Repo sync

.github/instructions/code.instructions.md

@@ -4,7 +4,7 @@ applyTo: "src/**,.github/**,config/**,.devcontainer/**,**Dockerfile,package*.jso
 
 # Copilot code instructions for docs.github.com
 
-For code reviews and for creating or updating pull requests, follow the Guidelines, Tests, and Validate sections below.
+For code reviews and for creating or updating pull requests, follow the guidelines in the sections below.
 
 ## Guidelines
 
@@ -101,3 +101,27 @@ logger.error("Failure", { error });
 - Never log secrets, tokens, or PII.
 - Create loggers once at module scope, not inside functions.
 - Do not use the logger in scripts (locally-run code); `console.log` is fine there.
+
+## Code comments
+
+- Comments explain _why_ and not _what_. Use variables, names, types, and structure to convey _what_ the code does. If the code doesn't need a _why_, don't write a comment.
+- Document constraints, workarounds, unexpected dependencies, domain rules, user-visible consequences, security, ordering, and performance issues.
+- Be concise. Keep the comment to a glance.
+- Use active voice and active, specific verbs. Avoid phrases like "there is", "should", or vague "uses". Prefer "does x" over "is x". Do not hedge. If needed, write the action then the reason, such as "do X, so Y".
+- Do not narrate, restate, or summarize the code.
+- Avoid jargon, or define jargon if you must use it.
+- Describe the current state. Avoid framing such as "now" or "recently". Do not include the previous state.
+- In TypeScript and JavaScript, prefer `//` over `/*` comments. Only use `/*` if `//` makes the formatting too awkward or in JSX. Do not use JSDoc or TSDoc style comments.
+- Do not use comments to add headings, dividers, steps, or other structures.
+- Comments that need more than one line: break at sentence ends and clauses. Prettier does not reflow comment format.
+- Avoid excessive formatting. Only use parentheses to refer to literal syntax. Do not use markdown-style formatting. Do not use emdashes. You may use uppercase to emphasize words, rarely.
+- Keep comments inside a function body to a single line. Place multiline comments above the function.
+- Do not reference issues, pull requests, or discussions in the `github` organization, such as numbers or URLs. Include the context directly in the comment or in a nearby markdown file. You may use a full URL to an issue in an external open source project.
+- Do not reference line numbers or line counts. Do not reference specific versions unless a future version requires action.
+- Do not leave TODO, FIXME, or HACK comments.
+- Do not keep commented out code.
+- You may label deliberately absent fields.
+- You may write a simple input and output example for regular expressions. Use realistic data and not garbage like foo/bar or Alice/Bob.
+- You may use internal cross-reference identifiers in comments, such as unique error codes.
+- You may use tool directives such as `@ts-expect-error` or `eslint-disable` in rare cases.
+- You may add legally required comments like license and copyright.

.github/workflows/check-for-spammy-prs.yml

@@ -1,6 +1,6 @@
 name: Check for Spammy PRs
 
-# **What it does**: This action closes low value pull requests in the open-source repository.
+# **What it does**: This action closes low value pull requests and PRs that do not target main.
 # **Why we have it**: We get lots of spam in the open-source repository.
 # **Who does it impact**: Open-source contributors.
 
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   spammy-pr-check:
-    name: Label PRs that only delete files or touch a large number of files
+    name: Label spammy PRs and reject non-main targets
     if: >
       github.repository == 'github/docs' && github.event_name == 'pull_request_target' &&
       github.event.pull_request.user.login != 'docs-bot'
@@ -27,6 +27,7 @@ jobs:
             const owner = 'github'
             const repo = 'docs'
             const pull_number = context.payload.pull_request.number
+            const targetsNonMain = context.payload.pull_request.base.ref !== 'main'
 
             const files = await github.paginate(github.rest.pulls.listFiles, {
               owner,
@@ -50,8 +51,8 @@ jobs:
             })
             const onlyRenames = files.length > 0 && files.every(f => f.status === 'renamed')
 
-            // Close the PR and add the invalid label
             if (
+              targetsNonMain ||
               onlyDeletesLines ||
               onlyDeletes ||
               isEmptyCommit ||
@@ -66,16 +67,26 @@ jobs:
                 labels: ['invalid'],
               })
 
-              // Comment on the PR
               await github.rest.issues.createComment({
                 owner,
                 repo,
                 issue_number: pull_number,
-                body: onlyDeletesLines
-                  ? `This pull request only removes existing content. Before submitting a content-removal pull request, please [open an issue](https://github.com/github/docs/issues/new/choose) explaining the proposed removal and wait for approval from the GitHub Docs team. Once the change has been approved, you can open a new pull request and link it to the issue.`
-                  : `This pull request may have been opened accidentally. I'm going to close it now, but feel free to check out our [contribution guidelines](https://docs.github.com/en/contributing), or raise an issue.`,
+                body: targetsNonMain
+                  ? 'Pull requests must target the `main` branch. This pull request has been closed as invalid. If you think this is incorrect, please mention this in a corresponding issue.'
+                  : onlyDeletesLines
+                    ? 'This pull request only removes existing content. Before submitting a content-removal pull request, please [open an issue](https://github.com/github/docs/issues/new/choose) explaining the proposed removal and wait for approval from the GitHub Docs team. Once the change has been approved, you can open a new pull request and link it to the issue.'
+                    : "This pull request may have been opened accidentally. I'm going to close it now, but feel free to check out our [contribution guidelines](https://docs.github.com/en/contributing), or raise an issue.",
               })
 
+              if (targetsNonMain) {
+                await github.rest.pulls.update({
+                  owner,
+                  repo,
+                  pull_number,
+                  state: 'closed',
+                })
+              }
+
               if (onlyDeletesLines) {
                 core.setFailed(
                   'This pull request only deletes lines. An approved issue is required first.',

.github/workflows/sync-graphql.yml

@@ -32,6 +32,7 @@ jobs:
         env:
           # need to use a token from a user with access to github/github for this step
           GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          NODE_OPTIONS: '--max-old-space-size=8192'
         run: npm run sync-graphql
       - name: Create pull request
         id: create-pull-request

.github/workflows/test.yml

@@ -38,31 +38,38 @@ jobs:
         # Note that *if you add* to this, remember to also add that
         # to the **required checks** in the branch protection rules.
         name:
-          # src/ directory
+          # Every directory in src/ is listed here.
+          # A commented out entry has no test files of its own.
+          # - ai-tools
+          # - app
           - archives
           - article-api
           - assets
           - audit-logs
           - automated-pipelines
-          # - bookmarklets
-          # - code-scanning
-          # - codeql-cli
+          # - codeql-cli # enable once github/docs-internal#63239 removes the broken scratch test
+          # - codeql-queries
           - color-schemes
           - content-linter
+          # - content-pipelines
           - content-render
           - data-directory
+          # - deployments
           # - dev-toc
           - early-access
+          # - eslint-rules
           - events
           - fixtures
           - frame
+          - ghes-releases
           - github-apps
           - graphql
+          - journeys
           - landings
           - languages
-          # - links
+          - links
+          # - metrics
           - observability
-          # - open-source
           # - pages
           - products
           - redirects
@@ -73,6 +80,7 @@ jobs:
           - shielding
           # - tests
           # - tools
+          # - types
           - versions
           - webhooks
           - workflows

Dockerfile

@@ -63,25 +63,22 @@ RUN --mount=type=secret,id=DOCS_BOT_PAT_BASE,mode=0444 \
   . ./build-scripts/fetch-repos.sh
 
 # ------------------------------------------------
-# PROD_DEPS STAGE: Install production dependencies
+# ALL_DEPS STAGE: Install all dependencies
 # ------------------------------------------------
-FROM base AS prod_deps
+FROM base AS all_deps
 USER node:node
 WORKDIR $APP_HOME
 
-# Copy what is needed to run npm ci
 COPY --chown=node:node package.json package-lock.json ./
-
-# Install only production dependencies (skip scripts to avoid husky)
-RUN npm ci --omit=dev --ignore-scripts --registry https://registry.npmjs.org/
+COPY --chown=node:node patches patches/
+RUN npm ci --registry https://registry.npmjs.org/
 
 # ------------------------------------------------------------
-# ALL_DEPS STAGE: Install all dependencies on top of prod deps
+# PROD_DEPS STAGE: Strip dev dependencies back out
 # ------------------------------------------------------------
-FROM prod_deps AS all_deps
+FROM all_deps AS prod_deps
 
-# Install dev dependencies on top of production ones
-RUN npm ci --registry https://registry.npmjs.org/
+RUN npm prune --omit=dev --ignore-scripts
 
 # ----------------------------------
 # BUILD STAGE: Build the application

content/code-security/concepts/code-scanning/autofix-for-code-scanning.md

@@ -23,7 +23,8 @@ There are two ways to get a fix for an alert: agentic autofix and {% data variab
 
 ## Agentic autofix
 
-> [!NOTE] This feature is currently in public preview and is subject to change.
+> [!NOTE]
+> This feature is currently in public preview and is subject to change. {% data reusables.copilot.preview-features-policy %}
 
 Assign a {% data variables.product.prodname_code_scanning %} alert to {% data variables.product.prodname_copilot_short %} to have it resolve the alert for you. Assigning an alert starts an agent session: {% data variables.copilot.copilot_cloud_agent %} calls tools to explore your codebase beyond the affected file, generates a fix, validates it (for example, by re-running {% data variables.product.prodname_codeql %}), and iterates until it opens a pull request with the changes. See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#fixing-alerts-with-copilot).
 

content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts.md

@@ -36,7 +36,7 @@ With a {% data variables.copilot.copilot_enterprise %} license, you can ask {% d
 ## Fixing alerts with {% data variables.product.prodname_copilot_short %}
 
 > [!NOTE]
-> This feature is in {% data variables.release-phases.public_preview %} and subject to change. {% data variables.copilot.copilot_cloud_agent %} and {% data variables.copilot.copilot_autofix_short %} must be available in the repository.
+> This feature is in {% data variables.release-phases.public_preview %} and subject to change. {% data variables.copilot.copilot_cloud_agent %} and {% data variables.copilot.copilot_autofix_short %} must be available in the repository. {% data reusables.copilot.preview-features-policy %}
 
 You can assign a {% data variables.product.prodname_code_scanning %} alert to {% data variables.product.prodname_copilot_short %} to have it fix the alert for you. Assigning the alert starts an agent session: {% data variables.copilot.copilot_cloud_agent %} explores your codebase, generates a fix, validates it, and opens a pull request.
 

content/code-security/reference/security-at-scale/overview-dashboard-filters.md

@@ -192,7 +192,7 @@ For more information about production context, see [AUTOTITLE](/code-security/tu
 |{% endif %}|
 |`ecosystem`|Display {% data variables.product.prodname_dependabot_alerts %} detected in a specified ecosystem, for example: `ecosystem:Maven`.|
 |`epss-percentage`|Display {% data variables.product.prodname_dependabot_alerts %} whose EPSS score meets the defined criteria, for example: `epss-percentage:>=0.01`|
-|`has`|Display {% data variables.product.prodname_dependabot_alerts %} for vulnerabilities where either a secure version is already available (`patch`) or where at least one call from the repository to a vulnerable function is detected (`vulnerable-calls`). For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts).|
+|`has`|Display {% data variables.product.prodname_dependabot_alerts %} for vulnerabilities where a secure version is already available (`patch`).|
 |`is`|Display {% data variables.product.prodname_dependabot_alerts %} that are open (`open`) or closed (`closed`).|
 |`package`|Display {% data variables.product.prodname_dependabot_alerts %} detected in the specified package, for example: `package:semver`.|
 |`props`|Display {% data variables.product.prodname_dependabot_alerts %} for repositories with a specific custom property set. For example, `props.data_sensitivity:high` displays results for repositories with the `data_sensitivity` property set to the value `high`.|