Merge branch 'main' into fix/pull-request-template-translated-content-link

.github/actions-scripts/create-enterprise-issue.js

@@ -86,7 +86,7 @@ async function run() {
     'utf8'
   )
   const issueLabels =
-    milestone === 'release' ? ['enterprise release'] : ['enterprise deprecation', 'priority-3']
+    milestone === 'release' ? ['enterprise release'] : ['enterprise deprecation', 'priority-4', 'batch', 'time sensitive']
   const issueTitle = `[${nextMilestoneDate}] Enterprise Server ${versionNumber} ${milestone} (technical steps)`
 
   const issueBody = `GHES ${versionNumber} ${milestone} occurs on ${nextMilestoneDate}.

.github/allowed-actions.js

@@ -10,8 +10,8 @@ export default [
   'actions/setup-node@38d90ce44d5275ad62cc48384b3d8a58c500bb5f', // v2.2.0
   'actions/stale@cdf15f641adb27a71842045a94023bef6945e3aa', // v4.0.0
   'actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074', // v2.2.4
-  'alex-page/github-project-automation-plus@fdb7991b72040d611e1123d2b75ff10eda9372c9',
-  'andymckay/labeler@22d5392de2b725cea4b284df5824125054049d84',
+  'alex-page/github-project-automation-plus@bb266ff4dde9242060e2d5418e120a133586d488', // v0.8.1
+  'andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90', // v1.0.4
   'crowdin/github-action@d7f217268068f1244883a993379d62d816f84f25', // v1.4.0
   'crykn/copy_folder_to_another_repo_action@0282e8b9fef06de92ddcae9fe6cb44df6226646c',
   'cschleiden/actions-linter@caffd707beda4fc6083926a3dff48444bc7c24aa', // uses github-actions-parser v0.23.0
@@ -31,7 +31,6 @@ export default [
   'peter-evans/create-pull-request@7380612b49221684fefa025244f2ef4008ae50ad', // v3.10.1
   'peter-evans/find-comment@0da1f4fc1f20cd898368bd56089d391df418f52f',
   'rachmari/actions-add-new-issue-to-column@1a459ef92308ba7c9c9dc2fcdd72f232495574a9',
-  'rachmari/labeler@832d42ec5523f3c6d46e8168de71cd54363e3e2e',
   'repo-sync/github-sync@3832fe8e2be32372e1b3970bbae8e7079edeec88',
   'repo-sync/pull-request@65194d8015be7624d231796ddee1cd52a5023cb3', // v2.6
   'someimportantcompany/github-actions-slack-message@0b470c14b39da4260ed9e3f9a4f1298a74ccdefd',

.github/dependabot.yml

@@ -9,4 +9,4 @@ updates:
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
-      interval: weekly
+      interval: monthly

.github/workflows/crowdin.yml

@@ -27,6 +27,8 @@ jobs:
       - name: Sync
         uses: crowdin/github-action@d7f217268068f1244883a993379d62d816f84f25
         with:
+          # This option enables the transfer of existing translations in this project to Crowdin.
+          # We explicitly set this to `false` since we only want to use the downloaded translations managed by Crowdin.
           upload_translations: false
           download_translations: true
           create_pull_request: true

.github/workflows/first-responder-docs-content.yml

@@ -48,7 +48,7 @@ jobs:
             console.log(`This issue or pull request was authored by an external contributor.`)
             return 'false'
       - name: Label external contributor pull requests with docs-content-fr
-        uses: rachmari/labeler@832d42ec5523f3c6d46e8168de71cd54363e3e2e
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
         if: steps.set-result.outputs.result == 'false'
         with:
           repo-token: '${{ secrets.DOCUBOT_READORG_REPO_WORKFLOW_SCOPES }}'
@@ -89,7 +89,7 @@ jobs:
             })
       - name: Remove docs-content-fr label if not already removed
         if: github.event.action == 'closed'
-        uses: rachmari/labeler@832d42ec5523f3c6d46e8168de71cd54363e3e2e
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
         with:
           repo-token: '${{ secrets.DOCUBOT_READORG_REPO_WORKFLOW_SCOPES }}'
           remove-labels: 'docs-content-fr'

.github/workflows/move-help-wanted-issues.yml

@@ -9,13 +9,19 @@ on:
     types:
       - labeled
 
+permissions:
+  issues: none
+
 jobs:
   move_issues:
-    if: github.repository == 'github/docs' && (github.event.label.name == 'help wanted' || github.event.label.name == 'good first issue')
+    if: >-
+      ${{
+        github.repository == 'github/docs' &&
+        (github.event.label.name == 'help wanted' || github.event.label.name == 'good first issue')
+      }}
     runs-on: ubuntu-latest
-
     steps:
-      - uses: alex-page/github-project-automation-plus@fdb7991b72040d611e1123d2b75ff10eda9372c9
+      - uses: alex-page/github-project-automation-plus@bb266ff4dde9242060e2d5418e120a133586d488
         with:
           project: Docs team reviews
           column: Help wanted

.github/workflows/move-ready-to-merge-pr.yaml

@@ -9,19 +9,27 @@ on:
     types:
       - labeled
 
+permissions:
+  pull-requests: write
+
 jobs:
   unmark_for_review:
-    if: github.repository == 'github/docs' && github.event.label.name == 'ready to merge'
+    if: >-
+      ${{
+        github.repository == 'github/docs' &&
+        github.event.label.name == 'ready to merge'
+      }}
     runs-on: ubuntu-latest
     steps:
       - name: move PR
-        uses: alex-page/github-project-automation-plus@fdb7991b72040d611e1123d2b75ff10eda9372c9
+        uses: alex-page/github-project-automation-plus@bb266ff4dde9242060e2d5418e120a133586d488
         with:
           project: Docs team reviews
           column: Triage
           repo-token: ${{ secrets.DOCUBOT_READORG_REPO_WORKFLOW_SCOPES }}
+
       - name: remove label
-        uses: andymckay/labeler@22d5392de2b725cea4b284df5824125054049d84
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
         with:
+          ignore-if-assigned: 'false'
           remove-labels: 'waiting for review'
-          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/move-reopened-issues-to-triage.yaml

@@ -37,5 +37,5 @@ jobs:
                 }
               }
             } catch(e) {
-              console.log(error);
+              console.log(e);
             }

.github/workflows/notify-when-maintainers-cannot-edit.yaml

@@ -0,0 +1,64 @@
+name: Notify When Maintainers Cannot Edit
+
+# **What it does**: Notifies the author of a PR when their PR does not allow maintainers to edit it.
+# **Why we have it**: To prevent having to do this manually.
+# **Who does it impact**: Open-source.
+
+on:
+  pull_request_target:
+    types:
+      - opened
+
+permissions:
+  pull-requests: write
+
+jobs:
+  notify-when-maintainers-cannot-edit:
+    if: github.repository == 'github/docs'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
+        with:
+          script: |
+            const query = `
+              query($number: Int!) {
+                repository(owner: "github", name: "docs") {
+                  pullRequest(number: $number) {
+                    headRepositoryOwner {
+                      login
+                    }
+                    maintainerCanModify
+                  }
+                }
+              }
+            `;
+
+            const pullNumber = context.issue.number;
+            const variables = { number: pullNumber };
+
+            try {
+              console.log(`Check github/docs#${pullNumber} for maintainer edit access ...`);
+              const result = await github.graphql(query, variables);
+
+              console.log(JSON.stringify(result, null, 2));
+
+              const pullRequest = result.repository.pullRequest;
+
+              if (pullRequest.headRepositoryOwner.login === 'github') {
+                console.log('PR owned by github');
+                return;
+              }
+
+              if (!pullRequest.maintainerCanModify) {
+                console.log('PR not owned by github and does not have maintainer edits enabled');
+
+                await github.issues.createComment({
+                  issue_number: pullNumber,
+                  owner: 'github',
+                  repo: 'docs',
+                  body: "Thanks for submitting a PR to the GitHub Docs project!\n\nIn order to review and merge PRs most efficiently, we require that all PRs grant maintainer edit access before we review them. For information on how to do this, [see the documentation](https://docs.github.com/en/github/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork)."
+                });
+              }
+            } catch(e) {
+              console.log(e);
+            }

.github/workflows/openapi-decorate.yml

@@ -5,23 +5,28 @@ name: OpenAPI generate decorated schema files
 # **Who does it impact**: Anyone making OpenAPI changes in `github/github`, and wanting to get them published on the docs site.
 
 on:
-  workflow_dispatch:
   pull_request:
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   generate-decorated-files:
-    if: github.event.pull_request.user.login == 'github-openapi-bot'
+    if: >-
+      ${{
+        github.repository == 'github/docs-internal' &&
+        github.event.pull_request.user.login == 'github-openapi-bot'
+      }}
     runs-on: ubuntu-latest
     steps:
       - name: Label pull requests with 'github-openapi-bot'
-        uses: rachmari/labeler@832d42ec5523f3c6d46e8168de71cd54363e3e2e
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
         with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
           add-labels: 'github-openapi-bot'
+
       - name: Checkout repository code
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
-        with:
-          token: ${{ secrets.DOCUBOT_REPO_PAT }}
 
       - name: Setup node
         uses: actions/setup-node@38d90ce44d5275ad62cc48384b3d8a58c500bb5f

.github/workflows/staging-deploy-pr.yml

@@ -79,9 +79,18 @@ jobs:
                 name: prRepoName
               }
             } = run
-            const headLabel = `${prRepoOwner}:${headBranch}`
 
             const prIsInternal = owner === prRepoOwner && repo === prRepoName
+            let headLabel = `${prRepoOwner}:${headBranch}`
+
+            // If the PR is external, prefix its head branch name with the
+            // forked repo owner's login and their fork repo name e.g.
+            // "octocat/my-fork:docs".  We need to include the fork repo
+            // name as well to account for an API issue (this will work fine
+            // if they don't have a different fork repo name).
+            if (!prIsInternal) {
+              headLabel = `${prRepoOwner}/${prRepoName}:${headBranch}`
+            }
 
             // If the PR is external, prefix its head branch name with the
             // forked repo owner's login, e.g. "octocat:docs"

.github/workflows/staging-undeploy-pr.yml

@@ -50,19 +50,9 @@ jobs:
     # IMPORTANT: Intentionally OMIT a `concurrency` configuration from this job!
     steps:
       - name: Add a label to the PR to block deployment during undeployment
-        uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
         with:
-          script: |
-            const { owner, repo } = context.repo
-            await github.issues.addLabels({
-              owner,
-              repo,
-              issue_number: process.env.PR_NUMBER,
-              labels: ['automated-block-deploy']
-            })
+          add-labels: 'automated-block-deploy'
 
       - name: Check out repo's default branch
         uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
@@ -127,19 +117,9 @@ jobs:
 
       - if: ${{ always() }}
         name: Remove the label from the PR to unblock deployment
-        uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
         with:
-          script: |
-            const { owner, repo } = context.repo
-            await github.issues.removeLabel({
-              owner,
-              repo,
-              issue_number: process.env.PR_NUMBER,
-              name: 'automated-block-deploy'
-            })
+          remove-labels: 'automated-block-deploy'
 
       - name: Send Slack notification if workflow failed
         uses: someimportantcompany/github-actions-slack-message@0b470c14b39da4260ed9e3f9a4f1298a74ccdefd

.github/workflows/translations.yml

@@ -8,6 +8,9 @@ on:
   schedule:
     - cron: '20 19 * * *' # once a day at 19:20 UTC / 11:20 PST
 
+permissions:
+  pull-requests: write
+
 env:
   FREEZE: ${{ secrets.FREEZE }}
 
@@ -51,13 +54,7 @@ jobs:
           number: ${{ steps.pr.outputs.number }}
       - if: ${{ !steps.has-label.outputs.result }}
         name: Add automerge label
-        uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            github.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: ${{ steps.pr.outputs.number }},
-              labels: ['automerge']
-            })
+          issue-number: ${{ steps.pr.outputs.number }}
+          add-labels: 'automerge'

.github/workflows/triage-issue-comments.yml

@@ -9,9 +9,12 @@ on:
     types:
       - created
 
+permissions:
+  issues: write
+
 jobs:
   triage-issue-comments:
-    if: github.repository == 'github/docs' && github.event.issue.pull_request == null
+    if: ${{ github.repository == 'github/docs' && !github.event.issue.pull_request }}
     runs-on: ubuntu-latest
 
     steps:
@@ -19,7 +22,7 @@ jobs:
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
         id: is-internal-contributor
         with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           result-encoding: string
           script: |
             const repo = context.payload.repository.name
@@ -39,10 +42,9 @@ jobs:
               return 'false'
             }
       - name: Label issues with new comments with 'triage'
-        uses: rachmari/labeler@832d42ec5523f3c6d46e8168de71cd54363e3e2e
-        if: (steps.is-internal-contributor.outputs.result == 'false')
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
+        if: ${{ steps.is-internal-contributor.outputs.result == 'false' }}
         with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
           add-labels: 'triage'
       - name: Triage to project board
         uses: rachmari/actions-add-new-issue-to-column@1a459ef92308ba7c9c9dc2fcdd72f232495574a9

.github/workflows/triage-issues.yml

@@ -10,16 +10,18 @@ on:
       - reopened
       - opened
 
+permissions:
+  issues: write
+
 jobs:
   triage_issues:
-    if: github.repository == 'github/docs'
+    if: ${{ github.repository == 'github/docs' }}
     runs-on: ubuntu-latest
 
     steps:
       - name: Label new issues with 'triage'
-        uses: rachmari/labeler@832d42ec5523f3c6d46e8168de71cd54363e3e2e
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
         with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
           add-labels: 'triage'
       - name: Triage to project board
         uses: rachmari/actions-add-new-issue-to-column@1a459ef92308ba7c9c9dc2fcdd72f232495574a9

.github/workflows/triage-pull-requests.yml

@@ -10,16 +10,18 @@ on:
       - reopened
       - opened
 
+permissions:
+  pull-requests: write
+
 jobs:
   triage_pulls:
-    if: github.repository != 'github/docs-internal'
+    if: ${{ github.repository != 'github/docs-internal' }}
     runs-on: ubuntu-latest
 
     steps:
       - name: Label new pull requests with 'triage'
-        uses: rachmari/labeler@832d42ec5523f3c6d46e8168de71cd54363e3e2e
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
         with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
           add-labels: 'triage'
       - name: Triage to project board
         uses: rachmari/actions-add-new-issue-to-column@1a459ef92308ba7c9c9dc2fcdd72f232495574a9

.github/workflows/workflow-lint.yml

@@ -28,4 +28,4 @@ jobs:
       - name: Run linter
         uses: cschleiden/actions-linter@caffd707beda4fc6083926a3dff48444bc7c24aa
         with:
-          workflows: '[".github/workflows/*.yml", ".github/workflows/*.yaml", "!.github/workflows/remove-from-fr-board.yaml", "!.github/workflows/staging-deploy-pr.yml", "!.github/workflows/staging-deploy-pr-docker.yml"]'
+          workflows: '[".github/workflows/*.yml", ".github/workflows/*.yaml", "!.github/workflows/remove-from-fr-board.yaml", "!.github/workflows/staging-deploy-pr.yml", "!.github/workflows/triage-issue-comments.yml"]'