Merge branch 'main' into main

Author: Gabriel-Xu

.github/workflows/changelog-agent.yml

@@ -112,10 +112,12 @@ jobs:
         if: steps.check_team.outputs.is_team_member == 'true'
         id: extract_issue
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          PR_BODY: ${{ steps.resolve_pr.outputs.pr_body }}
         with:
           github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
           script: |
-            const body = `${{ steps.resolve_pr.outputs.pr_body }}`;
+            const body = process.env.PR_BODY || '';
 
             // Match closing keywords followed by docs-content issue references.
             // Supports: closes github/docs-content#123, fixes https://github.com/github/docs-content/issues/123
@@ -224,6 +226,10 @@ jobs:
         if: steps.check_parent.outputs.has_parent == 'true'
         id: gather_context
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          PR_TITLE: ${{ steps.resolve_pr.outputs.pr_title }}
+          PR_BODY: ${{ steps.resolve_pr.outputs.pr_body }}
+          PR_URL: ${{ steps.resolve_pr.outputs.pr_url }}
         with:
           github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
           script: |
@@ -254,9 +260,9 @@ jobs:
             const changedFiles = files.map(f => f.filename);
 
             core.setOutput('pr_author', prAuthor);
-            core.setOutput('pr_title', '${{ steps.resolve_pr.outputs.pr_title }}');
-            core.setOutput('pr_body', `${{ steps.resolve_pr.outputs.pr_body }}`);
-            core.setOutput('pr_url', '${{ steps.resolve_pr.outputs.pr_url }}');
+            core.setOutput('pr_title', process.env.PR_TITLE || '');
+            core.setOutput('pr_body', process.env.PR_BODY || '');
+            core.setOutput('pr_url', process.env.PR_URL || '');
             core.setOutput('pr_number', prNumber.toString());
             core.setOutput('approved_reviewers', approvedReviewers.join(','));
             core.setOutput('changed_files', changedFiles.join('\n'));
@@ -421,14 +427,19 @@ jobs:
       - name: Dry run summary
         if: steps.generate_draft.outputs.response != '' && inputs.dry_run == true
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          PR_AUTHOR: ${{ steps.gather_context.outputs.pr_author }}
+          PR_URL: ${{ steps.gather_context.outputs.pr_url }}
+          PARENT_TITLE: ${{ steps.check_parent.outputs.parent_title }}
+          DRAFT: ${{ steps.generate_draft.outputs.response }}
         with:
           script: |
             core.info('=== DRY RUN — no PR will be created, no Slack DM sent ===');
-            core.info(`PR author: ${{ steps.gather_context.outputs.pr_author }}`);
-            core.info(`Source PR: ${{ steps.gather_context.outputs.pr_url }}`);
-            core.info(`Parent issue: ${{ steps.check_parent.outputs.parent_title }}`);
+            core.info(`PR author: ${process.env.PR_AUTHOR || ''}`);
+            core.info(`Source PR: ${process.env.PR_URL || ''}`);
+            core.info(`Parent issue: ${process.env.PARENT_TITLE || ''}`);
             core.info('--- Generated changelog draft ---');
-            core.info(`${{ steps.generate_draft.outputs.response }}`);
+            core.info((process.env.DRAFT || '').replace(/^::/gm, ': :'));
             core.info('--- End of draft ---');
 
       - name: Create changelog PR in docs-content

.github/workflows/repo-sync.yml

@@ -28,12 +28,29 @@ jobs:
           persist-credentials: false
 
       - name: Sync repo to branch
-        uses: repo-sync/github-sync@3832fe8e2be32372e1b3970bbae8e7079edeec88
-        with:
-          source_repo: https://${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}@github.com/github/${{ github.repository == 'github/docs-internal' && 'docs' || 'docs-internal' }}.git
-          source_branch: main
-          destination_branch: repo-sync
-          github_token: ${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}
+        env:
+          SOURCE_REPO: https://${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}@github.com/github/${{ github.repository == 'github/docs-internal' && 'docs' || 'docs-internal' }}.git
+          SOURCE_BRANCH: main
+          DESTINATION_BRANCH: repo-sync
+          GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_REPO_SYNC }}
+        run: |
+          set -euo pipefail
+
+          : "${GH_TOKEN:?DOCS_BOT_PAT_REPO_SYNC is empty}"
+          : "${SOURCE_REPO:?SOURCE_REPO is empty}"
+          : "${SOURCE_BRANCH:?SOURCE_BRANCH is empty}"
+          : "${DESTINATION_BRANCH:?DESTINATION_BRANCH is empty}"
+
+          git config --unset-all http."https://github.com/".extraheader || true
+
+          git remote remove tmp_upstream 2>/dev/null || true
+          trap 'git remote remove tmp_upstream 2>/dev/null || true' EXIT
+
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git remote add tmp_upstream "${SOURCE_REPO}"
+
+          git fetch tmp_upstream --quiet
+          git push origin "refs/remotes/tmp_upstream/${SOURCE_BRANCH}:refs/heads/${DESTINATION_BRANCH}" --force
 
       - name: Ship pull request
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3

CHANGELOG.md

@@ -10,15 +10,22 @@
 # ---------------------------------------------------------------
 # To update the sha:
 # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble
-FROM ghcr.io/github/gh-base-image/gh-base-noble:20260505-222701-gb8f4d82d0@sha256:e5ee5190511450a452713144fb1dcd957535ec7c68705efa48b3d2cbb9871b0d AS base
+FROM ghcr.io/github/gh-base-image/gh-base-noble:20260527-203230-gabf2049e0@sha256:e6d4192acbdf566584c77f1306cd72cac3a381be6ff6174c85ee21bb164a8b46 AS base
 
 # Install curl for Node install and determining the early access branch
 # Install git for cloning docs-early-access & translations repos
 # Install Node.js latest LTS
 # https://github.com/nodejs/release#release-schedule
 # Ubuntu's apt-get install nodejs is _very_ outdated
 # Must run as root
-RUN apt-get -qq update && apt-get -qq install --no-install-recommends curl git \
+
+# From https://thehub.github.com/epd/engineering/devops/ci/actions/setting-up-new-github-action/
+# We passed pkg-mirror-host as a secret to the build but it is not sensitive data.
+RUN --mount=type=secret,id=pkg-mirror-host,target=/etc/pkg_mirror_host.txt \
+  if [ -f /etc/pkg_mirror_host.txt ]; then cat /etc/pkg_mirror_host.txt >> /etc/apt/mirrorlist.txt; fi
+
+RUN --mount=type=secret,id=apt-auth-conf,target=/etc/apt/auth.conf.d/apt_auth.conf \
+  apt-get -qq update && apt-get -qq install --no-install-recommends curl git \
   && curl -sL https://deb.nodesource.com/setup_24.x | bash - \
   && apt-get install -y nodejs \
   && node --version