[ci] do not suspend scheduled bundle job after inactivity of repository

[LinqLover]

See: https://lists.squeakfoundation.org/archives/list/[email protected]/thread/O5VS7RFCCLTPKF7ACGMSNSNM6HMG62WA/

[tonyg]

I like it! Can (and/or should) we vendor the dependency on the reactivation workflow step?

[LinqLover]

To vendor = fork the actions repository (liskin/gh-workflow-keepalive)? :-) Sure, we could. Not sure how much value that adds, though. We would be cut off from updates (fixes) to the action and after all, we depend on implementation details of the GitHub Actions infrastructure for this optional feature anyway. I'm more on the side of trunk-based development/EAFP/fix it when it breaks. :-)

Best,
Christoph

[tonyg]

Yes, fork it or include the essential portion of it directly in our CI script. CI actions are, generally speaking, not great from a security perspective, so it'd be nice to just do what we need minimally ourselves rather than pull in privileged code under control of someone else. That said, it's extra work, so I completely understand if it's not something to be done Right Now :-)

[marceltaeumel]

Does the "write" permission in this action means that it has also potential access to this repository's secrets can can thus extract the private certificates (*.enc files) without our knowledge?