Merge branch 'main' into patch-3

.github/workflows/automerge.yml

@@ -1,4 +1,4 @@
-name: automerge
+name: Automerge
 
 # **What it does**: Pull requests with label "automerge" or "autosquash" will automatically merge.
 # **Why we have it**: While now this is a feature built into GitHub, we still use it as part of other automation.

.github/workflows/autoupdate-branch.yml

@@ -1,4 +1,4 @@
-name: autoupdate branch
+name: Autoupdate branch
 
 # **What it does**: Any pull requests with "autoupdate" label will get main branch updates.
 # **Why we have it**: Our repo-sync automation relies on it.

.github/workflows/crowdin.yml

@@ -14,6 +14,9 @@ jobs:
     name: Sync with Crowdin
     if: github.repository == 'github/docs-internal'
     runs-on: ubuntu-latest
+    # A sync's average run time is ~3.2 hours.
+    # This sets a maximum execution time of 300 minutes (5 hours) to prevent the workflow from running longer than necessary.
+    timeout-minutes: 300
     steps:
       - name: Checkout
         uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
@@ -59,3 +62,24 @@ jobs:
           # See https://crowdin.com/settings#api-key to generate a token
           # This token was created by logging into Crowdin with the octoglot user
           CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+
+      # When the maximum execution time is reached for this job, Actions cancels the workflow run.
+      # This emits a notification for the first responder to triage.
+      - name: Send Slack notification if workflow is cancelled
+        uses: someimportantcompany/github-actions-slack-message@f8d28715e7b8a4717047d23f48c39827cacad340
+        if: cancelled()
+        with:
+          channel: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
+          bot-token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
+          color: failure
+          text: The last Crowdin Sync run for ${{github.repository}} was cancelled. Please try running the workflow manually; see https://github.com/${{github.repository}}/actions/workflows/crowdin.yml
+
+      # Emit a notification for the first responder to triage if the workflow failed.
+      - name: Send Slack notification if workflow failed
+        uses: someimportantcompany/github-actions-slack-message@f8d28715e7b8a4717047d23f48c39827cacad340
+        if: failure()
+        with:
+          channel: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
+          bot-token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
+          color: failure
+          text: The last Crowdin Sync run for ${{github.repository}} failed. See https://github.com/${{github.repository}}/actions/workflows/crowdin.yml

.github/workflows/link-check-ghec.yml

@@ -0,0 +1,36 @@
+name: 'Link Checker: Enterprise Cloud'
+
+# **What it does**: This checks links for GHEC version of docs.
+# **Why we have it**: We want to know if links break.
+# **Who does it impact**: Docs content.
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+
+      - name: Setup node
+        uses: actions/setup-node@270253e841af726300e85d718a5f606959b2903c
+        with:
+          node-version: 16.8.x
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: 'Link check: Enterprise Cloud'
+        env:
+          DOCS_VERSION: 'enterprise-cloud'
+        run: npm run link-check

.github/workflows/move-ready-to-merge-pr.yaml

@@ -11,6 +11,7 @@ on:
 
 permissions:
   pull-requests: write
+  issues: write
 
 jobs:
   unmark_for_review:

.github/workflows/site-policy-sync.yml

@@ -1,4 +1,4 @@
-name: site-policy-sync
+name: Site policy sync
 
 # **What it does**: Updates our site-policy repo when changes happen to site policy docs.
 # **Why we have it**: We want keep site-policy repo up to date.

.github/workflows/staging-build-pr.yml

@@ -30,7 +30,7 @@ jobs:
 
   build-pr:
     if: ${{ github.repository == 'github/docs-internal' || github.repository == 'github/docs' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
     timeout-minutes: 5
     # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
     # progress for this PR branch.
@@ -127,10 +127,6 @@ jobs:
             app.json \
             Procfile
 
-          ls -lh app.tar
-          zstd -q app.tar -o app.tar.zst
-          ls -lh app.tar.zst
-
       # Upload only the files needed to run this application.
       # We are not willing to trust the rest (e.g. script/) for the remainder
       # of the deployment process.
@@ -138,4 +134,4 @@ jobs:
         uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074
         with:
           name: pr_build
-          path: app.tar.zst
+          path: app.tar

.github/workflows/staging-deploy-pr.yml

@@ -251,7 +251,7 @@ jobs:
   prepare-for-deploy:
     needs: [pr-metadata, check-pr-before-prepare]
     if: ${{ needs.check-pr-before-prepare.outputs.pull_request_state == 'open' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
     timeout-minutes: 5
     # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
     # progress for this PR branch.
@@ -323,14 +323,17 @@ jobs:
           name: pr_build
           path: ${{ runner.temp }}
 
-      - name: Extract user-changes to temp directory
+      # For security reasons, only extract the tar from docs-internal
+      # This allows us to add search indexes and early access content to the build
+      - if: ${{ github.repository == 'github/docs-internal' }}
+        name: Extract user-changes to temp directory
         run: |
-          zstd -d -q $RUNNER_TEMP/app.tar.zst -o $RUNNER_TEMP/app.tar
           mkdir $RUNNER_TEMP/app
           tar -x --file=$RUNNER_TEMP/app.tar -C "$RUNNER_TEMP/app/"
 
       # Move the LFS content into the temp directory in chunks (destructively)
-      - name: Move the LFS objects
+      - if: ${{ github.repository == 'github/docs-internal' }}
+        name: Move the LFS objects
         run: |
           git lfs ls-files --name-only | xargs -n 1 -I {} sh -c 'mkdir -p "$RUNNER_TEMP/app/$(dirname {})"; mv {} "$RUNNER_TEMP/app/$(dirname {})/"'
 
@@ -342,9 +345,15 @@ jobs:
           mv content/early-access "$RUNNER_TEMP/app/content/"
           mv data/early-access "$RUNNER_TEMP/app/data/"
 
-      - name: Create a gzipped archive
+      - if: ${{ github.repository == 'github/docs-internal' }}
+        name: Create a gzipped archive (docs-internal)
         run: tar -cz --file app.tar.gz "$RUNNER_TEMP/app/"
 
+      # gzip the app.tar from github/docs so we're working with the same format
+      - if: ${{ github.repository == 'github/docs' }}
+        name: Create a gzipped archive (docs)
+        run: gzip -9 < "$RUNNER_TEMP/app.tar" > app.tar.gz
+
       - name: Create a Heroku build source
         id: build-source
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
@@ -447,7 +456,7 @@ jobs:
   deploy:
     needs: [pr-metadata, prepare-for-deploy, check-pr-before-deploy]
     if: ${{ needs.check-pr-before-deploy.outputs.pull_request_state == 'open' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
     timeout-minutes: 10
     # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
     # progress for this PR branch.

.github/workflows/test-windows.yml

@@ -23,7 +23,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        test-group: [content, graphql, meta, rendering, routing, unit, linting]
+        test-group:
+          [
+            content,
+            graphql,
+            meta,
+            rendering,
+            routing,
+            unit,
+            linting,
+            translations,
+          ]
     steps:
       - name: Check out repo
         uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97

.github/workflows/test.yml

@@ -26,7 +26,17 @@ jobs:
       fail-fast: false
       matrix:
         # The same array lives in test-windows.yml, so make any updates there too.
-        test-group: [content, graphql, meta, rendering, routing, unit, linting]
+        test-group:
+          [
+            content,
+            graphql,
+            meta,
+            rendering,
+            routing,
+            unit,
+            linting,
+            translations,
+          ]
     steps:
       # Each of these ifs needs to be repeated at each step to make sure the required check still runs
       # Even if if doesn't do anything

.github/workflows/transfer-to-localization-repo.yml

@@ -0,0 +1,72 @@
+name: Copy to REST API issue to docs-content
+
+# **What it does**: Copies an issue in the open source repo to the docs-content repo, comments on and closes the original issue
+# **Why we have it**: REST API updates cannot be made in the open source repo. Instead, we copy the issue to an internal issue (we do not transfer so that the issue does not disappear for the contributor) and close the original issue.
+# **Who does it impact**: Open source and docs-content maintainers
+
+permissions:
+  contents: write
+
+on:
+  issues:
+    types:
+      - labeled
+
+jobs:
+  transfer-issue:
+    name: Transfer issue
+    runs-on: ubuntu-latest
+    if: (github.event.label.name == 'localization ' && github.repository == 'github/docs')
+    steps:
+      - name: Check if this run was triggered by a member of the docs team
+        uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
+        id: triggered-by-member
+        with:
+          github-token: ${{secrets.DOCUBOT_READORG_REPO_WORKFLOW_SCOPES}}
+          result-encoding: string
+          script: |
+            const triggerer_login = context.payload.sender.login
+            const teamMembers = await github.request(
+              `/orgs/github/teams/docs/members?per_page=100`
+            )
+            const logins = teamMembers.data.map(member => member.login)
+            if (logins.includes(triggerer_login)) {
+              console.log(`This workflow was triggered by ${triggerer_login} (on the docs team).`)
+              return 'true'
+            }
+            console.log(`This workflow was triggered by ${triggerer_login} (not on the docs team), so no action will be taken.`)
+            return 'false'
+
+      - name: Exit if not triggered by a docs team member
+        if: steps.triggered-by-member.outputs.result == 'false'
+        run: |
+          echo Aborting. This workflow must be triggered by a member of the docs team.
+          exit 1
+
+      - name: Create an issue in the localization repo
+        run: |
+          new_issue_url="$(gh issue create --title "$ISSUE_TITLE" --body "$ISSUE_BODY" --repo github/localization)"
+          echo 'NEW_ISSUE='$new_issue_url >> $GITHUB_ENV
+        env:
+          GITHUB_TOKEN: ${{secrets.DOCUBOT_READORG_REPO_WORKFLOW_SCOPES}}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
+
+      - name: Comment on the new issue
+        run: gh issue comment $NEW_ISSUE --body "This issue was originally opened in the open source repo as $OLD_ISSUE"
+        env:
+          GITHUB_TOKEN: ${{secrets.DOCUBOT_READORG_REPO_WORKFLOW_SCOPES}}
+          NEW_ISSUE: ${{ env.NEW_ISSUE }}
+          OLD_ISSUE: ${{ github.event.issue.html_url }}
+
+      - name: Comment on the old issue
+        run: gh issue comment $OLD_ISSUE --body "Thank you for opening this issue! Updates to translated content must be made internally. I have copied your issue to an internal issue, so I will close this issue."
+        env:
+          GITHUB_TOKEN: ${{secrets.DOCUBOT_READORG_REPO_WORKFLOW_SCOPES}}
+          OLD_ISSUE: ${{ github.event.issue.html_url }}
+
+      - name: Close the old issue
+        run: gh issue close $OLD_ISSUE
+        env:
+          GITHUB_TOKEN: ${{secrets.DOCUBOT_READORG_REPO_WORKFLOW_SCOPES}}
+          OLD_ISSUE: ${{ github.event.issue.html_url }}

.github/workflows/triage-stale-check.yml

@@ -21,7 +21,7 @@ jobs:
           days-before-pr-stale: 7
           days-before-pr-close: 3
           stale-pr-label: 'stale'
-          exempt-pr-labels: 'waiting for review,never-stale'
+          exempt-pr-labels: 'waiting for review,never-stale, ready to merge'
   stale_staff:
     if: github.repository == 'github/docs'
     runs-on: ubuntu-latest