ci(1979): call the board-aware stale sweep instead of copying actions/stale

[LukasWodka]

Part of the backend#1979 wave. backend#1680 closes on this landing.

What changes

.github/workflows/stale-backlog.yml — a byte-identical copy of an actions/stale
config carried in 16 repos — becomes a thin caller of the reusable that .github#288
landed, following the -caller.yml convention already used by fr-gate-caller.yml,
code-quality-caller.yml and fr-pass-comment-caller.yml.

jobs:
stale:
uses: tracebloc/.github/.github/workflows/stale-backlog.yml@mainsecrets: inherit

Why it is not just deduplication

The copy called actions/stale, which is column-blind: it can see labels and
dates, not the board. So it would close a North Stars epic, or anything already in
the pipeline, on the same 6-week/8-week timer as a forgotten Backlog item — the
defect behind backend#1597 item 1.

Board awareness needs a script, and a script cannot be maintained as sixteen
byte-identical copies. The reusable's eligibility is exactly Backlog, and it
fails toward skipping, because the destructive direction here is closing.

No inputs passed, on purpose

Every input the callee declares is defaulted (project-number: 2, dry-run: false,
strict: false, script-ref: main). A caller may only pass inputs the @main
callee declares — passing one it lacks kills the run at startup_failure, which is
exactly why the callee had to reach main before any caller could be armed.

permissions: contents: read only: the sweep's writes go through the App token
minted inside the reusable, and asking for more here than the callee needs fails the
run at startup with no jobs.

DRAFT — and what un-drafts it

This cannot merge yet, and draft is the mechanical guarantee of that. Callers pin
@main, and .github/main still carries the old 1174-byte copy — the reusable is on
.github/develop, 4 commits ahead. Merging this first would leave a scheduled
workflow that fails at startup every Monday.

Order, per the note carried in repo-inventory.yml:

1. .github promotes develop → staging → main, carrying the reusable
2. these 16 callers merge
3. one final .github PR adds .github's own caller and flips all 17 inventory
   entries from exempt to required

Step 3 is last for a stated reason: flipping to required before a repo's caller
lands would redden the org audit for every repo still waiting — the drift window made
to look permanent. And .github's caller ships with the flip rather than before it,
because exempt plus a caller on the audited branch is itself a finding
(caller-drift.py:2260).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes a scheduled workflow that can auto-close issues. Behavior is more conservative (Backlog-only) but still destructive if the reusable or token is misconfigured.

Overview
Replaces the local Monday actions/stale copy with a thin caller of tracebloc/.github’s stale-backlog.yml@main.

The sweep is now board-aware: only Backlog cards are eligible, so North Stars and in-pipeline items are no longer auto-closed on inactivity. No workflow inputs are passed (callee defaults); permissions are contents: read because writes use the App token inside the reusable.

^{Reviewed by Cursor Bugbot for commit 4a18e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saqlainsyed007]

The diff itself is correct — the thin stale-backlog-caller.yml (reusable @main, secrets: inherit, contents: read) and the deletion of the local actions/stale copy match the rest of the backend#1979 wave, and I'd approve it on that basis.

Not approving yet because a required check is red: quality / pipefail early-close fails. Note it's not caused by this diff — the shared code-quality reusable (now at @main) newly enforces the early-close rule and flags pre-existing shell in this repo that this PR doesn't touch:

• scripts/sync-schema.sh:57-58
• scripts/sync-backend-fixtures.sh:51-52
• scripts/file-budget.sh:37
• scripts/coverage-floor.sh:51,57

Each is a … | grep -q … (or similar) piped into an early-closing reader under set -e -o pipefail: the reader exits before draining the pipe, the producer takes SIGPIPE, and errexit trips. The rule suggests a here-string or capture-then-slice instead.

Since it's a required check it blocks the merge regardless of origin. Cleanest path is a sibling shell-fix PR (or fold the fixes in here) so this repo's leg of the wave goes green — the workflow swap and the shell cleanup are independent, so a separate PR keeps this one a pure dedup. Happy to approve the moment CI is green.

[LukasWodka]

@saqlainsyed007 you were right that quality / pipefail early-close was not caused by this diff — thanks for flagging it rather than just re-running.

No sibling fix PR needed: the fix is already on develop. This branch was behind it, and the check evaluates the PR head sha, so it was being run against pre-fix shell. develop already carries the early-close remediation that replaced the … | head -1 | awk … constructs with here-strings and capture-then-test.

I've merged develop in rather than editing any shell — the check is now SUCCESS and the diff is still exactly two files (add the caller, delete the old copy). Nothing in this PR touches shell.

Sorry for the wasted look. Re-requesting review — the only change since yours is the develop merge.

[saqlainsyed007]

Re-reviewed at head. The required check I was holding on — quality / pipefail early-close — is now green (the pre-existing shell it flagged got fixed on the base branch, so the re-run against the updated base passes). Every check is pass/skip now, no open Bugbot threads.

The PR's own diff is unchanged and correct: the thin stale-backlog-caller.yml (reusable @main, secrets: inherit, contents: read) plus deletion of the local actions/stale copy — identical to the rest of the backend#1979 wave. Approving.

[LukasWodka]

/fr-pass