From 8e313eddb2f7685324bb0860c776c3b927328f8d Mon Sep 17 00:00:00 2001
From: bmuenzenmeyer <brian.muenzenmeyer@gmail.com>
Date: Thu, 20 Aug 2026 10:56:27 -0500
Subject: [PATCH 1/2] ci: adds age-gate

---
 .changeset/upset-walls-bet.md               |  2 +
 .github/workflows/pull-request-age-gate.yml | 51 +++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 .changeset/upset-walls-bet.md
 create mode 100644 .github/workflows/pull-request-age-gate.yml

diff --git a/.changeset/upset-walls-bet.md b/.changeset/upset-walls-bet.md
new file mode 100644
index 0000000000000..a845151cc8400
--- /dev/null
+++ b/.changeset/upset-walls-bet.md
@@ -0,0 +1,2 @@
+---
+---
diff --git a/.github/workflows/pull-request-age-gate.yml b/.github/workflows/pull-request-age-gate.yml
new file mode 100644
index 0000000000000..3b7003cefae6c
--- /dev/null
+++ b/.github/workflows/pull-request-age-gate.yml
@@ -0,0 +1,51 @@
+# Security Notes
+# Only selected Actions are allowed within this repository. Please refer to (https://github.com/nodejs/nodejs.org/settings/actions)
+# for the full list of available actions. If you want to add a new one, please reach out a maintainer with Admin permissions.
+# REVIEWERS, please always double-check security practices before merging a PR that contains Workflow changes!!
+# AUTHORS, please only use actions with explicit SHA references, and avoid using `@master` or `@main` references or `@version` tags.
+
+name: Pull Request Age Gate
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+  schedule:
+    # Hourly, so that open Pull Requests flip from red to green on their own
+    # once enough wall-clock time has passed, without needing a new commit
+    - cron: '0 * * * *'
+
+permissions: {}
+
+concurrency:
+  # Scheduled runs have no Pull Request in context and evaluate every open Pull
+  # Request, so they are keyed by run id to avoid cancelling one another
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  age-gate:
+    name: Age Gate
+    runs-on: ubuntu-latest
+    permissions:
+      # Required by `bmuenzenmeyer/pr-age-gate` to create/update the check run
+      checks: write
+      # Required by `bmuenzenmeyer/pr-age-gate` to read Pull Request metadata
+      pull-requests: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Check Pull Request Age
+        uses: bmuenzenmeyer/pr-age-gate@749a8fefb38c9bcb350afb84773d5c730b222871 # v0.2.1
+        with:
+          min-hours: '48'
+          bypass-labels: fast-track

From 0610e1eab2dde41a9836e5f9936d0a74f2bc49a8 Mon Sep 17 00:00:00 2001
From: bmuenzenmeyer <brian.muenzenmeyer@gmail.com>
Date: Thu, 20 Aug 2026 14:53:29 -0500
Subject: [PATCH 2/2] update action with a small fork-pr ux fix

---
 .github/workflows/pull-request-age-gate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pull-request-age-gate.yml b/.github/workflows/pull-request-age-gate.yml
index 3b7003cefae6c..b92deb726f068 100644
--- a/.github/workflows/pull-request-age-gate.yml
+++ b/.github/workflows/pull-request-age-gate.yml
@@ -45,7 +45,7 @@ jobs:
           egress-policy: audit
 
       - name: Check Pull Request Age
-        uses: bmuenzenmeyer/pr-age-gate@749a8fefb38c9bcb350afb84773d5c730b222871 # v0.2.1
+        uses: bmuenzenmeyer/pr-age-gate@d4243cf80a6386863234c6fc6be01f19bf4a6bfc # v0.2.3
         with:
           min-hours: '48'
           bypass-labels: fast-track