From 6a673b939649c86249076b7a2b9c0db4b608cadc Mon Sep 17 00:00:00 2001
From: Steven Welch <steven@makeitwork.cloud>
Date: Wed, 9 Sep 2026 01:24:23 -0600
Subject: [PATCH] feat: add stale PR dry-run caller

---
 .github/workflows/stale-pull-requests.yml | 19 +++++++++++++++++++
 CHANGELOG.md                              |  4 ++++
 2 files changed, 23 insertions(+)
 create mode 100644 .github/workflows/stale-pull-requests.yml

diff --git a/.github/workflows/stale-pull-requests.yml b/.github/workflows/stale-pull-requests.yml
new file mode 100644
index 0000000..9e3f5b7
--- /dev/null
+++ b/.github/workflows/stale-pull-requests.yml
@@ -0,0 +1,19 @@
+---
+# Temporary repository-local dry-run caller. Organization-wide adoption remains
+# owned by tfroot-github after branch-protection-compatible adoption.
+name: stale-pull-requests
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  stale:
+    uses: makeitworkcloud/shared-workflows/.github/workflows/_stale-pull-requests.yml@e7560bb511468fd800aedbc783d02950d3dff5ca
+    with:
+      dry-run: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5cd20f..f81b751 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,10 @@ exactly that versioned section and publishes it as the GitHub Release body.
 
 ## Unreleased
 
+### Added
+
+- A read-only scheduled dry run that reports stale pull request candidates without changing NetworkManager or Cloudflare DNS configuration.
+
 ## [1.1.0] - 2026-09-02
 
 ### Added