- Add scheduled approval for trusted stale lead maintainer PRs
- Move approval checks into a `utils/github` Ruby script
- Short-circuit API reads once approval is impossible
- Require stale PRs to be open 48 hours without review
- Permit recent approval evidence from fork PRs
- Refuse to auto-approve sensitive paths
- Use event type for branch push reports
- Document the supply-chain guardrails and maintainer behaviour
- Validate that issues and pull requests keep at least 75% of a
template's headings and checkboxes (ticked or not) instead of
requiring every field, so valid reports are not autoclosed.
- Block bodies that strip the template (e.g. AI-generated ones) and
require pull requests to disclose AI/LLM usage.
- Auto-reopen issues on edit once the template is restored and list
the missing sections and checkboxes in the close comment.
- Validate issues against `homebrew-core` and `homebrew-cask`
templates too so transferred issues are not closed.
- Warn in the issue and pull request templates not to delete the
checkboxes.
- Keep issue and pull request checks isolated so each workflow has a
narrower trigger and permission surface.
- Share template matching in `.github/scripts/check_template.rb` so issue
and pull request behaviour stays consistent.
- Close new API-created issues that do not provide required template
responses.
Michka Popoff