Skip to content

chore: add stale PR cleanup workflow via centralized pr-manager #310

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Manask322 wants to merge 4 commits into
base: master
Choose a base branch
from
Open

chore: add stale PR cleanup workflow via centralized pr-manager #310

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a13c3c5
chore: add stale PR cleanup workflow via centralized pr-manager
Manask322 Jul 14, 2026
6733e64
chore: add stale PR cleanup workflow via centralized pr-manager
Manask322 Jul 14, 2026
398a25c
chore: fix stale PR manager workflow — correct cron, @master, secrets…
Manask322 Jul 15, 2026
19f5fe0
chore: fix stale PR manager workflow — correct cron, @master, secrets…
Manask322 Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/workflows/stale.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# PR Manager — stale PR cleanup via centralized reusable workflow in razorpay/actions.
# See: https://github.com/razorpay/actions/blob/master/.github/workflows/pr-manager.yaml
name: PR Manager

on:
schedule:
- cron: '30 20 * * *' # 2:00 AM IST (8:30 PM UTC)
workflow_dispatch: {}

jobs:
stale:
uses: razorpay/actions/.github/workflows/pr-manager.yaml@master
secrets: inherit

@semgrep-code-razorpay semgrep-code-razorpay Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

The workflow passes all secrets to an external reusable workflow using secrets: inherit, giving the external workflow access to every repository secret. If the external workflow is compromised, an attacker gains access to all your secrets.

More details about this

This workflow passes all secrets to the reusable workflow razorpay/actions/.github/workflows/pr-manager.yaml@master using secrets: inherit.

Here's how this creates a security risk:

  1. Attacker compromises the external workflow: An attacker with access to the razorpay/actions repository could modify the reusable workflow to exfiltrate secrets (e.g., by adding a step that logs ${{ secrets.GITHUB_TOKEN }} or other secrets to workflow logs).

  2. All repository secrets become accessible: Because you're using secrets: inherit, every secret stored in your repository settings (API keys, deployment tokens, authentication credentials, etc.) gets passed into that external workflow's execution context.

  3. Attacker uses stolen secrets: The compromised workflow could grab those secrets and send them to an attacker-controlled server, giving them access to your infrastructure, databases, or third-party services.

Even if the razorpay/actions workflow isn't malicious today, it could be compromised in the future, or a maintainer could go rogue. You're giving away the keys to your entire secret vault based on trust in an external party.

The issue here is that the stale job doesn't need every secret—it probably only needs specific ones (if any) to complete its PR cleanup task. By using secrets: inherit, you're violating the principle of least privilege.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
secrets: inherit
secrets:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
View step-by-step instructions
  1. Replace secrets: inherit with an explicit secrets: mapping under the stale job.
  2. Pass only the secret that this reusable workflow needs. For this workflow, map the GitHub token explicitly as GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}.
  3. Update the job so it looks like secrets: { GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} } or the YAML equivalent:
    secrets:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  4. Keep any other secrets out of this workflow unless the reusable workflow documentation shows they are required. This limits the called workflow to only the minimum access it needs.
💬 Ignore this finding

Leave a nosemgrep comment directly above or at the end of line 13 like so // nosemgrep: yaml.github-actions.security.secrets-inherit.secrets-inherit

Take care to validate that this is not a true positive finding before ignoring it.
Learn more about ignoring code, files and folders here.

You can view more details about this finding in the Semgrep AppSec Platform.