update workflow config

.github/workflows/build.yml

@@ -2,29 +2,29 @@
 # SPDX-FileContributor: Sebastian Thomschke, Vegard IT GmbH
 # SPDX-License-Identifier: Apache-2.0
 #
-# https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
 name: Build
 
 on:
   push:
-    branches:    # build all branches
-    - '**'
-    tags-ignore: # but don't build tags
+    branches-ignore:  # build all branches except:
+    - 'dependabot/**'  # prevent GHA triggered twice (once for commit to the branch and once for opening/syncing the PR)
+    tags-ignore:  # don't build tags
     - '**'
     paths-ignore:
     - '**/*.adoc'
     - '**/*.md'
+    - '**/*.rst'
     - '.editorconfig'
     - '.git*'
-    - '**/*.rst'
     - '.github/*.yml'
   pull_request:
     paths-ignore:
     - '**/*.adoc'
     - '**/*.md'
+    - '**/*.rst'
     - '.editorconfig'
     - '.git*'
-    - '**/*.rst'
     - '.github/*.yml'
   workflow_dispatch:
     # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
@@ -44,23 +44,26 @@ env:
 jobs:
 
   ###########################################################
-  build:
+  build-spks:
   ###########################################################
+    runs-on: ubuntu-latest
+
     strategy:
+      max-parallel: 4
       fail-fast: false
       matrix:
         # see https://kb.synology.com/en-uk/DSM/tutorial/What_kind_of_CPU_does_my_NAS_have
         PACKAGE_ARCH:
-        - apollolake # e.g. DS918+
+        - apollolake  # e.g. DS918+
         - armada37xx
         - armada38x
         - avoton
-        - braswell # e.g. DS716+II
+        - braswell  # e.g. DS716+II
         - broadwell
         - broadwellnk
         - bromolow
         - cedarview
-        - denverton # e.g. RS2418+
+        - denverton  # e.g. RS2418+
         - geminilake
         - grantley
         - kvmx64
@@ -71,11 +74,9 @@ jobs:
         - rtd1619b
         - v1000
 
-    runs-on: ubuntu-latest
-
     steps:
     - name: Git checkout
-      uses: actions/checkout@v3 #https://github.com/actions/checkout
+      uses: actions/checkout@v4  # https://github.com/actions/checkout
 
     - name: Set effective DSM version
       run: |
@@ -91,13 +92,13 @@ jobs:
 
         docker build -t synobuild .
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4  # https://github.com/actions/cache
       if: github.ref_name == 'master'
       with:
         path: toolkit_tarballs/ds.*
         key: synology_toolkit_tarballs_DSM${{ env.DSM_VERSION }}_${{ matrix.PACKAGE_ARCH }}
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4  # https://github.com/actions/cache
       with:
         path: toolkit_tarballs/base_env-*
         key: synology_toolkit_tarballs_DSM${{ env.DSM_VERSION }}_base_env
@@ -142,7 +143,7 @@ jobs:
 
     - name: Upload SPKs
       if: github.ref == 'refs/heads/master'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: artifacts-${{ matrix.PACKAGE_ARCH }}
         path: artifacts/**
@@ -153,17 +154,17 @@ jobs:
   ###########################################################
     runs-on: ubuntu-latest
     needs: 
-      - build
+      - build-spks
     if: github.ref == 'refs/heads/master'
     concurrency: publish-latest-release # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idconcurrency
 
     steps:
     - name: Git checkout 
       # only required by "hub release create" to prevent "fatal: Not a git repository"
-      uses: actions/checkout@v3 #https://github.com/actions/checkout
+      uses: actions/checkout@v4  # https://github.com/actions/checkout
 
     - name: Download build artifacts
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
 
     - name: Set effective DSM version
       run: |
@@ -209,20 +210,24 @@ jobs:
 
         release_name=WireGuard-${WG_VERSION}-DSM${DSM_VERSION}
 
-        spks=($(ls artifacts-*/WireGuard-*/*.spk))
+        # https://cli.github.com/manual/gh_release_create
+        echo "
+        ${release_name}
 
-        # https://hub.github.com/hub-release.1.html
-        hub release create "${release_name}" \
-          --message "${release_name}" \
-          --message "**Use at your own risk. We are not responsible if this breaks your NAS. Realistically it should not result in data loss, but it could render your NAS inaccessible if something goes wrong.**" \
-          --message "" \
-          --message "**Especially if you are not comfortable with removing the hard drives from your NAS and manually recovering the data, this is not for you.**" \
-          --message "" \
-          --message "See https://kb.synology.com/en-uk/DSM/tutorial/What_kind_of_CPU_does_my_NAS_have to find the right architecture of your NAS" \
-          ${spks[@]/#/--attach }
+        **Use at your own risk. We are not responsible if this breaks your NAS. Realistically it should not result in data loss, but it could render your NAS inaccessible if something goes wrong.**
+
+        **Especially if you are not comfortable with removing the hard drives from your NAS and manually recovering the data, this is not for you.**
+        
+        See https://kb.synology.com/en-uk/DSM/tutorial/What_kind_of_CPU_does_my_NAS_have to find the right architecture of your NAS
+        " | GH_DEBUG=1 gh release create "$release_name" \
+          --title "$release_name" \
+          --latest \
+          --notes-file - \
+          --target "${{ github.sha }}" \
+          $(ls artifacts-*/WireGuard-*/*.spk)
 
     - name: "Delete intermediate build artifacts"
-      uses: geekyeggo/delete-artifact@v2 # https://github.com/GeekyEggo/delete-artifact/
+      uses: geekyeggo/delete-artifact@v5 # https://github.com/GeekyEggo/delete-artifact/
       with:
         name: "*"
         failOnError: false

.github/workflows/stale.yml

@@ -0,0 +1,61 @@
+# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com) and contributors
+# SPDX-FileContributor: Sebastian Thomschke, Vegard IT GmbH
+# SPDX-License-Identifier: Apache-2.0
+#
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
+name: Stale issues
+
+on:
+  schedule:
+    - cron: '0 16 * * 3'
+  workflow_dispatch:
+    # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
+
+permissions:
+  contents: write # only for delete-branch option
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Git checkout
+      uses: actions/checkout@v4  # https://github.com/actions/checkout
+
+    - name: Run stale action
+      uses: actions/stale@v9  # https://github.com/actions/stale
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        days-before-stale: 90
+        days-before-close: 14
+        stale-issue-message: >
+          This issue has been automatically marked as stale because it has not had
+          recent activity. It will be closed in 14 days if no further activity occurs.
+          If the issue is still valid, please add a respective comment to prevent this 
+          issue from being closed automatically. Thank you for your contributions.
+        stale-issue-label: stale
+        close-issue-label: wontfix
+        exempt-issue-labels: |
+          enhancement
+          pinned
+          security
+
+    - name: Run stale action
+      uses: actions/stale@v9  # https://github.com/actions/stale
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        days-before-stale: 360
+        days-before-close: 14
+        stale-issue-message: >
+          This issue has been automatically marked as stale because it has not had
+          recent activity. It will be closed in 14 days if no further activity occurs.
+          If the issue is still valid, please add a respective comment to prevent this 
+          issue from being closed automatically. Thank you for your contributions.
+        stale-issue-label: stale
+        close-issue-label: wontfix
+        only-labels: enhancement
+        exempt-issue-labels: |
+          pinned
+          security