).
.github/workflows/stale.yml	New stale-bot workflow with correct permissions, full message coverage, and consistent exempt labels; only remaining concern is the mutable @v9 version tag (P2).

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Events
    participant SW as stale.yml (cron / dispatch)
    participant RW as release-notification.yml
    participant SA as actions/stale@v9
    participant SL as Slack Webhook

    GH->>SW: schedule (daily midnight UTC) or workflow_dispatch
    SW->>SA: Run stale action
    SA-->>GH: Label issues/PRs as stale after 60d
    SA-->>GH: Close stale items after 7d

    GH->>RW: release: published
    RW->>RW: if SLACK_WEBHOOK_URL != empty, continue
    RW->>RW: Build message via env vars (TAG, RELEASE_NAME, URL)
    RW->>SL: POST payload via slackapi/slack-github-action
    SL-->>RW: 200 OK

Prompt To Fix All With AI

This is a comment left during a code review.
Path: .github/workflows/release-notification.yml
Line: 22

Comment:
**Pin action to a commit SHA instead of a mutable version tag**

`slackapi/slack-github-action@v2.1.0` is pinned to a version tag, which can be silently moved by the upstream maintainer (intentionally or after a supply-chain compromise). GitHub's security hardening guide recommends pinning to a full commit SHA to guarantee the exact code that runs.

```suggestion
        uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0
```

_(Replace with the actual commit SHA for the `v2.1.0` release.)_

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: .github/workflows/stale.yml
Line: 16

Comment:
**Pin action to a commit SHA instead of a mutable version tag**

`actions/stale@v9` is a floating major-version tag. If the maintainer ever pushes a breaking change or a malicious actor gains access to the tag, the workflow will silently use different code. Pin to a specific commit SHA for reproducibility and supply-chain safety.

```suggestion
      - uses: actions/stale@5bef64f19d7facfed25b8b884520294b42f96b2b
```

_(Replace with the actual commit SHA for the `v9` release you want to lock to.)_

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (3): Last reviewed commit: "fix: pass release event data via env to ..." | Re-trigger Greptile}

.github/workflows/release-notification.yml

.github/workflows/stale.yml

…pt labels - Fix JSON injection in Slack payload — build message in run step to avoid malformed JSON from release names with quotes - Add close-pr-message for stale PRs — contributors get context - Add bug to exempt-pr-labels — match issue exemptions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/release-notification.yml

Use env variables instead of direct ${{ }} interpolation in run block to prevent shell injection from release names with metacharacters. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

abhizipstack · 2026-04-08T06:30:38Z

Addressed remaining Greptile P1 in c94f2d0 — release event data now passed via env: variables instead of direct ${{ }} interpolation in the run: block to prevent script injection.

wicky-zipstack

LGTM

abhizipstack requested review from Deepak-Gnanasekar, tahierhussain and wicky-zipstack April 6, 2026 09:25

greptile-apps bot reviewed Apr 6, 2026

View reviewed changes

.github/workflows/release-notification.yml Show resolved Hide resolved

.github/workflows/stale.yml Show resolved Hide resolved

.github/workflows/stale.yml Outdated Show resolved Hide resolved

abhizipstack self-assigned this Apr 6, 2026

greptile-apps bot reviewed Apr 6, 2026

View reviewed changes

.github/workflows/release-notification.yml Outdated Show resolved Hide resolved

fix: pass release event data via env to prevent script injection

c94f2d0

Use env variables instead of direct ${{ }} interpolation in run block to prevent shell injection from release names with metacharacters. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

wicky-zipstack approved these changes Apr 8, 2026

View reviewed changes

Deepak-Gnanasekar approved these changes Apr 8, 2026

View reviewed changes

abhizipstack merged commit cd931ab into main Apr 8, 2026
5 of 6 checks passed

wicky-zipstack mentioned this pull request Apr 8, 2026

fix: release notification secrets context and script injection #50

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add stale bot and release notification workflows#42

feat: add stale bot and release notification workflows#42
abhizipstack merged 3 commits intomainfrom
feat/stale-bot-and-release-notification

abhizipstack commented Apr 6, 2026

Uh oh!

greptile-apps bot commented Apr 6, 2026 •

edited

Loading

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

abhizipstack commented Apr 8, 2026

Uh oh!

wicky-zipstack left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

abhizipstack commented Apr 6, 2026

What

Why

How

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

Database Migrations

Env Config

Notes on Testing

Checklist

Uh oh!

greptile-apps bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

abhizipstack commented Apr 8, 2026

Uh oh!

wicky-zipstack left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

greptile-apps bot commented Apr 6, 2026 •

edited

Loading