From c31d97b4a6deb345d04d0af7f2f1197809ccec7a Mon Sep 17 00:00:00 2001 From: bmuenzenmeyer Date: Tue, 22 Sep 2026 21:32:35 -0500 Subject: [PATCH 1/2] ci: adds pull-request-age-gate --- .github/workflows/pull-request-age-gate.yml | 51 +++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 .github/workflows/pull-request-age-gate.yml diff --git a/.github/workflows/pull-request-age-gate.yml b/.github/workflows/pull-request-age-gate.yml new file mode 100644 index 0000000..b63b15c --- /dev/null +++ b/.github/workflows/pull-request-age-gate.yml @@ -0,0 +1,51 @@ +# Security Notes +# Only selected Actions are allowed within this repository. Please refer to (https://github.com/nodejs/nodejs.org/settings/actions) +# for the full list of available actions. If you want to add a new one, please reach out a maintainer with Admin permissions. +# REVIEWERS, please always double-check security practices before merging a PR that contains Workflow changes!! +# AUTHORS, please only use actions with explicit SHA references, and avoid using `@master` or `@main` references or `@version` tags. + +name: Pull Request Age Gate + +on: + pull_request: + branches: + - main + types: + - opened + - synchronize + - reopened + - labeled + - unlabeled + schedule: + # Hourly, so that open Pull Requests flip from red to green on their own + # once enough wall-clock time has passed, without needing a new commit + - cron: '0 * * * *' + +permissions: {} + +concurrency: + # Scheduled runs have no Pull Request in context and evaluate every open Pull + # Request, so they are keyed by run id to avoid cancelling one another + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: true + +jobs: + age-gate: + name: Age Gate + runs-on: ubuntu-latest + permissions: + # Required by `bmuenzenmeyer/pr-age-gate` to create/update the check run + checks: write + # Required by `bmuenzenmeyer/pr-age-gate` to read Pull Request metadata + pull-requests: read + steps: + - name: Harden Runner + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + with: + egress-policy: audit + + - name: Check Pull Request Age + uses: bmuenzenmeyer/pr-age-gate@1581d7c3943b70747e697f519ecad52eb0f671d0 # v1.0.0 + with: + min-hours: '48' + bypass-labels: fast-track From 74f349f0272a997d74e51fb82320ec77cde909c5 Mon Sep 17 00:00:00 2001 From: Matt Cowley Date: Wed, 23 Sep 2026 12:02:02 +0100 Subject: [PATCH 2/2] Fix repository settings link Co-authored-by: Michael Esteban Signed-off-by: Matt Cowley --- .github/workflows/pull-request-age-gate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pull-request-age-gate.yml b/.github/workflows/pull-request-age-gate.yml index b63b15c..5fef834 100644 --- a/.github/workflows/pull-request-age-gate.yml +++ b/.github/workflows/pull-request-age-gate.yml @@ -1,5 +1,5 @@ # Security Notes -# Only selected Actions are allowed within this repository. Please refer to (https://github.com/nodejs/nodejs.org/settings/actions) +# Only selected Actions are allowed within this repository. Please refer to (https://github.com/nodejs/learn/settings/actions) # for the full list of available actions. If you want to add a new one, please reach out a maintainer with Admin permissions. # REVIEWERS, please always double-check security practices before merging a PR that contains Workflow changes!! # AUTHORS, please only use actions with explicit SHA references, and avoid using `@master` or `@main` references or `@version` tags.