Hello,
I work with ASF Infra on managing the GitHub Actions allow list and came across an issue in your repo.
The workflow uses an unmaintained action and is not required. Additionally the workflow does not limit the permissions of the GITHUB_TOKEN which is a considerable security issue, especially with an unmaintained action.
Github provides functionality that makes this workflow superflous, just use one of the documented keywords to link a PR to an issue and GitHub will close it when the PR is merged.
Due to the security issue I will remove the peter-evans/close-issue action from the allow list today. (you are it's only user in apache/)