npm-cli-gh-issue-preparator 1.32.0 → 1.33.0

package/.github/CODEOWNERS

@@ -1,2 +1,6 @@
-* @HiromiShikata
-* @renovate
+# DO NOT EDIT DIRECTLY.
+# This file is auto-synchronized from HiromiShikata/repositories-management.
+# Direct edits in downstream repositories will be overwritten by the next sync.
+# Update the source file in HiromiShikata/repositories-management instead.
+
+* @HiromiShikata @renovate

package/.github/copilot-instructions.md

@@ -0,0 +1,6 @@
+<!--
+DO NOT EDIT DIRECTLY.
+This file is auto-synchronized from HiromiShikata/repositories-management.
+Direct edits in downstream repositories will be overwritten by the next sync.
+Update the source file in HiromiShikata/repositories-management instead.
+-->

package/.github/dependabot.yml

@@ -0,0 +1,17 @@
+# DO NOT EDIT DIRECTLY.
+# This file is auto-synchronized from HiromiShikata/repositories-management.
+# Direct edits in downstream repositories will be overwritten by the next sync.
+# Update the source file in HiromiShikata/repositories-management instead.
+
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: saturday
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: saturday

package/.github/instructions/code-review.instructions.md

@@ -2,6 +2,13 @@
 applyTo: '**'
 ---
 
+<!--
+DO NOT EDIT DIRECTLY.
+This file is auto-synchronized from HiromiShikata/repositories-management.
+Direct edits in downstream repositories will be overwritten by the next sync.
+Update the source file in HiromiShikata/repositories-management instead.
+-->
+
 # Code Review Instructions
 
 ## Scope Integrity

package/.github/workflows/api-created_issue_pr.yml

@@ -1,3 +1,8 @@
+# DO NOT EDIT DIRECTLY.
+# This file is auto-synchronized from HiromiShikata/repositories-management.
+# Direct edits in downstream repositories will be overwritten by the next sync.
+# Update the source file in HiromiShikata/repositories-management instead.
+
 name: Add to Project
 
 on:
@@ -15,9 +20,19 @@ jobs:
   add-to-project:
     runs-on: ubuntu-latest
     steps:
+      - uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - name: Generate hs-bot-gh-ap installation token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.HS_BOT_GH_AP_CLIENT_ID }}
+          private-key: ${{ secrets.HS_BOT_GH_AP_PRIVATE_KEY }}
+          owner: HiromiShikata
       - name: Add to Project
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           ISSUE_OR_PR_URL="${{ github.event.inputs.issue_or_pr_url }}"
           ISSUE_OR_PR_URL="${ISSUE_OR_PR_URL%%\?*}"

package/.github/workflows/close-manual-prs.yml

@@ -0,0 +1,46 @@
+# DO NOT EDIT DIRECTLY.
+# This file is auto-synchronized from HiromiShikata/repositories-management.
+# Direct edits in downstream repositories will be overwritten by the next sync.
+# Update the source file in HiromiShikata/repositories-management instead.
+
+name: Close Manual PRs
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  close-manual-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - name: Generate hs-bot-gh-ap installation token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.HS_BOT_GH_AP_CLIENT_ID }}
+          private-key: ${{ secrets.HS_BOT_GH_AP_PRIVATE_KEY }}
+      - name: Close manually created pull request
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_ACTOR_TYPE: ${{ github.event.pull_request.user.type }}
+          PR_ACTOR_LOGIN: ${{ github.event.pull_request.user.login }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          if [ "$PR_ACTOR_TYPE" = "Bot" ]; then
+            echo "PR created by bot ($PR_ACTOR_LOGIN), skipping."
+            exit 0
+          fi
+          case "$PR_ACTOR_LOGIN" in
+            "hs-bot-gh-app[bot]"|"dependabot[bot]"|"renovate[bot]"|"github-actions[bot]")
+              echo "PR created by allowed bot ($PR_ACTOR_LOGIN), skipping."
+              exit 0
+              ;;
+          esac
+          echo "PR created by human user ($PR_ACTOR_LOGIN), closing."
+          gh pr comment "$PR_NUMBER" --body "Thank you for your contribution. In this repository, pull requests must be created through the automated process by pushing a feature branch. Manually created pull requests are not accepted. Please push your branch and let the CI workflow create the pull request automatically."
+          gh pr close "$PR_NUMBER"

package/.github/workflows/commit-lint.yml

@@ -1,3 +1,8 @@
+# DO NOT EDIT DIRECTLY.
+# This file is auto-synchronized from HiromiShikata/repositories-management.
+# Direct edits in downstream repositories will be overwritten by the next sync.
+# Update the source file in HiromiShikata/repositories-management instead.
+
 name: Lint Commit Messages
 on:
   pull_request:
@@ -19,8 +24,11 @@ jobs:
       pull-requests: write
       contents: read
     steps:
+      - uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -46,7 +54,12 @@ jobs:
           loose-matching: true
       - name: Install commitlint
         run: |
-          npm install --save-dev @commitlint/{config-conventional,cli}
+          mkdir -p /tmp/commitlint-run
+          cd /tmp/commitlint-run
+          npm init -y
+          npm install --no-audit --no-fund --save-dev @commitlint/cli @commitlint/config-conventional
       - name: Lint commits
+        env:
+          NODE_PATH: /tmp/commitlint-run/node_modules
         run: |
-          npx commitlint --from=origin/main --to=HEAD --config ./.github/workflows/configs/commitlint.config.js
+          /tmp/commitlint-run/node_modules/.bin/commitlint --from=origin/main --to=HEAD --config $GITHUB_WORKSPACE/.github/workflows/configs/commitlint.config.js

package/.github/workflows/configs/commitlint.config.js

@@ -1,3 +1,8 @@
+// DO NOT EDIT DIRECTLY.
+// This file is auto-synchronized from HiromiShikata/repositories-management.
+// Direct edits in downstream repositories will be overwritten by the next sync.
+// Update the source file in HiromiShikata/repositories-management instead.
+
 module.exports = {
   extends: ['@commitlint/config-conventional'],
   rules: {

package/.github/workflows/create-pr.yml

@@ -1,3 +1,8 @@
+# DO NOT EDIT DIRECTLY.
+# This file is auto-synchronized from HiromiShikata/repositories-management.
+# Direct edits in downstream repositories will be overwritten by the next sync.
+# Update the source file in HiromiShikata/repositories-management instead.
+
 name: Create PR
 
 on:
@@ -10,8 +15,18 @@ jobs:
     runs-on: ubuntu-latest
     if: github.actor != 'dependabot[bot]' && github.actor != 'renovate[bot]'
     steps:
+      - uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - name: Generate hs-bot-gh-ap installation token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.HS_BOT_GH_AP_CLIENT_ID }}
+          private-key: ${{ secrets.HS_BOT_GH_AP_PRIVATE_KEY }}
+
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set branch name as output
         id: branch_name
@@ -23,14 +38,14 @@ jobs:
           EXISTING_PR=$(gh pr list --head "${{ steps.branch_name.outputs.branch }}" --base main --json number --jq '.[0].number // empty')
           echo "existing_pr=$EXISTING_PR" >> "$GITHUB_OUTPUT"
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
       - name: Create Pull Request
         id: create_pr
         if: steps.check_pr.outputs.existing_pr == ''
-        uses: repo-sync/pull-request@v2
+        uses: repo-sync/pull-request@7e79a9f5dc3ad0ce53138f01df2fad14a04831c5
         with:
-          github_token: ${{ secrets.GH_TOKEN }}
+          github_token: ${{ steps.app-token.outputs.token }}
           destination_branch: 'main'
           source_branch: ''
           pr_title: '${{ steps.branch_name.outputs.branch }}'
@@ -48,40 +63,34 @@ jobs:
           fi
           echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
-
-      - name: Assign PR to author
-        if: steps.resolve_pr.outputs.pr_number
-        run: |
-          curl -s -X POST \
-            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-            -H "Accept: application/vnd.github.v3+json" \
-            -d '{"assignees":["${{ github.actor }}"]}' \
-            "https://api.github.com/repos/${{ github.repository }}/issues/${{ steps.resolve_pr.outputs.pr_number }}/assignees"
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
       - name: Get PR Node ID
         if: steps.resolve_pr.outputs.pr_number
         id: get_pr_id
         run: |
-          PR_DATA=$(curl -s -H "Authorization: token ${{ secrets.GH_TOKEN }}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/${{ github.repository }}/pulls/${{ steps.resolve_pr.outputs.pr_number }}")
+          PR_DATA=$(curl -s -H "Authorization: token ${{ steps.app-token.outputs.token }}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/${{ github.repository }}/pulls/${{ steps.resolve_pr.outputs.pr_number }}")
           PR_ID=$(echo "$PR_DATA" | jq -r '.node_id')
           echo "node_id=$PR_ID" >> "$GITHUB_OUTPUT"
 
       - name: Enable Auto Merge for PR
         if: steps.resolve_pr.outputs.pr_number
+        continue-on-error: true
         run: |
           RESPONSE=$(curl -s -X POST \
-            -H "Authorization: bearer ${{ secrets.GH_TOKEN }}" \
+            -H "Authorization: bearer ${{ steps.app-token.outputs.token }}" \
             -H "Content-Type: application/json" \
-            -d '{
-              "query": "mutation($id: ID!) { enablePullRequestAutoMerge(input: { pullRequestId: $id }) { clientMutationId } }",
-              "variables": {
-                "id": "'"${{ steps.get_pr_id.outputs.node_id }}"'"
+            -d "{
+              \"query\": \"mutation(\$id: ID!) { enablePullRequestAutoMerge(input: { pullRequestId: \$id, mergeMethod: SQUASH }) { clientMutationId } }\",
+              \"variables\": {
+                \"id\": \"${{ steps.get_pr_id.outputs.node_id }}\"
               }
-            }' \
+            }" \
             "https://api.github.com/graphql")
           echo "$RESPONSE"
           if echo "$RESPONSE" | jq -e '.errors' >/dev/null; then
             echo "Failed to enable auto merge"
             exit 1
           fi
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}

package/.github/workflows/secret-scan.yml

@@ -0,0 +1,51 @@
+# DO NOT EDIT DIRECTLY.
+# This file is auto-synchronized from HiromiShikata/repositories-management.
+# Direct edits in downstream repositories will be overwritten by the next sync.
+# Update the source file in HiromiShikata/repositories-management instead.
+
+name: Secret Scan
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+
+concurrency:
+  group: secret-scan-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  secret-scan:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Download and verify gitleaks binary
+        run: |
+          GITLEAKS_VERSION="8.30.1"
+          GITLEAKS_ARCHIVE="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${GITLEAKS_ARCHIVE}" -o "${GITLEAKS_ARCHIVE}"
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  ${GITLEAKS_ARCHIVE}" | sha256sum --check
+          tar -xzf "${GITLEAKS_ARCHIVE}" gitleaks
+          chmod +x gitleaks
+          ./gitleaks version
+
+      - name: Run gitleaks on PR commits
+        run: |
+          ./gitleaks detect \
+            --log-opts="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" \
+            --config=.gitleaks.toml \
+            --verbose \
+            --redact

package/.github/workflows/umino-project.yml

@@ -1,4 +1,13 @@
+# DO NOT EDIT DIRECTLY.
+# This file is auto-synchronized from HiromiShikata/repositories-management.
+# Direct edits in downstream repositories will be overwritten by the next sync.
+# Update the source file in HiromiShikata/repositories-management instead.
+
 name: UMINO Project
+
+permissions:
+  contents: read
+
 on:
   issues:
     types:
@@ -32,7 +41,6 @@ on:
 env:
   unread: Unread
   in_progress: In Progress
-  gh_project_token: ${{ secrets.GH_TOKEN }}
   user: HiromiShikata
   project_id: 48
   project_v2_id: PVT_kwHOAGJHa84AFWnr
@@ -41,21 +49,72 @@ env:
 
 jobs:
   umino-job:
-    if: (github.event_name != 'issue_comment' || github.event.comment.user.login != 'umino-bot') && github.event.action != 'labeled'
+    if: >-
+      github.actor != 'dependabot[bot]' &&
+      ((github.event_name != 'issue_comment') ||
+       (github.event.comment.user.login == 'HiromiShikata' &&
+        (contains(github.event.comment.body, '/createissue') ||
+         contains(github.event.comment.body, '/close') ||
+         contains(github.event.comment.body, '/done') ||
+         contains(github.event.comment.body, '/movenextactiondateto') ||
+         contains(github.event.comment.body, '/changeassignee ')))) &&
+      github.event.action != 'labeled'
     runs-on: ubuntu-latest
     steps:
-      - name: Move issue to ${{ env.unread }}
-        uses: leonsteinhaeuser/project-beta-automations@v2.2.1
+      - uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - name: Generate hs-bot-gh-ap installation token
+        id: app-token
+        uses: actions/create-github-app-token@v3
         with:
-          gh_token: ${{ env.gh_project_token }}
-          user: ${{ env.user }}
-          project_id: ${{ env.project_id }}
-          resource_node_id: ${{ github.event.pull_request.node_id || github.event.issue.node_id }}
-          status_value: ${{ env.unread }}
+          client-id: ${{ secrets.HS_BOT_GH_AP_CLIENT_ID }}
+          private-key: ${{ secrets.HS_BOT_GH_AP_PRIVATE_KEY }}
+          owner: HiromiShikata
+      - name: Move issue to ${{ env.unread }}
+        run: |
+          RESOURCE_NODE_ID="${{ github.event.pull_request.node_id || github.event.issue.node_id }}"
+          PROJECT_V2_ID="${{ env.project_v2_id }}"
+
+          echo "RESOURCE_NODE_ID=$RESOURCE_NODE_ID"
+          echo "PROJECT_V2_ID=$PROJECT_V2_ID"
+
+          ADD_RESPONSE=$(gh api graphql \
+            -f query='mutation($projectId:ID!,$contentId:ID!){addProjectV2ItemById(input:{projectId:$projectId,contentId:$contentId}){item{id}}}' \
+            -f projectId="$PROJECT_V2_ID" \
+            -f contentId="$RESOURCE_NODE_ID" 2>&1 || true)
+
+          echo "addProjectV2ItemById response: $ADD_RESPONSE"
+
+          ITEM_ID=$(echo "$ADD_RESPONSE" | jq -r '.data.addProjectV2ItemById.item.id // empty' 2>/dev/null || echo "")
+
+          if [ -z "$ITEM_ID" ]; then
+            FALLBACK_RESPONSE=$(gh api graphql \
+              -f query='query($nodeId:ID!){node(id:$nodeId){...on PullRequest{projectItems(first:10){nodes{id project{id}}}}...on Issue{projectItems(first:10){nodes{id project{id}}}}}}' \
+              -f nodeId="$RESOURCE_NODE_ID" 2>&1 || true)
+            echo "projectItems fallback response: $FALLBACK_RESPONSE"
+            ITEM_ID=$(echo "$FALLBACK_RESPONSE" | jq -r ".data.node.projectItems.nodes[]? | select(.project.id == \"$PROJECT_V2_ID\") | .id" 2>/dev/null || echo "")
+          fi
+
+          if [ -z "$ITEM_ID" ]; then
+            echo "Failed to resolve project item ID for $RESOURCE_NODE_ID in project $PROJECT_V2_ID"
+            exit 1
+          fi
+
+          echo "Resolved ITEM_ID=$ITEM_ID"
+
+          gh api graphql \
+            -f query='mutation($projectId:ID!,$itemId:ID!,$fieldId:ID!,$optionId:String!){updateProjectV2ItemFieldValue(input:{projectId:$projectId,itemId:$itemId,fieldId:$fieldId,value:{singleSelectOptionId:$optionId}}){projectV2Item{id}}}' \
+            -f projectId="$PROJECT_V2_ID" \
+            -f itemId="$ITEM_ID" \
+            -f fieldId="PVTSSF_lAHOAGJHa84AFWnrzgDFcxE" \
+            -f optionId="f75ad846"
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
         if: >-
-          (github.event_name == 'issues' && github.event.issue.state == 'open') || 
-          (github.event_name == 'pull_request' && github.event.pull_request.state == 'open') &&
-          (github.event.action == 'opened' || github.event.action == 'reopened' || 
+          ((github.event_name == 'issues' && github.event.issue.state == 'open') ||
+          (github.event_name == 'pull_request' && github.event.pull_request.state == 'open')) &&
+          (github.event.action == 'opened' || github.event.action == 'reopened' ||
           github.event.action == 'assigned' || github.event.action == 'unassigned')
       - run: |
           OWNER=$(echo ${{ github.repository }} | cut -d '/' -f 1)
@@ -64,7 +123,7 @@ jobs:
           NUMBER=$(echo ${{ github.event_name }} | grep -q "pull_request" && echo ${{ github.event.pull_request.number }} || echo ${{ github.event.issue.number }})
 
           QUERY_DATA='{ "query": "query { repository(owner: \"'$OWNER'\", name: \"'$REPO'\") { '${ENTITY_TYPE}'(number: '$NUMBER') { projectItems(first: 10) { nodes { id } } } } }" }'
-          RESPONSE=$(curl -X POST -H "Authorization: bearer ${{ secrets.GH_TOKEN }}" -H "Content-Type: application/json" --data "$QUERY_DATA" https://api.github.com/graphql)
+          RESPONSE=$(curl -X POST -H "Authorization: Bearer $GH_PROJECT_TOKEN" -H "Content-Type: application/json" --data "$QUERY_DATA" https://api.github.com/graphql)
 
           if echo $RESPONSE | grep -q "errors"; then
             echo "Error in GraphQL query"
@@ -86,7 +145,7 @@ jobs:
           CLEAR_FIELD_DATA="{\"query\":\"mutation { clearProjectV2ItemFieldValue(input: {projectId: \\\"${{ env.project_v2_id }}\\\", fieldId: \\\"${{ env.field_id }}\\\", itemId: \\\"$ITEM_ID\\\"}) { clientMutationId }}\"}"
           CLEAR_RESPONSE=$(curl --request POST \
             --url https://api.github.com/graphql \
-            --header "Authorization: Bearer ${{ env.gh_project_token }}" \
+            --header "Authorization: Bearer $GH_PROJECT_TOKEN" \
             --header "Content-Type: application/json" \
             --data "$CLEAR_FIELD_DATA")
 
@@ -95,6 +154,8 @@ jobs:
             echo "Clear Field Response: $CLEAR_RESPONSE"
             exit 1
           fi
+        env:
+          GH_PROJECT_TOKEN: ${{ secrets.GH_TOKEN }}
         if: >-
           ((github.event_name == 'issues' && github.event.issue.state == 'open') ||
           (github.event_name == 'pull_request' && github.event.pull_request.state == 'open')) &&
@@ -102,10 +163,10 @@ jobs:
           github.event.action == 'assigned' || github.event.action == 'unassigned')
 
       - name: Create Issue
-        if: ${{ github.event_name == 'issue_comment' && github.event.action == 'created' && contains(github.event.comment.body, '/createissue') }}
+        if: ${{ github.event_name == 'issue_comment' && github.event.action == 'created' && github.event.comment.user.login == 'HiromiShikata' && contains(github.event.comment.body, '/createissue') }}
         uses: actions/github-script@v9
         with:
-          github-token: ${{secrets.GH_TOKEN}}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const commentBody = context.payload.comment.body;
             const commandMatch = /(^|\n)\s*\/createissue\b/m.exec(commentBody);
@@ -127,10 +188,10 @@ jobs:
               assignees: ['HiromiShikata']
             });
       - name: Close Issue
-        if: ${{ github.event_name == 'issue_comment' && github.event.action == 'created' && (contains(github.event.comment.body, '/close') || contains(github.event.comment.body, '/done')) }}
+        if: ${{ github.event_name == 'issue_comment' && github.event.action == 'created' && github.event.comment.user.login == 'HiromiShikata' && (contains(github.event.comment.body, '/close') || contains(github.event.comment.body, '/done')) }}
         uses: actions/github-script@v9
         with:
-          github-token: ${{secrets.GH_TOKEN}}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const body = context.payload.comment.body;
             if (!/(^|\n)\s*\/(close|done)\b/m.test(body)) return;
@@ -141,13 +202,13 @@ jobs:
               state: 'closed'
             });
       - name: Update Date Field
-        if: ${{ github.event_name == 'issue_comment' && github.event.action == 'created' && contains(github.event.comment.body, '/movenextactiondateto') }}
+        if: ${{ github.event_name == 'issue_comment' && github.event.action == 'created' && github.event.comment.user.login == 'HiromiShikata' && contains(github.event.comment.body, '/movenextactiondateto') }}
         uses: actions/github-script@v9
         env:
           PROJECT_V2_ID: ${{ env.project_v2_id }}
           FIELD_ID: ${{ env.field_id }}
         with:
-          github-token: ${{ secrets.GH_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const commentBody = context.payload.comment.body;
             const commandMatch = /(^|\n)\s*\/movenextactiondateto\b/m.exec(commentBody);
@@ -179,10 +240,10 @@ jobs:
               { projectId, fieldId, itemId, date: dateString }
             );
       - name: Change Assignee
-        if: ${{ github.event_name == 'issue_comment' && github.event.action == 'created' && contains(github.event.comment.body, '/changeassignee ') }}
+        if: ${{ github.event_name == 'issue_comment' && github.event.action == 'created' && github.event.comment.user.login == 'HiromiShikata' && contains(github.event.comment.body, '/changeassignee ') }}
         uses: actions/github-script@v9
         with:
-          github-token: ${{secrets.GH_TOKEN}}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const commentBody = context.payload.comment.body;
             const commandMatch = /(^|\n)\s*\/changeassignee\s+(\S+)/m.exec(commentBody);
@@ -194,28 +255,47 @@ jobs:
               issue_number: context.issue.number,
               assignees: [assigneeName]
             });
-      - name: Auto assign issue for non-team repositories
+      - name: Auto assign issue to owner
         if: >-
-          github.event_name == 'issues' && 
-          github.event.action == 'opened' && 
-          !contains(env.team_repo, github.event.repository.name)
-        uses: pozil/auto-assign-issue@v3.0.0
+          github.event_name == 'issues' &&
+          github.event.action == 'opened'
+        uses: pozil/auto-assign-issue@af6beea6bdf1e8eb373f061c5bc168681fc6d011
         with:
           assignees: HiromiShikata
-          repo-token: ${{ secrets.GH_TOKEN }}
+          repo-token: ${{ steps.app-token.outputs.token }}
+      - name: Auto assign PR to owner
+        if: >-
+          github.event_name == 'pull_request' &&
+          github.event.action == 'opened'
+        uses: pozil/auto-assign-issue@af6beea6bdf1e8eb373f061c5bc168681fc6d011
+        with:
+          assignees: HiromiShikata
+          repo-token: ${{ steps.app-token.outputs.token }}
 
   check_pull_requests_to_link_issues:
     runs-on: ubuntu-latest
     name: Check linked issues in pull requests
     if: >-
-      (github.event_name == 'pull_request')
+      (github.event_name == 'pull_request') &&
+      github.actor != 'dependabot[bot]'
     steps:
-      - uses: nearform-actions/github-action-check-linked-issues@v1
+      - uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - name: Generate hs-bot-gh-ap installation token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.HS_BOT_GH_AP_CLIENT_ID }}
+          private-key: ${{ secrets.HS_BOT_GH_AP_PRIVATE_KEY }}
+          owner: HiromiShikata
+      - uses: nearform-actions/github-action-check-linked-issues@7140e2e01aa0c18b8ac61bddf5e89abde1ca760e
         id: check-linked-issues
         if: github.event.pull_request.user.login != 'dependabot[bot]'
         with:
           exclude-branches: 'release/**, dependabot/**, project-common/**, renovate/**'
-          github-token: ${{ secrets.GH_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
           loose-matching: true
+          skip-linked-issues-check-label: ''
       - name: Get the output
         run: echo "How many linked issues? ${{ steps.check-linked-issues.outputs.linked_issues_count }}"

package/.gitleaks.toml

@@ -0,0 +1,9 @@
+# DO NOT EDIT DIRECTLY.
+# This file is auto-synchronized from HiromiShikata/repositories-management.
+# Direct edits in downstream repositories will be overwritten by the next sync.
+# Update the source file in HiromiShikata/repositories-management instead.
+
+title = "gitleaks config"
+
+[extend]
+useDefault = true

package/.prettierignore

@@ -1,3 +1,4 @@
+*.toml
 *.xml
 .gitignore
 .prettierignore

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+# [1.33.0](https://github.com/HiromiShikata/npm-cli-gh-issue-preparator/compare/v1.32.1...v1.33.0) (2026-06-26)
+
+
+### Features
+
+* **core:** add stale tmux session cleanup to daemon cycle ([#331](https://github.com/HiromiShikata/npm-cli-gh-issue-preparator/issues/331)) ([abc015b](https://github.com/HiromiShikata/npm-cli-gh-issue-preparator/commit/abc015bf790e93f31aeed0ec287d3ed75f6154b8))
+
+## [1.32.1](https://github.com/HiromiShikata/npm-cli-gh-issue-preparator/compare/v1.32.0...v1.32.1) (2026-05-09)
+
+
+### Bug Fixes
+
+* **core:** add required author field to Issue test fixtures for v1.42.1 compatibility ([c5adc02](https://github.com/HiromiShikata/npm-cli-gh-issue-preparator/commit/c5adc02c5326e111ffc6b85ec6a3cb4bc1eb360a))
+* **core:** remove dead author type-guard code now that Issue.author is required in v1.42.1 ([d5dd0f0](https://github.com/HiromiShikata/npm-cli-gh-issue-preparator/commit/d5dd0f0706db840d0b9908f95e298b6f25ee7ce3))
+
 # [1.32.0](https://github.com/HiromiShikata/npm-cli-gh-issue-preparator/compare/v1.31.1...v1.32.0) (2026-05-06)
 
 

package/bin/adapter/entry-points/cli/index.js

@@ -44,6 +44,7 @@ const fs = __importStar(require("fs"));
 const yaml = __importStar(require("js-yaml"));
 const commander_1 = require("commander");
 const StartPreparationUseCase_1 = require("../../../domain/usecases/StartPreparationUseCase");
+const StaleTmuxSessionKillUseCase_1 = require("../../../domain/usecases/StaleTmuxSessionKillUseCase");
 const NotifyFinishedIssuePreparationUseCase_1 = require("../../../domain/usecases/NotifyFinishedIssuePreparationUseCase");
 const TowerDefenceIssueRepository_1 = require("../../repositories/TowerDefenceIssueRepository");
 const GraphqlIssueRepository_1 = require("../../repositories/GraphqlIssueRepository");
@@ -313,6 +314,15 @@ program
         utilizationPercentageThreshold,
         allowedIssueAuthors,
     });
+    const staleTmuxSessionKillUseCase = new StaleTmuxSessionKillUseCase_1.StaleTmuxSessionKillUseCase(projectRepository, {
+        getAllOpened: towerDefenceIssueRepository.getAllOpened.bind(towerDefenceIssueRepository),
+    }, localCommandRunner);
+    await staleTmuxSessionKillUseCase.run({
+        projectUrl,
+        excludedStatus: StaleTmuxSessionKillUseCase_1.DEFAULT_EXCLUDED_STATUS,
+        idleThresholdSeconds: StaleTmuxSessionKillUseCase_1.DEFAULT_IDLE_THRESHOLD_SECONDS,
+        now: new Date(),
+    });
 });
 program
     .command('notifyFinishedIssuePreparation')