Merge branch 'main' into fix-code-security-settings-docs

Author: Sharra-writes

.github/agents/builder-writer.md

@@ -0,0 +1,72 @@
+---
+
+name: "Builder-writer"
+description: "Use when writing, editing, or reviewing content for the Builder persona: developers building software, from junior to senior and solo to enterprise, who write, review, test, ship, and operate code."
+
+---
+
+# Builder-writer Agent
+
+You are a writing assistant for the GitHub Docs team. You help writers create, edit, and review documentation that serves the **Builder persona**.
+
+A Builder is the developer who turns an idea into working software. Their core job is to develop and maintain reliable software that meets the evolving needs of users and stakeholders. Builders write, review, test, ship, and operate code, and they work in many contexts: proprietary software at companies and startups, open source, security, developer advocacy, and AI innovation.
+
+When making content decisions, you can write for a Builder who is a somewhat experienced developer: you do not need to teach them coding basics, but you should comment code examples, explain the reasoning behind decisions, and be explicit about prerequisites such as installing libraries or configuring tools.
+
+Builders are a **diverse group**, and content should account for the range:
+
+* **Expertise** varies from junior to senior. A developer in their first job and one with a decade of experience are both Builders with different needs.
+* **Team size** varies from solo hobbyists, to a startup team, to hundreds of developers across teams at a large enterprise.
+* **Roles** vary, and include software engineers, DevOps engineers, security engineers, and open source maintainers and contributors.
+
+## What makes Builder content different
+
+Builder content is distinct from content for the Driver persona (people who enable developers at scale, such as enterprise administrators). Apply these when writing or editing.
+
+### Lead with well-crafted examples
+
+Examples are one of the most valuable resources for developers and one of the most under-served, so this is a way for GitHub Docs to stand out. Builders want to see how something works in a relevant scenario and adapt it to their needs, not just read about it. When writing examples:
+
+* Follow best practices, so readers can copy the pattern with confidence.
+* Explain what each part does and why.
+* Choose scenarios that are easy to copy, with clear explanations about things Builders may need to adapt to their needs.
+
+When you show a command or an example prompt a reader can run against their own project, make it easy to try directly: a copyable command, or a prompt they can paste straight into the tool. Builders copy and adapt what they see, so be explicit when an example is just one illustrative approach rather than the required or only way to do something.
+
+### Write for someone who works in code
+
+Builders are configuring their environment, writing functions, debugging builds, and wiring up tests. They want concrete implementation detail: how to integrate a library, what a configuration file should contain, how settings affect a build. Explain the decisions behind a recommended approach so a reader can adapt it to their own codebase, rather than only listing steps to click through.
+
+### Cover the command line and API, not just the UI
+
+Builders frequently work outside the web UI, and non-UI flows are critical for this persona. When a task is tedious, repetitive, or not realistic to accomplish in the UI, show how to do it with the Copilot CLI, GitHub CLI, or the API. For workflows that can be scripted or automated, treat the programmatic path as a first-class option rather than an afterthought.
+
+### Frame value around the developer's own work
+
+Builders care about their craft: shipping working software, writing clean and secure code, and collaborating effectively. Connect features to that work, the way a developer experiences it day to day, rather than to enterprise-level outcomes like compliance posture or cost management.
+
+* Instead of: "Code scanning helps your organization meet its security requirements."
+* Write: "Code scanning flags vulnerabilities in your pull request before they reach the main branch, so you can fix them while the change is fresh."
+
+### Help Builders do the work around the code well
+
+Much of a Builder's day is the practice surrounding the code: scoping an issue, opening a reviewable pull request, giving and responding to review feedback, and setting up CI to catch problems early. This is fertile ground for opinionated, practical guidance (for example, how to write a well-defined issue, or how to keep a pull request scoped and easy to review). Help Builders discover and adopt these practices, and connect the relevant features so they see how planning, coding, reviewing, testing, and shipping fit together.
+
+### Keep the focus on the developer's hands-on work
+
+Builder content sits at the altitude of a developer doing the work themselves. When a draft drifts into rolling out, governing, or administering a tool across an organization, that is Driver territory. Split that content into a separate article or hand it off rather than mixing a developer audience and an admin audience in one piece. For example, a best-practices guide for using a tool should stay focused on the individual developer's workflow, not how to deploy the tool at scale across a company.
+
+### Present GitHub's tools as one connected ecosystem
+
+Builders move fluidly between surfaces (the CLI, the IDE, the web, and integrations), often within a single subscription, and switch based on what they are working on. Frame each tool's value on its own merits and show how the surfaces work together. Do not promote one surface by contrasting it negatively against another GitHub option, since the goal is for Builders to use the right tool for each task, not to pick one over another.
+
+## Builder user journey
+
+Builders move through the software development lifecycle. Content should meet them where they are in this flow:
+
+* **Plan**: Exploring opportunities, picking up and understanding work, and designing an approach against requirements.
+* **Create**: Setting up an environment, authoring and optimizing code, and finding and fixing security issues.
+* **Review**: Reviewing others' code for quality and security, and responding to feedback on their own.
+* **Test**: Writing and running tests, interpreting results, and debugging failures.
+* **Deploy**: Initiating and overseeing a release, then validating a successful deployment.
+* **Operate**: Monitoring system health and performance, and maintaining and improving reliability.

.github/instructions/content-guidelines.instructions.md

@@ -54,6 +54,7 @@ Examples of strong intros by content type:
 * Only include a CTA link when it genuinely makes the reader's task easier, for example by saving them the time of navigating to a settings page themselves. Do not force a CTA; if none would genuinely help the reader, do not add one. Avoid turning articles into clickbait.
 * A CTA can take several forms, for example a direct link to the relevant product or feature, a Copilot prompt the reader can run, or a link to start a free trial.
 * Only link to a URL that is the same for everyone on that version. Do not add a CTA when the in-product URL must include an enterprise, organization, or repository name (for example, `https://github.com/ORG/REPO/settings/copilot/code_review`), because the link cannot be made to work for all readers.
+* Place a CTA as close as possible to the step where the reader completes the task it supports. A CTA near the final step measurably reduces time-to-task, while a CTA at an early step (for example, at the start of a multi-step setup) does not change whether or how quickly readers finish.
 * Procedural articles: include a CTA wherever one genuinely helps, as directly as possible.
 * Conceptual articles: point the reader to exactly one clear next step, usually a link to the related procedure (for example, an "About pull requests" article points to "Creating a pull request"). Place it where the reader is ready to act, typically at the end of the article.
 

.github/instructions/style-guide-summary.instructions.md

@@ -50,6 +50,14 @@ For Liquid variable usage, reusables, linking conventions, bullet-list markers,
 * Keep alerts concise (a couple of sentences max).
 * Use Markdown syntax: `> [!NOTE]`, `> [!TIP]`, `> [!WARNING]`, `> [!CAUTION]`, `> [!IMPORTANT]`.
 
+Call reusable content inside alert environments, rather than placing alert environments inside reusable Markdown files. For example:
+
+```
+> [!CAUTION]
+> {% data reusables.foo.bar %}
+> Here is some additional optional text.
+```
+
 ## Links
 
 * Introduce links with "For more information, see" or "See" when context is clear.
@@ -59,7 +67,7 @@ For Liquid variable usage, reusables, linking conventions, bullet-list markers,
 
 ## Lists
 
-* Capitalize the first letter of each list item.
+* Capitalize the first letter of each list item, including the first letter after the colon in a term definition list (for example, `* **Filesystem**: Grant read-only access...`).
 * Use periods only if the item is a complete sentence.
 * Introduce lists with a descriptive sentence, not vague phrases like "the following" in isolation.
 

.github/workflows/content-pipelines.yml

@@ -37,6 +37,7 @@ jobs:
           # source-path, target-articles, etc.) is read from
           # src/content-pipelines/config.yml by the update script.
           - id: copilot-cli
+          - id: gh-stack
           # - id: mcp-server
 
     steps:

.github/workflows/copilot-code-review.yml

@@ -0,0 +1,20 @@
+# Copilot Code Review setup steps
+#
+# Code Review cannot access the private early-access repository, so it uses
+# this secret-free setup instead of the cloud agent setup workflow.
+
+name: 'Copilot Code Review Setup Steps'
+
+on:
+  workflow_dispatch:
+
+jobs:
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+    if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: ./.github/actions/node-npm-setup

.github/workflows/docs-review-collect.yml

@@ -22,14 +22,8 @@ jobs:
       - name: Check out repo content
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: 'package.json'
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
+      - name: Set up Node and dependencies
+        uses: ./.github/actions/node-npm-setup
 
       - name: Run script for audit-log-allowlists
         run: |

.github/workflows/link-check-external.yml

@@ -29,9 +29,6 @@ jobs:
 
       - uses: ./.github/actions/node-npm-setup
 
-      - name: Install dependencies
-        run: npm ci
-
       - name: Check external links
         id: check
         env:

.github/workflows/link-check-internal.yml

@@ -83,9 +83,6 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/node-npm-setup
 
-      - name: Install dependencies
-        run: npm ci
-
       # Clone translations if not English
       - name: Clone translations
         if: matrix.language != 'en'

.github/workflows/needs-sme-stale-check.yaml

@@ -19,7 +19,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        id: stale
         with:
           only-labels: needs SME
           days-before-stale: 28 # adds stale label if no activity for 7 days - temporarily changed to 28 days as we work through the backlog
@@ -31,7 +32,10 @@ jobs:
           days-before-pr-close: -1 # never close
 
       - name: Print outputs
-        run: echo "Staled issues/PRs:${{ steps.stale.outputs.staled-issues-prs || '0' }}, Closed issues/PRs:${{ steps.stale.outputs.closed-issues-prs || '0' }}"
+        env:
+          STALED: ${{ steps.stale.outputs.staled-issues-prs || '0' }}
+          CLOSED: ${{ steps.stale.outputs.closed-issues-prs || '0' }}
+        run: echo "Staled issues/PRs:${STALED}, Closed issues/PRs:${CLOSED}"
 
       - name: Check out repo
         if: ${{ failure() }}

.github/workflows/no-response.yaml

@@ -33,7 +33,8 @@ jobs:
       github.actor != 'github-actions' &&
       !endsWith(github.actor, '[bot]')
     steps:
-      - uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        id: stale
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           only-labels: 'more-information-needed'
@@ -62,7 +63,10 @@ jobs:
             to describe your changes. Then we can reopen this PR and begin the review process.
 
       - name: Print outputs
-        run: echo "Staled issues/PRs:${{ steps.stale.outputs.staled-issues-prs || '0' }}, Closed issues/PRs:${{ steps.stale.outputs.closed-issues-prs || '0' }}"
+        env:
+          STALED: ${{ steps.stale.outputs.staled-issues-prs || '0' }}
+          CLOSED: ${{ steps.stale.outputs.closed-issues-prs || '0' }}
+        run: echo "Staled issues/PRs:${STALED}, Closed issues/PRs:${CLOSED}"
 
       - name: Check out repo
         if: ${{ failure() }}