Skip to content

Commit 7dfda1a

Browse files
author
Martin Lopes
authored
Merge branch 'main' into patch-1
2 parents cd2c7ce + c25bd6b commit 7dfda1a

58 files changed

Lines changed: 1023 additions & 233 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/allowed-actions.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,6 @@ module.exports = [
3232
'repo-sync/pull-request@33777245b1aace1a58c87a29c90321aa7a74bd7d',
3333
'someimportantcompany/github-actions-slack-message@0b470c14b39da4260ed9e3f9a4f1298a74ccdefd',
3434
'tjenkinson/gh-action-auto-merge-dependency-updates@cee2ac0',
35-
'EndBug/add-and-commit@9358097a71ad9fb9e2f9624c6098c89193d83575'
35+
'EndBug/add-and-commit@9358097a71ad9fb9e2f9624c6098c89193d83575',
36+
'dorny/paths-filter@eb75a1edc117d3756a18ef89958ee59f9500ba58'
3637
]

.github/workflows/close-unwanted-pull-requests.yml

Lines changed: 0 additions & 39 deletions
This file was deleted.

.github/workflows/confirm-internal-staff-work-in-docs.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ jobs:
1717
continue-on-error: true
1818
if: github.repository == 'github/docs'
1919
steps:
20-
- uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
20+
- id: membership_check
21+
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
2122
with:
2223
github-token: ${{ secrets.DOCUBOT_FR_PROJECT_BOARD_WORKFLOWS_REPO_ORG_READ_SCOPES }}
2324
script: |
@@ -61,10 +62,10 @@ jobs:
6162
body: `@${context.payload.sender.login} opened https://github.com/github/docs/issues/${issueNo} publicly in the github/docs repo, instead of the private github/docs-internal repo.\n\n@${context.payload.sender.login}, please confirm that this belongs in the public repo and that no sensitive information was disclosed by commenting below and closing the issue.\n\nIf this was not intentional and sensitive information was shared, please delete https://github.com/github/docs/issues/${issueNo} and notify us in the \#docs-open-source channel.\n\nThanks! \n\n/cc @github/docs @github/docs-engineering`
6263
});
6364
64-
throw new Error('A Hubber opened an issue on the public github/docs repo');
65+
core.setOutput('did_warn', 'true')
6566
6667
- name: Send Slack notification if a GitHub employee who isn't on the docs team opens an issue in public
67-
if: ${{ failure() && github.repository == 'github/docs' }}
68+
if: ${{ steps.membership_check.outputs.did_warn && github.repository == 'github/docs' }}
6869
uses: someimportantcompany/github-actions-slack-message@0b470c14b39da4260ed9e3f9a4f1298a74ccdefd
6970
with:
7071
channel: ${{ secrets.DOCS_OPEN_SOURCE_SLACK_CHANNEL_ID }}

.github/workflows/repo-sync-stalls.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Repo Sync Stalls
22
on:
33
workflow_dispatch:
44
schedule:
5-
- cron: '*/30 * * * *'
5+
- cron: '0 */2 * * *'
66
jobs:
77
check-freezer:
88
name: Check for deployment freezes

.github/workflows/repo-sync.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ jobs:
5252
destination_branch: main
5353
pr_title: 'repo sync'
5454
pr_body: "This is an automated pull request to sync changes between the public and private repos.\n\n:robot: This pull request should be merged (not squashed) to preserve continuity across repos, so please let a bot do the merging!"
55-
pr_label: automerge,autoupdate
55+
pr_label: automerge,autoupdate,automated-reposync-pr
5656
github_token: ${{ secrets.OCTOMERGER_PAT_WITH_REPO_AND_WORKFLOW_SCOPE }}
5757

5858
- name: Find pull request
Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
name: Check unallowed file changes
2+
3+
on:
4+
push:
5+
6+
jobs:
7+
triage:
8+
if: github.repository == 'github/docs' && github.event.pull_request.user.login != 'Octomerger'
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
12+
- name: Get pull request number
13+
id: pull-number
14+
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
15+
with:
16+
github-token: ${{secrets.GITHUB_TOKEN}}
17+
result-encoding: string
18+
script: |
19+
const pulls = await github.repos.listPullRequestsAssociatedWithCommit({
20+
...context.repo,
21+
commit_sha: context.sha
22+
})
23+
24+
return pulls.data.map(pull => pull.number).shift()
25+
- name: Check for existing requested changes
26+
id: requested-change
27+
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
28+
with:
29+
github-token: ${{secrets.GITHUB_TOKEN}}
30+
result-encoding: json
31+
script: |
32+
const pullReviews = await github.pulls.listReviews({
33+
...context.repo,
34+
pull_number: ${{steps.pull-number.outputs.result}}
35+
})
36+
37+
return pullReviews.data
38+
.filter(review => review.user.login === 'github-actions[bot]')
39+
.sort((a, b) => new Date(b.submitted_at) - new Date(a.submitted_at))
40+
.shift()
41+
- name: Get files changed
42+
uses: dorny/paths-filter@eb75a1edc117d3756a18ef89958ee59f9500ba58
43+
id: filter
44+
with:
45+
# Base branch used to get changed files
46+
base: 'main'
47+
48+
# Enables setting an output in the format in `${FILTER_NAME}_files
49+
# with the names of the matching files formatted as JSON array
50+
list-files: json
51+
52+
# Returns list of changed files matching each filter
53+
filters: |
54+
translation:
55+
- 'translations/**'
56+
openapi:
57+
- 'lib/rest/static/**'
58+
notAllowed:
59+
- '.github/workflows/**'
60+
- '.github/CODEOWNERS'
61+
- 'translations/**'
62+
- 'assets/fonts/**'
63+
- 'data/graphql/**'
64+
- 'lib/graphql/**'
65+
- 'lib/redirects/**'
66+
- 'lib/rest/**'
67+
- 'lib/webhooks/**'
68+
69+
# When there are changes to files we can't accept
70+
# and no review exists,leave a REQUEST_CHANGES review
71+
- name: Request pull request changes
72+
# Check for no reviews or reviews that aren't CHANGES_REQUESTED
73+
if: ${{ steps.filter.outputs.notAllowed == 'true' && (!steps.requested-change.outputs.result || fromJson(steps.requested-change.outputs.result).state != 'CHANGES_REQUESTED') }}
74+
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
75+
with:
76+
github-token: ${{secrets.GITHUB_TOKEN}}
77+
script: |
78+
const changedFiles = ${{steps.filter.outputs.notAllowed_files}}
79+
const restFiles = ${{steps.filter.outputs.openapi_files}}
80+
const translationFiles = ${{steps.filter.outputs.translation_files}}
81+
const markdownFiles = changedFiles.map(file => `- \`${file}\`\n`).join('')
82+
83+
let reviewMessage = `👋 Hey there spelunker. It looks like you've modified some files that we can't accept as contributions.\n${markdownFiles}\n\nYou'll need to revert all of these ☝️ files using [GitHub Desktop](https://docs.github.com/en/free-pro-team@latest/desktop/contributing-and-collaborating-using-github-desktop/reverting-a-commit) or \`git checkout origin/main <file name>\`. Once you get those files reverted, we can continue with the review process. :octocat:`
84+
85+
if (restFiles.length > 0) {
86+
reviewMessage += "\n\nIt looks like you've modified the OpenAPI schema (`lib/rest/static/**`). While we aren't accepting changes to the schema directly, you can open an issue for any updates to the REST API docs. Head on over to the [`github/rest-api-description`](https://github.com/github/rest-api-description/issues/new?assignees=&labels=Inaccuracy&template=schema-inaccuracy.md&title=%5BSchema+Inaccuracy%5D+%3CDescribe+Problem%3E) repository to open an issue. ⚡"
87+
}
88+
89+
if (translationFiles.length > 0) {
90+
await github.issues.addLabels({
91+
...context.repo,
92+
issue_number: ${{steps.pull-number.outputs.result}},
93+
labels: ['localization']
94+
})
95+
reviewMessage += "\n\nIt looks like you've modified translated content. Unfortunately, we are not able to accept pull requests for translated content. Our translation process involves an integration with an external service at crowdin.com, where all translation activity happens. We hope to eventually open up the translation process to the open source community, but we're not there yet. See https://github.com/github/docs/blob/main/CONTRIBUTING.md#earth_asia-translations for more details."
96+
}
97+
98+
await github.pulls.createReview({
99+
...context.repo,
100+
pull_number: ${{steps.pull-number.outputs.result}},
101+
body: reviewMessage,
102+
event: 'REQUEST_CHANGES'
103+
})
104+
# When the most recent review was CHANGES_REQUESTED and the existing
105+
# PR no longer contains unallowed changes, dismiss the previous review
106+
- name: Dismiss pull request review
107+
if: ${{ steps.filter.outputs.notAllowed == 'false' && fromJson(steps.requested-change.outputs.result).state == 'CHANGES_REQUESTED' }}
108+
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
109+
with:
110+
github-token: ${{secrets.GITHUB_TOKEN}}
111+
script: |
112+
await github.pulls.dismissReview({
113+
...context.repo,
114+
pull_number: ${{steps.pull-number.outputs.result}},
115+
review_id: ${{fromJson(steps.requested-change.outputs.result).id}},
116+
message: `✨Looks like you reverted all files we don't accept contributions for. 🙌 A member of the docs team will review your PR soon. 🚂`
117+
})

.vscode/launch.json

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"version": "0.2.0",
3+
"configurations": [
4+
{
5+
"type": "node",
6+
"request": "attach",
7+
"name": "Node: Nodemon",
8+
"processId": "${command:PickProcess}",
9+
"restart": true,
10+
"protocol": "inspector",
11+
},
12+
]
13+
}

content/actions/learn-github-actions/security-hardening-for-github-actions.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ This means that a compromise of a single action within a workflow can be very si
5454
**Warning:** The short version of the commit SHA is insecure and should never be used for specifying an action's Git reference. Because of how repository networks work, any user can fork the repository and push a crafted commit to it that collides with the short SHA. This causes subsequent clones at that SHA to fail because it becomes an ambiguous commit. As a result, any workflows that use the shortened SHA will immediately fail.
5555

5656
{% endwarning %}
57+
58+
5759
* **Audit the source code of the action**
5860

5961
Ensure that the action is handling the content of your repository and secrets as expected. For example, check that secrets are not sent to unintended hosts, or are not inadvertently logged.
@@ -92,10 +94,14 @@ This list describes the recommended approaches for accessing repository data wit
9294

9395
As a result, self-hosted runners should almost [never be used for public repositories](/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories) on {% data variables.product.product_name %}, because any user can open pull requests against the repository and compromise the environment. Similarly, be cautious when using self-hosted runners on private repositories, as anyone who can fork the repository and open a PR (generally those with read-access to the repository) are able to compromise the self-hosted runner environment, including gaining access to secrets and the more privileged `GITHUB_TOKEN` which grants write-access permissions on the repository.
9496

97+
When a self-hosted runner is defined at the organization or enterprise level, {% data variables.product.product_name %} can schedule workflows from multiple repositories onto the same runner. Consequently, a security compromise of these environments can result in a wide impact. To help reduce the scope of a compromise, you can create boundaries by organizing your self-hosted runners into separate groups. For more information, see "[Managing access to self-hosted runners using groups](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups)."
98+
9599
You should also consider the environment of the self-hosted runner machines:
96100
- What sensitive information resides on the machine configured as a self-hosted runner? For example, private SSH keys, API access tokens, among others.
97101
- Does the machine have network access to sensitive services? For example, Azure or AWS metadata services. The amount of sensitive information in this environment should be kept to a minimum, and you should always be mindful that any user capable of invoking workflows has access to this environment.
98102

103+
Some customers might attempt to partially mitigate these risks by implementing systems that automatically destroy the self-hosted runner after each job execution. However, this approach might not be as effective as intended, as there is no way to guarantee that a self-hosted runner only runs one job.
104+
99105
### Auditing {% data variables.product.prodname_actions %} events
100106

101107
You can use the audit log to monitor administrative tasks in an organization. The audit log records the type of action, when it was run, and which user account performed the action.
@@ -132,5 +138,3 @@ The following tables describe the {% data variables.product.prodname_actions %}
132138
| `action:org.runner_group_renamed` | Triggered when an organization admin renames a self-hosted runner group.
133139
| `action:org.runner_group_runners_added` | Triggered when an organization admin [adds a self-hosted runner to a group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group).
134140
| `action:org.runner_group_runners_removed` | Triggered when an organization admin removes a self-hosted runner from a group.
135-
136-

content/discussions/guides/finding-discussions-across-multiple-repositories.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ versions:
1010
### Finding discussions
1111

1212
1. Navigate to {% data variables.product.prodname_dotcom_the_website %}.
13-
1. In the top-right corner of {% data variables.product.prodname_dotcom_the_website %}, click your profile photo, then click **Your enterprises**.
13+
1. In the top-right corner of {% data variables.product.prodname_dotcom_the_website %}, click your profile photo, then click **Your discussions**.
1414
!["Your discussions" in drop-down menu for profile photo on {% data variables.product.product_name %}](/assets/images/help/discussions/your-discussions.png)
1515
1. Toggle between **Created** and **Commented** to see the discussions you've created or participated in.
1616

content/github/authenticating-to-github/removing-sensitive-data-from-a-repository.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@ To replace all text listed in `passwords.txt` wherever it can be found in your r
4040
$ bfg --replace-text passwords.txt
4141
```
4242

43+
After the sensitive data is removed, you must force push your changes to {% data variables.product.product_name %}.
44+
45+
```shell
46+
$ git push --force
47+
```
48+
4349
See the [BFG Repo-Cleaner](http://rtyley.github.io/bfg-repo-cleaner/)'s documentation for full usage and download instructions.
4450

4551
#### Using filter-branch

0 commit comments

Comments
 (0)