The stale workflow was failing due to insufficient permissions for the reusable workflow at cpp-linter/.github/.github/workflows/stale.yml@main.

Error from Actions run:

Invalid workflow file: .github/workflows/stale.yml#L9
The workflow is not valid. .github/workflows/stale.yml (Line: 9, Col: 3): Error calling workflow 'cpp-linter/.github/.github/workflows/stale.yml@main'. The nested job 'stale' is requesting 'contents: read, pull-requests: write', but is only allowed 'contents: none, pull-requests: none'.

Root Cause:
The calling workflow only granted issues: write at the workflow level, but the reusable workflow's job requires additional permissions (contents: read and pull-requests: write) that were not available.

Solution:
Following GitHub Actions security best practices with job-level permissions (principle of least privilege):

1. Set workflow-level permissions to permissions: {} (empty)
2. Grant specific permissions only to the job that needs them:
   • contents: read
   • issues: write
   • pull-requests: write

This ensures the reusable workflow receives all required permissions while maintaining minimal privilege scope.

Before:

permissions:
 issues: write
jobs:
 stale:
 uses: cpp-linter/.github/.github/workflows/stale.yml@main

After:

permissions: {}
jobs:
 stale:
 permissions:
 contents: read
 issues: write
 pull-requests: write
 uses: cpp-linter/.github/.github/workflows/stale.yml@main

Fixes #333.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.