Merge pull request #13791 from github/repo-sync

repo sync

Author: Octomerger

.github/actions-scripts/staging-undeploy.js

@@ -4,8 +4,9 @@ name: Remove stale staging resources
 # This cleans up any rogue staging applications and environments that outlasted
 # the closure of their corresponding pull requests.
 # **Why we have it**:
-# Staging applications and environments sometimes fail to be destroyed when
-# their corresponding pull request is closed or merged.
+# Staging applications and environments should be destroyed after their
+# corresponding pull request is closed or merged, especially to save money spent
+# on Heroku App staging deployments for closed PRs.
 # **Who does it impact**:
 # Anyone with a closed, spammy, or deleted pull request in docs or docs-internal.
 
@@ -14,8 +15,10 @@ on:
     - cron: '15,45 * * * *' # every thirty minutes at :15 and :45
 
 permissions:
+  actions: read
   contents: read
-  pull-requests: read
+  deployments: write
+  pull-requests: write
 
 jobs:
   remove_stale_staging_apps:
@@ -60,5 +63,7 @@ jobs:
       - name: Run script
         run: script/remove-stale-staging-envs.js
         env:
-          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_FR }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ELEVATED_TOKEN: ${{ secrets.DOCS_BOT_FR }}
           REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}

.github/workflows/remove-stale-staging-resources.yml

@@ -25,9 +25,6 @@ permissions:
   statuses: write
 
 # This allows a subsequently queued workflow run to interrupt previous runs
-# These are different from the concurrency in that here it checks if the
-# whole workflow runs again. The "inner concurrency" is used for
-# undeployments to cleaning up resources.
 concurrency:
   group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
   cancel-in-progress: true
@@ -44,11 +41,7 @@ jobs:
     runs-on: self-hosted
 
     timeout-minutes: 5
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
-    concurrency:
-      group: 'PR Staging @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
-      cancel-in-progress: true
+
     steps:
       - name: Check out repo
         uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
@@ -85,15 +78,6 @@ jobs:
           DOCUBOT_REPO_PAT: ${{ secrets.DOCUBOT_REPO_PAT }}
           GIT_BRANCH: ${{ github.event.pull_request.head.sha }}
 
-      - name: Check that the PR isn't blocking deploys
-        # We can't use ${{...}} on this if statement because of this bug
-        # https://github.com/cschleiden/actions-linter/issues/114
-        if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'automated-block-deploy')
-        run: |
-          echo "The PR appears to have the label 'automated-block-deploy'"
-          echo "Will not proceed to deploy the PR."
-          exit 2
-
       - name: Create a Heroku build source
         id: build-source
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d

.github/workflows/staging-build-and-deploy-pr.yml

@@ -27,8 +27,7 @@ jobs:
 
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}
     timeout-minutes: 5
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
+    # This interrupts Build and Deploy workflow runs in progress for this PR branch.
     concurrency:
       group: 'PR Staging @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
       cancel-in-progress: true

.github/workflows/staging-build-pr.yml

@@ -198,68 +198,12 @@ jobs:
           color: failure
           text: Staging build failed for PR ${{ needs.pr-metadata.outputs.url }} at commit ${{ needs.pr-metadata.outputs.head_sha }}. See ${{ env.BUILD_ACTIONS_RUN_LOG }}. This run was ${{ env.ACTIONS_RUN_LOG }}.
 
-  check-pr-before-prepare:
-    needs: pr-metadata
-    if: >-
-      ${{
-        needs.pr-metadata.outputs.number != '0' &&
-        github.event.workflow_run.conclusion == 'success'
-      }}
-    runs-on: ubuntu-latest
-    # This timeout should match or exceed the value of the timeout for Undeploy
-    timeout-minutes: 5
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
-    concurrency:
-      group: 'PR Staging @ ${{ needs.pr-metadata.outputs.head_label }}'
-      cancel-in-progress: true
-    outputs:
-      pull_request_state: ${{ steps.check-pr.outputs.state }}
-    steps:
-      - name: Check pull request state
-        id: check-pr
-        uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
-        env:
-          PR_NUMBER: ${{ needs.pr-metadata.outputs.number }}
-        with:
-          script: |
-            // Equivalent of the 'await-sleep' module without the install
-            const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
-
-            const blockingLabel = 'automated-block-deploy'
-            const { owner, repo } = context.repo
-            const startTime = Date.now()
-
-            let pullRequest = {}
-            let blocked = true
-
-            // Keep polling the PR until the blocking label has been removed
-            while (blocked) {
-              const { data: pr } = await github.pulls.get({
-                owner,
-                repo,
-                pull_number: process.env.PR_NUMBER
-              })
-
-              blocked = pr.labels.some(({ name }) => name === blockingLabel)
-              if (blocked) {
-                console.warn(`WARNING! PR currently has blocking label "${blockingLabel}" (after ${Date.now() - startTime} ms). Will check again soon...`)
-                await sleep(15000) // Wait 15 seconds and check again
-              } else {
-                console.log(`PR was unblocked (after ${Date.now() - startTime} ms)!`)
-                pullRequest = pr
-              }
-            }
-
-            core.setOutput('state', pullRequest.state)
-
   prepare-for-deploy:
-    needs: [pr-metadata, check-pr-before-prepare]
-    if: ${{ needs.check-pr-before-prepare.outputs.pull_request_state == 'open' }}
+    needs: pr-metadata
+    if: ${{ needs.pr-metadata.outputs.state == 'open' }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
+    # This interrupts Build and Deploy workflow runs in progress for this PR branch.
     concurrency:
       group: 'PR Staging @ ${{ needs.pr-metadata.outputs.head_label }}'
       cancel-in-progress: true
@@ -395,8 +339,7 @@ jobs:
     needs: [pr-metadata, prepare-for-deploy]
     runs-on: ubuntu-latest
     timeout-minutes: 1
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
+    # This interrupts Build and Deploy workflow runs in progress for this PR branch.
     concurrency:
       group: 'PR Staging @ ${{ needs.pr-metadata.outputs.head_label }}'
       cancel-in-progress: true
@@ -423,8 +366,7 @@ jobs:
     if: ${{ needs.check-pr-before-deploy.outputs.pull_request_state == 'open' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    # This interrupts Build, Deploy, and pre-write Undeploy workflow runs in
-    # progress for this PR branch.
+    # This interrupts Build and Deploy workflow runs in progress for this PR branch.
     concurrency:
       group: 'PR Staging @ ${{ needs.pr-metadata.outputs.head_label }}'
       cancel-in-progress: true

.github/workflows/staging-deploy-pr.yml

@@ -23,8 +23,9 @@ To prevent new packages from being uploaded, you can set an ecosystem you previo
 {% data reusables.enterprise_site_admin_settings.access-settings %}
 {% data reusables.enterprise_site_admin_settings.management-console %}
 {% data reusables.enterprise_site_admin_settings.packages-tab %}
-1. Under "Ecosystem Toggles", for each package type, select **Enabled**, **Read-Only**, or **Disabled**.
-  ![Ecosystem toggles](/assets/images/enterprise/site-admin-settings/ecosystem-toggles.png)
+1. Under "Ecosystem Toggles", for each package type, select **Enabled**, **Read-Only**, or **Disabled**.{% ifversion ghes > 3.1 %}
+  ![Ecosystem toggles](/assets/images/enterprise/site-admin-settings/ecosystem-toggles.png){% else %}
+  ![Ecosystem toggles](/assets/images/enterprise/3.1/site-admin-settings/ecosystem-toggles.png){% endif %}
 {% data reusables.enterprise_management_console.save-settings %}
 
 {% ifversion ghes = 3.0 or ghes > 3.0 %}
@@ -42,6 +43,8 @@ To allow network connections to the npm registry, you will need to configure net
 
 Note that connections to `registry.npmjs.com` traverse through the Cloudflare network, and subsequently do not connect to a single static IP address; instead, a connection is made to an IP address within the CIDR ranges listed here: https://www.cloudflare.com/ips/.
 
+If you wish to enable npm upstream sources, select `Enabled` for `npm upstreaming`.
+
 {% endif %}
 
 ## Next steps

.github/workflows/staging-undeploy-pr.yml

@@ -55,6 +55,10 @@
       "name": "enterprise-admin",
       "description": "Administer a GitHub enterprise."
     },
+    {
+      "name": "dependabot",
+      "description": "Endpoints to manage Dependabot."
+    },
     {
       "name": "gists",
       "description": "View, modify your gists."