@@ -1,4 +1,4 @@
 # Update ARG and FROM together from the Node devcontainer image tags:
 # https://mcr.microsoft.com/en-us/product/devcontainers/javascript-node/tags
 ARG VARIANT=dev-24-bookworm
-FROM mcr.microsoft.com/devcontainers/javascript-node:dev-24-bookworm@sha256:5ed0bf1411cffe8182ee6808477dd64c969a4ce78fee1b63e6a654d7deff889c
+FROM mcr.microsoft.com/devcontainers/javascript-node:dev-24-bookworm@sha256:d0445b9546f96869b509aa70b8593bdc0054aca6689bc1dd0324083d0fd2bcc3
@@ -31,17 +31,8 @@ if (import.meta.url.endsWith(process.argv[1])) {
     ignoreIfLabeled: boolEnvVar('IGNORE_IF_LABELED'),
   }
 
-  // Actions pass comma-separated labels.
-  if (typeof ADD_LABELS === 'string') {
-    opts.addLabels = [...ADD_LABELS.split(',')].map((l) => l.trim())
-  } else {
-    opts.addLabels = []
-  }
-  if (typeof REMOVE_LABELS === 'string') {
-    opts.removeLabels = [...REMOVE_LABELS.split(',')].map((l) => l.trim())
-  } else {
-    opts.removeLabels = []
-  }
+  opts.addLabels = parseLabels(ADD_LABELS)
+  opts.removeLabels = parseLabels(REMOVE_LABELS)
 
   const actionContext = getActionContext()
   const { owner, repo } = actionContext
@@ -58,6 +49,14 @@ if (import.meta.url.endsWith(process.argv[1])) {
   main(coreLib, octokit, opts)
 }
 
+// Actions pass comma-separated labels, and an omitted input arrives as an empty string.
+export function parseLabels(value?: string): string[] {
+  return (value || '')
+    .split(',')
+    .map((l) => l.trim())
+    .filter(Boolean)
+}
+
 export default async function main(
   core: typeof coreLib | CoreInject,
   octokit: Octokit,
 
@@ -23,7 +23,9 @@ updates:
           ['version-update:semver-patch', 'version-update:semver-minor']
 
   - package-ecosystem: 'github-actions'
-    directory: '/'
+    directories:
+      - '/'
+      - '/.github/actions/*'
     schedule:
       interval: weekly
       day: tuesday
 
@@ -9,6 +9,7 @@ on:
       - 'Gemfile*'
       - 'Dockerfile'
       - '.github/workflows/**'
+      - '.github/actions/**'
 
 permissions:
   contents: write
 
@@ -227,10 +227,12 @@ jobs:
             const prNumber = parseInt('${{ steps.resolve_pr.outputs.pr_number }}', 10);
             const prAuthor = '${{ steps.resolve_pr.outputs.pr_author }}';
 
-            const { data: reviews } = await github.rest.pulls.listReviews({
+            // Approvals often come after many comment reviews, so read every page
+            const reviews = await github.paginate(github.rest.pulls.listReviews, {
               owner: context.repo.owner,
               repo: context.repo.repo,
               pull_number: prNumber,
+              per_page: 100,
             });
 
             const approvedReviewers = [...new Set(
 
@@ -32,7 +32,9 @@ jobs:
         with:
           languages: javascript
       - uses: github/codeql-action/analyze@e296a935590eb16afc0c0108289f68c87e2a89a5 # v4.30.7
-        continue-on-error: true
+        # Pull request scans stay non-blocking so analysis errors do not hold up merges.
+        # Push runs must fail so the alert steps below fire.
+        continue-on-error: ${{ github.event_name == 'pull_request' }}
 
       - uses: ./.github/actions/create-workflow-failure-issue
         id: create-failure-issue
 
@@ -4,9 +4,9 @@ name: Confirm internal staff meant to post in public
 
 on:
   issues:
+    # Issues moved into github/docs arrive as opened. The transferred event fires in the source repo.
     types:
       - opened
-      - transferred
   # pull_request_target lets the workflow check org membership for forked PR authors.
   pull_request_target:
     types:
 
@@ -44,6 +44,8 @@ jobs:
 
       - name: Update comment
         if: ${{ steps.comment.outputs.markdown != '' }}
+        # Fork PRs get a read-only token, so posting fails there. The next step still shows the instructions.
+        continue-on-error: true
         uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         with:
           comment-id: ${{ steps.findComment.outputs.comment-id }}
@@ -53,7 +55,11 @@ jobs:
 
       - name: Ultimately fail the workflow for attention
         if: ${{ steps.comment.outputs.markdown != '' }}
+        env:
+          MARKDOWN: ${{ steps.comment.outputs.markdown }}
         run: |
           echo "More than 1 asset image was deleted as part of this PR."
-          echo "See posted PR commented about how to get them back."
+          echo "See the PR comment or this job's summary for how to get them back."
+          echo "$MARKDOWN" >> "$GITHUB_STEP_SUMMARY"
+          echo "$MARKDOWN"
           exit 1
@@ -42,6 +42,8 @@ jobs:
 
       - name: Update comment
         if: ${{ steps.comment.outputs.markdown != '' }}
+        # Fork PRs get a read-only token, so posting fails there. The next step still shows the instructions.
+        continue-on-error: true
         uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         with:
           comment-id: ${{ steps.findComment.outputs.comment-id }}
@@ -51,7 +53,11 @@ jobs:
 
       - name: Ultimately fail the workflow for attention
         if: ${{ steps.comment.outputs.markdown != '' }}
+        env:
+          MARKDOWN: ${{ steps.comment.outputs.markdown }}
         run: |
           echo "This PR deletes or renames one or more feature files."
-          echo "See the PR comment for how to get them back."
+          echo "See the PR comment or this job's summary for how to get them back."
+          echo "$MARKDOWN" >> "$GITHUB_STEP_SUMMARY"
+          echo "$MARKDOWN"
           exit 1
@@ -152,6 +152,11 @@ jobs:
   create-pull-request:
     if: github.repository == 'github/docs-internal'
     runs-on: ubuntu-latest
+    # Serialize publishing so a second run sees the first run's PR before it force-pushes.
+    # Pull request dry runs get their own group so they never queue behind or cancel a publisher.
+    concurrency:
+      group: ${{ github.workflow }}-query-table-publication-${{ github.event_name == 'pull_request' && github.run_id || 'publish' }}
+      cancel-in-progress: false
     permissions:
       contents: write
       pull-requests: write
@@ -216,27 +221,27 @@ jobs:
 
           branchname=codeql-query-tables-${{ steps.codeql.outputs.OPENAPI_COMMIT_SHA }}
 
-          # Query the remote because actions/checkout with fetch-depth 1 omits other remote-tracking branches.
-          branchExists=$(git ls-remote --heads origin refs/heads/$branchname | wc -l)
-
           # Pull request runs validate generated files without pushing branches.
           if [ "$DRY_RUN" = "true" ]; then
             echo "Dry-run mode when run in a pull request"
             echo "See the 'Insight into diff' step for the changes it would create PR about."
             exit 0
           fi
 
-          if [ $branchExists -ne 0 ]; then
-            echo "Branch $branchname already exists in the remote repository."
+          # Check for an open PR before pushing so reruns do not overwrite commits added to it.
+          existing_pr=$(gh pr list --repo github/docs-internal --head "$branchname" --json number --jq '.[0].number')
+          if [[ -n "$existing_pr" ]]; then
+            echo "Pull request #$existing_pr already exists for branch $branchname. Skipping PR creation."
             exit 0
-          else
-            git checkout -b $branchname
           fi
 
+          git checkout -b $branchname
           git add data/reusables/code-scanning/codeql-query-tables
           git add data/reusables/code-quality/codeql-query-tables
           git commit -m "Update CodeQL query tables"
-          git push -u origin $branchname
+
+          # Force-push over a branch left by a failed attempt; this workflow exclusively owns these branches.
+          git push --force -u origin $branchname
 
           echo "Creating pull request..."
           gh pr create \