Add stalebot configs for Islandora org

.github/workflows/stale.yaml

@@ -0,0 +1,29 @@
+name: 'Manage stale issues and PRs'
+on:
+  workflow_dispatch:
+  workflow_call:
+  schedule:
+    - cron: '40 21 * * *'
+
+jobs:
+  stale:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 #v9
+        with:
+          days-before-issue-stale: 90
+          days-before-issue-close: 14
+          stale-issue-message: 'This issue is being marked as stale from inactivity and will be automatically closed in 2 weeks unless further action is taken. If this issue is still relevant please comment. Please also consider attending [the weekly Tech Call](https://github.com/Islandora/islandora-community/wiki/Weekly-Open-Tech-Call) to discuss the issue'
+          days-before-pr-stale: 90 
+          days-before-pr-close: 14
+          stale-pr-message: 'This PR is being marked as stale from inactivity and will be automatically closed in 90 days unless further action is taken. If this PR is still relevant please comment. Please also consider attending [the weekly Tech Call](https://github.com/Islandora/islandora-community/wiki/Weekly-Open-Tech-Call) to discuss the PR'
+          exempt-issue-labels: 'feature request'
+          operations-per-run: 100
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 #v9
+        with:
+          days-before-stale: 365
+          days-before-close: 14
+          stale-issue-message: 'This feature request issue is being marked as stale from inactivity and will be automatically closed in 2 weeks unless further action is taken. If this issue is still relevant please comment. Please also consider attending [the weekly Tech Call](https://github.com/Islandora/islandora-community/wiki/Weekly-Open-Tech-Call) to discuss the issue'
+          stale-pr-message: 'This feature request PR is being marked as stale from inactivity and will be automatically closed in 90 days unless further action is taken. If this PR is still relevant please comment. Please also consider attending [the weekly Tech Call](https://github.com/Islandora/islandora-community/wiki/Weekly-Open-Tech-Call) to discuss the PR'
+          only-labels: 'feature request'
+

.github/workflows/validate-renovate.yaml

@@ -0,0 +1,23 @@
+name: validate renovate.json5
+
+on:
+  pull_request:
+    paths:
+      - "renovate.json5"
+env:
+  LOG_LEVEL: debug
+
+jobs:
+  renovate-config-validator:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+
+      - run: npx -p renovate renovate-config-validator renovate.json5
+

renovate.json5

@@ -0,0 +1,40 @@
+{
+  extends: [
+    'config:best-practices',
+    ':rebaseStalePrs',
+  ],
+  packageRules: [
+    {
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+        'digest',
+      ],
+      groupName: 'all non-major dependencies',
+      schedule: [
+        '* 22 * * 3',
+      ],
+      matchPackageNames: [
+        '*',
+      ],
+    },
+    {
+      matchUpdateTypes: [
+        'major',
+      ],
+      groupName: null,
+      matchPackageNames: [
+        '*',
+      ],
+      prConcurrentLimit: 1,
+    },
+  ],
+  labels: [
+    'dependencies',
+  ],
+  osvVulnerabilityAlerts: true,
+  dependencyDashboardOSVVulnerabilitySummary: 'unresolved',
+  vulnerabilityAlerts: {
+    enabled: true,
+  },
+}

scripts/stale.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ORG="Islandora"
+WORKDIR=$(pwd | xargs dirname)
+NEW_FILE_NAME=".github/workflows/stale.yaml"
+
+REPOS=$(gh repo list "$ORG" --limit 1000 --json name -q '.[].name')
+
+for REPO in $REPOS; do
+  if [ "$REPO" = ".github" ]; then
+    echo "skipping .github repo"
+    continue
+  fi
+
+  if [ -f "$WORKDIR/$REPO/$NEW_FILE_NAME" ]; then
+    echo "$REPO/$NEW_FILE_NAME exists, skipping"
+    continue
+  fi
+
+  if [ ! -d "$WORKDIR/$REPO" ]; then
+    gh repo clone "$ORG/$REPO" "$WORKDIR/$REPO"
+  fi
+
+  MINUTE=$(( RANDOM % 60 ))
+  HOUR=$(( RANDOM % 23 ))
+  STALE_YML="name: 'Manage stale issues and PRs'
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '$MINUTE $HOUR * * *'
+jobs:
+  stale:
+    uses: $ORG/.github/.github/workflows/stale.yaml@main
+    secrets: inherit"
+
+  pushd "$WORKDIR/$REPO"
+
+  DEFAULT_BRANCH=$(gh repo view "$ORG/$REPO" --json defaultBranchRef -q '.defaultBranchRef.name')
+
+  git checkout "$DEFAULT_BRANCH"
+  git pull origin "$DEFAULT_BRANCH"
+
+  mkdir -p "$(echo "$NEW_FILE_NAME" | xargs dirname)"
+  echo "$STALE_YML" > "$NEW_FILE_NAME"
+  git add "$NEW_FILE_NAME"
+  git commit -m "Adding stale.yaml GHA"
+
+
+  CURRENT_STATUS=$(gh api "repos/$ORG/$REPO/branches/$DEFAULT_BRANCH/protection" --jq '.enforce_admins.enabled' || echo "false")
+  if [ "$CURRENT_STATUS" = "true" ]; then
+    echo "Disabling admin bypass on $ORG/$REPO:$DEFAULT_BRANCH temporarily"
+    gh api \
+      --method DELETE \
+      -H "Accept: application/vnd.github+json" \
+      "repos/$ORG/$REPO/branches/$DEFAULT_BRANCH/protection/enforce_admins"
+  fi
+  git push origin "$DEFAULT_BRANCH"
+  if [ "$CURRENT_STATUS" = "true" ]; then
+    echo "Re-Enabling admin bypass"
+    gh api \
+      --method POST \
+      -H "Accept: application/vnd.github+json" \
+      "repos/$ORG/$REPO/branches/$DEFAULT_BRANCH/protection/enforce_admins"
+  fi
+
+  popd > /dev/null
+
+  sleep 5
+done
+