@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/_notify.yml.ejs

@@ -0,0 +1,96 @@
+name: _notify (reusable)
+
+# Reusable failure-alert workflow. Both deploy callers (04-deploy-test,
+# 10-deploy-prod) invoke this from an `if: failure()` job with the
+# failure-summary interface below. Keep these inputs in lockstep with every
+# caller's `with:` block — the workflow-structure L1 sweep statically resolves
+# each caller's `with:` against this contract (#1548, #1549).
+on:
+  workflow_call:
+    inputs:
+      workflow_name:
+        description: Human-readable name of the failing workflow.
+        required: true
+        type: string
+      area:
+        description: Subsystem/area for triage (e.g. deploy, ci).
+        required: false
+        type: string
+        default: ci
+      severity:
+        description: Severity tag for the alert (e.g. P0, P1).
+        required: false
+        type: string
+        default: P2
+      branch:
+        description: Branch the failure occurred on.
+        required: false
+        type: string
+        default: ''
+      run_url:
+        description: URL of the failing workflow run.
+        required: false
+        type: string
+        default: ''
+      failure_summary:
+        description: One-line summary of what failed.
+        required: false
+        type: string
+        default: ''
+      status:
+        description: Run status reported by the caller (e.g. failure).
+        required: false
+        type: string
+        default: failure
+
+permissions:
+  issues: write
+
+jobs:
+  notify:
+    name: Open or update failure issue
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - name: Open or update failure issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          WORKFLOW_NAME: ${{ inputs.workflow_name }}
+          AREA: ${{ inputs.area }}
+          SEVERITY: ${{ inputs.severity }}
+          BRANCH: ${{ inputs.branch }}
+          RUN_URL: ${{ inputs.run_url }}
+          FAILURE_SUMMARY: ${{ inputs.failure_summary }}
+          STATUS: ${{ inputs.status }}
+        run: |
+          MARKER="<!-- arbiter-notify:${WORKFLOW_NAME} -->"
+          TITLE="[${SEVERITY}] ${WORKFLOW_NAME} failed"
+          BODY="${MARKER}
+          **Workflow:** ${WORKFLOW_NAME}
+          **Area:** ${AREA}
+          **Severity:** ${SEVERITY}
+          **Branch:** ${BRANCH}
+          **Status:** ${STATUS}
+          **Run:** ${RUN_URL}
+
+          ${FAILURE_SUMMARY}"
+          # GitHub's search API does not index HTML-comment content (and has
+          # indexing lag), so `--search "${MARKER} in:body"` never matched and
+          # every failure opened a fresh issue. Filter locally instead.
+          ISSUE_NUMBER=$(gh issue list \
+            --repo "${GH_REPO}" \
+            --state open \
+            --limit 100 \
+            --json number,body |
+            jq -r --arg marker "$MARKER" \
+              '[.[] | select((.body // "") | contains($marker))][0].number // empty')
+          if [ -n "$ISSUE_NUMBER" ]; then
+            gh issue comment "$ISSUE_NUMBER" \
+              --repo "${GH_REPO}" \
+              --body "${BODY}" > /dev/null
+          else
+            gh issue create \
+              --repo "${GH_REPO}" \
+              --title "${TITLE}" \
+              --body "${BODY}" > /dev/null
+          fi

package/dist/templates/github/workflows/_partials/macos-keychain-bypass.ejs

@@ -0,0 +1,6 @@
+      - name: macOS — DOCKER_CONFIG override (bypass Keychain)
+        if: runner.os == 'macOS'
+        run: |
+          DOCKER_CONF_DIR="$(mktemp -d)"
+          echo '{"credsStore":""}' > "${DOCKER_CONF_DIR}/config.json"
+          echo "DOCKER_CONFIG=${DOCKER_CONF_DIR}" >> "$GITHUB_ENV"

package/dist/templates/github/workflows/_partials/macos-keychain-restore.ejs

@@ -0,0 +1,6 @@
+      - name: macOS — restore DOCKER_CONFIG
+        if: runner.os == 'macOS' && always()
+        run: |
+          if [ -n "${DOCKER_CONFIG:-}" ] && [ -d "${DOCKER_CONFIG}" ]; then
+            rm -rf "${DOCKER_CONFIG}"
+          fi

package/dist/templates/github/workflows/_partials/scheduled-heavy-jobs.ejs

@@ -0,0 +1,117 @@
+<%# #1693 (ADR-101): the fuzz + soak-e2e heavy scheduled jobs, extracted into a
+    shared partial so they render identically whether included from _nightly.yml
+    (runnerProfile 'fleet', the default) or _weekly.yml (runnerProfile 'solo').
+    References bare `language`/`buildTool` — inherited from the parent's locals
+    via EJS include scope (renderTemplate passes { filename }, with(locals) is on). -%>
+  fuzz:
+    name: Fuzz testing
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: fast-check fuzz (property-based)
+        run: npm run --if-present test:fuzz
+<%# #1803: kotlin shares the java branch below — jqwik runs on JVM bytecode
+    so it works identically for a Kotlin-sourced Gradle/Maven build (confirmed
+    during the #1724 cross-language-matrix audit); no separate invocation
+    needed. -%>
+<% } else if (language === 'java' || language === 'kotlin') { %>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+      - name: jqwik property-based tests
+        run: |
+<% if (buildTool === 'gradle') { %>
+          ./gradlew test -Djqwik.database=false
+<% } else { %>
+          mvn test -Djqwik.database=false
+<% } %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Go native fuzz (30 min budget)
+        run: |
+          FUZZ_FUNCS=$(grep -r 'func Fuzz' --include='*.go' -l . || true)
+          if [ -n "$FUZZ_FUNCS" ]; then
+            for f in $(grep -r 'func Fuzz' --include='*.go' -l .); do
+              PKG=$(dirname "$f")
+              FUNC=$(grep 'func Fuzz' "$f" | head -1 | sed 's/func //' | sed 's/(.*//')
+              go test -fuzz="$FUNC" -fuzztime=5m "./$PKG" || true
+            done
+          fi
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install atheris
+      - name: atheris fuzz (30 min budget)
+        run: |
+          FUZZ_SCRIPTS=$(find . -name 'fuzz_*.py' | head -5)
+          if [ -n "$FUZZ_SCRIPTS" ]; then
+            for s in $FUZZ_SCRIPTS; do
+              timeout 360 python "$s" -atheris_runs=100000 || true
+            done
+          fi
+<% } else if (language === 'rust') { %>
+      - name: Install Rust nightly + cargo-fuzz
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - name: cargo-fuzz (30 min budget)
+        run: |
+          cargo install cargo-fuzz --locked || true
+          TARGETS=$(cargo fuzz list 2>/dev/null || true)
+          if [ -n "$TARGETS" ]; then
+            for target in $TARGETS; do
+              cargo fuzz run "$target" -- -max_total_time=360 || true
+            done
+          fi
+<% } %>
+
+  soak-e2e:
+    name: Soak / E2E full suite
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: Bake E2E
+        run: npm run --if-present test:e2e:bake
+      - name: Native E2E
+        env:
+          VITEST_NATIVE: "1"
+        run: npm run --if-present test:e2e:native
+<% } else if (language === 'java') { %>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+      - name: Newman / REST Assured soak (60 min budget)
+        run: |
+<% if (buildTool === 'gradle') { %>
+          ./gradlew test -Dgroups='soak,e2e' || true
+<% } else { %>
+          mvn test -Dgroups='soak,e2e' || true
+<% } %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Go soak tests (60 min budget)
+        run: go test -tags e2e,soak -timeout 60m ./... || true
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install -e ".[dev]"
+      - name: pytest soak (60 min budget)
+        run: pytest -m 'e2e or soak' --timeout=3600 || true
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - name: cargo soak tests (60 min budget)
+        run: cargo test --test soak -- --nocapture || true
+<% } %>

package/dist/templates/github/workflows/_partials/sigstore-preflight.ejs

@@ -0,0 +1,8 @@
+      - name: Sigstore preflight check (H3-S1)
+        run: |
+          STATUS=$(curl -sf https://status.sigstore.dev/api/v2/status.json \
+            --max-time 10 | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('status',{}).get('indicator','unknown'))" 2>/dev/null || echo "unknown")
+          if [[ "$STATUS" != "none" ]]; then
+            echo "::warning::Sigstore status is '${STATUS}' — cosign sign may fail"
+          fi
+          echo "sigstore-status=$STATUS"

package/dist/templates/github/workflows/_partials/trivy-fs-java.ejs

@@ -0,0 +1,27 @@
+<%# Trivy fs replaces OWASP Dependency-Check for JVM dependency scanning (ADR-104):
+    the OWASP DC CLI downloads the full NVD database on every run (an NVD API key is
+    required to avoid multi-minute/flaky downloads — an experience independently hit
+    running the equivalent OWASP DC step in another downstream project) and
+    dependency-check/Dependency-Check_Action was additionally a Docker-outside-of-Docker
+    action — same defect class as bridgecrewio/checkov-action (fixed) and
+    google/osv-scanner-action (fixed, #1767): on a self-hosted runner whose own process runs
+    inside a container, the action's workspace bind-mount resolves against the DOCKER HOST
+    path, not the runner's own checkout — and literal `ubuntu-latest` is no guarantee of real
+    GitHub-hosted infra in this fleet (#1767). `trivy-action` is a composite action (no
+    workspace bind-mount, no docker-container defect class) that queries the GitHub Advisory
+    Database / OSV instead of NVD — no API key, no slow/flaky download — and reuses the same
+    trivy-db-cached scanner arbiter already ships for container scanning (02-pr-extended,
+    04-deploy-test, 05-release trivy-strict-release). failOnCVSS 7 (INV-13) maps to
+    `--severity HIGH,CRITICAL --exit-code 1`, with `.trivyignore` as the suppression file
+    (INV-31). Shared partial: included from both _shared-security.yml.ejs (dep-cve-refresh)
+    and 06-nightly-lite.yml.ejs (dep-cve-refresh) so the two java branches cannot drift
+    apart. -%>
+      - name: Trivy fs — dependency CVE scan (HIGH/CRITICAL, INV-13)
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          exit-code: '1'
+          severity: HIGH,CRITICAL
+          trivyignores: .trivyignore

package/dist/templates/github/workflows/_post-merge-notify.yml.ejs

@@ -0,0 +1,228 @@
+name: Post-merge CODEOWNERS notification
+
+# Sends a plain-text email to CODEOWNERS after each merged PR.
+# Body: PR URL, author, coverage %, changed files. No PR body (untrusted text).
+#
+# Trust boundary (#1661): this runs on the `pull_request` (closed) event, NOT
+# pull_request_target. GitHub withholds repository secrets — and downgrades
+# GITHUB_TOKEN to read-only — from ANY pull_request run whose head branch is a
+# FORK, merged or not. So a merged FORK PR has empty MAIL_SERVER and exits at the
+# guard below: CODEOWNERS are emailed only for SAME-REPO branch merges (where
+# secrets are present). Fork-merge notification would need a workflow_run-chained
+# or pull_request_target design; it is intentionally not covered here.
+# The Python step never logs str(exception) on SMTP failure to avoid credential
+# leakage in job logs.
+#
+# Setup required:
+#   secrets:   MAIL_SERVER, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD
+#   variables: MAIL_DOMAIN_ALLOWLIST (comma-separated domains, or `*` to allow all)
+#
+# Limitation: CODEOWNERS `**` patterns are not supported by the simplified
+# matcher below. Standard glob (`*`, `*.ext`, `path/`, `/anchored`) works.
+
+on:
+  pull_request:
+    types: [closed]
+
+concurrency:
+  group: '${{ github.repository }}-post-merge-notify'
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  notify-codeowners:
+    name: Notify CODEOWNERS on merge
+    if: github.event.pull_request.merged == true && github.run_attempt == 1
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Download coverage artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        continue-on-error: true
+        with:
+          name: coverage-report
+          path: coverage/
+
+      - name: Get changed files
+        id: changed
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          TMPFILE=$(mktemp)
+          git diff -z --name-only "$BASE_SHA" "$HEAD_SHA" \
+            | python3 -c "
+          import sys
+          raw = sys.stdin.buffer.read().split(b'\x00')
+          files = [f.decode('utf-8', errors='replace') for f in raw
+                   if f and b'\r' not in f and b'\n' not in f]
+          capped = files[:100]
+          trailer = ['... and {} more file(s)'.format(len(files)-100)] if len(files) > 100 else []
+          print('\n'.join(capped + trailer))
+          " > "$TMPFILE"
+          echo "files_path=$TMPFILE" >> $GITHUB_OUTPUT
+
+      - name: Find CODEOWNERS
+        id: codeowners
+        run: |
+          for path in .github/CODEOWNERS CODEOWNERS docs/CODEOWNERS; do
+            if [ -f "$path" ]; then
+              echo "path=$path" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+          done
+          echo "path=" >> $GITHUB_OUTPUT
+
+      - name: Parse CODEOWNERS and send email
+        env:
+          MAIL_SERVER: ${{ secrets.MAIL_SERVER }}
+          MAIL_PORT: ${{ secrets.MAIL_PORT }}
+          MAIL_USERNAME: ${{ secrets.MAIL_USERNAME }}
+          MAIL_PASSWORD: ${{ secrets.MAIL_PASSWORD }}
+          MAIL_DOMAIN_ALLOWLIST: ${{ vars.MAIL_DOMAIN_ALLOWLIST }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          CODEOWNERS_PATH: ${{ steps.codeowners.outputs.path }}
+          FILES_PATH: ${{ steps.changed.outputs.files_path }}
+        run: |
+          python3 << 'PYEOF'
+          import fnmatch, json, os, re, ssl, sys, smtplib
+          from email.message import EmailMessage
+
+          mail_server = os.environ.get('MAIL_SERVER', '')
+          if not mail_server:
+              print('MAIL_SERVER not configured — skipping notification')
+              sys.exit(0)
+
+          files_path = os.environ.get('FILES_PATH', '')
+          changed_files = []
+          if files_path and os.path.isfile(files_path):
+              changed_files = [l for l in open(files_path).read().splitlines() if l]
+          if not changed_files:
+              print('No changed files detected — skipping')
+              sys.exit(0)
+
+          def codeowners_match(filepath, pattern):
+              if pattern.startswith('/'):
+                  pattern = pattern[1:]
+              if pattern.endswith('/'):
+                  return filepath.startswith(pattern) or filepath == pattern.rstrip('/')
+              return (fnmatch.fnmatch(filepath, pattern) or
+                      fnmatch.fnmatch(os.path.basename(filepath), pattern) or
+                      filepath.startswith(pattern.rstrip('/') + '/'))
+
+          codeowners_path = os.environ.get('CODEOWNERS_PATH', '')
+          file_to_owners = {}
+          email_re = re.compile(r'[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}')
+
+          if codeowners_path and os.path.isfile(codeowners_path):
+              with open(codeowners_path) as f:
+                  for line in f:
+                      line = line.strip()
+                      if not line or line.startswith('#'):
+                          continue
+                      parts = line.split()
+                      if len(parts) < 2:
+                          continue
+                      pattern, owners = parts[0], parts[1:]
+                      emails = [m for o in owners
+                                for m in email_re.findall(o)
+                                if '\r' not in m and '\n' not in m]
+                      if not emails:
+                          continue
+                      for cf in changed_files:
+                          if codeowners_match(cf, pattern):
+                              file_to_owners[cf] = emails
+
+          recipients = set()
+          for emails in file_to_owners.values():
+              recipients.update(emails)
+
+          if not recipients:
+              print('No email addresses found in CODEOWNERS for changed files — skipping')
+              sys.exit(0)
+
+          allowlist_raw = os.environ.get('MAIL_DOMAIN_ALLOWLIST', '').strip()
+          if not allowlist_raw:
+              print('MAIL_DOMAIN_ALLOWLIST not configured — notifications disabled. '
+                    'Set to domain list or * to enable.')
+              sys.exit(0)
+          if allowlist_raw != '*':
+              allowed = {d.strip().lower() for d in allowlist_raw.split(',') if d.strip()}
+              before = len(recipients)
+              recipients = {r for r in recipients if r.split('@')[-1].lower() in allowed}
+              if len(recipients) < before:
+                  print(f'Domain allowlist filtered {before - len(recipients)} recipient(s)')
+
+          recipients_list = list(recipients)[:10]
+          if len(recipients) > 10:
+              print(f'Recipient cap (10) reached — {len(recipients) - 10} address(es) skipped')
+
+          if not recipients_list:
+              print('No recipients after filtering — skipping')
+              sys.exit(0)
+
+          coverage_pct = 'N/A'
+          try:
+              with open('coverage/coverage-summary.json') as f:
+                  data = json.load(f)
+              coverage_pct = f"{data['total']['lines']['pct']:.1f}%"
+          except Exception:
+              pass
+
+          pr_number = os.environ.get('PR_NUMBER', '')
+          pr_title  = os.environ.get('PR_TITLE',  '').replace('\r', '').replace('\n', '')
+          pr_url    = os.environ.get('PR_URL',    '')
+          pr_author = os.environ.get('PR_AUTHOR', '').replace('\r', '').replace('\n', '')
+          mail_user = os.environ.get('MAIL_USERNAME', '')
+
+          file_lines = [f'  {f}' for f in changed_files if not f.startswith('...')]
+          body = '\n'.join([
+              f'PR #{pr_number} merged: {pr_title}',
+              f'Author:   {pr_author}',
+              f'URL:      {pr_url}',
+              f'Coverage: {coverage_pct}',
+              '',
+              'Changed files:',
+              *file_lines,
+          ])
+          if len(body) > 50_000:
+              body = body[:50_000] + '\n[truncated]'
+
+          msg = EmailMessage()
+          msg['Subject'] = f'[PR merged] #{pr_number} {pr_title}'
+          msg['From']    = mail_user or 'noreply@github.com'
+          msg['To']      = mail_user or 'noreply@github.com'
+          msg['Bcc']     = ', '.join(recipients_list)
+          msg.set_content(body)
+
+          mail_port = int(os.environ.get('MAIL_PORT', '587') or '587')
+          mail_pass = os.environ.get('MAIL_PASSWORD', '')
+          ctx = ssl.create_default_context()
+          try:
+              if mail_port == 465:
+                  with smtplib.SMTP_SSL(mail_server, mail_port, context=ctx, timeout=30) as s:
+                      if mail_user and mail_pass:
+                          s.login(mail_user, mail_pass)
+                      s.send_message(msg)
+              else:
+                  with smtplib.SMTP(mail_server, mail_port, timeout=30) as s:
+                      s.starttls(context=ctx)
+                      s.ehlo()
+                      if mail_user and mail_pass:
+                          s.login(mail_user, mail_pass)
+                      s.send_message(msg)
+              print(f'Notification sent to {len(recipients_list)} recipient(s)')
+          except Exception:
+              print('SMTP send failed (redacted)')
+              sys.exit(0)
+          PYEOF

package/dist/templates/github/workflows/_pr-staleness.yml.ejs

@@ -0,0 +1,85 @@
+name: Stale PR sweep (bot)
+
+# Mark PRs stale after 14 days of inactivity, close after 28 days.
+# PRs with the 'no-stale' label are exempt from staleness checks.
+# Generated by arbiter (#884).
+
+on:
+  schedule:
+    - cron: '0 8 * * *'   # daily at 08:00 UTC
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    name: Mark and close stale PRs
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Process stale pull requests
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          STALE_DAYS=14
+          CLOSE_DAYS=28
+          # Exported so the child python3 sees them via os.environ (a plain shell
+          # var is NOT inherited by the subprocess environment).
+          export NOW=$(date +%s)
+          export STALE_CUTOFF=$((NOW - STALE_DAYS * 86400))
+          export CLOSE_CUTOFF=$((NOW - CLOSE_DAYS * 86400))
+
+          # Write the PR list to a file: a `gh ... | python3 - <<EOF` pipe collides
+          # with the heredoc on stdin (the heredoc wins, the JSON is discarded and
+          # json.load crashes). Reading from a file keeps stdin free for the program.
+          gh pr list --repo "$GH_REPO" --state open --json number,updatedAt,labels --limit 200 > prs.json
+
+          python3 <<'PYEOF'
+          import json, subprocess, os, time
+
+          with open('prs.json') as f:
+              data = json.load(f)
+          repo = os.environ['GH_REPO']
+          now = int(os.environ['NOW'])
+          stale_cutoff = int(os.environ['STALE_CUTOFF'])
+          close_cutoff = int(os.environ['CLOSE_CUTOFF'])
+
+          for pr in data:
+              labels = [l['name'] for l in pr['labels']]
+              if 'no-stale' in labels:
+                  continue
+
+              updated = int(time.mktime(time.strptime(pr['updatedAt'], '%Y-%m-%dT%H:%M:%SZ')))
+              pr_num = pr['number']
+
+              if updated < close_cutoff:
+                  if 'stale' in labels:
+                      subprocess.run(
+                          ['gh', 'pr', 'edit', str(pr_num), '--remove-label', 'stale', '--repo', repo],
+                          check=False,
+                      )
+                  subprocess.run(
+                      ['gh', 'pr', 'close', str(pr_num), '--repo', repo,
+                       '--comment', 'Closing as stale after 28 days of inactivity. Add no-stale label to exempt.'],
+                      check=False,
+                  )
+                  print(f'Closed stale PR #{pr_num}')
+              elif updated < stale_cutoff:
+                  if 'stale' not in labels:
+                      subprocess.run(
+                          ['gh', 'label', 'create', 'stale',
+                           '--description', 'No activity in 14+ days',
+                           '--color', 'ededed',
+                           '--repo', repo,
+                           '--force'],
+                          check=False,
+                      )
+                      subprocess.run(
+                          ['gh', 'pr', 'edit', str(pr_num), '--add-label', 'stale', '--repo', repo],
+                          check=False,
+                      )
+                      print(f'Marked PR #{pr_num} as stale')
+          PYEOF