Skip to content

Commit 4cae562

Browse files
Sharra-writesSharra-writes
authored
Merge branch 'main' into moraesc/concurrent-pr-limit-for-non-collaborators
2 parents 484d851 + 76d78b3 commit 4cae562

136 files changed

Lines changed: 529 additions & 237 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/changelog-agent.yml‎

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,20 @@ jobs:
4545
)
4646
runs-on: ubuntu-latest
4747
steps:
48+
- name: Generate GitHub App token
49+
id: app-token
50+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
51+
with:
52+
app-id: ${{ secrets.DOCS_BOT_APP_ID }}
53+
private-key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
54+
owner: github
55+
repositories: docs-internal,docs-content
56+
4857
- name: Resolve PR data
4958
id: resolve_pr
5059
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
5160
with:
52-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
61+
github-token: ${{ steps.app-token.outputs.token }}
5362
script: |
5463
let pr;
5564
if (context.eventName === 'workflow_dispatch') {
@@ -77,7 +86,7 @@ jobs:
7786
id: check_team
7887
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
7988
with:
80-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
89+
github-token: ${{ steps.app-token.outputs.token }}
8190
script: |
8291
const author = '${{ steps.resolve_pr.outputs.pr_author }}';
8392
@@ -115,7 +124,7 @@ jobs:
115124
env:
116125
PR_BODY: ${{ steps.resolve_pr.outputs.pr_body }}
117126
with:
118-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
127+
github-token: ${{ steps.app-token.outputs.token }}
119128
script: |
120129
const body = process.env.PR_BODY || '';
121130
@@ -150,7 +159,7 @@ jobs:
150159
id: check_parent
151160
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
152161
with:
153-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
162+
github-token: ${{ steps.app-token.outputs.token }}
154163
script: |
155164
const issueNumber = parseInt('${{ steps.extract_issue.outputs.issue_number }}', 10);
156165
@@ -231,7 +240,7 @@ jobs:
231240
PR_BODY: ${{ steps.resolve_pr.outputs.pr_body }}
232241
PR_URL: ${{ steps.resolve_pr.outputs.pr_url }}
233242
with:
234-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
243+
github-token: ${{ steps.app-token.outputs.token }}
235244
script: |
236245
const prNumber = parseInt('${{ steps.resolve_pr.outputs.pr_number }}', 10);
237246
const prAuthor = '${{ steps.resolve_pr.outputs.pr_author }}';
@@ -272,7 +281,7 @@ jobs:
272281
id: check_existing
273282
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
274283
with:
275-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
284+
github-token: ${{ steps.app-token.outputs.token }}
276285
script: |
277286
const branchName = `changelog-agent-${{ steps.resolve_pr.outputs.pr_number }}`;
278287
const { data: pulls } = await github.rest.pulls.list({
@@ -295,7 +304,7 @@ jobs:
295304
id: read_examples
296305
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
297306
with:
298-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
307+
github-token: ${{ steps.app-token.outputs.token }}
299308
script: |
300309
// Fetch changelog-internal.md from docs-content
301310
const { data } = await github.rest.repos.getContent({
@@ -420,7 +429,10 @@ jobs:
420429
uses: actions/ai-inference@17ff458cb182449bbb2e43701fcd98f6af8f6570 # v2.1.0
421430
with:
422431
provider: copilot
423-
model: gpt-4.1
432+
# No model is pinned: actions/ai-inference forwards --model to the
433+
# Copilot CLI only when it differs from its GitHub Models default, so
434+
# omitting it lets the CLI pick its own current default (latest Sonnet)
435+
# and avoids breaking when a pinned slug (e.g. gpt-4.1) is retired.
424436
prompt-file: prompt.txt
425437
system-prompt-file: system-prompt.txt
426438
max-completion-tokens: 1000
@@ -462,7 +474,7 @@ jobs:
462474
PARENT_AUTHOR: ${{ steps.check_parent.outputs.parent_author }}
463475
PARENT_ASSIGNEES: ${{ steps.check_parent.outputs.parent_assignees }}
464476
with:
465-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
477+
github-token: ${{ steps.app-token.outputs.token }}
466478
script: |
467479
const branchName = `changelog-agent-${{ steps.resolve_pr.outputs.pr_number }}`;
468480
const filePath = 'docs-content-docs/docs-content-workflows/changelog-internal.md';
@@ -623,7 +635,7 @@ jobs:
623635
PARENT_AUTHOR: ${{ steps.check_parent.outputs.parent_author }}
624636
PARENT_ASSIGNEES: ${{ steps.check_parent.outputs.parent_assignees }}
625637
with:
626-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
638+
github-token: ${{ steps.app-token.outputs.token }}
627639
script: |
628640
const author = process.env.PR_AUTHOR;
629641
const changelogPrUrl = process.env.CHANGELOG_PR_URL;
@@ -718,7 +730,7 @@ jobs:
718730
if: steps.create_pr.outputs.changelog_pr_url != '' && inputs.dry_run != true
719731
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
720732
with:
721-
github-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
733+
github-token: ${{ steps.app-token.outputs.token }}
722734
script: |
723735
const changelogPrUrl = '${{ steps.create_pr.outputs.changelog_pr_url }}';
724736
await github.rest.issues.createComment({

‎.github/workflows/count-translation-corruptions.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,20 +23,29 @@ jobs:
2323
if: github.repository == 'github/docs-internal'
2424
runs-on: ubuntu-latest
2525
steps:
26+
- name: Generate GitHub App token
27+
id: app-token
28+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
29+
with:
30+
app-id: ${{ secrets.DOCS_BOT_APP_ID }}
31+
private-key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
32+
owner: github
33+
repositories: docs-internal,docs-internal.es-es,docs-internal.ja-jp,docs-internal.pt-br,docs-internal.zh-cn,docs-internal.ru-ru,docs-internal.fr-fr,docs-internal.ko-kr,docs-internal.de-de
34+
2635
- name: Checkout English repo
2736
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2837
with:
2938
# Using a PAT is necessary so that the new commit will trigger the
3039
# CI in the PR. (Events from GITHUB_TOKEN don't trigger new workflows.)
31-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
40+
token: ${{ steps.app-token.outputs.token }}
3241

3342
# It's important because translations are often a bit behind.
3443
# So if a translation is a bit behind, it might still be referencing
3544
# an asset even though none of the English content does.
3645
- name: Clone all translations
3746
uses: ./.github/actions/clone-translations
3847
with:
39-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
48+
token: ${{ steps.app-token.outputs.token }}
4049

4150
- uses: ./.github/actions/node-npm-setup
4251

‎.github/workflows/index-autocomplete-search.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,21 @@ jobs:
2727

2828
- uses: ./.github/actions/node-npm-setup
2929

30+
- name: Generate GitHub App token
31+
id: app-token
32+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
33+
with:
34+
app-id: ${{ secrets.DOCS_BOT_APP_ID }}
35+
private-key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
36+
owner: github
37+
repositories: docs-internal,docs-internal-data
38+
3039
- uses: ./.github/actions/setup-elasticsearch
3140
if: ${{ github.event_name == 'pull_request' }}
3241

3342
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3443
with:
35-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
44+
token: ${{ steps.app-token.outputs.token }}
3645
repository: github/docs-internal-data
3746
path: docs-internal-data
3847

@@ -53,4 +62,4 @@ jobs:
5362
- uses: ./.github/actions/create-workflow-failure-issue
5463
if: ${{ failure() && github.event_name == 'schedule' }}
5564
with:
56-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
65+
token: ${{ steps.app-token.outputs.token }}

‎.github/workflows/index-general-search-pr.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,12 +39,21 @@ jobs:
3939
- name: Check out repo
4040
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4141

42+
- name: Generate GitHub App token
43+
id: app-token
44+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
45+
with:
46+
app-id: ${{ secrets.DOCS_BOT_APP_ID }}
47+
private-key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
48+
owner: github
49+
repositories: docs-internal-data
50+
4251
- name: Clone docs-internal-data
4352
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4453
with:
4554
repository: github/docs-internal-data
4655
# This works because user `docs-bot` has read access to that private repo.
47-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
56+
token: ${{ steps.app-token.outputs.token }}
4857
path: docs-internal-data
4958

5059
- uses: ./.github/actions/setup-elasticsearch

‎.github/workflows/orphaned-features-check.yml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,27 +25,36 @@ jobs:
2525
if: ${{ github.repository == 'github/docs-internal' }}
2626
runs-on: ubuntu-latest
2727
steps:
28+
- name: Generate GitHub App token
29+
id: app-token
30+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
31+
with:
32+
app-id: ${{ secrets.DOCS_BOT_APP_ID }}
33+
private-key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
34+
owner: github
35+
repositories: docs-internal,docs-internal.es-es,docs-internal.ja-jp,docs-internal.pt-br,docs-internal.zh-cn,docs-internal.ru-ru,docs-internal.fr-fr,docs-internal.ko-kr,docs-internal.de-de
36+
2837
- name: Checkout English repo
2938
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3039
with:
3140
# Using a PAT is necessary so that the new commit will trigger the
3241
# CI in the PR. (Events from GITHUB_TOKEN don't trigger new workflows.)
33-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
42+
token: ${{ steps.app-token.outputs.token }}
3443

3544
# It's important because translations are often a bit behind.
3645
# So if a translation is a bit behind, it might still be referencing
3746
# a feature even though none of the English content does.
3847
- name: Clone all translations
3948
uses: ./.github/actions/clone-translations
4049
with:
41-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
50+
token: ${{ steps.app-token.outputs.token }}
4251

4352
- uses: ./.github/actions/node-npm-setup
4453

4554
- name: Check for orphaned features
4655
env:
4756
# Needed for gh
48-
GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
57+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
4958
DRY_RUN: ${{ github.event_name == 'pull_request'}}
5059
run: |
5160
set -e
@@ -109,4 +118,4 @@ jobs:
109118
- uses: ./.github/actions/create-workflow-failure-issue
110119
if: ${{ failure() && github.event_name == 'schedule' }}
111120
with:
112-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
121+
token: ${{ steps.app-token.outputs.token }}

‎.github/workflows/orphaned-files-check.yml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,27 +29,36 @@ jobs:
2929
if: ${{ github.repository == 'github/docs-internal' }}
3030
runs-on: ubuntu-latest
3131
steps:
32+
- name: Generate GitHub App token
33+
id: app-token
34+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
35+
with:
36+
app-id: ${{ secrets.DOCS_BOT_APP_ID }}
37+
private-key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
38+
owner: github
39+
repositories: docs-internal,docs-internal.es-es,docs-internal.ja-jp,docs-internal.pt-br,docs-internal.zh-cn,docs-internal.ru-ru,docs-internal.fr-fr,docs-internal.ko-kr,docs-internal.de-de
40+
3241
- name: Checkout English repo
3342
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3443
with:
3544
# Using a PAT is necessary so that the new commit will trigger the
3645
# CI in the PR. (Events from GITHUB_TOKEN don't trigger new workflows.)
37-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
46+
token: ${{ steps.app-token.outputs.token }}
3847

3948
# It's important because translations are often a bit behind.
4049
# So if a translation is a bit behind, it might still be referencing
4150
# an asset even though none of the English content does.
4251
- name: Clone all translations
4352
uses: ./.github/actions/clone-translations
4453
with:
45-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
54+
token: ${{ steps.app-token.outputs.token }}
4655

4756
- uses: ./.github/actions/node-npm-setup
4857

4958
- name: Check for orphaned assets and reusables
5059
env:
5160
# Needed for gh
52-
GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
61+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
5362
DRY_RUN: ${{ github.event_name == 'pull_request'}}
5463
run: |
5564
set -e
@@ -117,4 +126,4 @@ jobs:
117126
- uses: ./.github/actions/create-workflow-failure-issue
118127
if: ${{ failure() && github.event_name == 'schedule' }}
119128
with:
120-
token: ${{ secrets.DOCS_BOT_PAT_BASE }}
129+
token: ${{ steps.app-token.outputs.token }}

‎.github/workflows/reviewers-content-systems.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,21 @@ jobs:
3232
runs-on: ubuntu-latest
3333
env:
3434
PR: ${{ github.event.pull_request.html_url }}
35-
GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
3635

3736
steps:
3837
- name: Checkout repository
3938
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4039

40+
- name: Generate GitHub App token
41+
id: app-token
42+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
43+
with:
44+
app-id: ${{ secrets.DOCS_BOT_APP_ID }}
45+
private-key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
46+
4147
- name: Add content systems as a reviewer
48+
env:
49+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
4250
uses: ./.github/actions/retry-command
4351
with:
4452
command: gh pr edit $PR --add-reviewer github/docs-content-systems --add-label reviewers-content-systems

‎.github/workflows/reviewers-dependabot.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,21 @@ jobs:
3333
runs-on: ubuntu-latest
3434
env:
3535
PR: ${{ github.event.pull_request.html_url }}
36-
GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
3736

3837
steps:
3938
- name: Checkout repository
4039
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4140

41+
- name: Generate GitHub App token
42+
id: app-token
43+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
44+
with:
45+
app-id: ${{ secrets.DOCS_BOT_APP_ID }}
46+
private-key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
47+
4248
- name: Add dependabot as a reviewer
49+
env:
50+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
4351
uses: ./.github/actions/retry-command
4452
with:
4553
command: gh pr edit $PR --add-reviewer github/dependabot-updates-reviewers --add-label reviewers-dependabot

‎.github/workflows/reviewers-docs-engineering.yml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,18 +45,26 @@ jobs:
4545
runs-on: ubuntu-latest
4646
env:
4747
PR: ${{ github.event.pull_request.html_url }}
48-
GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
4948

5049
steps:
5150
- name: Checkout repository
5251
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
5352

53+
- name: Generate GitHub App token
54+
id: app-token
55+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
56+
with:
57+
app-id: ${{ secrets.DOCS_BOT_APP_ID }}
58+
private-key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
59+
5460
# Detect PRs that only changed package-lock.json (no engineering source files).
5561
# These are usually cross-platform `npm install` churn from contributors
5662
# editing content. We comment with reset instructions instead of pulling in
5763
# docs-engineering for review.
5864
- name: Detect lockfile-only churn
5965
id: detect
66+
env:
67+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
6068
run: |
6169
changed=$(gh pr diff "$PR" --name-only)
6270
echo "Changed files:"
@@ -71,6 +79,8 @@ jobs:
7179
7280
- name: Comment and label lockfile-only PRs
7381
if: steps.detect.outputs.lockfile_only == 'true'
82+
env:
83+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
7484
run: |
7585
cat > /tmp/lockfile-churn-body.md <<'EOF'
7686
_Posted by Copilot on behalf of docs-engineering._
@@ -90,6 +100,8 @@ jobs:
90100
91101
- name: Add docs engineering as a reviewer
92102
if: steps.detect.outputs.lockfile_only != 'true'
103+
env:
104+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
93105
uses: ./.github/actions/retry-command
94106
with:
95107
command: gh pr edit $PR --add-reviewer github/docs-engineering --add-label reviewers-docs-engineering

0 commit comments

Comments
 (0)