From e328eac341f95a21d67a458848bc4602a01643c5 Mon Sep 17 00:00:00 2001
From: Anas Khan <83116240+anxkhn@users.noreply.github.com>
Date: Sat, 4 Jul 2026 16:30:00 +0530
Subject: [PATCH] fix(ci): correct stale-issue-label and exempt security issues

The stale workflow set `stale-issue-label: 'stale,security'`, but
`stale-issue-label` takes a single label and is applied verbatim, so stale
issues were tagged with one bogus label literally named `stale,security`
instead of `stale`. That breaks the workflow's own stale-issue-message and
anything keyed on the `stale` label.

It also left `security` out of `exempt-issue-labels`, so security-labeled
issues were still marked stale and auto-closed, unlike security-labeled PRs
which are already exempted via `exempt-pr-labels: 'not-stale,security'`.

Set `stale-issue-label: 'stale'` and add `security` to `exempt-issue-labels`
so the issue side mirrors the PR side.
---
 .github/workflows/stale.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index eee3a01b11..273fe951a2 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -35,8 +35,8 @@ jobs:
       - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           # stale issues
-          stale-issue-label: 'stale,security'
-          exempt-issue-labels: 'not-stale'
+          stale-issue-label: 'stale'
+          exempt-issue-labels: 'not-stale,security'
           days-before-issue-stale: 180
           days-before-issue-close: 14
           stale-issue-message: >