Merge branch 'main' into docs/workflow-dispatch-input-options

Author: kburym

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
 # Update ARG and FROM together from the Node devcontainer image tags:
 # https://mcr.microsoft.com/en-us/product/devcontainers/javascript-node/tags
 ARG VARIANT=dev-24-bookworm
-FROM mcr.microsoft.com/devcontainers/javascript-node:dev-24-bookworm@sha256:02207aa539c49a8714bd18ba482a05381a42ee4768ea19a39a4c58f2ae6f7644
+FROM mcr.microsoft.com/devcontainers/javascript-node:dev-24-bookworm@sha256:5ed0bf1411cffe8182ee6808477dd64c969a4ce78fee1b63e6a654d7deff889c

.github/rulesets/docs-internal/main-branch-protection.json

@@ -196,6 +196,10 @@
             "context": "shielding",
             "integration_id": 15368
           },
+          {
+            "context": "tools",
+            "integration_id": 15368
+          },
           {
             "context": "versions",
             "integration_id": 15368

.github/rulesets/docs/main-branch-protection.json

@@ -173,6 +173,10 @@
             "context": "shielding",
             "integration_id": 15368
           },
+          {
+            "context": "tools",
+            "integration_id": 15368
+          },
           {
             "context": "versions",
             "integration_id": 15368

.github/workflows/auto-close-dependencies.yml

@@ -9,10 +9,6 @@ on:
       - 'Gemfile*'
       - 'Dockerfile'
       - '.github/workflows/**'
-  pull_request_review:
-    types:
-      - edited
-      - submitted
 
 permissions:
   contents: write

.github/workflows/confirm-internal-staff-work-in-docs.yml

@@ -75,6 +75,7 @@ jobs:
           github-token: ${{ github.token }}
           script: |
             const githubLogin = context.payload.sender.login.toLowerCase();
+            const lookupStartedAt = Date.now();
 
             core.info(`Looking up Slack user for @${githubLogin}...`);
             core.setOutput('slack_user_id', '');
@@ -85,59 +86,127 @@ jobs:
               throw new Error('SLACK_DOCS_BOT_TOKEN is not configured.');
             }
 
+            const sleep = (milliseconds) =>
+              new Promise((resolve) => setTimeout(resolve, milliseconds));
+            const maxRetries = 5;
+            const minimumRequestIntervalMs = 3000;
+            let lastRequestAt = 0;
+
+            async function fetchUsersPage(url, pageNumber) {
+              for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
+                const spacingDelay = Math.max(
+                  0,
+                  minimumRequestIntervalMs - (Date.now() - lastRequestAt),
+                );
+                if (spacingDelay > 0) {
+                  await sleep(spacingDelay);
+                }
+
+                lastRequestAt = Date.now();
+                const requestStartedAt = lastRequestAt;
+                const response = await fetch(url, {
+                  headers: {
+                    Authorization: `Bearer ${token}`,
+                  },
+                });
+                const requestDurationMs = Date.now() - requestStartedAt;
+
+                if (response.status === 429) {
+                  if (attempt === maxRetries) {
+                    throw new Error(
+                      `Slack users.list page ${pageNumber} remained rate-limited after ${maxRetries} retries.`,
+                    );
+                  }
+
+                  const retryAfterSeconds = Number(response.headers.get('retry-after'));
+                  const retryDelayMs =
+                    Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
+                      ? retryAfterSeconds * 1000
+                      : Math.min(1000 * 2 ** attempt, 30000);
+
+                  core.warning(
+                    `Slack users.list page ${pageNumber} was rate-limited (attempt ${attempt + 1}/${maxRetries + 1}); retrying in ${retryDelayMs} ms.`,
+                  );
+                  await sleep(retryDelayMs);
+                  continue;
+                }
+
+                if (!response.ok) {
+                  throw new Error(
+                    `Slack users.list page ${pageNumber} returned HTTP ${response.status} after ${requestDurationMs} ms.`,
+                  );
+                }
+
+                if (attempt > 0) {
+                  core.info(
+                    `Slack users.list page ${pageNumber} succeeded after ${attempt} retry attempt(s) in ${requestDurationMs} ms.`,
+                  );
+                } else {
+                  core.info(
+                    `Slack users.list page ${pageNumber} returned HTTP ${response.status} in ${requestDurationMs} ms.`,
+                  );
+                }
+
+                return response.json();
+              }
+
+              throw new Error(`Slack users.list page ${pageNumber} request did not complete.`);
+            }
+
             let cursor = '';
             let pages = 0;
-            const matches = [];
 
             do {
-              core.info(`Fetching Slack users.list page ${pages + 1}...`);
+              const pageNumber = pages + 1;
+              core.info(`Fetching Slack users.list page ${pageNumber}...`);
               const url = new URL('https://slack.com/api/users.list');
               url.searchParams.set('limit', '200');
               if (cursor) {
                 url.searchParams.set('cursor', cursor);
               }
 
-              const response = await fetch(url, {
-                headers: {
-                  Authorization: `Bearer ${token}`,
-                },
-              });
-
-              if (!response.ok) {
-                throw new Error(`Slack users.list returned HTTP ${response.status}.`);
-              }
-
-              const result = await response.json();
+              const result = await fetchUsersPage(url, pageNumber);
               if (!result.ok) {
-                throw new Error(`Slack users.list failed: ${result.error || 'unknown error'}.`);
+                throw new Error(
+                  `Slack users.list page ${pageNumber} failed: ${result.error || 'unknown error'}.`,
+                );
               }
 
               if (!Array.isArray(result.members)) {
-                throw new Error('Slack users.list response did not include a members array.');
+                throw new Error(
+                  `Slack users.list page ${pageNumber} did not include a members array.`,
+                );
               }
 
               pages += 1;
-              matches.push(...result.members.filter((member) =>
+              core.info(`Slack users.list page ${pages} contained ${result.members.length} member records.`);
+              const match = result.members.find((member) =>
                 !member.deleted &&
                 !member.is_bot &&
                 !member.is_app_user &&
                 typeof member.id === 'string' &&
                 typeof member.name === 'string' &&
                 member.name.toLowerCase() === githubLogin
-              ));
+              );
+
+              if (match) {
+                core.info(
+                  `Found the matching Slack username on page ${pages} after ${Date.now() - lookupStartedAt} ms.`,
+                );
+                core.setOutput('slack_user_id', match.id);
+                core.setOutput('slack_mention', `<@${match.id}>`);
+                return;
+              }
 
               cursor = result.response_metadata?.next_cursor || '';
+              core.info(
+                `No matching Slack username on page ${pages}; ${cursor ? 'continuing pagination.' : 'no more pages.'}`,
+              );
             } while (cursor);
 
-            core.info(`Checked ${pages} pages of users.list. Found ${matches.length} match(es) for @${githubLogin}.`);
-            if (matches.length !== 1) {
-              core.warning(`Expected one Slack username matching @${githubLogin}; found ${matches.length}. No DM will be sent.`);
-              return;
-            }
-
-            core.info(`Will DM Slack user ${matches[0].id}.`);
-            core.setOutput('slack_user_id', matches[0].id);
-            core.setOutput('slack_mention', `<@${matches[0].id}>`);
+            core.warning(
+              `No active Slack username matched @${githubLogin} after ${pages} page(s) and ${Date.now() - lookupStartedAt} ms; no DM will be sent.`,
+            );
 
       - name: DM the author in Slack
         id: slack_dm

.github/workflows/reviewers-docs-engineering.yml

@@ -51,10 +51,8 @@ jobs:
       # Detect PRs that only change package-lock.json. Contributors often create
       # cross-platform npm install churn while editing content.
       # Comment with reset instructions instead of adding them to the engineering review board.
-      # Dependabot security updates can change only the lockfile when package.json
-      # does not name the transitive dependency.
-      # Those PRs are intentional, so reset instructions would be wrong and
-      # keeping them off the board would leave them without engineering triage.
+      # Dependabot and docs-bot PRs can change only the lockfile on purpose, for example
+      # to fix a transitive dependency. Skip the check for them so they still get engineering triage.
       - name: Detect lockfile-only churn
         id: detect
         env:
@@ -64,8 +62,8 @@ jobs:
           CHANGED_FILES: ${{ github.event.pull_request.changed_files }}
           REPO: ${{ github.repository }}
         run: |
-          if [ "$PR_AUTHOR" = "dependabot[bot]" ]; then
-            echo "Author is Dependabot; skipping lockfile churn detection."
+          if [ "$PR_AUTHOR" = "dependabot[bot]" ] || [ "$PR_AUTHOR" = "docs-bot" ]; then
+            echo "Author is $PR_AUTHOR; skipping lockfile churn detection."
             echo "lockfile_only=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi

.github/workflows/test.yml

@@ -69,7 +69,7 @@ jobs:
           - secret-scanning
           - shielding
           # - tests
-          # - tools
+          - tools
           # - types
           - versions
           - webhooks
@@ -85,7 +85,7 @@ jobs:
     env:
       # These suites make no HTTP requests, so they skip the Next.js build and test server.
       # A suite that adds an HTTP test fails with a connection error until it's removed from this list.
-      START_VITEST_SERVER: ${{ contains(fromJSON('["color-schemes", "content-linter", "data-directory", "ghes-releases", "journeys", "links", "observability", "products", "workflows"]'), matrix.name) && 'false' || 'true' }}
+      START_VITEST_SERVER: ${{ contains(fromJSON('["color-schemes", "content-linter", "data-directory", "ghes-releases", "journeys", "links", "observability", "products", "tools", "workflows"]'), matrix.name) && 'false' || 'true' }}
 
     steps:
       # Repeat each if on its step so skipped work still leaves the required check present.

config/moda/deployment.yaml

@@ -196,7 +196,7 @@ environments:
     require_vault: true
     secret_environment: staging
     required_review_tasks: []
-    auto_deploy: true
+    auto_deploy: false
     skip_auto_merge: true
     proxima: true
     resource_path: config/kubernetes/docs-internal-review-lab

content/admin/backing-up-and-restoring-your-instance/configuring-elasticsearch-snapshots.md

@@ -33,7 +33,7 @@ This feature is opt-in. If you don't configure a snapshot repository, {% data va
 
 Configure the following settings using `ghe-config` over SSH. For more information, see [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-command-line/accessing-the-administrative-shell-ssh).
 
-You'll apply the configuration to register the snapshot repository with Elasticsearch. The repository is named `search_index_snapshots-VERSION`, where `VERSION` is the current {% data variables.product.prodname_ghe_server %} release version.
+You'll apply the configuration to register the snapshot repository with Elasticsearch. The repository is named `search_index_snapshots-vVERSION`, where `VERSION` is the current {% data variables.product.prodname_ghe_server %} release version.
 
 ### Azure Blob storage
 
@@ -106,7 +106,7 @@ You'll apply the configuration to register the snapshot repository with Elastics
 After configuration apply completes, confirm the snapshot repository was registered.
 
 ```shell
-curl -k "http://127.0.0.1:9200/_snapshot/search_index_snapshots-$(ghe-version -v)/_status"
+curl -k "http://127.0.0.1:9200/_snapshot/search_index_snapshots-v$(ghe-version -v)/_status"
 ```
 
 If a required secret is missing, configuration apply fails while registering the repository. Update the secrets and rerun `ghe-config-apply` to retry.
@@ -137,9 +137,9 @@ You can manage Elasticsearch snapshots directly using the following commands. Ru
 
 | Command | Description |
 | --- | --- |
-| `ghe-es-create-snapshot` | Creates a new snapshot in the configured repository. |
-| `ghe-es-list-snapshots` | Lists snapshot repositories, or snapshots within a repository. |
-| `ghe-es-restore-snapshot` | Restores search indices from a snapshot. |
+| `/usr/local/share/enterprise/ghe-es-create-snapshot` | Creates a new snapshot in the configured repository. |
+| `/usr/local/share/enterprise/ghe-es-list-snapshots` | Lists snapshot repositories, or snapshots within a repository. |
+| `/usr/local/share/enterprise/ghe-es-restore-snapshot` | Restores search indices from a snapshot. |
 
 > [!TIP]
 > For routine backups and restores, use {% data variables.product.prodname_enterprise_backup_utilities %} or {% data variables.product.prodname_enterprise_backup_service %} instead of these commands directly. The backup tooling coordinates Elasticsearch snapshots with the rest of your instance's data to ensure a consistent backup or restore. Use the manual commands only when you need to manage search index snapshots independently of a full instance backup or restore.
@@ -151,13 +151,13 @@ You can restore a snapshot created by an earlier {% data variables.product.prodn
 1. List available snapshots for the earlier version.
 
    ```shell
-   ghe-es-list-snapshots -v 3.14.0
+   /usr/local/share/enterprise/ghe-es-list-snapshots -v 3.14.0
    ```
 
 1. Restore the snapshot you want.
 
    ```shell
-   ghe-es-restore-snapshot -v 3.14.0 -s SNAPSHOT-NAME
+   /usr/local/share/enterprise/ghe-es-restore-snapshot -v 3.14.0 -s SNAPSHOT-NAME
    ```
 
 Elasticsearch automatically upgrades the restored indices to the current version's format.

content/admin/data-residency/feature-overview-for-github-enterprise-cloud-with-data-residency.md

@@ -23,7 +23,6 @@ The following features are currently unavailable on {% data variables.enterprise
 | Feature | Details | More information |
 | :- | :- | :- |
 | Dependency insights | Organization-level and enterprise-level dependency insights are unavailable and display no data. | [AUTOTITLE](/organizations/collaborating-with-groups-in-organizations/viewing-insights-for-dependencies-in-your-organization) |
-| License and package metadata in the dependency graph | License and package details are not currently populated in the dependency graph. This can result in empty license fields in software bill of materials (SBOM) exports and missing license information from the {% data variables.dependency-review.action_name %}. | [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/export-dependencies-as-sbom)<br>[AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-dependency-review-action) |
 | macOS runners for {% data variables.product.prodname_actions %} | Currently unavailable. | [AUTOTITLE](/actions/concepts/runners/github-hosted-runners) |
 | Maven and Gradle support for {% data variables.product.prodname_registry %} | Currently unavailable. | [AUTOTITLE](/packages/working-with-a-github-packages-registry/working-with-the-apache-maven-registry) |
 | {% data variables.product.prodname_marketplace %} | {% data variables.product.prodname_marketplace %}, as a means of searching for, purchasing, and directly installing apps and actions, is unavailable. Ecosystem apps and actions can still be discovered and installed from their source, but they may require modification to work on {% data variables.enterprise.data_residency_site %}. | [{% data variables.product.prodname_actions %} workflows from {% data variables.product.prodname_marketplace %}](#github-actions-workflows-from-github-marketplace) |