Merge branch 'main' into gha-hardening-pull-request-target

Author: Sharra-writes

.devcontainer/Dockerfile

@@ -1,5 +1,5 @@
 # To find available Node images, see https://mcr.microsoft.com/en-us/product/devcontainers/javascript-node/tags
 
 # [Choice] Node.js version
-ARG VARIANT="dev-22-bullseye"
+ARG VARIANT="dev-24-bullseye"
 FROM mcr.microsoft.com/devcontainers/javascript-node:${VARIANT}

.devcontainer/devcontainer.json

@@ -6,7 +6,7 @@
   "build": {
     "dockerfile": "Dockerfile",
     // Update 'VARIANT' to pick a Node version
-    "args": { "VARIANT": "22" }
+    "args": { "VARIANT": "24" }
   },
 
   // Install features. Type 'feature' in the VS Code command palette for a full list.

.github/actions/get-changed-files/get-changed-files.sh

@@ -18,8 +18,9 @@ git fetch --depth=1 origin main
 git fetch --depth=1 origin ${INPUT_HEAD:-HEAD}
 
 # Get diff with status information
+# Find the merge-base (common ancestor) instead of using origin/main directly
 echo "__ running git diff with status __"
-DIFF_OUTPUT=$(git diff --name-status origin/main origin/${INPUT_HEAD:-HEAD})
+DIFF_OUTPUT=$(git diff --name-status origin/main...origin/${INPUT_HEAD:-HEAD})
 
 # Function to extract files by pattern from diff output
 extract_files() {

.github/workflows/article-api-docs.yml

@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   check-content-linter-rules-docs:
-    runs-on: ${{ fromJSON('["ubuntu-latest", "ubuntu-20.04-xl"]')[github.repository == 'github/docs-internal'] }}
+    runs-on: ubuntu-latest
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
     steps:
       - name: Checkout

.github/workflows/auto-close-dependencies.yml

@@ -50,7 +50,7 @@ jobs:
 
       # Because we get far too much spam ;_;
       - name: Lock conversations
-        uses: actions/github-script@e69ef5462fd455e02edcaf4dd7708eda96b9eda0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
         with:

.github/workflows/changelog-prompt.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Check if PR author is in docs-content team
         id: check_team
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
           script: |
@@ -41,7 +41,7 @@ jobs:
 
         if: env.CONTINUE_WORKFLOW == 'true'
 
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
           script: |

.github/workflows/check-for-spammy-issues.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'github/docs'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@e69ef5462fd455e02edcaf4dd7708eda96b9eda0
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
         with:
           github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
           script: |

.github/workflows/close-bad-repo-sync-prs.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Close pull request if unwanted
-        uses: actions/github-script@e69ef5462fd455e02edcaf4dd7708eda96b9eda0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
         with:
           github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
           script: |

.github/workflows/confirm-internal-staff-work-in-docs.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'github/docs' && github.actor != 'docs-bot'
     steps:
       - id: membership_check
-        uses: actions/github-script@e69ef5462fd455e02edcaf4dd7708eda96b9eda0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
         env:
           TEAM_CONTENT_REPO: ${{ secrets.TEAM_CONTENT_REPO }}
         with:

.github/workflows/content-lint-markdown.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   lint-content:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
-    runs-on: ${{ fromJSON('["ubuntu-latest", "ubuntu-20.04-xl"]')[github.repository == 'github/docs-internal'] }}
+    runs-on: ubuntu-latest
     steps:
       - name: Check out repo
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0