feat: add automated stale PR completion workflow with Devin API

[anikdhabal]

What does this PR do?

Adds a GitHub Actions workflow that automatically triggers Devin AI to complete stale community PRs when they receive the stale label.

How it works:

1. Triggers on pull_request labeled events
2. Job-level if condition checks both: the stale label was just added AND the PR has the community label
3. Creates a Devin session via the Devin API with a prompt instructing Devin to complete the PR
4. Posts a comment on the PR with a link to the Devin session

Devin is instructed to gather PR details (description, comments, review feedback) himself during the session, keeping the workflow simple.

This follows the same pattern as the Cubic AI integration in #26618.

Updates since last revision

• Simplified community check: now just checks for community label on the PR instead of author_association/write access checks
• Removed comment/file gathering logic - Devin gathers this info himself during the session
• Reduced workflow from ~200 lines to ~90 lines
• Security fix: Moved user-controlled values (PR_TITLE, PR_AUTHOR, PR_BRANCH) to the env: block instead of inline ${{ }} interpolation to prevent potential shell injection attacks (addresses Cubic AI review feedback)

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. N/A - workflow only.
• I confirm automated tests are in place that prove my fix is effective or that my feature works. N/A - GitHub Actions workflow, tested by triggering with stale label.

How should this be tested?

1. Setup required: Ensure DEVIN_API_KEY secret is configured in the repository (Settings → Secrets and variables → Actions)
2. Find or create a test PR that has the community label
3. Add the stale label to the PR
4. Verify the workflow triggers and creates a Devin session
5. Verify a comment is posted on the PR with the Devin session link
6. Negative test: Add stale label to a PR without the community label and verify the workflow skips

Human Review Checklist

• Verify the community label is consistently applied to community PRs in this repository
• Verify the stale label name matches the exact label used in the repository's stale PR process
• Confirm DEVIN_API_KEY secret is configured in the repository

---

Link to Devin run: https://app.devin.ai/sessions/300a83ce09fd4d8fbe558c396f2678d8
Requested by: @anikdhabal

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

4 Skipped Deployments

Project	Deployment	Review	Updated (UTC)
api-v2	Ignored	Preview	Jan 12, 2026 3:47pm
cal	Ignored		Jan 12, 2026 3:47pm
cal-companion	Ignored	Preview	Jan 12, 2026 3:47pm
cal-eu	Ignored		Jan 12, 2026 3:47pm

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name=".github/workflows/stale-pr-devin-completion.yml">

<violation number="1" location=".github/workflows/stale-pr-devin-completion.yml:18">
P0: The entire `run:` block should use environment variables set via `env:` instead of inline `${{ }}` interpolation for user-controlled values. Pass `PR_TITLE`, `PR_AUTHOR`, `PR_BRANCH` via the `env:` block (already done for `DEVIN_API_KEY`), then reference them as `$PR_TITLE` etc. in the script.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[github-actions]

Devin AI is addressing Cubic AI's review feedback

A Devin session has been created to address the issues identified by Cubic AI.

View Devin Session