ci: add actions/stale workflow

Marks issues and pull requests stale after 60 days of inactivity and
closes them 14 days later. Any comment clears the stale label and
restarts the clock, so active discussions are never swept up.

Exempts pinned, security, blocked, help wanted and good first issue, and
anything assigned to a milestone. Runs oldest-first so the real backlog
is handled before recent items.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014L5EoqGWsuZWr8fCVM6izP

.github/workflows/stale.yml

@@ -0,0 +1,54 @@
+name: stale
+
+on:
+  schedule:
+    # Daily, off the hour to avoid GitHub's scheduling congestion at :00
+    - cron: '17 4 * * *'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v11
+        with:
+          days-before-stale: 60
+          days-before-close: 14
+
+          stale-issue-label: stale
+          stale-pr-label: stale
+
+          stale-issue-message: >
+            This issue has had no activity for 60 days and has been marked stale.
+            It will be closed in 14 days unless there is new activity. If it is
+            still relevant, a comment saying so is enough to keep it open.
+
+          stale-pr-message: >
+            This pull request has had no activity for 60 days and has been marked
+            stale. It will be closed in 14 days unless there is new activity. If
+            you intend to continue the work, a comment saying so is enough to keep
+            it open.
+
+          close-issue-message: >
+            Closing this issue after 14 days with no further activity. If it is
+            still relevant, please comment and it can be reopened.
+
+          close-pr-message: >
+            Closing this pull request after 14 days with no further activity.
+            Please comment if you would like to pick the work back up.
+
+          # Never touch anything deliberately kept open.
+          exempt-issue-labels: 'pinned,security,blocked,help wanted,good first issue'
+          exempt-pr-labels: 'pinned,security,blocked,dependencies'
+          exempt-all-milestones: true
+
+          # Restarts the clock when someone comments, so an active discussion is
+          # never swept up.
+          remove-stale-when-updated: true
+
+          # Oldest first, so the genuine backlog is handled before recent items.
+          ascending: true

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  "v2": "2.5.3"
+  "v2": "2.5.4"
 }

v2/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.5.4](https://github.com/glauth/glauth/compare/GLAuth-v2.5.3...GLAuth-v2.5.4) (2026-09-13)
+
+
+### Bug Fixes
+
+* revert pam plugin to msteinert/pam v1 ([#487](https://github.com/glauth/glauth/issues/487)) ([8d1ea39](https://github.com/glauth/glauth/commit/8d1ea390bacc74a54d9b2046e514b7e0336cb08b))
+
 ## [2.5.3](https://github.com/glauth/glauth/compare/GLAuth-v2.5.2...GLAuth-v2.5.3) (2026-09-13)
 
 

v2/Makefile

@@ -58,8 +58,21 @@ mocks:
 vet:
 	-go vet ./...
 .PHONY: vet
+#seedplugindb: @ stage the sqlite plugin and seed its test database
+seedplugindb:
+	@if [ -f bin/sqlite-linux-amd64.so ]; then \
+		echo "- staging sqlite plugin and seeding gl.db"; \
+		cp -f bin/sqlite-linux-amd64.so bin/sqlite.so; \
+		rm -f gl.db; \
+		glauth=$$(ls bin/$(GOOS)$(GOARCH)/glauth bin/glauth-$(GOOS)-$(GOARCH) 2>/dev/null | head -1); \
+		"$$glauth" -c pkg/plugins/glauth-sqlite/sample-database.cfg >/dev/null 2>&1 & \
+		pid=$$!; sleep 2; kill -TERM $$pid 2>/dev/null; wait $$pid 2>/dev/null || true; \
+		sqlite3 gl.db < scripts/ci/seed-sqlite-plugin.sql; \
+	fi
+.PHONY: seedplugindb
+
 #test: @ runs package, root integration, and shell integration tests
-test: mocks vet
+test: mocks vet seedplugindb
 	go test -v -cover -coverprofile coverage.out ./pkg/... ./internal/... .
 	$(MAKE) runtest
 #all: @ run build process for all binaries

v2/internal/version/const.go

@@ -2,4 +2,4 @@ package version
 
 // Version is the tag of the latest release, it gets changed by the ci
 // process when a release is happening
-const Version = "v2.5.3" // x-release-please-version
+const Version = "v2.5.4" // x-release-please-version

v2/scripts/ci/seed-sqlite-plugin.sql

@@ -0,0 +1,38 @@
+-- Seed data for TestSQLitePlugin. The schema itself is created by the plugin's
+-- CreateSchema() on first start, so this file only inserts rows.
+
+INSERT INTO ldapgroups(name, gidnumber)
+  VALUES('superheros', 5501);
+INSERT INTO ldapgroups(name, gidnumber)
+  VALUES('svcaccts', 5502);
+INSERT INTO ldapgroups(name, gidnumber)
+  VALUES('civilians', 5503);
+INSERT INTO ldapgroups(name, gidnumber)
+  VALUES('caped', 5504);
+INSERT INTO ldapgroups(name, gidnumber)
+  VALUES('lovesailing', 5505);
+INSERT INTO ldapgroups(name, gidnumber)
+  VALUES('smoker', 5506);
+INSERT INTO includegroups(parentgroupid, includegroupid)
+  VALUES(5503, 5501);
+INSERT INTO includegroups(parentgroupid, includegroupid)
+  VALUES(5504, 5502);
+INSERT INTO includegroups(parentgroupid, includegroupid)
+  VALUES(5504, 5501);
+INSERT INTO users(name, uidnumber, primarygroup, passsha256)
+  VALUES('hackers', 5001, 5501,
+    '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
+INSERT INTO users(name, uidnumber, primarygroup, passsha256)
+  VALUES('johndoe', 5002, 5502,
+    '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
+INSERT INTO users(name, mail, uidnumber, primarygroup, passsha256)
+  VALUES('serviceuser', "serviceuser@example.com", 5003, 5502,
+    '652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0');
+INSERT INTO users(name, uidnumber, primarygroup, passsha256, othergroups)
+  VALUES('user4', 5004, 5504,
+    '652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0',
+    '5505,5506');
+INSERT INTO capabilities(userid, action, object)
+  VALUES(5001, "search", "ou=superheros,dc=glauth,dc=com");
+INSERT INTO capabilities(userid, action, object)
+  VALUES(5003, "search", "*");