Repo sync

.github/workflows/content-pipelines.yml

@@ -30,6 +30,9 @@ jobs:
     steps:
       - name: Checkout docs-internal
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # The git steps below authenticate with the PAT, so no token stays in .git/config.
+          persist-credentials: false
 
       - uses: ./.github/actions/node-npm-setup
 
@@ -52,6 +55,10 @@ jobs:
       - name: Setup branch
         id: setup-branch
         env:
+          # A PAT push triggers CI on the PR; GITHUB_TOKEN events do not start workflows.
+          GIT_CONFIG_COUNT: 1
+          GIT_CONFIG_KEY_0: url.https://x-access-token:${{ secrets.DOCS_BOT_PAT_BASE }}@github.com/.insteadOf
+          GIT_CONFIG_VALUE_0: https://github.com/
           UPDATE_BRANCH: ${{ steps.branch.outputs.update_branch }}
           PR_NUMBER: ${{ steps.check-pr.outputs.pr_number }}
         run: |
@@ -105,6 +112,10 @@ jobs:
       - name: Push changes
         if: steps.commit.outputs.has_changes == 'true'
         env:
+          # A PAT push triggers CI on the PR; GITHUB_TOKEN events do not start workflows.
+          GIT_CONFIG_COUNT: 1
+          GIT_CONFIG_KEY_0: url.https://x-access-token:${{ secrets.DOCS_BOT_PAT_BASE }}@github.com/.insteadOf
+          GIT_CONFIG_VALUE_0: https://github.com/
           UPDATE_BRANCH: ${{ steps.branch.outputs.update_branch }}
           FORCE_PUSH: ${{ steps.setup-branch.outputs.force_push }}
         run: |

.github/workflows/index-autocomplete-search.yml

@@ -6,6 +6,12 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '20 16 * * 1-5'
+  # The GHES autocomplete index name uses the latest GHES release, so build the new index when releases change.
+  push:
+    branches:
+      - main
+    paths:
+      - 'src/versions/lib/enterprise-server-releases.ts'
   pull_request:
     paths:
       - .github/workflows/index-autocomplete-search.yml
@@ -15,6 +21,11 @@ on:
 permissions:
   contents: read
 
+# Production runs share indexes, and updateAlias deletes other runs' in-progress indexes, so run them one at a time.
+concurrency:
+  group: "${{ github.workflow }} @ ${{ github.event_name == 'pull_request' && github.head_ref || 'production' }}"
+  cancel-in-progress: false
+
 jobs:
   index-autocomplete-elasticsearch:
     if: ${{ github.repository == 'github/docs-internal' }}
@@ -45,12 +56,12 @@ jobs:
 
       - uses: ./.github/actions/create-workflow-failure-issue
         id: create-failure-issue
-        if: ${{ failure() && github.event_name == 'schedule' }}
+        if: ${{ failure() && github.event_name != 'workflow_dispatch' && github.event_name != 'pull_request' }}
         with:
           token: ${{ secrets.DOCS_BOT_PAT_BASE }}
 
       - uses: ./.github/actions/slack-alert
-        if: ${{ failure() && github.event_name == 'schedule' }}
+        if: ${{ failure() && github.event_name != 'workflow_dispatch' && github.event_name != 'pull_request' }}
         with:
           slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
           issue_url: ${{ steps.create-failure-issue.outputs.issue_url }}

.github/workflows/moda-allowed-ips.yml

@@ -22,11 +22,18 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
         run: |
+          set -o pipefail
+
           echo "Getting a list of Fastly IP addresses...."
           ips=$( \
-            curl -s https://api.fastly.com/public-ip-list \
+            curl -fsS https://api.fastly.com/public-ip-list \
             | jq -r '.addresses | join(",")' \
           )
+          # An empty value would clear the production allowlist.
+          if [ -z "$ips" ]; then
+            echo "::error::Fastly returned an empty IP list"
+            exit 1
+          fi
           echo "Got a list of Fastly IP addresses: $ips"
 
           echo "Updating the list of allowed IPs in Moda config..."

.github/workflows/sync-codeql-cli.yml

@@ -28,6 +28,9 @@ jobs:
     steps:
       - name: Checkout repository code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # 'Create pull request' pushes with the PAT, so no token stays in .git/config.
+          persist-credentials: false
       - name: Checkout semmle-code repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -64,6 +67,10 @@ jobs:
       - name: Create pull request
         env:
           GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          # A PAT push triggers CI on the PR; GITHUB_TOKEN events do not start workflows.
+          GIT_CONFIG_COUNT: 1
+          GIT_CONFIG_KEY_0: url.https://x-access-token:${{ secrets.DOCS_BOT_PAT_BASE }}@github.com/.insteadOf
+          GIT_CONFIG_VALUE_0: https://github.com/
         run: |
           # Exit before branch creation so a no-op sync does not leave an orphan branch.
           changes=$(git diff --name-only | wc -l)
@@ -77,6 +84,7 @@ jobs:
           git config --global user.email "77750099+docs-bot@users.noreply.github.com"
 
           branchname=codeql-cli-update-${{ steps.semmle-code.outputs.OPENAPI_COMMIT_SHA }}
+          labels="codeql-cli-pipeline,skip FR board,ready-for-doc-review,workflow-generated"
 
           git checkout -b $branchname
           git add .
@@ -89,6 +97,8 @@ jobs:
           existing_pr=$(gh pr list --repo github/docs-internal --head "$branchname" --json number --jq '.[0].number')
           if [[ -n "$existing_pr" ]]; then
             echo "Pull request #$existing_pr already exists for branch $branchname. Skipping PR creation."
+            # The prior run may have failed before it applied labels.
+            gh pr edit "$existing_pr" --repo github/docs-internal --add-label "$labels"
             exit 0
           fi
 
@@ -101,7 +111,7 @@ jobs:
 
             If CI does not pass or other problems arise, contact #technical-content on slack.' \
             --repo github/docs-internal \
-            --label "codeql-cli-pipeline,skip FR board,ready-for-doc-review,workflow-generated"
+            --label "$labels"
 
       - uses: ./.github/actions/create-workflow-failure-issue
         id: create-failure-issue

.github/workflows/sync-sdk-docs.yml

@@ -28,7 +28,7 @@ on:
       - 'src/workflows/sync-sdk-docs/**'
 
 concurrency:
-  group: sync-sdk-docs-${{ github.event_name }}
+  group: sync-sdk-docs-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:
@@ -49,6 +49,9 @@ jobs:
     steps:
       - name: Checkout docs-internal
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # 'Commit and push' authenticates with the PAT, so no token stays in .git/config.
+          persist-credentials: false
 
       # Publishing runs must start from the default branch because preserve-redirects.ts reads
       # live URLs from git HEAD. workflow_dispatch from another branch could write stale redirects.
@@ -199,8 +202,11 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
+          # A PAT triggers CI on the PR; GITHUB_TOKEN events do not start workflows.
+          PAT_URL_REWRITE="url.https://x-access-token:${GH_TOKEN}@github.com/.insteadOf=https://github.com/"
+
           # Fetch the sync branch if it exists so force-with-lease knows the remote state.
-          git fetch origin "$SYNC_BRANCH" 2>/dev/null || true
+          git -c "$PAT_URL_REWRITE" fetch origin "$SYNC_BRANCH" 2>/dev/null || true
 
           git checkout -B "$SYNC_BRANCH"
           git commit -m "Sync Copilot SDK docs from copilot-sdk@${SDK_SHA::7}
@@ -209,7 +215,7 @@ jobs:
 
           This commit was automatically generated by the sync-sdk-docs workflow."
 
-          git push --force-with-lease origin "$SYNC_BRANCH"
+          git -c "$PAT_URL_REWRITE" push --force-with-lease origin "$SYNC_BRANCH"
 
       - name: Create or update pull request
         if: >-

content/actions/how-tos/troubleshoot-workflows.md

@@ -136,6 +136,10 @@ A common cause can be using the `always()` [status check function](/actions/refe
 
 For more information, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-when-workflows-run/control-jobs-with-conditions) and [AUTOTITLE](/actions/how-tos/manage-workflow-runs/cancel-a-workflow-run).
 
+If a run remains queued or in progress after cancellation attempts, it may be stuck in an abnormal state rather than continuing because of `always()`. Signs include no jobs being created, the UI displaying "Failed to cancel workflow", or the `cancel` or `force-cancel` REST API endpoints returning HTTP `500` or `409`.
+
+Self-service cancellation, including force cancellation, may not clear a stuck or out-of-sync workflow run or check suite. If your repository uses concurrency, the stuck run can continue blocking later runs in the same concurrency group. In this situation, contact {% data variables.contact.contact_support %} for help clearing the run.
+
 ## Troubleshooting runners
 
 ### Defining runner labels

content/admin/data-residency/github-copilot-with-data-residency.md

@@ -54,13 +54,9 @@ The models available for {% data variables.product.prodname_copilot_short %} var
 
 * {% data variables.copilot.copilot_gpt_4o_mini %}
 * {% data variables.copilot.copilot_gpt_41 %}
-* {% data variables.copilot.copilot_gpt_5_mini %}
 * {% data variables.copilot.copilot_gpt_52 %}
 * {% data variables.copilot.copilot_gpt_53_codex %}
-* {% data variables.copilot.copilot_gpt_54 %}
-* {% data variables.copilot.copilot_gpt_54_mini %}
 * {% data variables.copilot.copilot_gpt_54_nano %}
-* {% data variables.copilot.copilot_gpt_55 %}
 * {% data variables.copilot.copilot_gpt_56_luna %}
 * {% data variables.copilot.copilot_gpt_56_sol %}
 * {% data variables.copilot.copilot_gpt_56_terra %}

content/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries.md

@@ -116,7 +116,9 @@ See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-depe
 
 ### Configuring OIDC authentication for a private registry
 
-OIDC (OpenID Connect) authentication allows {% data variables.product.prodname_dependabot %} to use short-lived credentials from your cloud identity provider to access private registries, eliminating the need to store long-lived secrets. With OIDC, credentials are generated dynamically for each {% data variables.product.prodname_dependabot %} update job. You must configure a trust relationship between your cloud provider and {% data variables.product.github %} before {% data variables.product.prodname_dependabot %} can authenticate.
+OIDC (OpenID Connect) authentication allows {% data variables.product.prodname_dependabot %} and {% data variables.product.prodname_code_scanning %} default setup to use short-lived credentials from your cloud identity provider to access private registries. Each feature is limited to its supported registry types.
+
+With OIDC, credentials are generated dynamically for update or analysis jobs, eliminating the need to store long-lived secrets. You must configure a trust relationship between your cloud provider and {% data variables.product.github %} before either feature can authenticate.
 
 When you select **OIDC** as the authentication method for a private registry, choose one of the supported providers and fill in the required fields:
 
@@ -136,7 +138,7 @@ For more information about how OIDC works, see [AUTOTITLE](/actions/concepts/sec
 
 ### Configuring an anonymous private registry
 
-Some registries, such as internal mirrors, don't require authentication. You can add these registries at the organization level with the **Anonymous** authentication method so that {% data variables.product.prodname_dependabot %} can use them without a token, password, or OIDC configuration.
+Some registries, such as internal mirrors, don't require authentication. You can add these registries at the organization level with the **Anonymous** authentication method so that {% data variables.product.prodname_dependabot %} and {% data variables.product.prodname_code_scanning %} default setup can use them without a token, password, or OIDC configuration. 
 
 {% ifversion dependabot-egress-allowlist %}
 {% data variables.product.prodname_dependabot %} update jobs can only connect to hosts on an egress allowlist. Adding an anonymous registry allows {% data variables.product.prodname_dependabot %} to reach the registry's host for jobs in repositories that have access to the registry, without storing a secret or sending credentials. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/resolve-a-blocked-host).

content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/index.md

@@ -10,6 +10,7 @@ contentType: how-tos
 children:
   - /configure-dependabot-alerts
   - /configure-malware-alerts
+  - /protecting-endpoints-with-package-firewall
   - /configure-security-updates
   - /configure-version-updates
   - /manage-innersource-advisories
@@ -21,4 +22,3 @@ children:
   - /use-dependency-submission-api
   - /verify-release-integrity
 ---
-