Repo sync

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
 # Update ARG and FROM together from the Node devcontainer image tags:
 # https://mcr.microsoft.com/en-us/product/devcontainers/javascript-node/tags
 ARG VARIANT=dev-24-bookworm
-FROM mcr.microsoft.com/devcontainers/javascript-node:dev-24-bookworm@sha256:5ed0bf1411cffe8182ee6808477dd64c969a4ce78fee1b63e6a654d7deff889c
+FROM mcr.microsoft.com/devcontainers/javascript-node:dev-24-bookworm@sha256:d0445b9546f96869b509aa70b8593bdc0054aca6689bc1dd0324083d0fd2bcc3

.github/actions/labeler/labeler.ts

@@ -31,17 +31,8 @@ if (import.meta.url.endsWith(process.argv[1])) {
     ignoreIfLabeled: boolEnvVar('IGNORE_IF_LABELED'),
   }
 
-  // Actions pass comma-separated labels.
-  if (typeof ADD_LABELS === 'string') {
-    opts.addLabels = [...ADD_LABELS.split(',')].map((l) => l.trim())
-  } else {
-    opts.addLabels = []
-  }
-  if (typeof REMOVE_LABELS === 'string') {
-    opts.removeLabels = [...REMOVE_LABELS.split(',')].map((l) => l.trim())
-  } else {
-    opts.removeLabels = []
-  }
+  opts.addLabels = parseLabels(ADD_LABELS)
+  opts.removeLabels = parseLabels(REMOVE_LABELS)
 
   const actionContext = getActionContext()
   const { owner, repo } = actionContext
@@ -58,6 +49,14 @@ if (import.meta.url.endsWith(process.argv[1])) {
   main(coreLib, octokit, opts)
 }
 
+// Actions pass comma-separated labels, and an omitted input arrives as an empty string.
+export function parseLabels(value?: string): string[] {
+  return (value || '')
+    .split(',')
+    .map((l) => l.trim())
+    .filter(Boolean)
+}
+
 export default async function main(
   core: typeof coreLib | CoreInject,
   octokit: Octokit,

.github/dependabot.yml

@@ -23,7 +23,9 @@ updates:
           ['version-update:semver-patch', 'version-update:semver-minor']
 
   - package-ecosystem: 'github-actions'
-    directory: '/'
+    directories:
+      - '/'
+      - '/.github/actions/*'
     schedule:
       interval: weekly
       day: tuesday

.github/workflows/auto-close-dependencies.yml

@@ -9,6 +9,7 @@ on:
       - 'Gemfile*'
       - 'Dockerfile'
       - '.github/workflows/**'
+      - '.github/actions/**'
 
 permissions:
   contents: write

.github/workflows/changelog-agent.yml

@@ -227,10 +227,12 @@ jobs:
             const prNumber = parseInt('${{ steps.resolve_pr.outputs.pr_number }}', 10);
             const prAuthor = '${{ steps.resolve_pr.outputs.pr_author }}';
 
-            const { data: reviews } = await github.rest.pulls.listReviews({
+            // Approvals often come after many comment reviews, so read every page
+            const reviews = await github.paginate(github.rest.pulls.listReviews, {
               owner: context.repo.owner,
               repo: context.repo.repo,
               pull_number: prNumber,
+              per_page: 100,
             });
 
             const approvedReviewers = [...new Set(

.github/workflows/codeql.yml

@@ -32,7 +32,9 @@ jobs:
         with:
           languages: javascript
       - uses: github/codeql-action/analyze@e296a935590eb16afc0c0108289f68c87e2a89a5 # v4.30.7
-        continue-on-error: true
+        # Pull request scans stay non-blocking so analysis errors do not hold up merges.
+        # Push runs must fail so the alert steps below fire.
+        continue-on-error: ${{ github.event_name == 'pull_request' }}
 
       - uses: ./.github/actions/create-workflow-failure-issue
         id: create-failure-issue

.github/workflows/confirm-internal-staff-work-in-docs.yml

@@ -4,9 +4,9 @@ name: Confirm internal staff meant to post in public
 
 on:
   issues:
+    # Issues moved into github/docs arrive as opened. The transferred event fires in the source repo.
     types:
       - opened
-      - transferred
   # pull_request_target lets the workflow check org membership for forked PR authors.
   pull_request_target:
     types:

.github/workflows/dont-delete-assets.yml

@@ -44,6 +44,8 @@ jobs:
 
       - name: Update comment
         if: ${{ steps.comment.outputs.markdown != '' }}
+        # Fork PRs get a read-only token, so posting fails there. The next step still shows the instructions.
+        continue-on-error: true
         uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         with:
           comment-id: ${{ steps.findComment.outputs.comment-id }}
@@ -53,7 +55,11 @@ jobs:
 
       - name: Ultimately fail the workflow for attention
         if: ${{ steps.comment.outputs.markdown != '' }}
+        env:
+          MARKDOWN: ${{ steps.comment.outputs.markdown }}
         run: |
           echo "More than 1 asset image was deleted as part of this PR."
-          echo "See posted PR commented about how to get them back."
+          echo "See the PR comment or this job's summary for how to get them back."
+          echo "$MARKDOWN" >> "$GITHUB_STEP_SUMMARY"
+          echo "$MARKDOWN"
           exit 1

.github/workflows/dont-delete-features.yml

@@ -42,6 +42,8 @@ jobs:
 
       - name: Update comment
         if: ${{ steps.comment.outputs.markdown != '' }}
+        # Fork PRs get a read-only token, so posting fails there. The next step still shows the instructions.
+        continue-on-error: true
         uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         with:
           comment-id: ${{ steps.findComment.outputs.comment-id }}
@@ -51,7 +53,11 @@ jobs:
 
       - name: Ultimately fail the workflow for attention
         if: ${{ steps.comment.outputs.markdown != '' }}
+        env:
+          MARKDOWN: ${{ steps.comment.outputs.markdown }}
         run: |
           echo "This PR deletes or renames one or more feature files."
-          echo "See the PR comment for how to get them back."
+          echo "See the PR comment or this job's summary for how to get them back."
+          echo "$MARKDOWN" >> "$GITHUB_STEP_SUMMARY"
+          echo "$MARKDOWN"
           exit 1

.github/workflows/generate-code-scanning-query-lists.yml

@@ -152,6 +152,11 @@ jobs:
   create-pull-request:
     if: github.repository == 'github/docs-internal'
     runs-on: ubuntu-latest
+    # Serialize publishing so a second run sees the first run's PR before it force-pushes.
+    # Pull request dry runs get their own group so they never queue behind or cancel a publisher.
+    concurrency:
+      group: ${{ github.workflow }}-query-table-publication-${{ github.event_name == 'pull_request' && github.run_id || 'publish' }}
+      cancel-in-progress: false
     permissions:
       contents: write
       pull-requests: write
@@ -216,27 +221,27 @@ jobs:
 
           branchname=codeql-query-tables-${{ steps.codeql.outputs.OPENAPI_COMMIT_SHA }}
 
-          # Query the remote because actions/checkout with fetch-depth 1 omits other remote-tracking branches.
-          branchExists=$(git ls-remote --heads origin refs/heads/$branchname | wc -l)
-
           # Pull request runs validate generated files without pushing branches.
           if [ "$DRY_RUN" = "true" ]; then
             echo "Dry-run mode when run in a pull request"
             echo "See the 'Insight into diff' step for the changes it would create PR about."
             exit 0
           fi
 
-          if [ $branchExists -ne 0 ]; then
-            echo "Branch $branchname already exists in the remote repository."
+          # Check for an open PR before pushing so reruns do not overwrite commits added to it.
+          existing_pr=$(gh pr list --repo github/docs-internal --head "$branchname" --json number --jq '.[0].number')
+          if [[ -n "$existing_pr" ]]; then
+            echo "Pull request #$existing_pr already exists for branch $branchname. Skipping PR creation."
             exit 0
-          else
-            git checkout -b $branchname
           fi
 
+          git checkout -b $branchname
           git add data/reusables/code-scanning/codeql-query-tables
           git add data/reusables/code-quality/codeql-query-tables
           git commit -m "Update CodeQL query tables"
-          git push -u origin $branchname
+
+          # Force-push over a branch left by a failed attempt; this workflow exclusively owns these branches.
+          git push --force -u origin $branchname
 
           echo "Creating pull request..."
           gh pr create \

.github/workflows/index-general-search.yml

@@ -203,12 +203,6 @@ jobs:
           curl --retry-connrefused --retry 5 ${{ env.ELASTICSEARCH_URL }}/_cat/indices?v
           curl --retry-connrefused --retry 5 ${{ env.ELASTICSEARCH_URL }}/_cat/indices?v
 
-      - name: Purge Fastly edge cache
-        env:
-          FASTLY_TOKEN: ${{ secrets.FASTLY_TOKEN }}
-          FASTLY_SERVICE_ID: ${{ secrets.FASTLY_SERVICE_ID }}
-        run: npm run purge-fastly -- --surrogate-key api-search:${{ matrix.language }}
-
       - name: Upload failures artifact
         if: ${{ steps.check-failures.outputs.has_failures == 'true' }}
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0

.github/workflows/link-check-external.yml

@@ -34,6 +34,8 @@ jobs:
         env:
           ACTION_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           CACHE_MAX_AGE_DAYS: '7'
+          # The script checks github.com repo links through the REST API only when this is set.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           if [[ -n "${{ inputs.max_urls }}" ]]; then
             npm run check-links-external -- --max ${{ inputs.max_urls }}

.github/workflows/link-check-internal.yml

@@ -124,20 +124,23 @@ jobs:
             }
 
             const report = JSON.parse(fs.readFileSync(reportFile, 'utf8'))
-            const allRedirectGroups = report.groups.filter(g => g.isWarning)
+            // Raw redirect targets can carry the checked version's prefix; replacementTarget does not.
+            // Skip strings that could break out of the inline code spans, since directives must stay exact.
+            const isSafe = s => typeof s === 'string' && s.length > 0 && !/[`\r\n]/.test(s)
+            const allRedirectGroups = report.groups.filter(g =>
+              g.isWarning && g.fixStrategy === 'codemod' &&
+              isSafe(g.target) && isSafe(g.replacementTarget) && isSafe(g.occurrences[0]?.file))
             const redirectGroups = allRedirectGroups.slice(0, 10)
 
             if (redirectGroups.length === 0) {
-              core.info('No redirect groups found, skipping Copilot issue.')
+              core.info('No renamed redirects found, skipping Copilot issue.')
               return
             }
 
             const directives = redirectGroups.map(g => {
               const occ = g.occurrences[0]
-              const redirectTarget = occ?.redirectTarget ?? 'unknown'
-              const file = occ?.file ?? 'unknown'
-              const lines = (occ?.lines ?? []).join(', ') || 'unknown'
-              return `- Update \`${g.target}\` to \`${redirectTarget}\` in \`${file}\` (line(s): ${lines})`
+              const lines = (occ.lines ?? []).filter(Number.isInteger).join(', ') || 'unknown'
+              return `- Update \`${g.target}\` to \`${g.replacementTarget}\` in \`${occ.file}\` (line(s): ${lines})`
             }).join('\n')
 
             const artifactsUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}/artifacts`

.github/workflows/move-content.yml

@@ -6,13 +6,13 @@ on:
   pull_request:
     paths:
       - src/content-render/scripts/move-content.ts
-      - src/content-render/scripts/test-move-content.ts
-      - 'src/frame/lib/**/*.js'
+      - src/content-render/scripts/test-moved-content.ts
+      - 'src/frame/lib/**/*.ts'
       - .github/workflows/move-content.yml
       # Dependency changes can break the move-content script.
       - 'package*.json'
-      - src/fixtures/fixtures/content/get-started/
-      - src/fixtures/fixtures/content/code-security/
+      - 'src/fixtures/fixtures/content/get-started/**'
+      - 'src/fixtures/fixtures/content/code-security/**'
 
 permissions:
   contents: read
@@ -50,8 +50,9 @@ jobs:
         env:
           ROOT: src/fixtures/fixtures
         run: |
+          # The trailing slash on the old path matches what shell tab completion adds.
           npm run move-content -- \
-            src/fixtures/fixtures/content/code-security/getting-started \
+            src/fixtures/fixtures/content/code-security/getting-started/ \
             src/fixtures/fixtures/content/code-security/got-started
 
           npm run test-moved-content -- \

.github/workflows/no-response.yaml

@@ -20,11 +20,13 @@ jobs:
     runs-on: ubuntu-latest
     # Only run in the public repo, and skip automated comments.
     # Bot-authored issue_comment events are workflow chatter, not author responses.
+    # Scheduled runs often have a bot actor, so the actor check skips only comments.
     if: >-
       github.repository == 'github/docs' &&
-      github.actor != 'docs-bot' &&
+      (github.event_name != 'issue_comment' ||
+      (github.actor != 'docs-bot' &&
       github.actor != 'github-actions' &&
-      !endsWith(github.actor, '[bot]')
+      !endsWith(github.actor, '[bot]')))
     steps:
       - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         id: stale

.github/workflows/notify-about-deployment.yml

@@ -37,6 +37,8 @@ jobs:
         timeout-minutes: 5
         env:
           GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          # Manual Purge Fastly runs carry no deploy, so the script reads /_build instead.
+          DEPLOY_SHA: ${{ github.event.workflow_run.event == 'deployment_status' && github.event.workflow_run.head_sha || '' }}
         run: npm run find-past-built-pr
 
       - uses: ./.github/actions/create-workflow-failure-issue

.github/workflows/orphaned-files-check.yml

@@ -9,15 +9,17 @@ on:
     - cron: '20 16 * * 1'
   pull_request:
     paths:
-      - .github/workflows/orphaned-assets-check.yml
       - .github/workflows/orphaned-files-check.yml
       # Dependency changes can break the orphaned-files scripts.
       - 'package*.json'
       - src/assets/scripts/find-orphaned-assets.ts
-      - src/content-render/scripts/reusables-cli/find/unused.ts
+      - src/content-render/scripts/reusables-cli.ts
+      - 'src/content-render/scripts/reusables-cli/**'
+      - src/content-linter/lib/helpers/liquid-utils.ts
       - src/data-directory/scripts/find-orphaned-tables.ts
       - src/workflows/walk-files.ts
       - src/languages/lib/languages.ts
+      - src/languages/lib/languages-server.ts
       - .github/actions/clone-translations/action.yml
       - .github/actions/node-npm-setup/action.yml
 
@@ -53,7 +55,9 @@ jobs:
 
           # The -s flag keeps npm script-alias noise out of the file lists.
           assetFilesToRemove=$(npm run -s find-orphaned-assets)
-          reusableFilesToRemove=$(npm run -s reusables -- find unused | grep '^data/reusables' || true)
+          # Keep the CLI out of the pipeline so set -e catches its failures; grep may match nothing.
+          reusablesOutput=$(npm run -s reusables -- find unused)
+          reusableFilesToRemove=$(printf '%s\n' "$reusablesOutput" | grep '^data/reusables' || true)
           tableFilesToRemove=$(npm run -s find-orphaned-tables)
           [ -z "$assetFilesToRemove" ] && [ -z "$reusableFilesToRemove" ] && [ -z "$tableFilesToRemove" ] && exit 0
 

.github/workflows/reviewers-docs-engineering.yml

@@ -61,12 +61,19 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           CHANGED_FILES: ${{ github.event.pull_request.changed_files }}
           REPO: ${{ github.repository }}
+          EVENT_ACTION: ${{ github.event.action }}
         run: |
           if [ "$PR_AUTHOR" = "dependabot[bot]" ] || [ "$PR_AUTHOR" = "docs-bot" ]; then
             echo "Author is $PR_AUTHOR; skipping lockfile churn detection."
             echo "lockfile_only=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          # Removing the lockfile-churn-only label and reopening the PR is the documented override.
+          if [ "$EVENT_ACTION" = "reopened" ]; then
+            echo "PR reopened; skipping lockfile churn detection."
+            echo "lockfile_only=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           # `gh pr diff` fails above 300 files, and `gh pr view --json files` stops at 100.
           changed=$(gh api --paginate "repos/$REPO/pulls/$PR_NUMBER/files" --jq '.[].filename')
           echo "Changed files:"
@@ -101,7 +108,7 @@ jobs:
           git push
           ```
 
-          If the lockfile change is intentional, remove the `lockfile-churn-only` label and push or reopen the PR so this workflow sends it to the engineering review board.
+          If the lockfile change is intentional, remove the `lockfile-churn-only` label, then close and reopen the PR so this workflow sends it to the engineering review board.
           EOF
           gh pr comment "$PR" --body-file /tmp/lockfile-churn-body.md
           gh pr edit "$PR" --add-label lockfile-churn-only

.github/workflows/send-to-triage-board.yml

@@ -2,6 +2,7 @@ name: Add new issues and PRs to central triage board
 
 # Adds new, reopened, and ready-for-review github/docs work to the Central Triage Group board.
 # Sets today's date so first responders can triage it.
+# Skips PRs opened by docs-bot, such as Repo sync PRs, because they never need triage.
 
 on:
   issues:
@@ -15,7 +16,7 @@ permissions:
 jobs:
   add-to-central-triage:
     runs-on: ubuntu-latest
-    if: github.repository == 'github/docs'
+    if: github.repository == 'github/docs' && github.event.pull_request.user.login != 'docs-bot'
     steps:
       - name: Triage to central triage board
         env:

.github/workflows/triage-stale-check.yml

@@ -26,11 +26,11 @@ jobs:
           days-before-close: 7
 
           stale-issue-message: 'A stale label has been added to this issue, because it has been open for 30 days with no activity. If you think this issue should remain open, please add a new comment.'
-          exempt-issue-labels: 'help wanted,never-stale,waiting for review'
+          exempt-issue-labels: 'help wanted,never-stale,waiting for review,needs SME'
           stale-issue-label: 'Inactive'
           close-issue-label: 'Closed as inactive'
 
-          exempt-pr-labels: 'never-stale,ready to merge,waiting for review'
+          exempt-pr-labels: 'never-stale,ready to merge,waiting for review,needs SME'
           stale-pr-message: 'A stale label has been added to this pull request because it has been open 30 days with no activity. If you think this pull request should remain open, please add a new comment.'
           stale-pr-label: 'Inactive'
           close-pr-label: 'Closed as inactive'

.github/workflows/validate-openapi-check.yml

@@ -8,8 +8,9 @@ on:
     paths:
       - 'Dockerfile.openapi_decorator'
       - 'src/rest/scripts/openapi-check.ts'
-      - 'src/rest/scripts/utils/get-operations.ts'
-      - 'src/rest/scripts/utils/operation.ts'
+      # The check runs operation.ts and the helpers it imports.
+      - 'src/rest/scripts/utils/*.ts'
+      - 'src/tests/lib/validate-json-schema.ts'
       - 'src/rest/fixtures/openapi-check-fixture.json'
       - 'package.json'
       - 'package-lock.json'