From c965a483e8b37f73bc7136801e2d8da199597285 Mon Sep 17 00:00:00 2001
From: Mason Daugherty <mason@langchain.dev>
Date: Tue, 31 Mar 2026 15:39:29 -0400
Subject: [PATCH] ci: minimize stale enforcement comments on pr reopen (#7365)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the `require_issue_link` workflow closes a PR and posts an
enforcement comment, that comment was never cleaned up after the
situation resolved — leaving a stale "automatically closed" message
visible on reopened PRs. Now all three resolution paths (maintainer
bypass, author fixing the issue link, and contributor assignment)
minimize the enforcement comment as outdated via GraphQL. The cleanup is
best-effort: failures log a warning but never block the primary workflow
logic (label removal, bypass, reopen).
---
 .github/workflows/reopen_on_assignment.yml | 23 +++++++++++
 .github/workflows/require_issue_link.yml   | 48 ++++++++++++++++++++++
 2 files changed, 71 insertions(+)

diff --git a/.github/workflows/reopen_on_assignment.yml b/.github/workflows/reopen_on_assignment.yml
index fd0cd2f0e..171971ad1 100644
--- a/.github/workflows/reopen_on_assignment.yml
+++ b/.github/workflows/reopen_on_assignment.yml
@@ -135,4 +135,27 @@ jobs:
               } catch (e) {
                 if (e.status !== 404) throw e;
               }
+
+              // Minimize stale enforcement comment (best-effort;
+              // sync w/ require_issue_link.yml minimize blocks)
+              try {
+                const marker = '<!-- require-issue-link -->';
+                const comments = await github.paginate(
+                  github.rest.issues.listComments,
+                  { owner, repo, issue_number: prNumber, per_page: 100 },
+                );
+                const stale = comments.find(c => c.body && c.body.includes(marker));
+                if (stale) {
+                  await github.graphql(`
+                    mutation($id: ID!) {
+                      minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) {
+                        minimizedComment { isMinimized }
+                      }
+                    }
+                  `, { id: stale.node_id });
+                  console.log(`Minimized stale enforcement comment ${stale.id} as outdated`);
+                }
+              } catch (e) {
+                core.warning(`Could not minimize stale comment on PR #${prNumber}: ${e.message}`);
+              }
             }
diff --git a/.github/workflows/require_issue_link.yml b/.github/workflows/require_issue_link.yml
index 814c1b48f..42120384e 100644
--- a/.github/workflows/require_issue_link.yml
+++ b/.github/workflows/require_issue_link.yml
@@ -13,6 +13,8 @@ name: Require Issue Link
 
 on:
   pull_request_target:
+    # NEVER CHECK OUT UNTRUSTED CODE FROM A PR's HEAD IN A pull_request_target JOB.
+    # Doing so would allow attackers to execute arbitrary code in the context of your repository.
     types: [edited, reopened, labeled, unlabeled]
 
 # ──────────────────────────────────────────────────────────────────────────────
@@ -142,6 +144,29 @@ jobs:
               // Add bypass-issue-check so future triggers skip enforcement
               await ensureAndAddLabel('bypass-issue-check', '0e8a16');
 
+              // Minimize stale enforcement comment (best-effort; must not
+              // abort bypass — sync w/ reopen_on_assignment.yml & step below)
+              try {
+                const marker = '<!-- require-issue-link -->';
+                const comments = await github.paginate(
+                  github.rest.issues.listComments,
+                  { owner, repo, issue_number: prNumber, per_page: 100 },
+                );
+                const stale = comments.find(c => c.body && c.body.includes(marker));
+                if (stale) {
+                  await github.graphql(`
+                    mutation($id: ID!) {
+                      minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) {
+                        minimizedComment { isMinimized }
+                      }
+                    }
+                  `, { id: stale.node_id });
+                  console.log(`Minimized stale enforcement comment ${stale.id} as outdated`);
+                }
+              } catch (e) {
+                core.warning(`Could not minimize stale comment on PR #${prNumber}: ${e.message}`);
+              }
+
               core.setOutput('has-link', 'true');
               core.setOutput('is-assigned', 'true');
             }
@@ -314,6 +339,29 @@ jobs:
               console.log(`Reopened PR #${prNumber}`);
             }
 
+            // Minimize stale enforcement comment (best-effort;
+            // sync w/ applyMaintainerBypass above & reopen_on_assignment.yml)
+            try {
+              const marker = '<!-- require-issue-link -->';
+              const comments = await github.paginate(
+                github.rest.issues.listComments,
+                { owner, repo, issue_number: prNumber, per_page: 100 },
+              );
+              const stale = comments.find(c => c.body && c.body.includes(marker));
+              if (stale) {
+                await github.graphql(`
+                  mutation($id: ID!) {
+                    minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) {
+                      minimizedComment { isMinimized }
+                    }
+                  }
+                `, { id: stale.node_id });
+                console.log(`Minimized stale enforcement comment ${stale.id} as outdated`);
+              }
+            } catch (e) {
+              core.warning(`Could not minimize stale comment on PR #${prNumber}: ${e.message}`);
+            }
+
       - name: Post comment, close PR, and fail
         if: >-
           env.ENFORCE_ISSUE_LINK == 'true' &&