Merge branch 'main' into themeOptimize

.devcontainer/devcontainer.json

@@ -30,6 +30,7 @@
                 "streetsidesoftware.code-spell-checker",
                 "alistairchristie.open-reusables",
                 "AlistairChristie.version-identifier",
+                "peterbe.ghdocs-goer",
                 "GitHub.copilot",
                 "GitHub.copilot-chat"
             ]
@@ -58,6 +59,9 @@
     // Use 'postCreateCommand' to run commands after the container is created.
     "postCreateCommand": "npm ci",
 
+    // Use 'updateContentCommand' to run commands to be included in Codespace pre-builds
+    "updateContentCommand": "git clone https://github.com/github/rest-api-description.git",
+
     // Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
     "remoteUser": "node",
 

.github/CODEOWNERS

@@ -11,7 +11,7 @@
 src/ghes-releases/lib/enterprise-dates.json @github/docs-content-enterprise
 
 # Requires review of #actions-oidc-integration, docs-engineering/issues/1506
-content/actions/deployment/security-hardening-your-deployments/** @github/oidc
+# content/actions/deployment/security-hardening-your-deployments/** @github/oidc
 
 # RAI - CELA
 data/reusables/rai/** @github/legal-product

.github/actions/labeler/action.yml

@@ -0,0 +1,33 @@
+name: Labeler
+
+description: Adds labels to an Issue or PR
+inputs:
+  token:
+    description: defaults to GITHUB_TOKEN, otherwise can use a PAT
+    required: false
+    default: ${{ github.token }}
+  addLabels:
+    description: array of labels to apply
+    required: false
+  removeLabels:
+    description: array of labels to remove
+    required: false
+  ignoreIfAssigned:
+    description: don't apply labels if there are assignees
+    required: false
+  ignoreIfLabeled:
+    description: don't apply labels if there are already labels added
+    required: false
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Add label to an issue or pr
+      run: node .github/actions/labeler/labeler.js
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.token }}
+        ADD_LABELS: ${{ inputs.addLabels }}
+        REMOVE_LABELS: ${{ inputs.removeLabels }}
+        IGNORE_IF_ASSIGNED: ${{ inputs.ignoreIfAssigned }}
+        IGNORE_IF_LABELED: ${{ inputs.ignoreIfLabeled }}

.github/actions/labeler/labeler.js

@@ -0,0 +1,160 @@
+/* See function main in this file for documentation */
+
+import coreLib from '@actions/core'
+
+import github from '#src/workflows/github.js'
+import { getActionContext } from '#src/workflows/action-context.js'
+import { boolEnvVar } from '#src/workflows/get-env-inputs.js'
+
+// When this file is invoked directly from action as opposed to being imported
+if (import.meta.url.endsWith(process.argv[1])) {
+  if (!process.env.GITHUB_TOKEN) {
+    throw new Error('You must set the GITHUB_TOKEN environment variable.')
+  }
+
+  const { ADD_LABELS, REMOVE_LABELS } = process.env
+
+  const octokit = github()
+
+  const opts = {
+    addLabels: ADD_LABELS,
+    removeLabels: REMOVE_LABELS,
+    ignoreIfAssigned: boolEnvVar('IGNORE_IF_ASSIGNED'),
+    ignoreIfLabeled: boolEnvVar('IGNORE_IF_LABELED'),
+  }
+
+  // labels come in comma separated from actions
+  let addLabels
+
+  if (opts.addLabels) {
+    addLabels = [...opts.addLabels.split(',')]
+    opts.addLabels = addLabels.map((l) => l.trim())
+  } else {
+    opts.addLabels = []
+  }
+
+  let removeLabels
+
+  if (opts.removeLabels) {
+    removeLabels = [...opts.removeLabels.split(',')]
+    opts.removeLabels = removeLabels.map((l) => l.trim())
+  } else {
+    opts.removeLabels = []
+  }
+
+  const actionContext = getActionContext()
+  const { owner, repo } = actionContext
+  let issueOrPrNumber = actionContext?.pull_request?.number
+
+  if (!issueOrPrNumber) {
+    issueOrPrNumber = actionContext?.issue?.number
+  }
+
+  opts.issue_number = issueOrPrNumber
+  opts.owner = owner
+  opts.repo = repo
+
+  main(coreLib, octokit, opts, {})
+}
+
+/*
+ * Applies labels to an issue or pull request.
+ *
+ * opts:
+ *  issue_number {number} id of the issue or pull request to label
+ *  owner {string} owner of the repository
+ *  repo {string} repository name
+ *  addLabels {Array<string>} array of labels to apply
+ *  removeLabels {Array<string>} array of labels to remove
+ *  ignoreIfAssigned {boolean} don't apply labels if there are assignees
+ *  ignoreIfLabeled {boolean} don't apply labels if there are already labels added
+ */
+export default async function main(core, octokit, opts = {}) {
+  if (opts.addLabels?.length === 0 && opts.removeLabels?.length === 0) {
+    core.info('No labels to add or remove specified, nothing to do.')
+    return
+  }
+
+  if (opts.ignoreIfAssigned || opts.ignoreIfLabeled) {
+    try {
+      const { data } = await octokit.issues.get({
+        issue_number: opts.issue_number,
+        owner: opts.owner,
+        repo: opts.repo,
+      })
+
+      if (opts.ignoreIfAssigned) {
+        if (data.assignees.length > 0) {
+          core.info(
+            `ignore-if-assigned is true: not applying labels since there's ${data.assignees.length} assignees`,
+          )
+          return 0
+        }
+      }
+
+      if (opts.ignoreIfLabeled) {
+        if (data.labels.length > 0) {
+          core.info(
+            `ignore-if-labeled is true: not applying labels since there's ${data.labels.length} labels applied`,
+          )
+          return 0
+        }
+      }
+    } catch (err) {
+      throw new Error(`Error getting issue: ${err}`)
+    }
+  }
+
+  if (opts.removeLabels?.length > 0) {
+    // removing a label fails if the label isn't already applied
+    let appliedLabels = []
+
+    try {
+      const { data } = await octokit.issues.get({
+        issue_number: opts.issue_number,
+        owner: opts.owner,
+        repo: opts.repo,
+      })
+
+      appliedLabels = data.labels.map((l) => l.name)
+    } catch (err) {
+      throw new Error(`Error getting issue: ${err}`)
+    }
+
+    opts.removeLabels = opts.removeLabels.filter((l) => appliedLabels.includes(l))
+
+    await Promise.all(
+      opts.removeLabels.map(async (label) => {
+        try {
+          await octokit.issues.removeLabel({
+            issue_number: opts.issue_number,
+            owner: opts.owner,
+            repo: opts.repo,
+            name: label,
+          })
+        } catch (err) {
+          throw new Error(`Error removing label: ${err}`)
+        }
+      }),
+    )
+
+    if (opts.removeLabels.length > 0) {
+      core.info(`Removed labels: ${opts.removeLabels.join(', ')}`)
+    }
+  }
+
+  if (opts.addLabels?.length > 0) {
+    try {
+      await octokit.issues.addLabels({
+        issue_number: opts.issue_number,
+        owner: opts.owner,
+        repo: opts.repo,
+        labels: opts.addLabels,
+      })
+
+      core.info(`Added labels: ${opts.addLabels.join(', ')}`)
+    } catch (err) {
+      throw new Error(`Error adding label: ${err}`)
+    }
+  }
+}

.github/actions/setup-elasticsearch/action.yml

@@ -1,3 +1,4 @@
+# For the sake of saving time, only run this step if the test-group is one that will run tests against an Elasticsearch on localhost.
 name: Set up local Elasticsearch
 
 description: Install a local Elasticsearch with version that matches prod
@@ -6,20 +7,83 @@ inputs:
   token:
     description: PAT
     required: true
+  elasticsearch_version:
+    description: Version of Elasticsearch to install
+    required: true
+    # Make sure the version matches production and is available on Docker Hub
+    default: '8.12.0'
 
 runs:
   using: 'composite'
   steps:
-    - name: Install a local Elasticsearch for testing
-      # For the sake of saving time, only run this step if the test-group
-      # is one that will run tests against an Elasticsearch on localhost.
-      uses: getong/elasticsearch-action@95b501ab0c83dee0aac7c39b7cea3723bef14954
+    # Cache the elasticsearch image to prevent Docker Hub rate limiting
+    - name: Cache Docker layers
+      id: cache-docker-layers
+      uses: actions/cache@v2
       with:
-        # Make sure this matches production
-        # It might also need to match what's available on Docker hub
-        elasticsearch version: '8.12.0'
-        host port: 9200
-        container port: 9200
-        host node port: 9300
-        node port: 9300
-        discovery type: 'single-node'
+        path: /tmp/docker-cache
+        key: ${{ runner.os }}-elasticsearch-${{ inputs.elasticsearch_version }}
+        restore-keys: |
+          ${{ runner.os }}-elasticsearch-
+
+    - name: Load cached Docker image
+      shell: bash
+      if: steps.cache-docker-layers.outputs.cache-hit == 'true'
+      run: docker load -i /tmp/docker-cache/elasticsearch.tar || echo "No cache found for elasticsearch, pulling image"
+
+    - name: Pull Docker image
+      shell: bash
+      if: steps.cache-docker-layers.outputs.cache-hit != 'true'
+      run: docker pull elasticsearch:${{ inputs.elasticsearch_version }}
+
+    - name: Save Docker image to cache
+      shell: bash
+      if: steps.cache-docker-layers.outputs.cache-hit != 'true'
+      run: |
+        mkdir -p /tmp/docker-cache
+        docker save -o /tmp/docker-cache/elasticsearch.tar elasticsearch:${{ inputs.elasticsearch_version }}
+
+    # Setups the Elasticsearch container
+    # Derived from https://github.com/getong/elasticsearch-action
+    - name: Run Docker container
+      shell: bash
+      env:
+        INPUT_ELASTICSEARCH_VERSION: ${{ inputs.elasticsearch_version }}
+        INPUT_HOST_PORT: 9200
+        INPUT_CONTAINER_PORT: 9200
+        INPUT_HOST_NODE_PORT: 9300
+        INPUT_NODE_PORT: 9300
+        INPUT_DISCOVERY_TYPE: 'single-node'
+      run: |
+        docker network create elastic
+
+        docker run --network elastic \
+          -e 'node.name=es1' \
+          -e 'cluster.name=docker-elasticsearch' \
+          -e 'cluster.initial_master_nodes=es1' \
+          -e 'discovery.seed_hosts=es1' \
+          -e 'cluster.routing.allocation.disk.threshold_enabled=false' \
+          -e 'bootstrap.memory_lock=true' \
+          -e 'ES_JAVA_OPTS=-Xms1g -Xmx1g' \
+          -e 'xpack.security.enabled=false' \
+          -e 'xpack.license.self_generated.type=basic' \
+          --ulimit nofile=65536:65536 \
+          --ulimit memlock=-1:-1 \
+          --name='es1' \
+          -d \
+          -p $INPUT_HOST_PORT:$INPUT_CONTAINER_PORT \
+          -p $INPUT_HOST_NODE_PORT:$INPUT_NODE_PORT \
+          -e discovery_type=$INPUT_DISCOVERY_TYPE \
+          elasticsearch:$INPUT_ELASTICSEARCH_VERSION
+
+        # Check if Elasticsearch is up and running
+        for i in {1..120}; do
+          if curl --silent --fail http://localhost:9200; then
+            echo "Elasticsearch is up and running"
+            exit 0
+          fi
+          echo "Waiting for Elasticsearch to be ready..."
+          sleep 1
+        done
+        echo "Elasticsearch did not become ready in time"
+        exit 1

.github/actions/slack-alert/action.yml

@@ -8,6 +8,14 @@ inputs:
   slack_token:
     description: Slack token
     required: true
+  message:
+    description: The message to send to Slack
+    default: The last '${{ github.workflow }}' run failed. See ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    required: false
+  color:
+    description: The color of the Slack message
+    default: failure
+    required: false
 
 runs:
   using: composite
@@ -17,5 +25,5 @@ runs:
       with:
         channel: ${{ inputs.slack_channel_id }}
         bot-token: ${{ inputs.slack_token }}
-        color: failure
-        text: The last '${{ github.workflow }}' run failed. See ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        color: ${{ inputs.color }}
+        text: ${{ inputs.message }}

.github/branch_protection_settings/main.json

@@ -39,7 +39,8 @@
       "frame",
       "products",
       "workflows",
-      "lint-code"
+      "lint-code",
+      "secret-scanning",
     ],
     "contexts_url": "https://api.github.com/repos/github/docs-internal/branches/main/protection/required_status_checks/contexts",
     "checks": [
@@ -81,7 +82,8 @@
       { "context": "frame", "app_id": 15368 },
       { "context": "products", "app_id": 15368 },
       { "context": "workflows", "app_id": 15368 },
-      { "context": "lint-code", "app_id": 15368 }
+      { "context": "lint-code", "app_id": 15368 },
+      { "context": "secret-scanning", "app_id": 15368 }
     ]
   },
   "restrictions": {

.github/dependabot.yml

@@ -11,7 +11,8 @@ updates:
       # Because whatever we have needs to match what @primer/react also uses
       - dependency-name: 'styled-components'
       - dependency-name: '*'
-        update-types: ['version-update:semver-patch']
+        update-types:
+          ['version-update:semver-patch', 'version-update:semver-minor']
 
   - package-ecosystem: 'github-actions'
     directory: '/'

.github/workflows/alert-changed-branch-protections.yml

@@ -38,10 +38,19 @@ jobs:
         id: compare
         run: |
           # Compare the fetched branch protections with the committed ones
-          git diff --no-index .github/branch_protection_settings/${{ matrix.branch }}.json ${{ matrix.branch }}-actual.json
+          git diff --no-index .github/branch_protection_settings/${{ matrix.branch }}.json ${{ matrix.branch }}-actual.json || echo "diff_failed=true" >> $GITHUB_ENV
+
+      - name: Set failure message
+        if: env.diff_failed == 'true'
+        run: |
+          message="Alert due to changes in branch protections for ${{ matrix.branch }}. Please review the changes and ensure they are intentional. If valid, update the branch protection settings in .github/branch_protection_settings/${{ matrix.branch }}.json to match the diff in this workflow."
+          echo "failure_message=$message" >> $GITHUB_ENV
+          echo "$message"
 
       - uses: ./.github/actions/slack-alert
-        if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
+        if: ${{ env.diff_failed == 'true' && github.event_name != 'workflow_dispatch' }}
         with:
           slack_channel_id: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
           slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
+          message: ${{ env.failure_message }}
+          color: purple