PR Sheriff workflow (pbakaus/impeccable)

The PR Sheriff workflow from pbakaus/impeccable, explained and optimized by Latchkey.

CI health: C - fair

Point runs-on at Latchkey and get caching, job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: pbakaus/impeccable.github/workflows/sheriff.ymlLicense Apache-2.0View source

What it does

This is the PR Sheriff workflow from the pbakaus/impeccable repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: PR Sheriff

on:
  schedule:
    # Daily UTC afternoon pass. The script uses an aggressive 7/14 day window:
    # warn contributor-blocked PRs after 7 days open, close after 14.
    - cron: "17 15 * * *"
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Print planned changes without mutating GitHub"
        type: boolean
        default: false

permissions:
  actions: read
  checks: read
  contents: read
  issues: write
  pull-requests: write

concurrency:
  group: pr-sheriff
  cancel-in-progress: false

jobs:
  sheriff:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Run sheriff
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mode="--apply"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.dry_run }}" = "true" ]; then
            mode="--dry-run"
          fi

          node scripts/github/sheriff.mjs "$mode" \
            --repo "$GITHUB_REPOSITORY" \
            --warning-days 7 \
            --close-days 14 \
            --maintainers "pbakaus" \
            --regular-contributors "pbakaus,abdulwahabone"

The same workflow, on Latchkey

Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.

name: PR Sheriff
 
on:
  schedule:
    # Daily UTC afternoon pass. The script uses an aggressive 7/14 day window:
    # warn contributor-blocked PRs after 7 days open, close after 14.
    - cron: "17 15 * * *"
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Print planned changes without mutating GitHub"
        type: boolean
        default: false
 
permissions:
  actions: read
  checks: read
  contents: read
  issues: write
  pull-requests: write
 
concurrency:
  group: pr-sheriff
  cancel-in-progress: false
 
jobs:
  sheriff:
    timeout-minutes: 30
    runs-on: latchkey-small
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
 
      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          cache: 'npm'
          node-version: 24
 
      - name: Run sheriff
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mode="--apply"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.dry_run }}" = "true" ]; then
            mode="--dry-run"
          fi
 
          node scripts/github/sheriff.mjs "$mode" \
            --repo "$GITHUB_REPOSITORY" \
            --warning-days 7 \
            --close-days 14 \
            --maintainers "pbakaus" \
            --regular-contributors "pbakaus,abdulwahabone"

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cache dependency installs on the setup step so they are served from cache.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout actions/setup-node