Merge branch 'main' into unwatch-repo

.devcontainer/devcontainer.json

@@ -32,5 +32,12 @@
 	"postCreateCommand": "npm ci && npm run build",
 		 
 	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
-	"remoteUser": "node"
+	"remoteUser": "node",
+	
+	// Test restricting low-spec machines
+	"hostRequirements": {
+		"cpus": 8,
+		"memory": "8gb",
+		"storage": "32gb" 
+	}
 }

.eslintrc.js

@@ -13,7 +13,7 @@ module.exports = {
     babelOptions: { configFile: './.babelrc' },
     sourceType: 'module',
   },
-  ignorePatterns: ['tmp/*'],
+  ignorePatterns: ['tmp/*', '!/.*', '/.next/'],
   rules: {
     'import/no-extraneous-dependencies': ['error', { packageDir: '.' }],
   },

.github/CODEOWNERS

@@ -10,6 +10,7 @@
 /.github/ @github/docs-engineering
 /script/ @github/docs-engineering
 /includes/ @github/docs-engineering
+/lib/search/popular-pages.json @github/docs-engineering
 app.json @github/docs-engineering
 Dockerfile @github/docs-engineering
 package-lock.json @github/docs-engineering

.github/actions-scripts/fr-add-docs-reviewers-requests.js

@@ -134,8 +134,8 @@ async function run() {
   // Exclude existing items going forward.
   // Until we have a way to check from a PR whether the PR is in a project,
   // this is how we (roughly) avoid overwriting PRs that are already on the board
-  let newItemIDs = []
-  let newItemAuthors = []
+  const newItemIDs = []
+  const newItemAuthors = []
   itemIDs.forEach((id, index) => {
     if (!existingItemIDs.includes(id)) {
       newItemIDs.push(id)

.github/actions-scripts/ready-for-docs-review.js

@@ -85,8 +85,8 @@ async function run() {
     // - affected docs sets (not considering changes to data/assets)
     let numFiles = 0
     let numChanges = 0
-    let features = new Set([])
-    const files = data.item.files.nodes.forEach((node) => {
+    const features = new Set([])
+    data.item.files.nodes.forEach((node) => {
       numFiles += 1
       numChanges += node.additions
       numChanges += node.deletions

.github/actions-scripts/staging-commit-status-success.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+
+import * as github from '@actions/github'
+
+import getOctokit from '../../script/helpers/github.js'
+
+const { GITHUB_TOKEN } = process.env
+
+// Exit if GitHub Actions PAT is not found
+if (!GITHUB_TOKEN) {
+  throw new Error('You must supply a GITHUB_TOKEN environment variable!')
+}
+
+// This helper uses the `GITHUB_TOKEN` implicitly!
+// We're using our usual version of Octokit vs. the provided `github`
+// instance to avoid versioning discrepancies.
+const octokit = getOctokit()
+
+const { CONTEXT_NAME, ACTIONS_RUN_LOG, HEAD_SHA } = process.env
+if (!CONTEXT_NAME) {
+  throw new Error('$CONTEXT_NAME not set')
+}
+if (!ACTIONS_RUN_LOG) {
+  throw new Error('$ACTIONS_RUN_LOG not set')
+}
+if (!HEAD_SHA) {
+  throw new Error('$HEAD_SHA not set')
+}
+
+const { context } = github
+const owner = context.repo.owner
+const repo = context.payload.repository.name
+
+await octokit.repos.createCommitStatus({
+  owner,
+  repo,
+  sha: HEAD_SHA,
+  context: CONTEXT_NAME,
+  state: 'success',
+  description: 'Successfully deployed! See logs.',
+  target_url: ACTIONS_RUN_LOG,
+})

.github/actions-scripts/staging-deploy.js

@@ -21,7 +21,7 @@ if (!HEROKU_API_TOKEN) {
 // instance to avoid versioning discrepancies.
 const octokit = getOctokit()
 
-const { RUN_ID, PR_URL, SOURCE_BLOB_URL, CONTEXT_NAME, ACTIONS_RUN_LOG, HEAD_SHA } = process.env
+const { RUN_ID, PR_URL, SOURCE_BLOB_URL } = process.env
 if (!RUN_ID) {
   throw new Error('$RUN_ID not set')
 }
@@ -31,15 +31,6 @@ if (!PR_URL) {
 if (!SOURCE_BLOB_URL) {
   throw new Error('$SOURCE_BLOB_URL not set')
 }
-if (!CONTEXT_NAME) {
-  throw new Error('$CONTEXT_NAME not set')
-}
-if (!ACTIONS_RUN_LOG) {
-  throw new Error('$ACTIONS_RUN_LOG not set')
-}
-if (!HEAD_SHA) {
-  throw new Error('$HEAD_SHA not set')
-}
 
 const { owner, repo, pullNumber } = parsePrUrl(PR_URL)
 if (!owner || !repo || !pullNumber) {
@@ -62,13 +53,3 @@ await deployToStaging({
   sourceBlobUrl: SOURCE_BLOB_URL,
   runId: RUN_ID,
 })
-
-await octokit.repos.createCommitStatus({
-  owner,
-  repo,
-  sha: HEAD_SHA,
-  context: CONTEXT_NAME,
-  state: 'success',
-  description: 'Successfully deployed! See logs.',
-  target_url: ACTIONS_RUN_LOG,
-})

.github/workflows/60-days-stale-check.yml

@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: '40 16 * * *' # Run each day at 16:40 UTC / 8:40 PST
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'

.github/workflows/add-review-template.yml

@@ -9,6 +9,9 @@ on:
     types:
       - labeled
 
+permissions:
+  contents: read
+
 jobs:
   comment-that-approved:
     name: Add review template

.github/workflows/auto-label-prs.yml

@@ -7,6 +7,10 @@ name: Auto label Pull Requests
 on:
   pull_request:
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   triage:
     if: github.repository == 'github/docs-internal'

.github/workflows/autoupdate-branch.yml

@@ -24,6 +24,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   autoupdate:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'

.github/workflows/browser-test.yml

@@ -6,9 +6,6 @@ name: Browser Tests
 
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - main
   pull_request:
     paths:
       - '**.js'
@@ -22,6 +19,9 @@ on:
       # Ultimately, for debugging this workflow itself
       - .github/workflows/browser-test.yml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -53,7 +53,7 @@ jobs:
         uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
         with:
           path: .next/cache
-          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}-${{ hashFiles('.github/workflows/browser-test.yml') }}
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
 
       - name: Cache lib/redirects/.redirects-cache_en_ja.json
         uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353

.github/workflows/check-all-english-links.yml

@@ -9,6 +9,10 @@ on:
   schedule:
     - cron: '40 19 * * *' # once a day at 19:40 UTC / 11:40 PST
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   check_all_english_links:
     name: Check all links
@@ -30,6 +34,11 @@ jobs:
           cache: npm
       - name: npm ci
         run: npm ci
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
       - name: npm run build
         run: npm run build
       - name: Run script

.github/workflows/check-broken-links-github-github.yml

@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '20 13 * * 1' # run every Monday at 1:20PM UTC
 
+permissions:
+  contents: read
+
 # **IMPORTANT:** Do not change the FREEZE environment variable set here!
 # This workflow runs on a recurring basis. To temporarily disable it (e.g.,
 # during a docs deployment freeze), add an Actions Secret to the repo settings

.github/workflows/check-for-spammy-issues.yml

@@ -7,6 +7,10 @@ name: Check for Spammy Issues
 on:
   issues:
     types: [opened]
+
+permissions:
+  contents: none
+
 jobs:
   spammy-title-check:
     name: Remove issues with spammy titles

.github/workflows/code-lint.yml

@@ -4,9 +4,6 @@ name: Lint code
 # **Why we have it**: We want some level of consistency to our code.
 # **Who does it impact**: Docs engineering, open-source engineering contributors.
 
-permissions:
-  contents: read
-
 on:
   workflow_dispatch:
   push:
@@ -21,11 +18,15 @@ on:
       - '**.yaml'
       - '**.yml'
       - '**.scss'
+      - .eslintrc.js
       # In case something like eslint or tsc or prettier upgrades
       - 'package-lock.json'
       # Ultimately, for debugging this workflow itself
       - .github/workflows/code-lint.yml
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -15,6 +15,11 @@ on:
       - '**/*.js'
       - '.github/workflows/codeql.yml'
 
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 jobs:
   build:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'

.github/workflows/confirm-internal-staff-work-in-docs.yml

@@ -13,6 +13,9 @@ on:
     types:
       - opened
 
+permissions:
+  contents: none
+
 jobs:
   check-team-membership:
     runs-on: ubuntu-latest

.github/workflows/content-changes-table-comment.yml

@@ -9,6 +9,10 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   PR-Preview-Links:
     if: github.event.pull_request.user.login != 'Octomerger'

.github/workflows/copy-api-issue-to-internal.yml

@@ -9,6 +9,9 @@ on:
     types:
       - labeled
 
+permissions:
+  contents: none
+
 jobs:
   transfer-issue:
     name: Transfer issue

.github/workflows/create-translation-batch-pr.yml

@@ -11,7 +11,10 @@ name: Create translation Batch Pull Request
 on:
   workflow_dispatch:
   schedule:
-    - cron: '25 */6 * * *' # Every six hours
+    - cron: '02 17 * * *' # Once a day at 17:02 UTC / 9:02 PST
+
+permissions:
+  contents: write
 
 jobs:
   create-translation-batch:

.github/workflows/crowdin-cleanup.yml

@@ -10,6 +10,9 @@ on:
     branches:
       - translations
 
+permissions:
+  contents: write
+
 jobs:
   homogenize_frontmatter:
     name: Homogenize frontmatter

.github/workflows/enterprise-dates.yml

@@ -11,6 +11,10 @@ on:
   schedule:
     - cron: '39 2 * * 2' # At 02:39 on Tuesday
 
+permissions:
+  contents: write
+  pull-requests: write
+
 # **IMPORTANT:** Do not change the FREEZE environment variable set here!
 # This workflow runs on a recurring basis. To temporarily disable it (e.g.,
 # during a docs deployment freeze), add an Actions Secret to the repo settings

.github/workflows/enterprise-release-sync-search-index.yml

@@ -26,6 +26,9 @@ on:
       - ready_for_review
       - unlocked
 
+permissions:
+  contents: write
+
 # This workflow requires a label in the format `sync-english-index-for-<PLAN@RELEASE>`
 jobs:
   updateIndices:
@@ -54,12 +57,17 @@ jobs:
         id: getVersion
         run: $GITHUB_WORKSPACE/.github/actions-scripts/enterprise-search-label.js
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - name: Generate the search index files
         if: ${{ steps.getVersion.outputs.versionToSync }}
         env:
           VERSION: ${{ steps.getVersion.outputs.versionToSync }}
           LANGUAGE: 'en'
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           npm run build
           npm run sync-search

.github/workflows/first-responder-docs-content.yml

@@ -13,6 +13,9 @@ on:
       - closed
       - unlabeled
 
+permissions:
+  contents: none
+
 jobs:
   first-responder-triage-pr:
     name: Triage PR to FR project board

.github/workflows/hubber-contribution-help.yml

@@ -12,12 +12,13 @@ on:
       - 'content/**'
       - 'data/**'
 
+permissions:
+  pull-requests: write
+
 jobs:
   check-team-membership:
     if: github.repository == 'github/docs-internal' && github.actor != 'github-openapi-bot'
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
     steps:
       - id: membership_check
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d

.github/workflows/link-check-dotcom.yml

@@ -6,11 +6,11 @@ name: 'Link Checker: Dotcom'
 
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
@@ -29,6 +29,12 @@ jobs:
       - name: Install
         run: npm ci
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - name: Build
         run: npm run build
 

.github/workflows/link-check-ghae.yml

@@ -6,11 +6,11 @@ name: 'Link Checker: GitHub AE'
 
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
@@ -29,6 +29,12 @@ jobs:
       - name: Install
         run: npm ci
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - name: Build
         run: npm run build
 

.github/workflows/link-check-ghec.yml

@@ -6,11 +6,11 @@ name: 'Link Checker: Enterprise Cloud'
 
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
@@ -27,6 +27,12 @@ jobs:
       - name: Install
         run: npm ci
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - name: Build
         run: npm run build
 

.github/workflows/link-check-ghes.yml

@@ -6,11 +6,11 @@ name: 'Link Checker: Enterprise Server'
 
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
@@ -29,6 +29,12 @@ jobs:
       - name: Install
         run: npm ci
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - name: Build
         run: npm run build
 

.github/workflows/manually-purge-fastly.yml

@@ -0,0 +1,29 @@
+name: Manually purge Fastly
+
+# **What it does**: Sends a soft-purge for the 'manual' Fastly surrogate key.
+# **Why we have it**: When something is overly cached in the Fastly CDN and want to purge it.
+# **Who does it impact**: Docs content.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  purge:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Soft-purge Fastly cache
+        env:
+          FASTLY_TOKEN: ${{ secrets.FASTLY_TOKEN }}
+          FASTLY_SERVICE_ID: ${{ secrets.FASTLY_SERVICE_ID }}
+          FASTLY_SURROGATE_KEY: 'manual-purge'
+        run: .github/actions-scripts/purge-fastly-edge-cache.js

.github/workflows/merged-notification.yml

@@ -9,6 +9,9 @@ on:
     types:
       - 'closed'
 
+permissions:
+  issues: write
+
 jobs:
   comment:
     if: github.repository == 'github/docs' && github.event.pull_request.merged && github.event.pull_request.base.ref == github.event.repository.default_branch && github.event.pull_request.user.login != 'Octomerger'

.github/workflows/move-existing-issues-to-the-correct-repo.yml

@@ -7,6 +7,9 @@ name: Move existing issues to correct docs repo
 on:
   workflow_dispatch:
 
+permissions:
+  contents: none
+
 jobs:
   transfer_issues:
     runs-on: ubuntu-latest

.github/workflows/move-help-wanted-issues.yml

@@ -10,7 +10,7 @@ on:
       - labeled
 
 permissions:
-  issues: none
+  contents: none
 
 jobs:
   move_issues:

.github/workflows/move-new-issues-to-correct-docs-repo.yml

@@ -11,6 +11,9 @@ on:
       - transferred
       - reopened
 
+permissions:
+  contents: none
+
 jobs:
   transfer_issue:
     runs-on: ubuntu-latest

.github/workflows/move-ready-to-merge-pr.yaml

@@ -11,7 +11,6 @@ on:
 
 permissions:
   pull-requests: write
-  issues: write
 
 jobs:
   unmark_for_review:

.github/workflows/move-reopened-issues-to-triage.yaml

@@ -9,6 +9,9 @@ on:
     types:
       - reopened
 
+permissions:
+  repository-projects: write
+
 jobs:
   move-reopened-issue-to-triage:
     if: github.repository == 'github/docs'
@@ -16,7 +19,6 @@ jobs:
     steps:
       - uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
         with:
-          github-token: ${{ github.token }}
           script: |
             const issueNumber = context.issue.number;
             const doneColumnId = 11167427;

.github/workflows/no-response.yaml

@@ -15,13 +15,16 @@ on:
     # Schedule for five minutes after the hour every hour
     - cron: '5 * * * *'
 
+permissions:
+  issues: write
+
 jobs:
   noResponse:
     runs-on: ubuntu-latest
     steps:
       - uses: lee-dohm/no-response@9bb0a4b5e6a45046f00353d5de7d90fb8bd773bb
         with:
-          token: ${{ github.token }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           closeComment: >
             This issue has been automatically closed because there has been no response
             to our request for more information from the original author. With only the

.github/workflows/open-enterprise-issue.yml

@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '49 14 * * *' # At 14:49 UTC daily
 
+permissions:
+  contents: read
+
 jobs:
   open_enterprise_issue:
     name: Open Enterprise issue

.github/workflows/openapi-schema-check.yml

@@ -23,6 +23,9 @@ on:
       - 'script/rest/**/*.js'
       - 'package*.json'
 
+permissions:
+  contents: read
+
 jobs:
   check-schema-versions:
     if: ${{ github.repository == 'github/docs-internal' }}

.github/workflows/os-ready-for-review.yml

@@ -3,15 +3,15 @@ name: OS Ready for review
 # **What it does**: Adds pull requests and issues in the docs repository to the docs-content review board when the "waiting for review" label is added
 # **Why we have it**: So that contributors in the OS repo can easily get reviews from the docs-content team, and so that writers can see when a PR is ready for review
 # **Who does it impact**: Writers working in the docs repository
-permissions:
-  contents: read
-
 on:
   pull_request_target:
     types: [labeled]
   issues:
     types: [labeled]
 
+permissions:
+  contents: read
+
 jobs:
   request_doc_review:
     name: Request a review from the docs-content team

.github/workflows/pa11y.yml

@@ -8,6 +8,10 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '25 17 * * *' # once a day at 17:25 UTC / 11:50 PST
+
+permissions:
+  contents: read
+
 jobs:
   test:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
@@ -25,6 +29,12 @@ jobs:
       - name: Install dependencies
         run: npm ci --include=optional
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - name: Run build scripts
         run: npm run build
 

.github/workflows/ping-staging-apps.yml

@@ -8,6 +8,9 @@ on:
   schedule:
     - cron: '10,30,50 * * * *' # every twenty minutes
 
+permissions:
+  contents: read
+
 jobs:
   ping_staging_apps:
     name: Ping
@@ -24,7 +27,5 @@ jobs:
           cache: npm
       - name: npm ci
         run: npm ci
-      - name: npm run build
-        run: npm run build
       - name: Run script
         run: script/ping-staging-apps.js

.github/workflows/prod-build-deploy.yml

@@ -52,6 +52,12 @@ jobs:
           DOCUBOT_REPO_PAT: ${{ secrets.DOCUBOT_REPO_PAT }}
           GIT_BRANCH: main
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - name: Build
         run: npm run build
 

.github/workflows/ready-for-doc-review.yml

@@ -8,6 +8,9 @@ on:
   pull_request:
     types: [labeled]
 
+permissions:
+  contents: read
+
 jobs:
   request_doc_review:
     name: Request a review from the docs-content team

.github/workflows/remove-from-fr-board.yaml

@@ -8,6 +8,9 @@ on:
   repository_dispatch:
     types: remove_from_docs_FR_board
 
+permissions:
+  contents: none
+
 jobs:
   remove_from_FR_board:
     if: github.repository == 'github/docs-internal'

.github/workflows/remove-unused-assets.yml

@@ -8,6 +8,9 @@ on:
   schedule:
     - cron: '20 15 * * 0' # run every Sunday at 20:15 UTC / 12:15 PST
 
+permissions:
+  contents: write
+
 env:
   FREEZE: ${{ secrets.FREEZE }}
 
@@ -39,7 +42,7 @@ jobs:
         with:
           path: ./results.md
       - name: Remove script results file
-        run: rm -rf ./results.md
+        run: rm ./results.md
       - name: Create pull request
         uses: peter-evans/create-pull-request@7380612b49221684fefa025244f2ef4008ae50ad
         env:

.github/workflows/repo-freeze-check.yml

@@ -16,6 +16,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: none
+
 env:
   FREEZE: ${{ secrets.FREEZE }}
 

.github/workflows/repo-sync-stalls.yml

@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '32 */2 * * *' # At minute 32 past every 2nd hour.
 
+permissions:
+  pull-requests: read
+
 jobs:
   repo-sync-stalls:
     runs-on: ubuntu-latest
@@ -17,7 +20,6 @@ jobs:
         name: Check if repo sync is stalled
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
         with:
-          github-token: ${{ secrets.DOCUBOT_READORG_REPO_WORKFLOW_SCOPES }}
           script: |
             let pulls;
             const owner = context.repo.owner

.github/workflows/repo-sync.yml

@@ -20,6 +20,10 @@ on:
   schedule:
     - cron: '10,40 * * * *' # every 30 minutes
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   close-invalid-repo-sync:
     name: Close invalid Repo Sync PRs

.github/workflows/site-policy-reminder.yml

@@ -8,6 +8,9 @@ on:
   pull_request:
     types: [labeled]
 
+permissions:
+  contents: none
+
 jobs:
   run:
     if: >-

.github/workflows/site-policy-sync.yml

@@ -16,14 +16,14 @@ on:
       - 'content/github/site-policy/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   sync:
     name: Get the latest docs
     if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && github.repository == 'github/docs-internal')
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
     steps:
       - name: checkout docs-internal
         uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579

.github/workflows/staging-build-and-deploy-pr.yml

@@ -0,0 +1,227 @@
+name: Staging - Build and Deploy PR (fast and private-only)
+
+# **What it does**: Builds and deploys PRs to staging but ONLY for docs-internal
+# **Why we have it**: Most PRs are made on the private repo. Let's make those extra fast if we can worry less about security.
+# **Who does it impact**: All staff.
+
+# This whole workflow is only guaranteed to be secure in the *private
+# repo* and because we repo-sync these files over the to the public one,
+# IT'S CRUCIALLY IMPORTANT THAT THIS WORKFLOW IS ONLY ENABLED IN docs-internal!
+
+on:
+  # Ideally, we'd like to use 'pull_request' because we can more easily
+  # test changes to this workflow without relying on merges to 'main'.
+  # But this is guaranteed to be safer and won't have the problem of
+  # necessary secrets not being available.
+  # Perhaps some day when we're confident this workflow will always
+  # work in a regular PR, we can switch to that.
+  pull_request_target:
+
+permissions:
+  actions: read
+  contents: read
+  deployments: write
+  pull-requests: read
+  statuses: write
+
+# This allows one Build workflow run to interrupt another
+# These are different from the concurrency in that here it checks if the
+# whole workflow runs again. The "inner concurrency" is used for
+# undeployments to cleaning up resources.
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label }}'
+  cancel-in-progress: true
+
+jobs:
+  build-and-deploy-pr:
+    # Important. This whole file is only supposed to run in the PRIVATE repo.
+    if: ${{ github.repository == 'github/docs-internal' }}
+
+    # The assumption here is that self-hosted is faster (e.g CPU power)
+    # that the regular ones. And it matters in this workflow because
+    # we do heavy CPU stuff with `npm run build` and `tar`
+    # runs-on: ubuntu-latest
+    runs-on: self-hosted
+
+    timeout-minutes: 5
+    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
+    # progress for this PR branch.
+    concurrency:
+      group: 'PR Staging @ ${{ github.event.pull_request.head.label }}'
+      cancel-in-progress: true
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          lfs: 'true'
+          # To prevent issues with cloning early access content later
+          persist-credentials: 'false'
+
+      - name: Check out LFS objects
+        run: git lfs checkout
+
+      - name: Setup node
+        uses: actions/setup-node@04c56d2f954f1e4c69436aa54cfef261a018f458
+        with:
+          node-version: 16.13.x
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
+      - name: Build
+        run: npm run build
+
+      - name: Clone early access
+        run: node script/early-access/clone-for-build.js
+        env:
+          DOCUBOT_REPO_PAT: ${{ secrets.DOCUBOT_REPO_PAT }}
+          GIT_BRANCH: ${{ github.event.pull_request.head.sha }}
+
+      - name: Check that the PR isn't blocking deploys
+        # We can't use ${{...}} on this if statement because of this bug
+        # https://github.com/cschleiden/actions-linter/issues/114
+        if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'automated-block-deploy')
+        run: |
+          echo "The PR appears to have the label 'automated-block-deploy'"
+          echo "Will not proceed to deploy the PR."
+          exit 2
+
+      - name: Create a Heroku build source
+        id: build-source
+        uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
+        env:
+          HEROKU_API_TOKEN: ${{ secrets.HEROKU_API_TOKEN }}
+        with:
+          script: |
+            const { owner, repo } = context.repo
+
+            if (owner !== 'github') {
+              throw new Error(`Repository owner must be 'github' but was: ${owner}`)
+            }
+            if (repo !== 'docs-internal') {
+              throw new Error(`Repository name must be 'docs-internal' but was: ${repo}`)
+            }
+
+            const Heroku = require('heroku-client')
+            const heroku = new Heroku({ token: process.env.HEROKU_API_TOKEN })
+
+            try {
+              const { source_blob: sourceBlob } = await heroku.post('/sources')
+              const { put_url: uploadUrl, get_url: downloadUrl } = sourceBlob
+
+              core.setOutput('upload_url', uploadUrl)
+              core.setOutput('download_url', downloadUrl)
+            } catch (error) {
+              if (error.statusCode === 503) {
+                console.error('💀 Heroku may be down! Please check its Status page: https://status.heroku.com/')
+              }
+              throw error
+            }
+
+      - name: Remove development-only dependencies
+        run: npm prune --production
+
+      - name: Remove all npm scripts
+        run: npm pkg delete scripts
+
+      - name: Set npm script for Heroku build to noop
+        run: npm set-script heroku-postbuild "echo 'Application was pre-built!'"
+
+      - name: Delete heavy things we won't need deployed
+        run: |
+
+          # The dereferenced file is not used in runtime once the
+          # decorated file has been created from it.
+          rm -rf lib/rest/static/dereferenced
+
+          # Translations are never tested in Staging builds
+          # but let's keep the empty directory.
+          rm -rf translations
+          mkdir translations
+
+          # Delete all the big search indexes that are NOT English (`*-en-*`)
+          pushd lib/search/indexes
+          ls | grep -v '\-en\-' | xargs rm
+          popd
+
+          # Note! Some day it would be nice to be able to delete
+          # all the heavy assets because they bloat the tarball.
+          # But it's not obvious how to test it then. For now, we'll have
+          # to accept that every staging build has a copy of the images.
+
+          # The assumption here is that a staging build will not
+          # need these legacy redirects. Only the redirects from
+          # front-matter will be at play.
+          # These static redirects json files are notoriously large
+          # and they make the tarball unnecessarily large.
+          echo '[]' > lib/redirects/static/archived-frontmatter-fallbacks.json
+          echo '{}' > lib/redirects/static/developer.json
+          echo '{}' > lib/redirects/static/archived-redirects-from-213-to-217.json
+
+          # This will turn every `lib/**/static/*.json` into
+          # an equivalent `lib/**/static/*.json.br` file.
+          # Once the server starts, it'll know to fall back to reading
+          # the `.br` equivalent if the `.json` file isn't present.
+          node .github/actions-scripts/compress-large-files.js
+
+      - name: Make the tarball for Heroku
+        run: |
+          # We can't delete the .next/cache directory from the workflow
+          # because it's needed for caching, but we can at least exclude it
+          # from the tarball. Then it can be cached but not weigh down the
+          # tarball we intend to deploy.
+          tar -zc --exclude=.next/cache --file=app.tar.gz \
+            node_modules/ \
+            .next/ \
+            assets/ \
+            content/ \
+            data/ \
+            includes/ \
+            lib/ \
+            middleware/ \
+            translations/ \
+            server.mjs \
+            package*.json \
+            .npmrc \
+            feature-flags.json \
+            next.config.js \
+            app.json \
+            Procfile
+
+          du -sh app.tar.gz
+
+      # See: https://devcenter.heroku.com/articles/build-and-release-using-the-api#sources-endpoint
+      - name: Upload to the Heroku build source
+        env:
+          UPLOAD_URL: ${{ steps.build-source.outputs.upload_url }}
+        run: |
+          curl "$UPLOAD_URL" \
+            -X PUT \
+            -H 'Content-Type:' \
+            --data-binary @app.tar.gz
+
+      # 'npm install' is faster than 'npm ci' because it only needs to
+      # *append* what's missing from ./node_modules/
+      - name: Re-install dependencies so we get devDependencies back
+        run: npm install --no-audit --no-fund --only=dev
+
+      - name: Deploy
+        id: deploy
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEROKU_API_TOKEN: ${{ secrets.HEROKU_API_TOKEN }}
+          HYDRO_ENDPOINT: ${{ secrets.HYDRO_ENDPOINT }}
+          HYDRO_SECRET: ${{ secrets.HYDRO_SECRET }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          SOURCE_BLOB_URL: ${{ steps.build-source.outputs.download_url }}
+          ALLOWED_POLLING_FAILURES_PER_PHASE: '15'
+          RUN_ID: ${{ github.run_id }}
+        run: .github/actions-scripts/staging-deploy.js

.github/workflows/staging-build-pr.yml

@@ -4,6 +4,8 @@ name: Staging - Build PR
 # **Why we have it**: Because it's not safe to share our deploy secrets with forked repos: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
 # **Who does it impact**: All contributors.
 
+# IT'S CRUCIALLY IMPORTANT THAT THIS WORKFLOW IS ONLY ENABLED IN docs!
+
 on:
   pull_request:
     types:
@@ -11,16 +13,6 @@ on:
       - reopened
       - synchronize
 
-  # This is necessary so that the cached things can be reused between
-  # pull requests.
-  # If we don't let the workflow run on `main` the caching will only
-  # help between multiple runs of the same workflow. By letting
-  # it build on pushes to main too, the cache will be reusable
-  # in other people's PRs too.
-  push:
-    branches:
-      - main
-
 permissions:
   contents: read
 
@@ -31,7 +23,9 @@ concurrency:
 
 jobs:
   build-pr:
-    if: ${{ github.repository == 'github/docs-internal' || github.repository == 'github/docs' }}
+    # Important. This whole file is only supposed to run in the PUBLIC repo.
+    if: ${{ github.repository == 'github/docs' }}
+
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
     timeout-minutes: 5
     # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
@@ -45,7 +39,7 @@ jobs:
 
       # Make sure only approved files are changed if it's in github/docs
       - name: Check changed files
-        if: ${{ github.repository == 'github/docs' && github.event.pull_request.user.login != 'Octomerger' }}
+        if: ${{ github.event.pull_request.user.login != 'Octomerger' }}
         uses: dorny/paths-filter@eb75a1edc117d3756a18ef89958ee59f9500ba58
         id: filter
         with:
@@ -93,7 +87,7 @@ jobs:
         uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
         with:
           path: .next/cache
-          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}-${{ hashFiles('.github/workflows/staging-build-pr.yml') }}
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
 
       - name: Build
         run: npm run build
@@ -107,47 +101,7 @@ jobs:
       - name: Set npm script for Heroku build to noop
         run: npm set-script heroku-postbuild "echo 'Application was pre-built!'"
 
-      - name: Delete heavy things we won't need deployed
-        if: ${{ github.repository == 'github/docs-internal' }}
-        run: |
-
-          # The dereferenced file is not used in runtime once the
-          # decorated file has been created from it.
-          rm -fr lib/rest/static/dereferenced
-
-          # Translations are never tested in Staging builds
-          # but let's keep the empty directory.
-          rm -fr translations
-          mkdir translations
-
-          # Delete all the big search indexes that are NOT English (`*-en-*`)
-          pushd lib/search/indexes
-          ls | grep -v '\-en\-' | xargs rm
-          popd
-
-          # Note! Some day it would be nice to be able to delete
-          # all the heavy assets because they bloat the tarball.
-          # But it's not obvious how to test it then. For now, we'll have
-          # to accept that every staging build has a copy of the images.
-
-          # The assumption here is that a staging build will not
-          # need these legacy redirects. Only the redirects from
-          # front-matter will be at play.
-          # These static redirects json files are notoriously large
-          # and they make the tarball unnecessarily large.
-          echo '[]' > lib/redirects/static/archived-frontmatter-fallbacks.json
-          echo '{}' > lib/redirects/static/developer.json
-          echo '{}' > lib/redirects/static/archived-redirects-from-213-to-217.json
-
-          # This will turn every `lib/**/static/*.json` into
-          # an equivalent `lib/**/static/*.json.br` file.
-          # Once the server starts, it'll know to fall back to reading
-          # the `.br` equivalent if the `.json` file isn't present.
-          node .github/actions-scripts/compress-large-files.js
-
       - name: Create an archive
-        # Only bother if this is actually a pull request
-        if: ${{ github.event.pull_request.number }}
         run: |
           tar -c --file=app.tar \
             node_modules/ \
@@ -177,8 +131,6 @@ jobs:
       # We are not willing to trust the rest (e.g. script/) for the remainder
       # of the deployment process.
       - name: Upload build artifact
-        # Only bother if this is actually a pull request
-        if: ${{ github.event.pull_request.number }}
         uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074
         with:
           name: pr_build

.github/workflows/staging-deploy-pr.yml

@@ -4,6 +4,8 @@ name: Staging - Deploy PR
 # **Why we have it**: To deploy with high visibility in case of failures.
 # **Who does it impact**: All contributors.
 
+# IT'S CRUCIALLY IMPORTANT THAT THIS WORKFLOW IS ONLY ENABLED IN docs!
+
 on:
   workflow_run:
     workflows:
@@ -34,22 +36,16 @@ env:
   BUILD_ACTIONS_RUN_LOG: https://github.com/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}
 
 jobs:
-  debug:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dump full context for debugging
-        env:
-          GITHUB_CONTEXT: ${{ toJSON(github) }}
-        run: echo "$GITHUB_CONTEXT"
-
   pr-metadata:
     # This is needed because the workflow we depend on
     # (see on.workflow_run.workflows) might be running from pushes on
     # main. That's because it needs to do that to popular the cache.
-    if: >
-      ${{ github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success' }}
-
+    if: >-
+      ${{
+        github.repository == 'github/docs' &&
+        github.event.workflow_run.event == 'pull_request' &&
+        github.event.workflow_run.conclusion == 'success'
+      }}
     runs-on: ubuntu-latest
     outputs:
       number: ${{ steps.pr.outputs.number }}
@@ -164,8 +160,7 @@ jobs:
     if: >-
       ${{
         needs.pr-metadata.outputs.number != '0' &&
-        github.event.workflow_run.conclusion == 'failure' &&
-        (github.repository == 'github/docs-internal' || github.repository == 'github/docs')
+        github.event.workflow_run.conclusion == 'failure'
       }}
     runs-on: ubuntu-latest
     timeout-minutes: 1
@@ -208,8 +203,7 @@ jobs:
     if: >-
       ${{
         needs.pr-metadata.outputs.number != '0' &&
-        github.event.workflow_run.conclusion == 'success' &&
-        (github.repository == 'github/docs-internal' || github.repository == 'github/docs')
+        github.event.workflow_run.conclusion == 'success'
       }}
     runs-on: ubuntu-latest
     # This timeout should match or exceed the value of the timeout for Undeploy
@@ -262,7 +256,7 @@ jobs:
   prepare-for-deploy:
     needs: [pr-metadata, check-pr-before-prepare]
     if: ${{ needs.check-pr-before-prepare.outputs.pull_request_state == 'open' }}
-    runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
     # progress for this PR branch.
@@ -308,22 +302,10 @@ jobs:
           node-version: 16.13.x
           cache: npm
 
-      # Install any dependencies that are needed for the early access script
-      - if: ${{ github.repository == 'github/docs-internal' }}
-        name: Install temporary dependencies
-        run: npm install --no-save dotenv rimraf
-
       # Install any additional dependencies *before* downloading the build artifact
       - name: Install Heroku client development-only dependency
         run: npm install --no-save heroku-client
 
-      - if: ${{ github.repository == 'github/docs-internal' }}
-        name: Clone early access
-        run: node script/early-access/clone-for-build.js
-        env:
-          DOCUBOT_REPO_PAT: ${{ secrets.DOCUBOT_REPO_PAT }}
-          GIT_BRANCH: ${{ needs.pr-metadata.outputs.head_ref }}
-
       # Download the previously built "app.tar"
       - name: Download build artifact
         uses: dawidd6/action-download-artifact@af92a8455a59214b7b932932f2662fdefbd78126
@@ -333,35 +315,8 @@ jobs:
           name: pr_build
           path: ${{ runner.temp }}
 
-      # For security reasons, only extract the tar from docs-internal
-      # This allows us to add search indexes and early access content to the build
-      - if: ${{ github.repository == 'github/docs-internal' }}
-        name: Extract user-changes to temp directory
-        run: |
-          mkdir $RUNNER_TEMP/app
-          tar -x --file=$RUNNER_TEMP/app.tar -C "$RUNNER_TEMP/app/"
-
-      # Move the LFS content into the temp directory in chunks (destructively)
-      - if: ${{ github.repository == 'github/docs-internal' }}
-        name: Move the LFS objects
-        run: |
-          git lfs ls-files --name-only | xargs -n 1 -I {} sh -c 'mkdir -p "$RUNNER_TEMP/app/$(dirname {})"; mv {} "$RUNNER_TEMP/app/$(dirname {})/"'
-
-      # Move the early access content into the temp directory (destructively)
-      - if: ${{ github.repository == 'github/docs-internal' }}
-        name: Move the early access content
-        run: |
-          mv assets/images/early-access "$RUNNER_TEMP/app/assets/images/"
-          mv content/early-access "$RUNNER_TEMP/app/content/"
-          mv data/early-access "$RUNNER_TEMP/app/data/"
-
-      - if: ${{ github.repository == 'github/docs-internal' }}
-        name: Create a gzipped archive (docs-internal)
-        run: tar -cz --file app.tar.gz "$RUNNER_TEMP/app/"
-
-      # gzip the app.tar from github/docs so we're working with the same format
-      - if: ${{ github.repository == 'github/docs' }}
-        name: Create a gzipped archive (docs)
+      # gzip the app.tar to meet Heroku's expected format
+      - name: Create a gzipped archive (docs)
         run: gzip -9 < "$RUNNER_TEMP/app.tar" > app.tar.gz
 
       - name: Create a Heroku build source
@@ -376,8 +331,8 @@ jobs:
             if (owner !== 'github') {
               throw new Error(`Repository owner must be 'github' but was: ${owner}`)
             }
-            if (repo !== 'docs-internal' && repo !== 'docs') {
-              throw new Error(`Repository name must be either 'docs-internal' or 'docs' but was: ${repo}`)
+            if (repo !== 'docs') {
+              throw new Error(`Repository name must be 'docs' but was: ${repo}`)
             }
 
             const Heroku = require('heroku-client')
@@ -466,7 +421,7 @@ jobs:
   deploy:
     needs: [pr-metadata, prepare-for-deploy, check-pr-before-deploy]
     if: ${{ needs.check-pr-before-deploy.outputs.pull_request_state == 'open' }}
-    runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
     # progress for this PR branch.
@@ -495,13 +450,18 @@ jobs:
           HYDRO_SECRET: ${{ secrets.HYDRO_SECRET }}
           PR_URL: ${{ needs.pr-metadata.outputs.url }}
           SOURCE_BLOB_URL: ${{ needs.prepare-for-deploy.outputs.source_blob_url }}
-          CONTEXT_NAME: ${{ env.CONTEXT_NAME }}
-          ACTIONS_RUN_LOG: ${{ env.ACTIONS_RUN_LOG }}
-          HEAD_SHA: ${{ needs.pr-metadata.outputs.head_sha }}
           ALLOWED_POLLING_FAILURES_PER_PHASE: '15'
           RUN_ID: ${{ github.run_id }}
         run: .github/actions-scripts/staging-deploy.js
 
+      - name: Create successful commit status
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CONTEXT_NAME: ${{ env.CONTEXT_NAME }}
+          ACTIONS_RUN_LOG: ${{ env.ACTIONS_RUN_LOG }}
+          HEAD_SHA: ${{ needs.pr-metadata.outputs.head_sha }}
+        run: .github/actions-scripts/staging-commit-status-success.js
+
       - name: Mark the deployment as inactive if timed out
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
         if: ${{ steps.deploy.outcome == 'cancelled' }}

.github/workflows/start-new-engineering-pr-workflow.yml

@@ -10,6 +10,9 @@ on:
       - opened
       - reopened
 
+permissions:
+  contents: none
+
 jobs:
   triage:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'

.github/workflows/sync-search-indices.yml

@@ -33,6 +33,9 @@ on:
   schedule:
     - cron: '53 0/8 * * *' # Run every eight hours at 53 minutes past the hour
 
+permissions:
+  contents: none
+
 env:
   FREEZE: ${{ secrets.FREEZE }}
 
@@ -61,12 +64,17 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - name: Run build scripts
         run: npm run build
 
       - name: Update search indexes
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ github.event.inputs.version }}
           LANGUAGE: ${{ github.event.inputs.language }}
         run: npm run sync-search

.github/workflows/sync-search-pr.yml

@@ -13,6 +13,9 @@ on:
       # Ultimately, for debugging this workflow itself
       - .github/workflows/sync-search-pr.yml
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -29,6 +32,12 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - name: Build
         run: npm run build
 

.github/workflows/test-windows.yml

@@ -12,6 +12,9 @@ on:
   schedule:
     - cron: '50 19 * * *' # once a day at 19:50 UTC / 11:50 PST
 
+permissions:
+  contents: read
+
 env:
   CI: true
 
@@ -50,6 +53,12 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Cache nextjs build
+        uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
+        with:
+          path: .next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
+
       - if: ${{ github.repository == 'github/docs-internal' }}
         name: Clone early access
         run: npm run heroku-postbuild

.github/workflows/test.yml

@@ -8,11 +8,13 @@ name: Node.js Tests
 
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - main
   pull_request:
 
+permissions:
+  contents: read
+  # Needed for the 'trilom/file-changes-action' action
+  pull-requests: read
+
 env:
   CI: true
 
@@ -81,7 +83,7 @@ jobs:
         uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353
         with:
           path: .next/cache
-          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}-${{ hashFiles('.github/workflows/test.yml') }}
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('package*.json') }}
 
       - name: Run build script
         run: npm run build

.github/workflows/transfer-api-issue-to-openapi.yml

@@ -9,6 +9,9 @@ on:
     types:
       - labeled
 
+permissions:
+  contents: none
+
 jobs:
   transfer-issue:
     name: Transfer issue

.github/workflows/transfer-to-localization-repo.yml

@@ -4,14 +4,14 @@ name: Copy to REST API issue to docs-content
 # **Why we have it**: REST API updates cannot be made in the open source repo. Instead, we copy the issue to an internal issue (we do not transfer so that the issue does not disappear for the contributor) and close the original issue.
 # **Who does it impact**: Open source and docs-content maintainers
 
-permissions:
-  contents: write
-
 on:
   issues:
     types:
       - labeled
 
+permissions:
+  contents: none
+
 jobs:
   transfer-issue:
     name: Transfer issue

.github/workflows/triage-issue-comments.yml

@@ -11,6 +11,7 @@ on:
 
 permissions:
   issues: write
+  repository-projects: write
 
 jobs:
   triage-issue-comments:
@@ -22,7 +23,6 @@ jobs:
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
         id: is-internal-contributor
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           result-encoding: string
           script: |
             const repo = context.payload.repository.name

.github/workflows/triage-pull-requests.yml

@@ -13,7 +13,6 @@ on:
 permissions:
   pull-requests: write
   repository-projects: write
-  issues: write
 
 jobs:
   triage_pulls:

.github/workflows/triage-unallowed-contributions.yml

@@ -24,6 +24,9 @@ on:
       - 'scripts/**'
       - 'translations/**'
 
+permissions:
+  pull-requests: write
+
 jobs:
   triage:
     if: >-
@@ -75,7 +78,6 @@ jobs:
         if: ${{ steps.filter.outputs.notAllowed }}
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const badFilesArr = [
               '.github/actions-scripts/**',
@@ -102,7 +104,7 @@ jobs:
             let workflowFailMessage = "It looks like you've modified some files that we can't accept as contributions."
 
             try {
-               createdComment = await github.issues.createComment ({
+               createdComment = await github.issues.createComment({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 issue_number: context.payload.number,

.github/workflows/triage-unallowed-internal-changes.yml

@@ -13,6 +13,10 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  # This is needed by dorny/paths-filter
+  pull-requests: read
+
 jobs:
   check-internal-changes:
     if: github.repository == 'github/docs-internal' && github.event.pull_request.user.login != 'Octomerger'

.github/workflows/update-graphql-files.yml

@@ -9,6 +9,10 @@ on:
   schedule:
     - cron: '20 16 * * *' # run every day at 16:20 UTC / 8:20 PST
 
+permissions:
+  contents: write
+  pull-requests: write
+
 # **IMPORTANT:** Do not change the FREEZE environment variable set here!
 # This workflow runs on a recurring basis. To temporarily disable it (e.g.,
 # during a docs deployment freeze), add an Actions Secret to the repo settings

.github/workflows/workflow-lint.yml

@@ -17,6 +17,9 @@ on:
       - '.github/workflows/*.yml'
       - '.github/workflows/*.yaml'
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     if: ${{ github.repository == 'github/docs-internal' }}

components/DefaultLayout.tsx

@@ -6,6 +6,7 @@ import { SmallFooter } from 'components/page-footer/SmallFooter'
 import { ScrollButton } from 'components/ui/ScrollButton'
 import { SupportSection } from 'components/page-footer/SupportSection'
 import { DeprecationBanner } from 'components/page-header/DeprecationBanner'
+import { RestRepoBanner } from 'components/page-header/RestRepoBanner'
 import { useMainContext } from 'components/context/MainContext'
 import { useTranslation } from 'components/hooks/useTranslation'
 import { useRouter } from 'next/router'
@@ -86,6 +87,7 @@ export const DefaultLayout = (props: Props) => {
       <main className="flex-1 min-width-0">
         <Header />
         <DeprecationBanner />
+        <RestRepoBanner />
 
         {props.children}
 

components/landing/CodeExamples.tsx

@@ -1,5 +1,6 @@
 import { useState } from 'react'
 import { ArrowRightIcon, SearchIcon } from '@primer/octicons-react'
+import { Text } from '@primer/components'
 
 import { useProductLandingContext } from 'components/context/ProductLandingContext'
 import { useTranslation } from 'components/hooks/useTranslation'
@@ -31,6 +32,16 @@ export const CodeExamples = () => {
   return (
     <div>
       <div className="pr-lg-3 mb-5 mt-3">
+        <Text
+          className="ml-1 mr-2"
+          fontWeight="bold"
+          fontSize={2}
+          as="label"
+          htmlFor="searchCodeExamples"
+          id="searchCodeExamples"
+        >
+          Search code examples:
+        </Text>
         <input
           data-testid="code-examples-input"
           className="input-lg py-2 px-3 col-12 col-lg-8 form-control"
@@ -45,9 +56,9 @@ export const CodeExamples = () => {
       <div className="d-flex flex-wrap gutter">
         {(isSearching ? searchResults : productCodeExamples.slice(0, numVisible)).map((example) => {
           return (
-            <div key={example.href} className="col-12 col-xl-4 col-lg-6 mb-4">
+            <li key={example.href} className="col-12 col-xl-4 col-lg-6 mb-4 list-style-none">
               <CodeExampleCard example={example} />
-            </div>
+            </li>
           )
         })}
       </div>

components/landing/GuideCard.tsx

@@ -8,7 +8,7 @@ export const GuideCard = ({ guide }: Props) => {
   const authorString = `@${authors.join(', @')}`
 
   return (
-    <div className="col-lg-4 col-12 mb-4">
+    <li className="col-lg-4 col-12 mb-4 list-style-none">
       <a
         className="Box color-shadow-medium height-full d-block hover-shadow-large no-underline color-fg-default p-5"
         href={guide.href}
@@ -20,36 +20,9 @@ export const GuideCard = ({ guide }: Props) => {
         />
 
         <footer className="d-flex">
-          <div className="mr-1">
-            {authors.length === 1 ? (
-              <img
-                className="avatar avatar-2 circle mr-1"
-                src={`https://github.com/${authors[0]}.png`}
-                alt={`@${authors[0]}`}
-              />
-            ) : (
-              <div className="AvatarStack AvatarStack--three-plus">
-                <div
-                  className="AvatarStack-body tooltipped tooltipped-se tooltipped-align-left-1"
-                  aria-label={authorString}
-                >
-                  {authors.map((author) => {
-                    return (
-                      <img
-                        className="avatar circle"
-                        alt={`@${author}`}
-                        src={`https://github.com/${author}.png`}
-                      />
-                    )
-                  })}
-                </div>
-              </div>
-            )}
-          </div>
-
           <div>{authorString}</div>
         </footer>
       </a>
-    </div>
+    </li>
   )
 }

components/page-header/RestRepoBanner.tsx

@@ -0,0 +1,61 @@
+import React from 'react'
+import { Flash } from '@primer/components'
+import { useRouter } from 'next/router'
+import { Link } from 'components/Link'
+
+const restDisplayPages = [
+  '/rest/reference/branches',
+  '/rest/reference/collaborators',
+  '/rest/reference/commits',
+  '/rest/reference/deployments',
+  '/rest/reference/pages',
+  '/rest/reference/releases',
+  '/rest/reference/repos',
+  '/rest/reference/repository-metrics',
+  '/rest/reference/webhooks',
+]
+const restRepoCategoryExceptionsTitles = {
+  branches: 'Branches',
+  collaborators: 'Collaborators',
+  commits: 'Commits',
+  deployments: 'Deployments',
+  pages: 'GitHub Pages',
+  releases: 'Releases',
+  'repository-metrics': 'Repository metrics',
+  webhooks: 'Webhooks',
+}
+
+export const RestRepoBanner = () => {
+  const router = useRouter()
+  const asPathRoot = router.asPath.split('?')[0].split('#')[0]
+  if (!restDisplayPages.includes(asPathRoot)) {
+    return null
+  }
+
+  const pages = Object.keys(restRepoCategoryExceptionsTitles) as Array<
+    keyof typeof restRepoCategoryExceptionsTitles
+  >
+  const newRestPagesText = pages.map((page, i) => [
+    <React.Fragment key={page}>
+      <Link href={`/${router.locale}/rest/reference/${page}`}>
+        {restRepoCategoryExceptionsTitles[page]}
+      </Link>
+      {i < pages.length - 1 && ', '}
+    </React.Fragment>,
+  ])
+
+  return (
+    <div data-testid="rest-api-repos-banner" className="container-xl mt-3 mx-auto p-responsive">
+      <Flash variant="warning">
+        <p>
+          <b className="text-bold">
+            <span>
+              We've recently moved some of the REST API documentation. If you can't find what you're
+              looking for, you might try the new {newRestPagesText} REST API pages.
+            </span>
+          </b>{' '}
+        </p>
+      </Flash>
+    </div>
+  )
+}

content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/merging-multiple-user-accounts.md

@@ -20,6 +20,12 @@ shortTitle: Merge multiple user accounts
 
 {% endtip %}
 
+{% warning %}
+
+**Warning:** Organization and repository access permissions aren't transferable between accounts. If the account you want to delete has an existing access permission, an organization owner or repository administrator will need to invite the account that you want to keep.
+
+{% endwarning %}
+
 1. [Transfer any repositories](/articles/how-to-transfer-a-repository) from the account you want to delete to the account you want to keep. Issues, pull requests, and wikis are transferred as well. Verify the repositories exist on the account you want to keep.
 2. [Update the remote URLs](/github/getting-started-with-github/managing-remote-repositories) in any local clones of the repositories that were moved.
 3. [Delete the account](/articles/deleting-your-user-account) you no longer want to use.

content/actions/deployment/managing-your-deployments/viewing-deployment-history.md

@@ -24,6 +24,6 @@ To view current and past deployments, click **Environments** on the home page of
 
 The deployments page displays the last active deployment of each environment for your repository. If the deployment includes an environment URL, a **View deployment** button that links to the URL is shown next to the deployment.
 
-The activity log shows the deployment history for your environments. By default, only the most recent deployment for an environment has an `Active` status; all previously active deployments have an `Inactive` status. For more information on automatic inactivation of deployments, see "[Inactive deployments](/rest/reference/repos#inactive-deployments)."
+The activity log shows the deployment history for your environments. By default, only the most recent deployment for an environment has an `Active` status; all previously active deployments have an `Inactive` status. For more information on automatic inactivation of deployments, see "[Inactive deployments](/rest/reference/deployments#inactive-deployments)."
 
 You can also use the REST API to get information about deployments. For more information, see "[Repositories](/rest/reference/repos#deployments)."

content/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners.md

@@ -55,6 +55,13 @@ $ cat ~/actions-runner/.service
 actions.runner.octo-org-octo-repo.runner01.service
 ```
 
+If this fails due to the service being installed elsewhere, you can find the service name in the list of running services. For example, on most Linux systems you can use the `systemctl` command:
+
+```shell
+$ systemctl --type=service | grep actions.runner
+actions.runner.octo-org-octo-repo.hostname.service loaded active running GitHub Actions Runner (octo-org-octo-repo.hostname)
+```
+
 You can use `journalctl` to monitor the real-time activity of the self-hosted runner:
 
 ```shell

content/actions/learn-github-actions/events-that-trigger-workflows.md

@@ -307,7 +307,7 @@ on:
 
 ### `deployment_status`
 
-Runs your workflow anytime a third party provides a deployment status, which triggers the `deployment_status` event. Deployments created with a commit SHA may not have a Git ref. For information about the REST API, see "[Create a deployment status](/rest/reference/repos#create-a-deployment-status)."
+Runs your workflow anytime a third party provides a deployment status, which triggers the `deployment_status` event. Deployments created with a commit SHA may not have a Git ref. For information about the REST API, see "[Create a deployment status](/rest/reference/deployments#create-a-deployment-status)."
 
 | Webhook event payload | Activity types | `GITHUB_SHA` | `GITHUB_REF` |
 | --------------------- | -------------- | ------------ | -------------|
@@ -701,7 +701,7 @@ on:
 
 {% note %}
 
-**Note:** The webhook payload available to GitHub Actions does not include the `added`, `removed`, and `modified` attributes in the `commit` object. You can retrieve the full commit object using the REST API. For more information, see "[Get a commit](/rest/reference/repos#get-a-commit)".
+**Note:** The webhook payload available to GitHub Actions does not include the `added`, `removed`, and `modified` attributes in the `commit` object. You can retrieve the full commit object using the REST API. For more information, see "[Get a commit](/rest/reference/commits#get-a-commit)".
 
 {% endnote %}
 

content/admin/advanced-security/index.md

@@ -15,8 +15,6 @@ children:
   - /enabling-github-advanced-security-for-your-enterprise
   - /configuring-code-scanning-for-your-appliance
   - /configuring-secret-scanning-for-your-appliance
-  - /viewing-your-github-advanced-security-usage
   - /overview-of-github-advanced-security-deployment
   - /deploying-github-advanced-security-in-your-enterprise
 ---
-

content/admin/advanced-security/viewing-your-github-advanced-security-usage.md

@@ -1,33 +0,0 @@
----
-title: Viewing your GitHub Advanced Security usage
-intro: 'You can view usage of your {% data variables.product.prodname_GH_advanced_security %} license.'
-permissions: 'Enterprise owners can view usage for {% data variables.product.prodname_GH_advanced_security %}.'
-product: '{% data reusables.gated-features.ghas %}'
-versions:
-  ghes: '>=3.1'
-type: how_to
-topics:
-  - Advanced Security
-  - Enterprise
-  - Licensing
-shortTitle: View Advanced Security usage
----
-
-## About licenses for {% data variables.product.prodname_GH_advanced_security %}
-
-{% data reusables.advanced-security.about-ghas-license-seats %} For more information, see "[About billing for {% data variables.product.prodname_GH_advanced_security %}](/billing/managing-billing-for-github-advanced-security/about-billing-for-github-advanced-security)."
-
-## Viewing license usage for {% data variables.product.prodname_GH_advanced_security %}
-
-You can check how many seats your license includes and how many seats are currently in use.
-
-{% data reusables.enterprise-accounts.access-enterprise %}
-{% data reusables.enterprise-accounts.settings-tab %}
-{% data reusables.enterprise-accounts.license-tab %}
-   The "{% data variables.product.prodname_GH_advanced_security %}" section shows details of the current usage. You can see the total number of seats used, as well as a table with the number of committers and unique committers for each organization.
-  ![{% data variables.product.prodname_GH_advanced_security %} section of Enterprise license](/assets/images/help/billing/ghas-orgs-list-enterprise-ghes.png)
-5. Optionally, click the name of an organization where you are an owner to display the security and analysis settings for the organization.
-  ![Owned organization in {% data variables.product.prodname_GH_advanced_security %} section of enterprise billing settings](/assets/images/help/billing/ghas-orgs-list-enterprise-click-org.png)
-6. On the "Security & analysis" settings page, scroll to the "{% data variables.product.prodname_GH_advanced_security %} repositories" section to see a detailed breakdown of usage by repository for this organization.
-  ![{% data variables.product.prodname_GH_advanced_security %} repositories section](/assets/images/help/enterprises/settings-security-analysis-ghas-repos-list.png)
-  For more information, see "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)."

content/admin/authentication/authenticating-users-for-your-github-enterprise-server-instance/disabling-unauthenticated-sign-ups.md

@@ -1,7 +1,7 @@
 ---
 title: Disabling unauthenticated sign-ups
 redirect_from:
-  - /enterprise/admin/articles/disabling-sign-ups/
+  - /enterprise/admin/articles/disabling-sign-ups
   - /enterprise/admin/user-management/disabling-unauthenticated-sign-ups
   - /enterprise/admin/authentication/disabling-unauthenticated-sign-ups
   - /admin/authentication/disabling-unauthenticated-sign-ups

content/admin/authentication/authenticating-users-for-your-github-enterprise-server-instance/index.md

@@ -2,10 +2,10 @@
 title: Authenticating users for your GitHub Enterprise Server instance
 intro: 'You can use {% data variables.product.prodname_ghe_server %}''s built-in authentication, or choose between CAS, LDAP, or SAML to integrate your existing accounts and centrally manage user access to {% data variables.product.product_location %}.'
 redirect_from:
-  - /enterprise/admin/categories/authentication/
-  - /enterprise/admin/guides/installation/user-authentication/
-  - /enterprise/admin/articles/inviting-users/
-  - /enterprise/admin/guides/migrations/authenticating-users-for-your-github-enterprise-instance/
+  - /enterprise/admin/categories/authentication
+  - /enterprise/admin/guides/installation/user-authentication
+  - /enterprise/admin/articles/inviting-users
+  - /enterprise/admin/guides/migrations/authenticating-users-for-your-github-enterprise-instance
   - /enterprise/admin/user-management/authenticating-users-for-your-github-enterprise-server-instance
   - /enterprise/admin/authentication/authenticating-users-for-your-github-enterprise-server-instance
 versions:

content/admin/authentication/authenticating-users-for-your-github-enterprise-server-instance/using-cas.md

@@ -1,8 +1,8 @@
 ---
 title: Using CAS
 redirect_from:
-  - /enterprise/admin/articles/configuring-cas-authentication/
-  - /enterprise/admin/articles/about-cas-authentication/
+  - /enterprise/admin/articles/configuring-cas-authentication
+  - /enterprise/admin/articles/about-cas-authentication
   - /enterprise/admin/user-management/using-cas
   - /enterprise/admin/authentication/using-cas
   - /admin/authentication/using-cas

content/admin/authentication/authenticating-users-for-your-github-enterprise-server-instance/using-ldap.md

@@ -1,11 +1,11 @@
 ---
 title: Using LDAP
 redirect_from:
-  - /enterprise/admin/articles/configuring-ldap-authentication/
-  - /enterprise/admin/articles/about-ldap-authentication/
-  - /enterprise/admin/articles/viewing-ldap-users/
-  - /enterprise/admin/hidden/enabling-ldap-sync/
-  - /enterprise/admin/hidden/ldap-sync/
+  - /enterprise/admin/articles/configuring-ldap-authentication
+  - /enterprise/admin/articles/about-ldap-authentication
+  - /enterprise/admin/articles/viewing-ldap-users
+  - /enterprise/admin/hidden/enabling-ldap-sync
+  - /enterprise/admin/hidden/ldap-sync
   - /enterprise/admin/user-management/using-ldap
   - /enterprise/admin/authentication/using-ldap
   - /admin/authentication/using-ldap

content/admin/authentication/authenticating-users-for-your-github-enterprise-server-instance/using-saml.md

@@ -1,8 +1,8 @@
 ---
 title: Using SAML
 redirect_from:
-  - /enterprise/admin/articles/configuring-saml-authentication/
-  - /enterprise/admin/articles/about-saml-authentication/
+  - /enterprise/admin/articles/configuring-saml-authentication
+  - /enterprise/admin/articles/about-saml-authentication
   - /enterprise/admin/user-management/using-saml
   - /enterprise/admin/authentication/using-saml
   - /admin/authentication/using-saml

content/admin/authentication/managing-your-enterprise-users-with-your-identity-provider/index.md

@@ -4,7 +4,7 @@ shortTitle: Manage users with your IdP
 product: '{% data reusables.gated-features.emus %}'
 intro: You can manage identity and access with your identity provider and provision accounts that can only contribute to your enterprise.
 redirect_from:
-  - /github/setting-up-and-managing-your-enterprise/managing-your-enterprise-users-with-your-identity-provider/
+  - /github/setting-up-and-managing-your-enterprise/managing-your-enterprise-users-with-your-identity-provider
 versions:
   ghec: '*'
 topics:

content/admin/configuration/configuring-network-settings/configuring-a-hostname.md

@@ -2,7 +2,7 @@
 title: Configuring a hostname
 intro: We recommend setting a hostname for your appliance instead of using a hard-coded IP address.
 redirect_from:
-  - /enterprise/admin/guides/installation/configuring-hostnames/
+  - /enterprise/admin/guides/installation/configuring-hostnames
   - /enterprise/admin/installation/configuring-a-hostname
   - /enterprise/admin/configuration/configuring-a-hostname
   - /admin/configuration/configuring-a-hostname

content/admin/configuration/configuring-network-settings/configuring-an-outbound-web-proxy-server.md

@@ -2,7 +2,7 @@
 title: Configuring an outbound web proxy server
 intro: 'A proxy server provides an additional level of security for {% data variables.product.product_location %}.'
 redirect_from:
-  - /enterprise/admin/guides/installation/configuring-a-proxy-server/
+  - /enterprise/admin/guides/installation/configuring-a-proxy-server
   - /enterprise/admin/installation/configuring-an-outbound-web-proxy-server
   - /enterprise/admin/configuration/configuring-an-outbound-web-proxy-server
   - /admin/configuration/configuring-an-outbound-web-proxy-server

content/admin/configuration/configuring-network-settings/configuring-built-in-firewall-rules.md

@@ -2,7 +2,7 @@
 title: Configuring built-in firewall rules
 intro: 'You can view default firewall rules and customize rules for {% data variables.product.product_location %}.'
 redirect_from:
-  - /enterprise/admin/guides/installation/configuring-firewall-settings/
+  - /enterprise/admin/guides/installation/configuring-firewall-settings
   - /enterprise/admin/installation/configuring-built-in-firewall-rules
   - /enterprise/admin/configuration/configuring-built-in-firewall-rules
   - /admin/configuration/configuring-built-in-firewall-rules

content/admin/configuration/configuring-network-settings/configuring-dns-nameservers.md

@@ -2,7 +2,7 @@
 title: Configuring DNS nameservers
 intro: '{% data variables.product.prodname_ghe_server %} uses the dynamic host configuration protocol (DHCP) for DNS settings when DHCP leases provide nameservers. If nameservers are not provided by a dynamic host configuration protocol (DHCP) lease, or if you need to use specific DNS settings, you can specify the nameservers manually.'
 redirect_from:
-  - /enterprise/admin/guides/installation/about-dns-nameservers/
+  - /enterprise/admin/guides/installation/about-dns-nameservers
   - /enterprise/admin/installation/configuring-dns-nameservers
   - /enterprise/admin/configuration/configuring-dns-nameservers
   - /admin/configuration/configuring-dns-nameservers

content/admin/configuration/configuring-network-settings/configuring-tls.md

@@ -2,8 +2,8 @@
 title: Configuring TLS
 intro: 'You can configure Transport Layer Security (TLS) on {% data variables.product.product_location %} so that you can use a certificate that is signed by a trusted certificate authority.'
 redirect_from:
-  - /enterprise/admin/articles/ssl-configuration/
-  - /enterprise/admin/guides/installation/about-tls/
+  - /enterprise/admin/articles/ssl-configuration
+  - /enterprise/admin/guides/installation/about-tls
   - /enterprise/admin/installation/configuring-tls
   - /enterprise/admin/configuration/configuring-tls
   - /admin/configuration/configuring-tls

content/admin/configuration/configuring-network-settings/enabling-subdomain-isolation.md

@@ -2,7 +2,7 @@
 title: Enabling subdomain isolation
 intro: 'You can set up subdomain isolation to securely separate user-supplied content from other portions of your {% data variables.product.prodname_ghe_server %} appliance.'
 redirect_from:
-  - /enterprise/admin/guides/installation/about-subdomain-isolation/
+  - /enterprise/admin/guides/installation/about-subdomain-isolation
   - /enterprise/admin/installation/enabling-subdomain-isolation
   - /enterprise/admin/configuration/enabling-subdomain-isolation
   - /admin/configuration/enabling-subdomain-isolation

content/admin/configuration/configuring-network-settings/index.md

@@ -1,10 +1,10 @@
 ---
 title: Configuring network settings
 redirect_from:
-  - /enterprise/admin/guides/installation/dns-hostname-subdomain-isolation-and-ssl/
-  - /enterprise/admin/articles/about-dns-ssl-and-subdomain-settings/
-  - /enterprise/admin/articles/configuring-dns-ssl-and-subdomain-settings/
-  - /enterprise/admin/guides/installation/configuring-your-github-enterprise-network-settings/
+  - /enterprise/admin/guides/installation/dns-hostname-subdomain-isolation-and-ssl
+  - /enterprise/admin/articles/about-dns-ssl-and-subdomain-settings
+  - /enterprise/admin/articles/configuring-dns-ssl-and-subdomain-settings
+  - /enterprise/admin/guides/installation/configuring-your-github-enterprise-network-settings
   - /enterprise/admin/installation/configuring-your-github-enterprise-server-network-settings
   - /enterprise/admin/configuration/configuring-network-settings
 intro: 'Configure {% data variables.product.prodname_ghe_server %} with the DNS nameservers and hostname required in your network. You can also configure a proxy server or firewall rules. You must allow access to certain ports for administrative and user purposes.'

content/admin/configuration/configuring-network-settings/network-ports.md

@@ -1,10 +1,10 @@
 ---
 title: Network ports
 redirect_from:
-  - /enterprise/admin/articles/configuring-firewalls/
-  - /enterprise/admin/articles/firewall/
-  - /enterprise/admin/guides/installation/network-configuration/
-  - /enterprise/admin/guides/installation/network-ports-to-open/
+  - /enterprise/admin/articles/configuring-firewalls
+  - /enterprise/admin/articles/firewall
+  - /enterprise/admin/guides/installation/network-configuration
+  - /enterprise/admin/guides/installation/network-ports-to-open
   - /enterprise/admin/installation/network-ports
   - /enterprise/admin/configuration/network-ports
   - /admin/configuration/network-ports

content/admin/configuration/configuring-network-settings/using-github-enterprise-server-with-a-load-balancer.md

@@ -2,7 +2,7 @@
 title: Using GitHub Enterprise Server with a load balancer
 intro: 'Use a load balancer in front of a single {% data variables.product.prodname_ghe_server %} appliance or a pair of appliances in a High Availability configuration.'
 redirect_from:
-  - /enterprise/admin/guides/installation/using-github-enterprise-with-a-load-balancer/
+  - /enterprise/admin/guides/installation/using-github-enterprise-with-a-load-balancer
   - /enterprise/admin/installation/using-github-enterprise-server-with-a-load-balancer
   - /enterprise/admin/configuration/using-github-enterprise-server-with-a-load-balancer
   - /admin/configuration/using-github-enterprise-server-with-a-load-balancer

content/admin/configuration/configuring-your-enterprise/accessing-the-administrative-shell-ssh.md

@@ -1,13 +1,13 @@
 ---
 title: Accessing the administrative shell (SSH)
 redirect_from:
-  - /enterprise/admin/articles/ssh-access/
-  - /enterprise/admin/articles/adding-an-ssh-key-for-shell-access/
-  - /enterprise/admin/guides/installation/administrative-shell-ssh-access/
-  - /enterprise/admin/articles/troubleshooting-ssh-permission-denied-publickey/
-  - /enterprise/admin/2.13/articles/troubleshooting-ssh-permission-denied-publickey/
-  - /enterprise/admin/2.14/articles/troubleshooting-ssh-permission-denied-publickey/
-  - /enterprise/admin/2.15/articles/troubleshooting-ssh-permission-denied-publickey/
+  - /enterprise/admin/articles/ssh-access
+  - /enterprise/admin/articles/adding-an-ssh-key-for-shell-access
+  - /enterprise/admin/guides/installation/administrative-shell-ssh-access
+  - /enterprise/admin/articles/troubleshooting-ssh-permission-denied-publickey
+  - /enterprise/admin/2.13/articles/troubleshooting-ssh-permission-denied-publickey
+  - /enterprise/admin/2.14/articles/troubleshooting-ssh-permission-denied-publickey
+  - /enterprise/admin/2.15/articles/troubleshooting-ssh-permission-denied-publickey
   - /enterprise/admin/installation/accessing-the-administrative-shell-ssh
   - /enterprise/admin/configuration/accessing-the-administrative-shell-ssh
   - /admin/configuration/accessing-the-administrative-shell-ssh

content/admin/configuration/configuring-your-enterprise/accessing-the-management-console.md

@@ -2,12 +2,12 @@
 title: Accessing the management console
 intro: '{% data reusables.enterprise_site_admin_settings.about-the-management-console %}'
 redirect_from:
-  - /enterprise/admin/articles/about-the-management-console/
-  - /enterprise/admin/articles/management-console-for-emergency-recovery/
-  - /enterprise/admin/articles/web-based-management-console/
-  - /enterprise/admin/categories/management-console/
-  - /enterprise/admin/articles/accessing-the-management-console/
-  - /enterprise/admin/guides/installation/web-based-management-console/
+  - /enterprise/admin/articles/about-the-management-console
+  - /enterprise/admin/articles/management-console-for-emergency-recovery
+  - /enterprise/admin/articles/web-based-management-console
+  - /enterprise/admin/categories/management-console
+  - /enterprise/admin/articles/accessing-the-management-console
+  - /enterprise/admin/guides/installation/web-based-management-console
   - /enterprise/admin/installation/accessing-the-management-console
   - /enterprise/admin/configuration/accessing-the-management-console
   - /admin/configuration/accessing-the-management-console

content/admin/configuration/configuring-your-enterprise/command-line-utilities.md

@@ -2,8 +2,8 @@
 title: Command-line utilities
 intro: '{% data variables.product.prodname_ghe_server %} includes a variety of utilities to help resolve particular problems or perform specific tasks.'
 redirect_from:
-  - /enterprise/admin/articles/viewing-all-services/
-  - /enterprise/admin/articles/command-line-utilities/
+  - /enterprise/admin/articles/viewing-all-services
+  - /enterprise/admin/articles/command-line-utilities
   - /enterprise/admin/installation/command-line-utilities
   - /enterprise/admin/configuration/command-line-utilities
   - /admin/configuration/command-line-utilities

content/admin/configuration/configuring-your-enterprise/configuring-backups-on-your-appliance.md

@@ -2,15 +2,15 @@
 title: Configuring backups on your appliance
 shortTitle: Configuring backups
 redirect_from:
-  - /enterprise/admin/categories/backups-and-restores/
-  - /enterprise/admin/articles/backup-and-recovery/
-  - /enterprise/admin/articles/backing-up-github-enterprise/
-  - /enterprise/admin/articles/restoring-github-enterprise/
-  - /enterprise/admin/articles/backing-up-repository-data/
-  - /enterprise/admin/articles/restoring-enterprise-data/
-  - /enterprise/admin/articles/restoring-repository-data/
-  - /enterprise/admin/articles/backing-up-enterprise-data/
-  - /enterprise/admin/guides/installation/backups-and-disaster-recovery/
+  - /enterprise/admin/categories/backups-and-restores
+  - /enterprise/admin/articles/backup-and-recovery
+  - /enterprise/admin/articles/backing-up-github-enterprise
+  - /enterprise/admin/articles/restoring-github-enterprise
+  - /enterprise/admin/articles/backing-up-repository-data
+  - /enterprise/admin/articles/restoring-enterprise-data
+  - /enterprise/admin/articles/restoring-repository-data
+  - /enterprise/admin/articles/backing-up-enterprise-data
+  - /enterprise/admin/guides/installation/backups-and-disaster-recovery
   - /enterprise/admin/installation/configuring-backups-on-your-appliance
   - /enterprise/admin/configuration/configuring-backups-on-your-appliance
   - /admin/configuration/configuring-backups-on-your-appliance

content/admin/configuration/configuring-your-enterprise/configuring-email-for-notifications.md

@@ -2,10 +2,10 @@
 title: Configuring email for notifications
 intro: 'To make it easy for users to respond quickly to activity on {% data variables.product.product_name %}, you can configure {% data variables.product.product_location %} to send email notifications for issue, pull request, and commit comments.'
 redirect_from:
-  - /enterprise/admin/guides/installation/email-configuration/
-  - /enterprise/admin/articles/configuring-email/
-  - /enterprise/admin/articles/troubleshooting-email/
-  - /enterprise/admin/articles/email-configuration-and-troubleshooting/
+  - /enterprise/admin/guides/installation/email-configuration
+  - /enterprise/admin/articles/configuring-email
+  - /enterprise/admin/articles/troubleshooting-email
+  - /enterprise/admin/articles/email-configuration-and-troubleshooting
   - /enterprise/admin/user-management/configuring-email-for-notifications
   - /admin/configuration/configuring-email-for-notifications
 versions: