GitHub Actions Automation skill for Codex

Gives the Codex app a display name, a one-line description and a starter prompt for this skill.

interface:
  display_name: "GitHub Actions Automation"
  short_description: "Repo housekeeping bots with least privilege"
  default_prompt: "$github-actions-automation Auto-label PRs by folder and close issues with no activity for 90 days"

# Repo chore recipes

Copy, then adjust labels, thresholds and messages to the repository. Every recipe has
explicit permissions and a manual trigger where it makes sense.

## Path labels (labeler v5)

`.github/labeler.yml`:

```yaml
area/docs:
  - changed-files:
      - any-glob-to-any-file: ["docs/**", "**/*.md"]
area/api:
  - changed-files:
      - any-glob-to-any-file: ["src/api/**", "openapi/**"]
dependencies:
  - changed-files:
      - any-glob-to-any-file: ["package.json", "pnpm-lock.yaml", "requirements*.txt"]
```

`.github/workflows/labeler.yml`:

```yaml
name: Label PRs
on:
  pull_request_target:
    types: [opened, synchronize, reopened]
permissions: {}
jobs:
  label:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/labeler@v5
        with:
          sync-labels: true        # remove path labels that no longer apply
```

No checkout step: labeler reads the changed-file list through the API.

## Stale issues and PRs

```yaml
name: Stale
on:
  schedule:
    - cron: "27 3 * * *"
  workflow_dispatch:
    inputs:
      debug:
        description: "Dry run (log only)"
        type: boolean
        default: true
permissions: {}
jobs:
  stale:
    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
    steps:
      - uses: actions/stale@v9
        with:
          debug-only: ${{ github.event_name == 'workflow_dispatch' && inputs.debug }}
          days-before-stale: 90
          days-before-close: 14
          stale-issue-label: stale
          stale-pr-label: stale
          exempt-issue-labels: confirmed,security,pinned
          exempt-pr-labels: security,work-in-progress
          exempt-draft-pr: true
          stale-issue-message: >
            This issue has had no activity for 90 days. It will close in 14 days
            unless someone comments or a maintainer adds the `confirmed` label.
          close-issue-message: Closed for inactivity. Comment if it is still relevant and we will reopen.
          stale-pr-message: >
            This PR has had no activity for 90 days. Push a commit or comment to keep it open.
          operations-per-run: 60
```

## First-time contributor greeting

```yaml
name: Greet
on:
  pull_request_target:
    types: [opened]
permissions: {}
jobs:
  greet:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            const pr = context.payload.pull_request;
            const assoc = pr.author_association;
            if (!['FIRST_TIME_CONTRIBUTOR', 'FIRST_TIMER'].includes(assoc)) return;
            await github.rest.issues.createComment({
              ...context.repo,
              issue_number: pr.number,
              body: [
                `Thanks for your first PR, @${pr.user.login}.`,
                'A maintainer will review within a week. CONTRIBUTING.md lists the checks CI runs.',
              ].join('\n\n'),
            });
```

## Issue triage: require a reproduction

```yaml
name: Triage new issues
on:
  issues:
    types: [opened]
permissions: {}
jobs:
  triage:
    runs-on: ubuntu-latest
    permissions:
      issues: write
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            const issue = context.payload.issue;
            const body = issue.body || '';
            const labels = ['needs-triage'];
            if (/^### Steps to reproduce\s*\n+\s*(_No response_)?\s*$/m.test(body) || !/Steps to reproduce/i.test(body)) {
              labels.push('needs-repro');
            }
            await github.rest.issues.addLabels({ ...context.repo, issue_number: issue.number, labels });
```

The issue title and body are untrusted input: they are read inside JavaScript here, never
interpolated into a shell `run:` line.

## Dependabot auto-merge (patch and minor)

```yaml
name: Dependabot auto-merge
on: pull_request
permissions: {}
jobs:
  automerge:
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - id: meta
        uses: dependabot/fetch-metadata@v2
      - if: steps.meta.outputs.update-type != 'version-update:semver-major'
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```

Requires "Allow auto-merge" and branch protection with required status checks, so the
merge waits for CI. Major versions stay manual.

## Release notes draft (release-drafter)

`.github/release-drafter.yml`:

```yaml
name-template: "v$RESOLVED_VERSION"
tag-template: "v$RESOLVED_VERSION"
categories:
  - title: Features
    labels: [feature, enhancement]
  - title: Fixes
    labels: [bug, fix]
  - title: Maintenance
    labels: [chore, dependencies]
version-resolver:
  major: { labels: [breaking] }
  minor: { labels: [feature, enhancement] }
  default: patch
template: |
  $CHANGES
```

```yaml
name: Release drafter
on:
  push:
    branches: [main]
  workflow_dispatch:
permissions: {}
jobs:
  draft:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
    steps:
      - uses: release-drafter/release-drafter@v6
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```

The draft is never published automatically; a maintainer edits and publishes it.

## Release PRs from Conventional Commits (release-please)

```yaml
name: release-please
on:
  push:
    branches: [main]
permissions: {}
jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: googleapis/release-please-action@v4
        with:
          release-type: node     # or python, go, simple; or use a manifest config file
```

Merging the release PR creates the tag and GitHub release. A publish job (npm, PyPI) that
should run on that release must be triggered by the action's `release_created` output in
the same workflow, because a release created by `GITHUB_TOKEN` does not trigger other
workflows.

## Lock old closed threads

```yaml
name: Lock threads
on:
  schedule:
    - cron: "41 4 * * 1"
  workflow_dispatch:
permissions: {}
jobs:
  lock:
    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
    steps:
      - uses: dessant/lock-threads@v5
        with:
          issue-inactive-days: 180
          pr-inactive-days: 180
          issue-comment: >
            Locked because it has been closed for 180 days. Open a new issue and link this one.
```