Comfy-Org · mattmillerai · Jul 9, 2026
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -0,0 +1,187 @@
+name: Stale PRs (reusable)
+
+# Reusable stale-PR sweeper. Keeps a repo's PR queue tidy and posts a Slack
+# digest of what it touched, so the same logic isn't copy-pasted (and left to
+# drift) across repos. Powered by https://github.com/actions/stale
+#   • PR inactive `days_before_pr_stale` days → labeled `stale` + reminder comment
+#   • Still inactive `days_before_pr_close` days later → closed
+#   • Any new commit/comment removes `stale` and resets the clock
+#   • Issues are left untouched (days-before-issue-* = -1)
+#
+# The Slack digest header names the source repo (`github.repository`) so two
+# repos' batches posted to the same channel are unambiguous — a bare "#158"
+# looks identical whether it's from cloud or comfy-infra.
+#
+# Caller pattern (place in source repo at .github/workflows/stale.yml). The
+# caller owns the schedule + the workflow_dispatch dry-run toggle; this reusable
+# does the sweep + the Slack post:
+#
+#   name: Stale PRs
+#   on:
+#     schedule:
+#       - cron: "0 3 * * *"   # daily 03:00 UTC
+#     workflow_dispatch:
+#       inputs:
+#         dry-run:
+#           description: "Preview without applying"
+#           type: boolean
+#           default: false
+#   permissions:
+#     pull-requests: write
+#     issues: write            # required by actions/stale even for PR-only runs
+#   concurrency:
+#     group: stale
+#     cancel-in-progress: false
+#   jobs:
+#     stale:
+#       uses: Comfy-Org/github-workflows/.github/workflows/stale.yml@<sha>  # v1
+#       with:
+#         # Optional overrides — see inputs below. Defaults post to #proj-cloud.
+#         dry_run: ${{ inputs.dry-run || false }}
+#       secrets:
+#         SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+
+on:
+  workflow_call:
+    inputs:
+      slack_channel:
+        description: >-
+          Slack channel ID the digest is posted to. The bot behind
+          SLACK_BOT_TOKEN must be a member. Defaults to #proj-cloud.
+        type: string
+        required: false
+        default: C08V9NDB3B4
+      days_before_pr_stale:
+        description: Days of PR inactivity before it's marked stale.
+        type: number
+        required: false
+        default: 14
+      days_before_pr_close:
+        description: Days after being marked stale before the PR is closed.
+        type: number
+        required: false
+        default: 14
+      stale_pr_label:
+        description: Label applied to a stale PR (and watched for removal to reset the clock).
+        type: string
+        required: false
+        default: stale
+      exempt_pr_labels:
+        description: >-
+          Comma-separated labels that exempt a PR from being marked stale.
+        type: string
+        required: false
+        default: pinned,security,work-in-progress,wip,dependencies,do-not-merge
+      stale_pr_message:
+        description: Comment posted when a PR is marked stale.
+        type: string
+        required: false
+        default: >
+          This PR has been automatically marked **stale** after 14 days of
+          inactivity. It will be closed in 14 days if there's no further
+          activity. Push a commit, comment, or remove the `stale` label to
+          keep it open.
+      close_pr_message:
+        description: Comment posted when a stale PR is closed.
+        type: string
+        required: false
+        default: >
+          Closing this PR as stale after ~4 weeks of inactivity. Feel free to
+          reopen when you pick it back up.
+      dry_run:
+        description: >-
+          Preview only — actions/stale runs in debug-only mode and no Slack
+          digest is sent. Wire the caller's workflow_dispatch dry-run input here.
+        type: boolean
+        required: false
+        default: false
+    secrets:
+      SLACK_BOT_TOKEN:
+        description: >-
+          Bot token used to post the digest via chat.postMessage. If omitted,
+          the sweep still runs; only the Slack heads-up is skipped.
+        required: false
+
+permissions:
+  pull-requests: write
+  issues: write # required by actions/stale even for PR-only runs
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - id: stale
+        uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          days-before-issue-stale: -1 # issues disabled
+          days-before-issue-close: -1
+          days-before-pr-stale: ${{ inputs.days_before_pr_stale }}
+          days-before-pr-close: ${{ inputs.days_before_pr_close }}
+          stale-pr-label: ${{ inputs.stale_pr_label }}
+          exempt-pr-labels: ${{ inputs.exempt_pr_labels }}
+          exempt-draft-pr: true
+          exempt-all-milestones: true
+          remove-stale-when-updated: true
+          operations-per-run: 30
+          ascending: true
+          stale-pr-message: ${{ inputs.stale_pr_message }}
+          close-pr-message: ${{ inputs.close_pr_message }}
+          debug-only: ${{ inputs.dry_run || false }}
+
+      # Surface what the bot did in Slack, not just in-PR. The header names the
+      # source repo so batches from different repos posted to the same channel
+      # are visually distinguishable.
+      - name: Slack heads-up (marked stale / closed)
+        # Skip during dry-run previews and when no PR was touched this run. If
+        # no SLACK_BOT_TOKEN is configured the curl below degrades to a warning
+        # rather than failing the run.
+        if: >-
+          ${{ inputs.dry_run != true &&
+            ( (steps.stale.outputs.staled-issues-prs != '' && steps.stale.outputs.staled-issues-prs != '[]') ||
+              (steps.stale.outputs.closed-issues-prs != '' && steps.stale.outputs.closed-issues-prs != '[]') ) }}
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_CHANNEL: ${{ inputs.slack_channel }}
+          REPO: ${{ github.repository }}
+          SERVER_URL: ${{ github.server_url }}
+          DAYS_TO_CLOSE: ${{ inputs.days_before_pr_close }}
+          STALED: ${{ steps.stale.outputs.staled-issues-prs }}
+          CLOSED: ${{ steps.stale.outputs.closed-issues-prs }}
+        run: |
+          set -euo pipefail
+
+          # actions/stale outputs JSON arrays of the PRs it staled/closed this run.
+          # Build "• <url|#N> title" lines; derive the URL from repo + number so we
+          # don't depend on html_url being present in the output objects.
+          fmt() {
+            echo "${1:-[]}" | jq -r --arg base "$SERVER_URL/$REPO/pull" \
+              '.[]? | "• <\($base)/\(.number)|#\(.number)> \(.title // "")"'
+          }
+          WARN_LINES=$(fmt "$STALED")
+          CLOSE_LINES=$(fmt "$CLOSED")
+
+          # Name the repo in the header so two repos' batches in the same channel
+          # aren't confused (a bare "#158" is ambiguous). Per-PR links already
+          # resolve correctly via $REPO above.
+          TEXT=":hourglass_flowing_sand: *Stale PR bot — ${REPO}*"
+          if [ -n "$WARN_LINES" ]; then
+            TEXT="${TEXT}"$'\n\n'"*Marked stale* — auto-closes in ${DAYS_TO_CLOSE} days without activity:"$'\n'"${WARN_LINES}"
+          fi
+          if [ -n "$CLOSE_LINES" ]; then
+            TEXT="${TEXT}"$'\n\n'"*Closed as stale:*"$'\n'"${CLOSE_LINES}"
+          fi
+
+          PAYLOAD=$(jq -nc --arg channel "$SLACK_CHANNEL" --arg text "$TEXT" \
+            '{channel: $channel, text: $text}')
+          RESPONSE=$(curl -sS -X POST \
+            -H "Authorization: Bearer ${SLACK_BOT_TOKEN}" \
+            -H 'Content-Type: application/json; charset=utf-8' \
+            --data "$PAYLOAD" \
+            https://slack.com/api/chat.postMessage || true)
+
+          if [ "$(echo "$RESPONSE" | jq -r '.ok')" = "true" ]; then
+            echo "Slack heads-up sent"
+          else
+            echo "::warning::Slack notification failed: $(echo "$RESPONSE" | jq -r '.error // "unknown error"')"
+          fi
diff --git a/README.md b/README.md
@@ -13,6 +13,7 @@ This repo is **public** so any repo — public or private, inside or outside the
 | [`cursor-review-auto-label.yml`](.github/workflows/cursor-review-auto-label.yml) | Companion to `cursor-review.yml`. On PR assignment, applies the review label for an opted-in reviewer (via the CLOUD_CODE_BOT app token, so the label actually triggers the review). The opt-in roster lives in the caller's `vars.CURSOR_REVIEW_OPTED_IN_LOGINS` — no roster is baked into the workflow. Requires `vars.APP_ID` + `CLOUD_CODE_BOT_PRIVATE_KEY`. |
 | [`assign-reviewers.yml`](.github/workflows/assign-reviewers.yml) | Auto-requests expertise-aware, load-balanced PR reviewers with new-folk randomization. Matches changed paths against a caller-repo `.github/reviewers.yml` (path-glob → reviewers, plus a `default_pool`), drops the author + `vars.REVIEWER_EXCLUDE`, ranks candidates by open review load (steering off anyone at/over `vars.REVIEWER_LOAD_CAP`), and may swap a slot for a `vars.REVIEWER_GROWTH_POOL` member. Requests go through the CLOUD_CODE_BOT app token so they work on fork PRs. Requires `vars.APP_ID` + `CLOUD_CODE_BOT_PRIVATE_KEY`. |
 | [`assign-prs-to-author.yml`](.github/workflows/assign-prs-to-author.yml) | Housekeeping — assigns every open PR with no assignees to its author (bot-authored PRs skipped by default). Run on a schedule from a thin caller; useful when a team tracks PR ownership via assignees. The calling job needs `pull-requests: write` and `issues: write`. |
+| [`stale.yml`](.github/workflows/stale.yml) | Stale-PR sweeper (`actions/stale`) plus a Slack digest of what it touched. PRs inactive for N days are labeled `stale`; still-inactive PRs are closed. The digest header names the source repo so batches from different repos posted to the same channel are unambiguous. Thresholds, messages, exempt labels, and the Slack channel are inputs; the caller owns the schedule + dry-run toggle. The calling job needs `pull-requests: write` and `issues: write`. Optional `SLACK_BOT_TOKEN`. |
 
 ## Usage