Merge branch 'master' into feat/conventions-sync-note

Author: andrewm4894

.github/ISSUE_TEMPLATE/art-request-template.md

@@ -7,22 +7,23 @@ labels:
 assignees:
   - lottiecoxon
   - dphawkins1617
+  - heidiberton
 projects:
   - PostHog/65
 
 ---
 
 > **How art requests work**
-> By default, Lottie and Daniel should be assigned to all art requests and the request will be added to [the art project board](https://github.com/orgs/PostHog/projects/65). They will decide who will work on this brief and reassign as needed. You can check the project board for updates if needed. 
+> By default, Lottie, Heidi & Daniel should be assigned to all art requests and the request will be added to [the art project board](https://github.com/orgs/PostHog/projects/65). They will decide who will work on this brief and reassign as needed. You can check the project board for updates if needed. 
 >
-> If your request is genuinely urgent, please share in [#team-marketing channel](https://posthog.slack.com/archives/C08CG24E3SR) and mention Lottie, Daniel, and/or Cory.
+> If your request is genuinely urgent, please share in [#team-marketing channel](https://posthog.slack.com/archives/C08CG24E3SR) and mention Lottie, Heidi, Daniel, and/or Cory.
 
 ## Outline
 _Avoid being overly prescriptive and instead provide context about what you're trying to convey - i.e. a feeling, reaction, or narrative._
 _If it's for an article, share the draft headline and some bullet points of what it's about._
 
 ## Deadline & Priority
-_Leave reasonable time. A week is the minimum. Two weeks notice is ideal._
+_Leave reasonable time. A week is the minimum. Two weeks notice is good, even more time is ideal._
 
 ## Technical requirements
 _Dimensions, file type etc._

.github/pull_request_template.md

@@ -7,8 +7,9 @@
 ## Checklist
 
 - [ ] Words are spelled using American English
+- [ ] PostHog product names are in [title case](https://apastyle.apa.org/style-grammar-guidelines/capitalization/title-case). It's "Product Analytics" not "Product analytics". If talking about a category of product, use sentence case e.g. "There are a lot of product analytics tools, but PostHog's Product Analytics is the best"
 - [ ] Titles are in [sentence case](https://apastyle.apa.org/style-grammar-guidelines/capitalization/sentence-case)
-- [ ] Feature names are in **[sentence case too](https://apastyle.apa.org/style-grammar-guidelines/capitalization/sentence-case)**. It's "product analytics" not "Product Analytics" and so on.
+- [ ] Feature names are in **[sentence case](https://apastyle.apa.org/style-grammar-guidelines/capitalization/sentence-case)**. It's "Click here to create a trend insight" not "... create a Trend Insight" and so on.
 - [ ] Use relative URLs for internal links
 - [ ] If I moved a page, I added a redirect in `vercel.json`
 - [ ] Remove this template if you're not going to fill it out!

.github/workflows/automerge.yml

@@ -8,14 +8,16 @@ jobs:
         name: Spelling
         runs-on: ubuntu-latest
         if: github.event.pull_request.head.repo.full_name == github.repository
+        permissions:
+            contents: write
 
         steps:
-            - uses: actions/checkout@v2
+            - uses: actions/checkout@v6
               with:
                   ref: ${{ github.head_ref }}
 
             - name: Set up Python 3.8
-              uses: actions/setup-python@v2
+              uses: actions/setup-python@v6
               with:
                   python-version: 3.8
 

.github/workflows/checks.yml

@@ -0,0 +1,28 @@
+on:
+    push:
+        branches:
+            - master
+    pull_request:
+
+name: Security
+
+permissions:
+    contents: read
+
+jobs:
+    ensure-pinned-actions:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v6
+            - name: Ensure SHA pinned actions
+              uses: zgosalvez/github-actions-ensure-sha-pinned-actions@9e9574ef04ea69da568d6249bd69539ccc704e74 # v4.0.0
+              with:
+                  allowlist: |
+                      actions/
+                      aws-actions/
+                      docker/
+                      github/
+                      hashicorp/
+                      PostHog/
+                      tailscale/

.github/workflows/ci-security.yml

@@ -0,0 +1,59 @@
+name: 'CodeQL Advanced'
+
+on:
+    push:
+        branches: ['master']
+    pull_request:
+        branches: ['master']
+    schedule:
+        - cron: '41 14 * * 1'
+
+jobs:
+    analyze:
+        name: Analyze (${{ matrix.language }})
+        # Runner size impacts CodeQL analysis time. To learn more, please see:
+        #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+        #   - https://gh.io/supported-runners-and-hardware-resources
+        #   - https://gh.io/using-larger-runners (GitHub.com only)
+        # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+        runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+        permissions:
+            # required for all workflows
+            security-events: write
+
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - language: actions
+                      build-mode: none
+                    - language: javascript-typescript
+                      build-mode: none
+                    - language: python
+                      build-mode: none
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v6
+
+            # Initializes the CodeQL tools for scanning.
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@v4
+              with:
+                  languages: ${{ matrix.language }}
+                  build-mode: ${{ matrix.build-mode }}
+
+            - name: Run manual build steps
+              if: matrix.build-mode == 'manual'
+              shell: bash
+              run: |
+                  echo 'If you are using a "manual" build mode for one or more of the' \
+                    'languages you are analyzing, replace this with the commands to build' \
+                    'your code, for example:'
+                  echo '  make bootstrap'
+                  echo '  make release'
+                  exit 1
+
+            - name: Perform CodeQL Analysis
+              uses: github/codeql-action/analyze@v4
+              with:
+                  category: '/language:${{matrix.language}}'

.github/workflows/codeql.yml

@@ -11,9 +11,9 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@v6
             - name: Install uv
-              uses: astral-sh/setup-uv@v6
+              uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7.1.0
             - name: Set up Python
               run: uv python install
               working-directory: scripts/hogfm

.github/workflows/hogfm-weekly.yml

@@ -13,9 +13,9 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@v6
             - name: Install uv
-              uses: astral-sh/setup-uv@v6
+              uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7.1.0
             - name: Set up Python
               run: uv python install
               working-directory: scripts/hogfm

.github/workflows/hogfm.yml

@@ -26,10 +26,10 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@v6
 
             - name: Setup Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v6
               with:
                   node-version: '22'
                   cache: 'pnpm'

.github/workflows/internal-links-check.yml

@@ -2,11 +2,6 @@ name: Markdown Lint
 
 on:
     pull_request:
-        paths:
-            - '**.md'
-            - '**.mdx'
-            - '.markdownlint-cli2.jsonc'
-            - '.github/workflows/markdown-lint.yml'
 
 permissions:
     contents: read
@@ -18,10 +13,27 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@v6
+              with:
+                  fetch-depth: 0
+
+            - name: Get changed markdown files
+              id: changed-files
+              uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47
+              with:
+                  files: |
+                      **/*.md
+                      **/*.mdx
+                      .markdownlint-cli2.jsonc
+                      .github/workflows/markdown-lint.yml
 
             - name: Run markdownlint-cli2
-              uses: DavidAnson/markdownlint-cli2-action@v21
+              if: steps.changed-files.outputs.any_changed == 'true'
+              uses: DavidAnson/markdownlint-cli2-action@30a0e04f1870d58f8d717450cc6134995f993c63 # v21
               with:
-                  globs: '**/*.{md,mdx}'
+                  globs: ${{ steps.changed-files.outputs.all_changed_files }}
                   config: '.markdownlint-cli2.jsonc'
+
+            - name: Skip if no markdown files changed
+              if: steps.changed-files.outputs.any_changed != 'true'
+              run: echo "No markdown files changed, skipping lint"