@@ -8,3 +8,7 @@ docs-early-access/
 node_modules/
 README.md
 tests/
+# Local symlinks to docs-early-access. merge-early-access.sh creates these during the build.
+assets/images/early-access
+content/early-access
+data/early-access
@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: read
+  issues: read
   pull-requests: write
 
 jobs:
@@ -52,10 +53,49 @@ jobs:
             )
             const onlyIndexMd = files.length === 1 && files[0].filename.split('/').pop() === 'index.md'
 
+            // Content removals are allowed once the Docs team marks the linked issue `help wanted`.
+            let hasApprovedIssue = false
+            if (onlyDeletesLines || onlyDeletes) {
+              try {
+                const { repository } = await github.graphql(
+                  `query($owner: String!, $repo: String!, $number: Int!) {
+                    repository(owner: $owner, name: $repo) {
+                      pullRequest(number: $number) {
+                        closingIssuesReferences(first: 100) {
+                          nodes {
+                            repository {
+                              nameWithOwner
+                            }
+                            labels(first: 100) {
+                              nodes {
+                                name
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }`,
+                  { owner, repo, number: pull_number },
+                )
+                const closingIssues = repository?.pullRequest?.closingIssuesReferences?.nodes || []
+                // Issues in other repos don't count, since their owners can add the label themselves.
+                hasApprovedIssue = closingIssues.some(issue =>
+                  issue.repository?.nameWithOwner?.toLowerCase() === `${owner}/${repo}` &&
+                  issue.labels.nodes.some(label => label.name.toLowerCase() === 'help wanted'),
+                )
+              } catch (error) {
+                // Without the lookup, treat the removal as unapproved, as before.
+                core.warning(`Could not check linked issues: ${error.message}`)
+              }
+            }
+            const unapprovedLineDeletion = onlyDeletesLines && !hasApprovedIssue
+            const unapprovedFileDeletion = onlyDeletes && !hasApprovedIssue
+
             if (
               targetsNonMain ||
-              onlyDeletesLines ||
-              onlyDeletes ||
+              unapprovedLineDeletion ||
+              unapprovedFileDeletion ||
               isEmptyCommit ||
               touchesTooMany ||
               isBlankLineEdit ||
@@ -75,8 +115,8 @@ jobs:
                 issue_number: pull_number,
                 body: targetsNonMain
                   ? 'Pull requests must target the `main` branch. This pull request has been closed as invalid. If you think this is incorrect, please mention this in a corresponding issue.'
-                  : onlyDeletesLines
-                    ? 'This pull request only removes existing content. Before submitting a content-removal pull request, please [open an issue](https://github.com/github/docs/issues/new/choose) explaining the proposed removal and wait for approval from the GitHub Docs team. Once the change has been approved, you can open a new pull request and link it to the issue.'
+                  : unapprovedLineDeletion
+                    ? 'This pull request only removes existing content. Before submitting a content-removal pull request, please [open an issue](https://github.com/github/docs/issues/new/choose) explaining the proposed removal and wait for the GitHub Docs team to add the `help wanted` label to it. Once the issue has the `help wanted` label, you can open a new pull request that links the issue with `Closes: #<issue number>` in the description.'
                     : "This pull request may have been opened accidentally. I'm going to close it now, but feel free to check out our [contribution guidelines](https://docs.github.com/en/contributing), or raise an issue.",
               })
 
@@ -89,7 +129,7 @@ jobs:
                 })
               }
 
-              if (onlyDeletesLines) {
+              if (unapprovedLineDeletion) {
                 core.setFailed(
                   'This pull request only deletes lines. An approved issue is required first.',
                 )
 
@@ -49,7 +49,10 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           UPDATE_BRANCH: ${{ steps.branch.outputs.update_branch }}
         run: |
-          PR_NUMBER=$(gh pr list --head "$UPDATE_BRANCH" --state open --json number --jq '.[0].number // empty' 2>/dev/null || echo "")
+          PR_NUMBER=$(gh pr list --head "$UPDATE_BRANCH" --state open --json number --jq '.[0].number // empty') || {
+            echo "::error::Could not look up the PR for ${UPDATE_BRANCH}."
+            exit 1
+          }
           echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
 
       - name: Setup branch
@@ -137,23 +140,22 @@ jobs:
           echo "source_path=$SOURCE_PATH" >> "$GITHUB_OUTPUT"
 
       - name: Create or update PR
-        if: steps.commit.outputs.has_changes == 'true'
+        if: steps.commit.outputs.has_changes == 'true' || steps.check-pr.outputs.pr_number != ''
         env:
           GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
           UPDATE_BRANCH: ${{ steps.branch.outputs.update_branch }}
           PIPELINE_ID: ${{ matrix.id }}
           SOURCE_REPO: ${{ steps.source-info.outputs.source_repo }}
           SOURCE_PATH: ${{ steps.source-info.outputs.source_path }}
+          PR_REF: ${{ steps.check-pr.outputs.pr_number }}
         run: |
-          PR_NUMBER="${{ steps.check-pr.outputs.pr_number }}"
+          set -euo pipefail
+
           PR_TITLE="docs: update ${PIPELINE_ID} content from source docs"
           SOURCE_LINK="See the [upstream repo](https://github.com/${SOURCE_REPO}/tree/main/${SOURCE_PATH}) for changes that triggered this update."
 
-          if [ -n "$PR_NUMBER" ]; then
-            echo "PR #$PR_NUMBER already exists"
-
-            echo "Ensuring PR #$PR_NUMBER is marked ready for review"
-            gh pr ready "$PR_NUMBER" || echo "Unable to mark PR #$PR_NUMBER as ready (it may already be ready)"
+          if [ -n "$PR_REF" ]; then
+            echo "PR #$PR_REF already exists"
           else
             echo "Creating new PR"
 
@@ -178,12 +180,30 @@ jobs:
             PR_BODY+="* Once satisfied, merge to keep docs up to date"$'\n'
             PR_BODY+="* A new PR will be created on the next run if there are further changes"
 
-            gh pr create \
+            # The opened event must describe a draft before any labels are applied.
+            PR_REF=$(gh pr create --draft \
               --title "$PR_TITLE" \
               --body "$PR_BODY" \
               --base main \
-              --head "$UPDATE_BRANCH" \
-              --label "workflow-generated,content-pipeline-update,ready-for-doc-review,skip FR board"
+              --head "$UPDATE_BRANCH")
+          fi
+
+          # Retry publication for existing PRs, including runs without content changes.
+          gh pr edit "$PR_REF" --add-label "skip FR board" || {
+            echo "::error::Could not apply skip FR board. The PR will not be marked ready."
+            exit 1
+          }
+          for LABEL in "workflow-generated" "content-pipeline-update" "ready-for-doc-review"; do
+            gh pr edit "$PR_REF" --add-label "$LABEL" \
+              || echo "::warning::Could not apply the \"$LABEL\" label."
+          done
+
+          IS_DRAFT=$(gh pr view "$PR_REF" --json isDraft --jq '.isDraft')
+          if [ "$IS_DRAFT" = "true" ]; then
+            gh pr ready "$PR_REF" || {
+              echo "::error::Could not mark the labeled PR ready for review."
+              exit 1
+            }
           fi
 
       - uses: ./.github/actions/create-workflow-failure-issue
 
@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to exclusively generate the search index for. E.g. 'dotcom', 'ghes-3.12'"
+        description: "Version to exclusively generate the search index for: 'fpt', 'ghec', or a supported 'ghes-X.Y'. Leave empty for all."
         required: false
         default: ''
       languages:
 
@@ -46,6 +46,31 @@ jobs:
             src/fixtures/fixtures/content/get-started/start-your-journey/hello-wurld.md
           git log | head -n 100
 
+      - name: Undo moving hello-world.md to hello-wurld.md
+        env:
+          ROOT: src/fixtures/fixtures
+        run: |
+          # The fixtures start with hello-world, so confirm the move rewrote them before testing undo.
+          for file in src/fixtures/fixtures/content/index.md src/fixtures/fixtures/content/get-started/index.md; do
+            grep -q -- '- /get-started/start-your-journey/hello-wurld$' "$file"
+          done
+
+          npm run move-content -- --undo \
+            src/fixtures/fixtures/content/get-started/start-your-journey/hello-world.md \
+            src/fixtures/fixtures/content/get-started/start-your-journey/hello-wurld.md
+
+          test -f src/fixtures/fixtures/content/get-started/start-your-journey/hello-world.md
+          test ! -e src/fixtures/fixtures/content/get-started/start-your-journey/hello-wurld.md
+          # Undo must revert featuredLinks too, or they point at a page that no longer exists.
+          for file in src/fixtures/fixtures/content/index.md src/fixtures/fixtures/content/get-started/index.md; do
+            grep -q -- '- /get-started/start-your-journey/hello-world$' "$file"
+            if grep -q hello-wurld "$file"; then
+              echo "$file still links to hello-wurld"
+              exit 1
+            fi
+          done
+          git log | head -n 100
+
       - name: Move code-security/getting-started to code-security/got-started
         env:
           ROOT: src/fixtures/fixtures
 
@@ -65,6 +65,8 @@ jobs:
 
       - name: Wait for production to serve this build
         if: ${{ github.event_name == 'deployment_status' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: npm run wait-for-build
 
       - name: Purge Fastly (manual)
 
@@ -48,19 +48,21 @@ jobs:
           echo PR_TITLE: $PR_TITLE
           [[ ! -z $PR_TITLE ]] && DESCRIPTION="${PR_TITLE}" || DESCRIPTION="Update manually triggered by workflow"
           echo "DESCRIPTION=$DESCRIPTION" >> $GITHUB_ENV
-          git commit -m "$(echo $DESCRIPTION)"
+          # git commit exits 1 when the public repo already matches, which would fail the job.
+          if git diff --cached --quiet; then
+            echo "No updates to push to the public repo"
+            echo "HAS_CHANGES=false" >> "$GITHUB_ENV"
+          else
+            git commit -m "$(echo $DESCRIPTION)"
+            echo "HAS_CHANGES=true" >> "$GITHUB_ENV"
+          fi
 
       - name: If there are changes to push, create a branch in the public repo and push changes
+        if: env.HAS_CHANGES == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
         run: |
           cd public-repo
           git config --local user.name 'site-policy-bot'
           git config --local user.email 'site-policy-bot@github.com'
-          NUM_FILES_CHANGED=$(git diff --name-only HEAD^..HEAD | wc -l)
-          if [[ $NUM_FILES_CHANGED -ge 1 ]]
-            then
-              git push --set-upstream origin automated-sync-$GITHUB_RUN_ID
-            else
-              echo "No updates to push to the public repo"
-          fi
+          git push --set-upstream origin automated-sync-$GITHUB_RUN_ID
@@ -8,6 +8,10 @@ on:
     paths:
       - 'assets/**'
       - '.github/workflows/validate-asset-images.yml'
+      # Dependency changes can break the validator.
+      - 'package*.json'
+      - 'src/assets/scripts/validate-asset-images.ts'
+      - '.github/actions/node-npm-setup/action.yml'
 
 permissions:
   contents: read
 
@@ -59,7 +59,6 @@ You can use a machine as a self-hosted runner as long as it meets these requirem
 
 * `x64` - Linux, macOS, Windows.
 * `ARM64` - Linux, macOS{% ifversion actions-windows-arm %}, Windows (currently in {% data variables.release-phases.public_preview %}){% endif %}.
-* `ARM32` - Linux.
 
 ## Routing precedence for self-hosted runners
 
 
@@ -51,7 +51,7 @@ This article walks through a simple setup that adds the agent's credential as a
 | --- | --- | --- |
 | Claude Code | `claude` | `ANTHROPIC_API_KEY` containing an Anthropic API key |
 | {% data variables.product.prodname_openai_codex %} | `codex` | `OPENAI_API_KEY` containing an OpenAI API key |
-| Google {% data variables.copilot.copilot_gemini %} CLI | `gemini` | `GEMINI_API_KEY` containing a Google AI Studio API key |
+| Google {% data variables.copilot.gemini %} CLI | `gemini` | `GEMINI_API_KEY` containing a Google AI Studio API key |
 | {% data variables.copilot.copilot_cli_short %} (default) | `copilot` | No secret needed for organization repositories (see below). For personal repositories, `COPILOT_GITHUB_TOKEN` containing a fine-grained {% data variables.product.pat_generic %} with **Copilot Requests** set to **Read**. |
 
 Other engines such as Pi (experimental) are also supported. For the full list, see the [{% data variables.copilot.github_agentic_workflows %} authentication reference](https://github.github.com/gh-aw/reference/auth/).