Merge pull request #1 from github/repo-sync

Repo sync

Author: bloommedicalcentrerak-dot

.github/agents/dependabot-ecosystem-update.md

@@ -30,6 +30,7 @@ jobs:
             const titleWordCountMin = 3
             const urlRegex = /https?:\/\/\S+/i
             const titleHasUrl = urlRegex.test(issue.title)
+            const titleHasDollarSign = issue.title.includes('$')
 
             try {
               await github.rest.teams.getMembershipForUserInOrg({
@@ -45,7 +46,7 @@ jobs:
               // An error will be thrown if the user is not a GitHub employee
               // If a user is not a GitHub employee, we should check to see if title has at least the minimum required number of words in it and if it does, we can exit the workflow
 
-              if (titleWordCount >= titleWordCountMin && !titleHasUrl) {
+              if (titleWordCount >= titleWordCountMin && !titleHasUrl && !titleHasDollarSign) {
                 return
               }
             }

.github/workflows/check-for-spammy-issues.yml

@@ -37,13 +37,17 @@ jobs:
             const onlyDeletes = files.length > 0 && files.every(f => f.status === 'removed')
             const isEmptyCommit = !files.length 
             const touchesTooMany = files.length > 10
-            const totalChanges = files.reduce((sum, f) => sum + f.additions + f.deletions, 0)
-            const isOneLineAddition = files.every(f => f.status === 'added') && totalChanges <= 1
-            const isBlankLineEdit = totalChanges <= 1 && files.every(f => f.status === 'modified')
+            const isBlankLineEdit = files.length > 0 && files.every(file => {
+              const changedLines = (file.patch || '')
+                .split('\n')
+                .filter(line => /^[+-]/.test(line))
+              return changedLines.length > 0 &&
+                changedLines.every(line => line.slice(1).trim() === '')
+            })
             const onlyRenames = files.length > 0 && files.every(f => f.status === 'renamed')
 
             // Close the PR and add the invalid label
-            if (onlyDeletes || isEmptyCommit || touchesTooMany || isOneLineAddition || isBlankLineEdit || onlyRenames) {
+            if (onlyDeletes || isEmptyCommit || touchesTooMany || isBlankLineEdit || onlyRenames) {
               await github.rest.issues.update({
                 owner: owner,
                 repo: repo,

.github/workflows/check-for-spammy-prs.yml

@@ -0,0 +1,45 @@
+name: Add new issues and PRs to central triage board
+
+# **What it does**: Adds newly opened or reopened issues and pull requests in github/docs to the right place for triage, and stamps the item with today's date.
+# **Why we have it**: To ensure incoming work in the public docs repo is triaged properly.
+# **Who does it impact**: Writers, FRs.
+
+on:
+  issues:
+    types: [opened, reopened]
+  pull_request_target:
+    types: [opened, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  add-to-central-triage:
+    runs-on: ubuntu-latest
+    if: github.repository == 'github/docs'
+    steps:
+      - name: Triage to central triage board
+        env:
+          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          ITEM_URL: ${{ github.event.issue.html_url || github.event.pull_request.html_url }}
+          # Add to the Central Triage Group project board and set date to now
+          PROJECT_NUMBER: '19598'
+          PROJECT_ID: 'PVT_kwDNJr_OAJ4AfQ'
+          DATE_FIELD_ID: 'PVTF_lADNJr_OAJ4Afc4IAbbv'
+        run: |
+          echo "Adding $ITEM_URL to project $PROJECT_NUMBER..."
+          ITEM_ID=$(gh project item-add "$PROJECT_NUMBER" --owner github --url "$ITEM_URL" --format json --jq '.id' || true)
+
+          sleep 10
+
+          if [ -n "$ITEM_ID" ] && [ "$ITEM_ID" != "null" ]; then
+            echo "Editing date on item $ITEM_ID..."
+            DATE=$(date '+%Y-%m-%d')
+            if gh project item-edit --project-id "$PROJECT_ID" --id "$ITEM_ID" --field-id "$DATE_FIELD_ID" --date "$DATE"; then
+              echo "done editing"
+            else
+              echo "::warning::gh project item-edit failed for $ITEM_URL (item $ITEM_ID); the item is on the board but the date field was not set"
+            fi
+          else
+            echo "::warning::gh project item-add did not return an item id for $ITEM_URL; skipping item-edit"
+          fi

.github/workflows/send-to-triage-board.yml

@@ -24,6 +24,7 @@ on:
     types: [opened, synchronize, reopened]
     paths:
       - '.github/workflows/sync-sdk-docs.yml'
+      - 'content/copilot/get-started/sdk-quickstart.md'
       - 'src/workflows/sync-sdk-docs/**'
 
 concurrency:
@@ -77,6 +78,10 @@ jobs:
       - name: Copy SDK docs
         run: |
           mkdir -p "$SDK_DOCS_TARGET"
+          # Pages relocated out of this tree into hand-authored content are not
+          # excluded here — they are removed by the RELOCATED_PAGES map in
+          # src/workflows/sync-sdk-docs/normalize-sdk-docs.ts, which also
+          # repoints inbound links at their new URLs.
           rsync -av --exclude='.validation/' --exclude='developer-docs/' "$SDK_TMP/docs/" "$SDK_DOCS_TARGET/"
           echo "Copied $(find "$SDK_DOCS_TARGET" -name '*.md' | wc -l | tr -d ' ') markdown files"
 

.github/workflows/sync-sdk-docs.yml

@@ -25,7 +25,7 @@ category:
 ---
 
 > [!NOTE]
-> Your profile name for your is {% data variables.product.github %} account is **required**. All other profile information described in this article is **optional**.
+> Your profile name for your {% data variables.product.github %} account is **required**. All other profile information described in this article is **optional**.
 
 ## Changing your profile picture
 

assets/images/help/pull_requests/abandon-review-button.png

@@ -99,6 +99,12 @@ To use OIDC in your workflows, you must establish a trust relationship between {
 
 Before granting an access token, your cloud provider checks that the [`subject`](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) and any other claims used to set conditions in its trust settings match those in the request's JSON Web Token (JWT). If the trust configuration matches, your cloud provider issues a temporary access token to the workflow.
 
+{% ifversion dependabot-oidc-support %}
+
+OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs have an `event_name` claim of `dynamic`. If your trust policy is intended to authorize only {% data variables.product.prodname_actions %} workflows and your cloud provider supports conditions on `event_name`, allow only the event names expected by your workflows.
+
+{% endif %}
+
 For steps and syntax for configuring OIDC trust and setting conditions for cloud providers, see [AUTOTITLE](/actions/reference/security/oidc#oidc-claims-used-to-define-trust-conditions-on-cloud-roles).
 
 ## Configuring OIDC on {% data variables.enterprise.data_residency_site %}

content/account-and-profile/tutorials/personalize-your-profile.md

@@ -34,7 +34,7 @@ For an example {% data variables.product.prodname_actions %} workflow using the
 
 * To be secure, you need to set a Claims JSON in JFrog when configuring identity mappings. For more information, see [AUTOTITLE](https://jfrog.com/help/r/jfrog-platform-administration-documentation/configure-identity-mappings) and [AUTOTITLE](/actions/reference/security/oidc#customizing-the-token-claims).
 
-    For example, you can set `iss` to `https://token.actions.githubusercontent.com`, and the `repository` to something like "octo-org/octo-repo"`. This will ensure only Actions workflows from the specified repository will have access to your JFrog platform. The following is an example Claims JSON when configuring identity mappings.
+  For example, you can set `iss` to `https://token.actions.githubusercontent.com`, and the `repository` to something like `octo-org/octo-repo`.{% ifversion dependabot-oidc-support %} JFrog identity mappings match each claim against an exact value, so to ensure only {% data variables.product.prodname_actions %} workflows from the specified repository have access to your JFrog platform, also set `event_name` to the event that triggers your workflow, such as `push`. This prevents OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs, which have an `event_name` of `dynamic`, from matching the identity mapping. If your workflows are triggered by more than one event, create a separate identity mapping for each event name.{% endif %} The following is an example Claims JSON when configuring identity mappings.
 
     {% data reusables.actions.jfrog-json-configuring-identity-mappings %}
 

content/actions/concepts/security/openid-connect.md

@@ -60,7 +60,7 @@ The OIDC token includes the following claims.
 | `enterprise_id`| The ID of the enterprise that contains the repository from where the workflow is running.                  |
 | {% endif %} |
 | `environment`| The name of the environment used by the job. If the `environment` claim is included (also via `include_claim_keys`), an environment is required and must be provided.                   |
-| `event_name`| The name of the event that triggered the workflow run.                    |
+| `event_name`| The name of the event that triggered the workflow run.{% ifversion dependabot-oidc-support %} OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs use `dynamic` as the value.{% endif %}                    |
 | `head_ref`| The source branch of the pull request in a workflow run.                   |
 | `job_workflow_ref`| For jobs using a reusable workflow, the ref path to the reusable workflow. For more information, see [AUTOTITLE](/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows).                  |
 | `job_workflow_sha`| For jobs using a reusable workflow, the commit SHA for the reusable workflow file.                   |
@@ -107,6 +107,12 @@ If you need more granular trust conditions, you can customize the {% ifversion g
 
 There are also many additional claims supported in the OIDC token that can be used for setting these conditions. In addition, your cloud provider could allow you to assign a role to the access tokens, letting you specify even more granular permissions.
 
+{% ifversion dependabot-oidc-support %}
+
+OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs have an `event_name` claim of `dynamic`. If your trust policy is intended to authorize only {% data variables.product.prodname_actions %} workflows and your cloud provider supports conditions on `event_name`, allow only the event names expected by your workflows.
+
+{% endif %}
+
 > [!NOTE]
 > To control how your cloud provider issues access tokens, you **must** define at least one condition, so that untrusted repositories can’t request access tokens for your cloud resources.