Dependabot/npm and yarn/typescript eslint/eslint plugin 8.4.0

.devcontainer/devcontainer.json

@@ -30,6 +30,7 @@
                 "streetsidesoftware.code-spell-checker",
                 "alistairchristie.open-reusables",
                 "AlistairChristie.version-identifier",
+                "peterbe.ghdocs-goer",
                 "GitHub.copilot",
                 "GitHub.copilot-chat"
             ]

.github/CODEOWNERS

@@ -11,7 +11,7 @@
 src/ghes-releases/lib/enterprise-dates.json @github/docs-content-enterprise
 
 # Requires review of #actions-oidc-integration, docs-engineering/issues/1506
-content/actions/deployment/security-hardening-your-deployments/** @github/oidc
+# content/actions/deployment/security-hardening-your-deployments/** @github/oidc
 
 # RAI - CELA
 data/reusables/rai/** @github/legal-product

.github/actions/setup-elasticsearch/action.yml

@@ -1,3 +1,4 @@
+# For the sake of saving time, only run this step if the test-group is one that will run tests against an Elasticsearch on localhost.
 name: Set up local Elasticsearch
 
 description: Install a local Elasticsearch with version that matches prod
@@ -6,20 +7,83 @@ inputs:
   token:
     description: PAT
     required: true
+  elasticsearch_version:
+    description: Version of Elasticsearch to install
+    required: true
+    # Make sure the version matches production and is available on Docker Hub
+    default: '8.12.0'
 
 runs:
   using: 'composite'
   steps:
-    - name: Install a local Elasticsearch for testing
-      # For the sake of saving time, only run this step if the test-group
-      # is one that will run tests against an Elasticsearch on localhost.
-      uses: getong/elasticsearch-action@95b501ab0c83dee0aac7c39b7cea3723bef14954
+    # Cache the elasticsearch image to prevent Docker Hub rate limiting
+    - name: Cache Docker layers
+      id: cache-docker-layers
+      uses: actions/cache@v2
       with:
-        # Make sure this matches production
-        # It might also need to match what's available on Docker hub
-        elasticsearch version: '8.12.0'
-        host port: 9200
-        container port: 9200
-        host node port: 9300
-        node port: 9300
-        discovery type: 'single-node'
+        path: /tmp/docker-cache
+        key: ${{ runner.os }}-elasticsearch-${{ inputs.elasticsearch_version }}
+        restore-keys: |
+          ${{ runner.os }}-elasticsearch-
+
+    - name: Load cached Docker image
+      shell: bash
+      if: steps.cache-docker-layers.outputs.cache-hit == 'true'
+      run: docker load -i /tmp/docker-cache/elasticsearch.tar || echo "No cache found for elasticsearch, pulling image"
+
+    - name: Pull Docker image
+      shell: bash
+      if: steps.cache-docker-layers.outputs.cache-hit != 'true'
+      run: docker pull elasticsearch:${{ inputs.elasticsearch_version }}
+
+    - name: Save Docker image to cache
+      shell: bash
+      if: steps.cache-docker-layers.outputs.cache-hit != 'true'
+      run: |
+        mkdir -p /tmp/docker-cache
+        docker save -o /tmp/docker-cache/elasticsearch.tar elasticsearch:${{ inputs.elasticsearch_version }}
+
+    # Setups the Elasticsearch container
+    # Derived from https://github.com/getong/elasticsearch-action
+    - name: Run Docker container
+      shell: bash
+      env:
+        INPUT_ELASTICSEARCH_VERSION: ${{ inputs.elasticsearch_version }}
+        INPUT_HOST_PORT: 9200
+        INPUT_CONTAINER_PORT: 9200
+        INPUT_HOST_NODE_PORT: 9300
+        INPUT_NODE_PORT: 9300
+        INPUT_DISCOVERY_TYPE: 'single-node'
+      run: |
+        docker network create elastic
+
+        docker run --network elastic \
+          -e 'node.name=es1' \
+          -e 'cluster.name=docker-elasticsearch' \
+          -e 'cluster.initial_master_nodes=es1' \
+          -e 'discovery.seed_hosts=es1' \
+          -e 'cluster.routing.allocation.disk.threshold_enabled=false' \
+          -e 'bootstrap.memory_lock=true' \
+          -e 'ES_JAVA_OPTS=-Xms1g -Xmx1g' \
+          -e 'xpack.security.enabled=false' \
+          -e 'xpack.license.self_generated.type=basic' \
+          --ulimit nofile=65536:65536 \
+          --ulimit memlock=-1:-1 \
+          --name='es1' \
+          -d \
+          -p $INPUT_HOST_PORT:$INPUT_CONTAINER_PORT \
+          -p $INPUT_HOST_NODE_PORT:$INPUT_NODE_PORT \
+          -e discovery_type=$INPUT_DISCOVERY_TYPE \
+          elasticsearch:$INPUT_ELASTICSEARCH_VERSION
+
+        # Check if Elasticsearch is up and running
+        for i in {1..120}; do
+          if curl --silent --fail http://localhost:9200; then
+            echo "Elasticsearch is up and running"
+            exit 0
+          fi
+          echo "Waiting for Elasticsearch to be ready..."
+          sleep 1
+        done
+        echo "Elasticsearch did not become ready in time"
+        exit 1

.github/branch_protection_settings/main.json

@@ -39,7 +39,8 @@
       "frame",
       "products",
       "workflows",
-      "lint-code"
+      "lint-code",
+      "secret-scanning",
     ],
     "contexts_url": "https://api.github.com/repos/github/docs-internal/branches/main/protection/required_status_checks/contexts",
     "checks": [
@@ -81,7 +82,8 @@
       { "context": "frame", "app_id": 15368 },
       { "context": "products", "app_id": 15368 },
       { "context": "workflows", "app_id": 15368 },
-      { "context": "lint-code", "app_id": 15368 }
+      { "context": "lint-code", "app_id": 15368 },
+      { "context": "secret-scanning", "app_id": 15368 }
     ]
   },
   "restrictions": {

.github/dependabot.yml

@@ -11,7 +11,8 @@ updates:
       # Because whatever we have needs to match what @primer/react also uses
       - dependency-name: 'styled-components'
       - dependency-name: '*'
-        update-types: ['version-update:semver-patch']
+        update-types:
+          ['version-update:semver-patch', 'version-update:semver-minor']
 
   - package-ecosystem: 'github-actions'
     directory: '/'
@@ -20,7 +21,8 @@ updates:
       day: wednesday
     ignore:
       - dependency-name: '*'
-        update-types: ['version-update:semver-patch']
+        update-types:
+          ['version-update:semver-patch', 'version-update:semver-minor']
 
   - package-ecosystem: 'docker'
     directory: '/'

.github/workflows/azure-preview-env-deploy-public.yml

@@ -66,7 +66,7 @@ jobs:
           password: ${{ secrets.NONPROD_REGISTRY_PASSWORD }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db
 
       - name: Check out main branch
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -112,7 +112,7 @@ jobs:
         run: src/workflows/prune-for-preview-env.sh
 
       - name: 'Build and push image'
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25
+        uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755
         with:
           context: .
           push: true

.github/workflows/azure-preview-env-deploy.yml

@@ -79,7 +79,7 @@ jobs:
           password: ${{ secrets.NONPROD_REGISTRY_PASSWORD }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db
 
       - name: Check out PR code
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -171,7 +171,7 @@ jobs:
         run: src/workflows/prune-for-preview-env.sh
 
       - name: 'Build and push image'
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25
+        uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755
         with:
           context: .
           push: true

.github/workflows/azure-prod-build-deploy.yml

@@ -49,12 +49,9 @@ jobs:
           password: ${{ secrets.PROD_REGISTRY_PASSWORD }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db
 
       - name: Check out repo
-        # If any of the steps above fail, we'll need a checkout so we
-        # have access to the `.github/actions/slack-alert/action.yml` file.
-        if: ${{ always() && github.event_name != 'workflow_dispatch' }}
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           ref: ${{ github.sha }}
@@ -67,6 +64,11 @@ jobs:
           node-version-file: 'package.json'
           cache: npm
 
+      # Currently we only need this to run dependencies in
+      # src/workflows/check-canary-slots.js
+      - name: Install dependencies
+        run: npm install
+
       - name: Clone docs-early-access
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
@@ -90,7 +92,7 @@ jobs:
           token: ${{ secrets.DOCS_BOT_PAT_READPUBLICKEY }}
 
       - name: 'Build and push image'
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25
+        uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755
         with:
           context: .
           push: true

.github/workflows/azure-staging-build-deploy.yml

@@ -57,7 +57,7 @@ jobs:
           password: ${{ secrets.NONPROD_REGISTRY_PASSWORD }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db
 
       - name: Check out repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -91,7 +91,7 @@ jobs:
         run: src/early-access/scripts/merge-early-access.sh
 
       - name: 'Build and push image'
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25
+        uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755
         with:
           context: .
           push: true

.github/workflows/codeowners-legal.yml

@@ -30,10 +30,16 @@ jobs:
     steps:
       - name: Check out repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          # Picking this number is a "best guess". If we make it too large,
+          # the checkout will take potentially unnecessariily long.
+          # This reduces the chance that tj-actions/changed-files has to
+          # fetch deeper history. But if it needs to, it will.
+          fetch-depth: 10
 
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@1754cd4b9e661d1f0eced3b33545a8d8b3bc46d8 # v44.5.0
+        uses: tj-actions/changed-files@40853de9f8ce2d6cfdc73c1b96f14e22ba44aec4 # v45.0.0
         with:
           files: 'content/**'
           output_renamed_files_as_deleted_and_added: true

.github/workflows/codeql.yml

@@ -36,13 +36,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: github/codeql-action/init@b7cec7526559c32f1616476ff32d17ba4c59b2d6 # v3.25.5
+      - uses: github/codeql-action/init@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0
         with:
           languages: javascript # comma separated list of values from {go, python, javascript, java, cpp, csharp, ruby}
           config: |
             paths-ignore:
               - 'src/open-source/scripts/add-pr-links.js'
-      - uses: github/codeql-action/analyze@b7cec7526559c32f1616476ff32d17ba4c59b2d6 # v3.25.5
+      - uses: github/codeql-action/analyze@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0
         continue-on-error: true
 
       - uses: ./.github/actions/slack-alert

.github/workflows/content-lint-markdown.yml

@@ -30,7 +30,7 @@ jobs:
 
       - name: Get changed content/data files
         id: changed-files
-        uses: tj-actions/changed-files@1754cd4b9e661d1f0eced3b33545a8d8b3bc46d8 # v44.5.0
+        uses: tj-actions/changed-files@40853de9f8ce2d6cfdc73c1b96f14e22ba44aec4 # v45.0.0
         with:
           # No need to escape the file names because we make the output of
           # tj-actions/changed-files be set as an environment variable. Not

.github/workflows/delete-orphan-translation-files.yml

@@ -95,7 +95,7 @@ jobs:
           changes=$(git diff --name-only | wc -l)
           untracked=$(git status --untracked-files --short | wc -l)
           if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then
-            echo "There are no changes to commit after running src/rest/scripts/update-files.js. Exiting..."
+            echo "There are no changes to commit or untracked files. Exiting."
             exit 0
           fi
 

.github/workflows/main-preview-docker-cache.yml

@@ -42,7 +42,7 @@ jobs:
           password: ${{ secrets.NONPROD_REGISTRY_PASSWORD }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db
 
       - name: Check out repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -68,7 +68,7 @@ jobs:
         run: src/workflows/prune-for-preview-env.sh
 
       - name: 'Build and push image'
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25
+        uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755
         with:
           context: .
           push: true

.github/workflows/repo-sync.yml

@@ -10,7 +10,7 @@ name: Repo Sync
 on:
   workflow_dispatch:
   schedule:
-    - cron: '20,50 * * * *' # Run every hour at 20 and 50 minutes after
+    - cron: '20 */3 * * *' # Run every 3rd hour at 20 minutes after
 
 permissions:
   contents: write

.github/workflows/sync-audit-logs.yml

@@ -55,7 +55,7 @@ jobs:
           changes=$(git diff --name-only | wc -l)
           untracked=$(git status --untracked-files --short | wc -l)
           if [[ $changes -eq 0 ]] && [[ $untracked -eq 0 ]]; then
-            echo "There are no changes to commit after running src/rest/scripts/update-files.js. Exiting..."
+            echo "There are no changes to commit or untracked files. Exiting..."
             exit 0
           fi