ci: require every PR to close an issue or say why it doesn't

[Hmbown]

No-Issue: repo-hygiene automation, filed from a backlog measurement rather than a report.

What the numbers said

342 issues open, 329 of them touched this month. Nothing is rotting — the backlog isn't stale, it's unclosed. stale.yml runs green daily but is scoped to only-labels: needs-info, which is 8 issues out of 342.

The leak: only 8 of 35 open PRs carry a closing keyword. The other 27 will merge and leave their issues open. That's how 121 issues land on one milestone and why the backlog stopped saying which work is actually done.

What this does

Reads the PR body for a GitHub closing keyword attached to an issue number, or a one-line opt-out:

Closes #1234
No-Issue: dependency bump

Either satisfies it. It's a prompt, not a wall.

Body only, deliberately. GitHub resolves closing keywords from the PR description — Closes #123 in the title auto-closes nothing. Accepting the title would pass PRs that close no issue: a green check guarding nothing, which is the shape this repo already has in cache_guard.rs and in the protected_invariants nothing enforces.

The body is read through env: rather than interpolated into the script, since it's attacker-controlled.

Verification

Matcher tested against 13 cases. All six closing-keyword spellings match (close/closes/closed/fix/fixes/fixed/resolve/resolves/resolved), multiline bodies match, indented opt-outs match. Correctly rejected: bare #1234 with no keyword, prose "this fixes the parser" with no number, an empty No-Issue:, and an unmarked chore. YAML validated.

Also changed, outside this diff

delete_branch_on_merge and allow_auto_merge are now enabled on the repo — merged branches stop accumulating (4 were sitting merged-but-undeleted).

Note on existing PRs

pull_request fires on opened/edited/reopened/synchronize, so the 27 unlinked PRs stay green until someone pushes to them. No retroactive red wall.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Claude finished @Hmbown's task in 4m 33s —— View job

---

Review: pr-issue-link.yml

• Read the workflow diff and repo CLAUDE.md/AGENTS.md guidance
• Check correctness of the bash matcher (regex, heredoc, quoting)
• Check security (script-injection surface, token permissions)
• Check test coverage for the new logic
• Post review

Small, self-contained addition — one new workflow file, no other code touched. Overall this is solid: it correctly reads PR_BODY through env: instead of interpolating it into the script body (the standard fix for the GitHub Actions script-injection class of bug), scopes permissions: contents: read to least privilege, and triggers on plain pull_request rather than pull_request_target, so forked PRs never get a token with write access. I traced the heredoc at lines 48–60 closely since indented <<'MSG' terminators are a classic gotcha — confirmed the terminator line has the same indentation as the block's base line, so YAML's block-scalar dedent strips it correctly and the heredoc closes as intended. No bug there.

Two minor, non-blocking observations:

1. The #N match misses GitHub's other closing-reference forms (.github/workflows/pr-issue-link.yml:36). The regex requires #[0-9]+ directly after the keyword, but GitHub also resolves closing keywords against owner/repo#123 and full issue URLs (Closes https://github.com/Hmbown/CodeWhale/issues/123). A PR body using the URL form — plausible if someone pastes a link instead of typing #N — would actually close its issue on merge but still get flagged by this check as "neither closes nor opts out." Given this repo is single-repo, the URL form is the realistic case worth covering; cross-repo is unlikely to matter here.

2. The "tested against 13 cases" verification isn't checked into the repo. The PR description lists solid manual coverage (six keyword spellings, multiline, indented opt-out, and the four rejection cases), but none of it exists as a script in the diff. A small assertion loop (e.g. a tests/pr-issue-link-cases.sh invoked with bash -n/local grep before this is trusted as a required check) would let the regex be re-verified automatically if it's ever edited, rather than relying on a comment claim.

Neither blocks merge — the design is explicitly "a prompt, not a wall," and both gaps fail closed (worst case: a valid closing reference has to be restated as #N, not silently ignored).