Remove disabled actions-cool/issues-helper workflows - #67
Merged
djdanielsson merged 1 commit intoJun 8, 2026
Merged
Conversation
These workflows have been failing on every scheduled run since GitHub disabled actions-cool/issues-helper following the May 2026 TeamPCP / Mini Shai-Hulud supply-chain campaign. The pinned ref (@V3 (tag, retargeted)) is itself attacker-controlled. Each file contained only the actions-cool/issues-helper step, so deleting them loses no other logic. If issue-lifecycle automation is desired, actions/github-script with inline JS is a drop-in alternative. Refs redhat-cop#66
Contributor
Author
|
The failing — a race condition during EDA project sync setup. Per |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #66.
What
Removes workflow files that depend on
actions-cool/issues-helper:.github/workflows/issue-close-inactive.yml.github/workflows/issue-find-inactive.yml.github/workflows/issue-labeled.yml.github/workflows/issue-remove-inactive.ymlWhy
GitHub disabled the upstream
actions-cool/issues-helperrepo following the May 2026 TeamPCP / Mini Shai-Hulud supply-chain campaign. Every scheduled run of these workflows currently fails within ~0.4s at the action-download step (##[error]Repository access blocked), so they produce only CI noise. The pinned ref@v3 (tag, retargeted)is itself attacker-controlled, so re-pinning is not an option.Each affected file contained only the
actions-cool/issues-helperstep (no other meaningful logic), so deleting outright is the minimal change.Alternative
If issue-lifecycle automation is still wanted,
actions/github-script@v7with inline JS is a drop-in replacement (~10 lines per action). Happy to follow up with that variant if you'd prefer — just close this PR and we can.Verification
Sample failing run: see the issue linked above.
Submitted by north-echo as part of routine supply-chain hygiene scanning across public OSS orgs.