Merge branch 'main' into jules-4798

Author: jules-p

.github/actions-scripts/enterprise-server-issue-templates/release-issue.md

@@ -116,7 +116,8 @@ This file should be automatically updated, but you can also run `script/update-e
   Use admin permissions to ship the release branch with this failure. Make sure that the merge's commit title does not include anything like `[DO NOT MERGE]`, and remove all the branch's commit details from the merge's commit message except for the co-author list.
 - [ ] Do any required smoke tests listed in the opening post in the megabranch PR.
 - [ ] Once smoke tests have passed, you can [unfreeze the repos](https://github.com/github/docs-content/blob/main/docs-content-docs/docs-content-workflows/freezing.md) and post an announcement in Slack.
-- [ ] After unfreezing, push the search index LFS objects for the public `github/docs` repo. The LFS objects were already being pushed for the internal repo after the `sync-english-index-for-<PLAN@RELEASE>` was added to the megabranch. To push the LFS objects, run the [search sync workflow](https://github.com/github/docs-internal/actions/workflows/sync-search-indices.yml) with the following inputs:
+- [ ] After unfreezing, push the search index LFS objects for the public `github/docs` repo. The LFS objects were already being pushed for the internal repo after the `sync-english-index-for-<PLAN@RELEASE>` was added to the megabranch. To push the LFS objects, run the [search sync workflow](https://github.com/github/docs-internal/actions/workflows/sync-search-indices.yml). Once you're there, click on `Run workflow` button. A modal will pop up where you can set the following inputs:
+  Branch: The new version megabranch you're working on
   version: `enterprise-server@<RELEASE>`
   language: `en`
 - [ ] After unfreezing, if there were significant or highlighted GraphQL changes in the release, consider manually running the [GraphQL update workflow](https://github.com/github/docs-internal/actions/workflows/update-graphql-files.yml) to update our GraphQL schemas. By default this workflow only runs once every 24 hours.

.github/actions-scripts/openapi-schema-branch.js

@@ -36,7 +36,7 @@ const changedFiles = execSync('git diff --name-only HEAD').toString()
 if (changedFiles !== '') {
   console.log(`These files were changed:\n${changedFiles}`)
   console.log(
-    `🚧⚠️ Your decorated and dereferenced schema files don't match. Ensure you're using decorated and dereferenced schemas from the automatically created pull requests by the 'github-openapi-bot' user. \n\n If this test is failing after updates to the script/rest directory, run script/rest/update-files.js --decorate-only to re-generate the decorated files from the existing dereferenced files and check those in. \n\n If this test is failing after an update to a package, check the changes the new package makes to the decorated files by running script/rest/update-files.js --decorate-only. If the changes are small style changes that don't impact the overall experience, check the updated decorated file in. Otherwise, more work may be needed to be compatible with the updated package. \n\n For more information, see 'script/rest/README.md'. 🛑`
+    `🚧⚠️ Your decorated and dereferenced schema files don't match. Ensure you're using decorated and dereferenced schemas from the automatically created pull requests by the 'github-openapi-bot' user. \n\n If this test is failing after updates to the script/rest directory, run script/rest/update-files.js --decorate-only to re-generate the decorated files from the existing dereferenced files and check those in. \n\n If this test is failing after an update to a package, check the changes the new package makes to the decorated files by running script/rest/update-files.js --decorate-only.\n\nIf you updated script/rest/utils/rest-api-overrides.json, you'll need to run script/rest/update-files.js --decorate-only to regenerate the decorated file and redirects file (check in the changed lib/rest/static/decorated files).\n\nIf the changes are small style changes that don't impact the overall experience, check the updated decorated file in. Otherwise, more work may be needed to be compatible with the updated package. \n\n For more information, see 'script/rest/README.md'. 🛑`
   )
   process.exit(1)
 }

.github/dependabot.yml

@@ -3,7 +3,8 @@ updates:
   - package-ecosystem: npm
     directory: '/'
     schedule:
-      interval: monthly
+      interval: weekly
+      day: tuesday
     open-pull-requests-limit: 20 # default is 5
     ignore:
       - dependency-name: '*'
@@ -13,7 +14,8 @@ updates:
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
-      interval: monthly
+      interval: weekly
+      day: wednesday
     ignore:
       - dependency-name: '*'
         update-types:
@@ -22,7 +24,8 @@ updates:
   - package-ecosystem: 'docker'
     directory: '/'
     schedule:
-      interval: monthly
+      interval: weekly
+      day: thursday
     ignore:
       - dependency-name: '*'
         update-types:

.github/workflows/enterprise-release-sync-search-index.yml

@@ -40,7 +40,7 @@ jobs:
     name: Update English index for new GHES release
     # Skip this check if the event originated from Docubot, to prevent
     # infinite runs when Docubot checks in the search indexes in this workflow
-    if: github.repository == 'github/docs-internal' && github.event.sender.login != 'Docubot'
+    if: github.repository == 'github/docs-internal' && github.event.sender.login != 'Docubot' && github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
       - name: checkout

.github/workflows/first-responder-docs-content.yml

@@ -19,7 +19,7 @@ permissions:
 jobs:
   first-responder-triage-pr:
     name: Triage PR to FR project board
-    if: github.repository == 'github/docs-internal' && github.event.pull_request.draft == false && github.event.action != 'unlabeled' && github.event.action != 'closed'
+    if: github.repository == 'github/docs-internal' && github.event.pull_request.draft == false && github.event.action != 'unlabeled' && github.event.action != 'closed' && github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
 
     steps:
@@ -66,7 +66,7 @@ jobs:
 
   first-responder-remove-pr:
     name: Remove PR from FR project board
-    if: github.repository == 'github/docs-internal' && ((github.event.label.name == 'docs-content-fr' && github.event.action == 'unlabeled') || github.event.action == 'closed')
+    if: github.repository == 'github/docs-internal' && ((github.event.label.name == 'docs-content-fr' && github.event.action == 'unlabeled') || github.event.action == 'closed') && github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/hubber-contribution-help.yml

@@ -41,7 +41,7 @@ jobs:
         run: |
           gh pr comment $PR --body "Thanks so much for opening this PR and contributing to GitHub Docs!
 
-          - When you're ready for the Docs team to review this PR, request a review by *docs-content* and your PR will be added to the [Docs Content review board](https://github.com/orgs/github/memexes/901?layout=table&groupedBy%5BcolumnId%5D=11024). **Please factor in at least 72 hours for a review, even longer if this is a substantial change.**
+          - When you're ready for the Docs team to review this PR, add the *ready-for-doc-review* label to your PR to the [Docs Content review board](https://github.com/orgs/github/memexes/901?layout=table&groupedBy%5BcolumnId%5D=11024). **Please factor in at least 72 hours for a review, even longer if this is a substantial change.**
           - If this is a major update to the docs, you might want to go back and open an [issue](https://github.com/github/docs-content/issues/new/choose) to ensure we've covered all areas of the docs in these updates. Not doing so may result in delays or inaccurate documentation."
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/optimize-images.yml

@@ -6,28 +6,47 @@ name: Optimize images
 
 on:
   workflow_dispatch:
-  schedule:
-    - cron: '45 17 * * 2' # Run Tuesdays at 17:45 UTC / 9:45 PST
+  pull_request:
+    paths:
+      - '**/*.png'
 
 permissions:
   contents: write
   pull-requests: write
 
 jobs:
-  optimize-images:
-    if: github.repository == 'github/docs-internal'
+  optimize-images-on-pr:
+    if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
     runs-on: ubuntu-latest
     steps:
-      - name: Check out repo
+      - name: Check out repo on head ref
         uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+        with:
+          ref: ${{ github.head_ref }}
+
+      - name: Check out base ref
+        run: git fetch --no-tags --depth=1 origin $GITHUB_BASE_REF
 
       - name: Install the Optipng package
         run: sudo apt-get update && sudo apt-get -y install optipng
 
-      - name: Run the Optipng package
-        run: find . -name '*.png' -print0 | xargs -0 optipng -nx
+      - name: Run optipng on new or changed images
+        run: |
+          set -e # exit when any command fails
+
+          echo "Ensure we can view $GITHUB_BASE_REF"
+          git checkout $GITHUB_BASE_REF
+
+          echo "Ensure we can view $GITHUB_HEAD_REF"
+          git checkout $GITHUB_HEAD_REF
 
-      - name: Make a branch, commit, push, and pull request
+          echo "List the files that changed"
+          git diff --name-only $GITHUB_HEAD_REF $GITHUB_BASE_REF
+
+          echo "Run optipng on pngs in from the diff"
+          git diff --name-only -z $GITHUB_HEAD_REF $GITHUB_BASE_REF -- '*.png' | xargs -0 optipng -nx
+
+      - name: Make a commit and a push
         run: |
           echo "If there's no changes, exit"
           if [[ !  `git status --porcelain` ]]
@@ -36,20 +55,13 @@ jobs:
             exit 0
           fi
 
-          echo "Make a new branch"
-          BRANCH="optimize-images-$(date +'%Y%m%d%H%M%S')"
-          git checkout -b $BRANCH
-
           echo "Make a commit"
           git config user.name github-actions
           git config user.email [email protected]
           git add "*.png"
           git commit --message="Optimize images"
 
           echo "Push up changes"
-          git push --set-upstream origin $BRANCH
-
-          echo "Open a pull request"
-          gh pr create --title "Optimize images" --body "Optimize images"
+          git push
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/sync-search-indices.yml

@@ -112,8 +112,8 @@ jobs:
         run: |
           echo 'git remote add public-docs-repo https://github.com/github/docs.git'
           git remote add public-docs-repo https://github.com/github/docs.git
-          echo 'git lfs push --all public-docs-repo'
-          git lfs push --all public-docs-repo
+          echo 'GIT_TRANSFER_TRACE=1 GIT_CURL_VERBOSE=1 GIT_TRACE=1 git lfs push --all public-docs-repo'
+          GIT_TRANSFER_TRACE=1 GIT_CURL_VERBOSE=1 GIT_TRACE=1 git lfs push --all public-docs-repo
 
       - name: Send slack notification if workflow run fails
         uses: someimportantcompany/github-actions-slack-message@f8d28715e7b8a4717047d23f48c39827cacad340

.github/workflows/triage-unallowed-contributions.yml

@@ -21,6 +21,7 @@ on:
       - 'package*.json'
       - 'script/**'
       - 'translations/**'
+      - 'content/actions/deployment/security-hardening-your-deployments/**'
 
 permissions:
   pull-requests: write
@@ -67,6 +68,7 @@ jobs:
               - 'package*.json'
               - 'scripts/**'
               - 'translations/**'
+              - 'content/actions/deployment/security-hardening-your-deployments/**'
 
       # When there are changes to files we can't accept, leave a comment
       # explaining this to the PR author
@@ -90,6 +92,7 @@ jobs:
               'package*.json',
               'scripts/**',
               'translations/**',
+              'content/actions/deployment/security-hardening-your-deployments/**',
             ]
 
             const badFiles = badFilesArr.join('\n')