From e86a3439769fe4aa97567c84bda406a8646ee242 Mon Sep 17 00:00:00 2001
From: fro-bot <80104189+fro-bot@users.noreply.github.com>
Date: Thu, 10 Sep 2026 04:04:45 +0000
Subject: [PATCH] fix(ci): unbreak the Manage Issues lock job

The Lock job has failed on every scheduled run since at least 2026-08-31
with `"github-token" length must be less than or equal to 100 characters
long`. dessant/lock-threads v6.0.0 validates the input with
`Joi.string().trim().max(100)`; the runner-issued GITHUB_TOKEN outgrew
that bound, so the action rejected a perfectly valid credential before
doing any work. v6.0.2 raises the limit to 1000 (upstream issue #55) and
changes nothing else functional.

Renovate sees the update on the dependency dashboard but will never open
a PR for it: `.github/renovate.json5` disables patch updates for
everything except python and typescript. Upstream bug-fix patches to
pinned actions are therefore a standing blind spot, which is how a broken
job stayed broken for ten days.

Pin moved to the commit that tag v6.0.2 dereferences to.
---
 .github/workflows/manage-issues.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/manage-issues.yaml b/.github/workflows/manage-issues.yaml
index 9e81fa94b..60da528ba 100644
--- a/.github/workflows/manage-issues.yaml
+++ b/.github/workflows/manage-issues.yaml
@@ -102,7 +102,12 @@ jobs:
     steps:
       - id: lock-threads
         name: Lock stale issues and pull requests
-        uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
+        # v6.0.0 validates `github-token` with `Joi.string().max(100)`, and the
+        # runner-issued GITHUB_TOKEN is now longer than that, so every scheduled
+        # run failed with `"github-token" length must be less than or equal to
+        # 100 characters long`. v6.0.2 raises the bound to 1000 (upstream #55).
+        # Renovate cannot ship this: repo policy disables patch updates.
+        uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
           exclude-any-issue-labels: awaiting-approval,work-in-progress
           exclude-any-pr-labels: awaiting-approval,work-in-progress