ci: replace compromised issues helper action#1710
Merged
meteorlxy merged 1 commit intoMay 19, 2026
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR removes usage of the compromised third-party actions-cool/issues-helper@v3 GitHub Action and replaces it with equivalent logic implemented via the preinstalled gh CLI (GitHub Script-style shell steps), reducing supply-chain risk in the repo’s issue automation workflows.
Changes:
- Replaced “close invalid issue” and “comment for need reproduction” automations with
gh issue comment/close. - Replaced daily “label stale / close stale / close need reproduction” automations with GitHub Search API queries +
gh issue edit/comment/close. - Replaced “remove stale label on comment” automation with a direct
gh apilabel deletion call, and ensuredissues: writepermissions are set.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/issue-labeled.yml |
Uses gh CLI to comment and/or close issues when specific labels are applied. |
.github/workflows/issue-daily.yml |
Uses GitHub Search API via gh api to find inactive issues, label them stale + comment, and close inactive labeled issues. |
.github/workflows/issue-commented.yml |
Removes the stale label on new comments using a direct GitHub REST API call via gh api, with explicit issues: write permission. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
meteorlxy
approved these changes
May 19, 2026
Member
|
@TheAlexLichter Thanks a lot! |
Contributor
Author
|
Also thanks to @connorshea for letting me know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the compromised GH Action (see source) with a GH script.