SRE-737: Remove dismiss-stale-approvals preflight in favor of GitHub-native

[TimDiekmann]

Purpose

Retire the custom dismiss-stale-approvals preflight in favor of GitHub-native stale-approval dismissal (dismiss_stale_reviews_on_push, configured via branch protection / org ruleset).

The custom range-diff action is smarter (only dismisses on real diff changes) but unreliable in practice: it dismisses approvals after merge (Vanta compliance noise), rebases fail opaquely, and the maintenance cost is too high. GitHub-native stack support is expected to make the custom logic moot anyway.

What does this change?

Deletes the reusable workflow and its composite action:

• .github/workflows/preflight-stale-approvals.yml
• .github/actions/dismiss-stale-approvals/ (8 files)

No references to these remain in this repo.

Rollout

.github-first per the plan. Consumers are SHA-pinned to the previous commit, so their preflight stays green until they drop the stale-approvals job in follow-up PRs. Branch protection is being switched to GitHub-native dismissal in parallel.

Related links

• SRE-737
• Reverses part of H-6402 (original preflight rollout)

[cursor]

PR Summary

Medium Risk
Removes automated stale-approval enforcement from this repo; merge safety now depends on GitHub-native settings and consumers updating pinned workflows.

Overview
Removes the custom dismiss-stale-approvals preflight so stale review dismissal is handled by GitHub-native branch protection (dismiss_stale_reviews_on_push) instead of in-repo automation.

The PR deletes .github/workflows/preflight-stale-approvals.yml and the entire .github/actions/dismiss-stale-approvals/ composite action (range-diff staleness checks, merge-tree manual resolution detection, artifact SHA tracking, review dismissal/dry-run, and the local self-test.sh). Nothing in this repo still references those paths.

Rollout note: other repos that SHA-pin this workflow keep the old preflight until they remove their stale-approvals job; branch protection is expected to be switched to native dismissal in parallel.

^{Reviewed by Cursor Bugbot for commit 6769e75. Bugbot is set up for automated code reviews on this repo. Configure here.}

[augmentcode]

🤖 Augment PR Summary

Summary: This PR retires the custom “dismiss stale approvals” preflight mechanism in favor of GitHub’s native stale-review dismissal (configured via branch protection / org rulesets).

Changes:

• Removed the reusable workflow .github/workflows/preflight-stale-approvals.yml that ran the stale-approval check on PR/merge queue events.
• Deleted the composite action .github/actions/dismiss-stale-approvals and its helper scripts used to detect meaningful diff changes (via git range-diff) and dismiss approvals.
• Eliminated the associated self-test harness that validated range-diff/merge-resolution logic.

Technical Notes:

• Behavior moves from repo-level automation to GitHub-native enforcement (dismiss_stale_reviews_on_push).
• Consumers are expected to be SHA-pinned to the prior version until they remove the now-obsolete “stale-approvals” job in follow-up PRs.
• Post-merge compliance noise and rebase brittleness from the custom workflow are avoided by relying on platform behavior.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

[TimDiekmann]

@copilot fix conflicts

[Copilot]

@copilot fix conflicts

Merged origin/main and resolved the delete/modify conflicts for .github/actions/dismiss-stale-approvals/action.yml and .github/workflows/preflight-stale-approvals.yml by keeping them deleted as intended by this PR.