build(deps): bump actions/stale from 10 to 11

[dependabot]

Bumps actions/stale from 10 to 11.

Release notes

Sourced from actions/stale's releases.

v11.0.0

What's Changed

Enhancement

• Migrate to ESM and update dependencies by @​chiranjib-swain in actions/stale#1350

Dependency Update

• Override brace-expansion to 5.0.8 to address 24 high-severity dependency vulnerabilities by @​dependabot in actions/stale#1351

Full Changelog: actions/stale@v10...v11.0.0

v10.4.0

What's Changed

Bug Fix

• Fixed only-issue-types validation by @​trueberryless in actions/stale#1338

Dependency Updates

• Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @​dependabot in actions/stale#1342

New Contributors

• @​trueberryless made their first contribution in actions/stale#1338

Full Changelog: actions/stale@v10.3.0...v10.4.0

v10.3.0

What's Changed

Bug Fix

• Enhancement: ignore stale labeling events by @​shamoon in actions/stale#1311

Dependency Updates

• Upgrade dependencies (@​actions/core, @​octokit/plugin-retry, @​typescript-eslint) by @​Copilot in actions/stale#1335

New Contributors

• @​shamoon made their first contribution in actions/stale#1311

Full Changelog: actions/stale@v10...v10.3.0

v10.2.0

What's Changed

Bug Fix

• Fix checking state cache (fix #1136) and switch to Octokit helper methods by @​itchyny in actions/stale#1152

Dependency Updates

• Upgrade js-yaml from 4.1.0 to 4.1.1 by @​dependabot in actions/stale#1304
• Upgrade lodash from 4.17.21 to 4.17.23 by @​dependabot in actions/stale#1313
• Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by @​chiranjib-swain in actions/stale#1312

New Contributors

• @​itchyny made their first contribution in actions/stale#1152

Full Changelog: actions/stale@v10...v10.2.0

... (truncated)

Changelog

Sourced from actions/stale's changelog.

Changelog

[10.1.0]

What's Changed

• Add only-issue-types option to filter issues by type by @​Bibo-Joshi in actions/stale#1255

[10.0.0]

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in actions/stale#1279 Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. Release Notes

Enhancement

• Introducing sort-by option by @​suyashgaonkar in actions/stale#1254

Dependency Upgrades

• Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot[bot] in actions/stale#1186
• Upgrade undici from 5.28.4 to 5.28.5 by @​dependabot[bot] in actions/stale#1201
• Upgrade @​action/cache from 4.0.0 to 4.0.2 by @​aparnajyothi-y in actions/stale#1226
• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​suyashgaonkar in actions/stale#1233
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in actions/stale#1251
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in actions/stale#1277

Documentation changes

• Changelog update for recent releases by @​suyashgaonkar in actions/stale#1224
• Permissions update in Readme by @​ghadimir in actions/stale#1248

[9.1.0]

What's Changed

• Documentation update by @​Marukome0743 in actions/stale#1116
• Add workflow file for publishing releases to immutable action package by @​Jcambass in actions/stale#1179
• Update undici from 5.28.2 to 5.28.4 by @​dependabot in actions/stale#1150
• Update actions/checkout from 3 to 4 by @​dependabot in actions/stale#1091
• Update actions/publish-action from 0.2.2 to 0.3.0 by @​dependabot in actions/stale#1147
• Update ts-jest from 29.1.1 to 29.2.5 by @​dependabot in actions/stale#1175
• Update @​actions/core from 1.10.1 to 1.11.1 by @​dependabot in actions/stale#1191
• Update @​types/jest from 29.5.11 to 29.5.14 by @​dependabot in actions/stale#1193
• Update @​actions/cache from 3.2.2 to 4.0.0 by @​dependabot in actions/stale#1194

[9.0.0]

Breaking Changes

1. Action is now stateful: If the action ends because of operations-per-run then the next run will start from the first unprocessed issue skipping the issues processed during the previous run(s). The state is reset when all the issues are processed. This should be considered for scheduling workflow runs.
2. Version 9 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.

... (truncated)

Commits

• 4391f3d Fix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...
• eaf9131 refactor: update imports to use ES module syntax and improve test structure (...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 7:47 PM ET / 23:47 UTC.

ClawSweeper review

What this changes

Updates all three scheduled stale-policy workflow steps from actions/stale@v10 to actions/stale@v11 without changing their thresholds, exemptions, messages, or permissions.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This PR remains necessary: current main and release v0.11.10 still run all three stale-policy steps on actions/stale@v10. The patch is a clean, limited major upgrade with no discrete correctness defect found, but it changes a scheduled workflow that can label and close issues or pull requests, so a maintainer should explicitly accept the upstream v11 behavior before merge.

Priority: P3
Reviewed head: 882d5929c1d5a0c8ee9da7fd5bf7b817e23e2688
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, clean dependency update with passing repository checks; its remaining gate is maintainer acceptance of the write-capable automation upgrade.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot workflow-only update is bot-authored; contributor real-behavior proof is not applicable, while maintainer compatibility review of the scheduled action remains needed.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot workflow-only update is bot-authored; contributor real-behavior proof is not applicable, while maintainer compatibility review of the scheduled action remains needed.
Evidence reviewed	4 items	Current workflow still uses v10: Current main has three actions/stale@v10 invocations for unassigned work, assigned issues, and assigned pull requests; the requested upgrade is not already implemented. Patch scope is policy-preserving: The PR changes exactly the three action references from v10 to v11; all action inputs, messages, and workflow permissions are unchanged. Workflow provenance: The current stale workflow was introduced by the shared-pipeline migration commit, and blame attributes all three v10 references to that same change.
Findings	None	None.
Security	None	None.

How this fits together

Discrawl’s scheduled stale workflow evaluates inactive issues and pull requests every day and applies labels or closes them under configured thresholds. This change swaps the third-party action that executes that repository-maintenance policy while preserving the local policy inputs.

flowchart LR
  A[Daily schedule or manual dispatch] --> B[Stale workflow]
  B --> C[Three stale-policy passes]
  C --> D[actions/stale major version]
  D --> E[Labels and closure decisions]
  E --> F[Repository issue and PR triage]

Loading

Decision needed

Question	Recommendation
Should Discrawl accept actions/stale@v11 for the daily workflow that automatically labels and closes issues and pull requests?	Approve the v11 upgrade: Confirm the upstream v11 runtime and input compatibility, then merge the unchanged-policy upgrade.

Why: The patch is mechanically narrow, but accepting a major version of the action determines the behavior of a write-capable scheduled repository policy and cannot be established solely from this repository’s static checks.

Before merge

• Resolve merge risk (P1) - actions/stale@v11 is a major upstream runtime/implementation change in a daily workflow with permission to label and close repository items; green checks and unchanged YAML inputs do not prove that live stale-policy decisions remain identical.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow references	3 changed, 0 added, 0 removed	Every stale-policy pass moves to the new major action version while local policy configuration remains intact.
Patch scope	1 workflow file, 6 changed lines	The review surface is isolated to scheduled repository-maintenance automation.

Merge-risk options

Maintainer options:

1. Verify upstream v11 compatibility before merge (recommended)
   Review the v11 runtime and configured stale-action inputs, then accept the upgrade if the scheduled labeling and closure policy remains intended.
2. Defer the major action upgrade
   Keep the existing v10 workflow until maintainers choose a rollout or validation approach for the write-capable scheduled policy.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Confirm `actions/stale@v11` supports the existing runner and all configured inputs before merging the isolated workflow upgrade.

Technical review

Best possible solution:

Confirm the repository runner supports the upstream v11 runtime and that no v11 release change alters the configured stale-policy inputs, then merge this isolated three-reference upgrade and monitor the next scheduled run.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency update rather than a report of broken Discrawl behavior. The relevant verification is compatibility of the scheduled workflow’s existing action inputs under v11.

Is this the best way to solve the issue?

Unclear until a maintainer accepts the upstream major-version behavior. Updating the existing three action references is the narrowest implementation path because it preserves Discrawl’s local stale-policy configuration.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 8141387a4f95.

Labels

Label justifications:

• P3: This is a narrow dependency-maintenance upgrade with no demonstrated user-facing regression.
• merge-risk: 🚨 automation: The changed dependency executes a scheduled workflow that applies labels and closes repository issues and pull requests.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-only update is bot-authored; contributor real-behavior proof is not applicable, while maintainer compatibility review of the scheduled action remains needed.

Evidence

What I checked:

• Current workflow still uses v10: Current main has three actions/stale@v10 invocations for unassigned work, assigned issues, and assigned pull requests; the requested upgrade is not already implemented. (.github/workflows/stale.yml:18, 8141387a4f95)
• Patch scope is policy-preserving: The PR changes exactly the three action references from v10 to v11; all action inputs, messages, and workflow permissions are unchanged. (.github/workflows/stale.yml:18, 882d5929c1d5)
• Workflow provenance: The current stale workflow was introduced by the shared-pipeline migration commit, and blame attributes all three v10 references to that same change. (.github/workflows/stale.yml:18, 4f3017c8188d)
• Release baseline: The latest release tag v0.11.10 points to the workflow-introduction commit, so the released stale policy also uses v10; this PR is not already shipped. (.github/workflows/stale.yml:18, 4f3017c8188d)

Likely related people:

• steipete: Introduced the complete stale workflow in the shared-pipeline migration; all three action references on current main trace to that commit. (role: workflow introducer and recent area contributor; confidence: high; commits: 4f3017c8188d; files: .github/workflows/stale.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Confirm the upstream v11 runtime and input compatibility before merging.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-08-01T13:00:33.207Z sha 882d592 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T14:52:09.289Z sha 882d592 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T16:18:05.109Z sha 882d592 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T18:44:48.793Z sha 882d592 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T22:36:47.877Z sha 882d592 :: needs maintainer review before merge. :: none

[steipete]

#158 carries this exact actions/stale@v11 update together with the rest of the repository's current dependency refresh.

The major action update has now been live-proved on #158 at commit 8a7d7d9: https://github.com/openclaw/discrawl/actions/runs/30730981192. All three stale-policy steps completed successfully. The live queue had zero issues and only new PRs, so no item was eligible for labeling or closure.

Recommendation: close this PR as superseded by #158, then land #158 after its remaining CI is green.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: build(deps): bump actions/stale from 10 to 11 This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[dependabot]

Looks like actions/stale is up-to-date now, so this is no longer needed.

[steipete]

#158 landed as 48b28c60866c95e4c106ce998e0c227998ed185e with actions/stale v11 and successful live workflow proof. Closing this PR as superseded, per the earlier note.