Merge branch 'main' into docs/clarify-dependency-graph-enabled

Author: subatoi

.github/agents/dependabot-ecosystem-update.md

@@ -30,6 +30,7 @@ jobs:
             const titleWordCountMin = 3
             const urlRegex = /https?:\/\/\S+/i
             const titleHasUrl = urlRegex.test(issue.title)
+            const titleHasDollarSign = issue.title.includes('$')
 
             try {
               await github.rest.teams.getMembershipForUserInOrg({
@@ -45,7 +46,7 @@ jobs:
               // An error will be thrown if the user is not a GitHub employee
               // If a user is not a GitHub employee, we should check to see if title has at least the minimum required number of words in it and if it does, we can exit the workflow
 
-              if (titleWordCount >= titleWordCountMin && !titleHasUrl) {
+              if (titleWordCount >= titleWordCountMin && !titleHasUrl && !titleHasDollarSign) {
                 return
               }
             }

.github/workflows/check-for-spammy-issues.yml

@@ -37,13 +37,19 @@ jobs:
             const onlyDeletes = files.length > 0 && files.every(f => f.status === 'removed')
             const isEmptyCommit = !files.length 
             const touchesTooMany = files.length > 10
-            const totalChanges = files.reduce((sum, f) => sum + f.additions + f.deletions, 0)
-            const isOneLineAddition = files.every(f => f.status === 'added') && totalChanges <= 1
-            const isBlankLineEdit = totalChanges <= 1 && files.every(f => f.status === 'modified')
+            const isBlankLineEdit = files.length > 0 && files.every(file => {
+              const changedLines = (file.patch || '')
+                .split('\n')
+                .filter(line => /^[+-]/.test(line))
+                )
+
+              return changedLines.length > 0 &&
+                changedLines.every(line => line.slice(1).trim() === '')
+            })
             const onlyRenames = files.length > 0 && files.every(f => f.status === 'renamed')
 
             // Close the PR and add the invalid label
-            if (onlyDeletes || isEmptyCommit || touchesTooMany || isOneLineAddition || isBlankLineEdit || onlyRenames) {
+            if (onlyDeletes || isEmptyCommit || touchesTooMany || isBlankLineEdit || onlyRenames) {
               await github.rest.issues.update({
                 owner: owner,
                 repo: repo,

.github/workflows/check-for-spammy-prs.yml

@@ -0,0 +1,45 @@
+name: Add new issues and PRs to central triage board
+
+# **What it does**: Adds newly opened or reopened issues and pull requests in github/docs to the right place for triage, and stamps the item with today's date.
+# **Why we have it**: To ensure incoming work in the public docs repo is triaged properly.
+# **Who does it impact**: Writers, FRs.
+
+on:
+  issues:
+    types: [opened, reopened]
+  pull_request_target:
+    types: [opened, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  add-to-central-triage:
+    runs-on: ubuntu-latest
+    if: github.repository == 'github/docs'
+    steps:
+      - name: Triage to central triage board
+        env:
+          GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          ITEM_URL: ${{ github.event.issue.html_url || github.event.pull_request.html_url }}
+          # Add to the Central Triage Group project board and set date to now
+          PROJECT_NUMBER: '19598'
+          PROJECT_ID: 'PVT_kwDNJr_OAJ4AfQ'
+          DATE_FIELD_ID: 'PVTF_lADNJr_OAJ4Afc4IAbbv'
+        run: |
+          echo "Adding $ITEM_URL to project $PROJECT_NUMBER..."
+          ITEM_ID=$(gh project item-add "$PROJECT_NUMBER" --owner github --url "$ITEM_URL" --format json --jq '.id' || true)
+
+          sleep 10
+
+          if [ -n "$ITEM_ID" ] && [ "$ITEM_ID" != "null" ]; then
+            echo "Editing date on item $ITEM_ID..."
+            DATE=$(date '+%Y-%m-%d')
+            if gh project item-edit --project-id "$PROJECT_ID" --id "$ITEM_ID" --field-id "$DATE_FIELD_ID" --date "$DATE"; then
+              echo "done editing"
+            else
+              echo "::warning::gh project item-edit failed for $ITEM_URL (item $ITEM_ID); the item is on the board but the date field was not set"
+            fi
+          else
+            echo "::warning::gh project item-add did not return an item id for $ITEM_URL; skipping item-edit"
+          fi

.github/workflows/send-to-triage-board.yml

@@ -25,7 +25,7 @@ category:
 ---
 
 > [!NOTE]
-> Your profile name for your is {% data variables.product.github %} account is **required**. All other profile information described in this article is **optional**.
+> Your profile name for your {% data variables.product.github %} account is **required**. All other profile information described in this article is **optional**.
 
 ## Changing your profile picture
 

assets/images/help/pull_requests/abandon-review-button.png

@@ -99,6 +99,12 @@ To use OIDC in your workflows, you must establish a trust relationship between {
 
 Before granting an access token, your cloud provider checks that the [`subject`](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) and any other claims used to set conditions in its trust settings match those in the request's JSON Web Token (JWT). If the trust configuration matches, your cloud provider issues a temporary access token to the workflow.
 
+{% ifversion dependabot-oidc-support %}
+
+OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs have an `event_name` claim of `dynamic`. If your trust policy is intended to authorize only {% data variables.product.prodname_actions %} workflows and your cloud provider supports conditions on `event_name`, allow only the event names expected by your workflows.
+
+{% endif %}
+
 For steps and syntax for configuring OIDC trust and setting conditions for cloud providers, see [AUTOTITLE](/actions/reference/security/oidc#oidc-claims-used-to-define-trust-conditions-on-cloud-roles).
 
 ## Configuring OIDC on {% data variables.enterprise.data_residency_site %}

content/account-and-profile/tutorials/personalize-your-profile.md

@@ -34,7 +34,7 @@ For an example {% data variables.product.prodname_actions %} workflow using the
 
 * To be secure, you need to set a Claims JSON in JFrog when configuring identity mappings. For more information, see [AUTOTITLE](https://jfrog.com/help/r/jfrog-platform-administration-documentation/configure-identity-mappings) and [AUTOTITLE](/actions/reference/security/oidc#customizing-the-token-claims).
 
-    For example, you can set `iss` to `https://token.actions.githubusercontent.com`, and the `repository` to something like "octo-org/octo-repo"`. This will ensure only Actions workflows from the specified repository will have access to your JFrog platform. The following is an example Claims JSON when configuring identity mappings.
+  For example, you can set `iss` to `https://token.actions.githubusercontent.com`, and the `repository` to something like `octo-org/octo-repo`.{% ifversion dependabot-oidc-support %} JFrog identity mappings match each claim against an exact value, so to ensure only {% data variables.product.prodname_actions %} workflows from the specified repository have access to your JFrog platform, also set `event_name` to the event that triggers your workflow, such as `push`. This prevents OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs, which have an `event_name` of `dynamic`, from matching the identity mapping. If your workflows are triggered by more than one event, create a separate identity mapping for each event name.{% endif %} The following is an example Claims JSON when configuring identity mappings.
 
     {% data reusables.actions.jfrog-json-configuring-identity-mappings %}
 

content/actions/concepts/security/openid-connect.md

@@ -60,7 +60,7 @@ The OIDC token includes the following claims.
 | `enterprise_id`| The ID of the enterprise that contains the repository from where the workflow is running.                  |
 | {% endif %} |
 | `environment`| The name of the environment used by the job. If the `environment` claim is included (also via `include_claim_keys`), an environment is required and must be provided.                   |
-| `event_name`| The name of the event that triggered the workflow run.                    |
+| `event_name`| The name of the event that triggered the workflow run.{% ifversion dependabot-oidc-support %} OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs use `dynamic` as the value.{% endif %}                    |
 | `head_ref`| The source branch of the pull request in a workflow run.                   |
 | `job_workflow_ref`| For jobs using a reusable workflow, the ref path to the reusable workflow. For more information, see [AUTOTITLE](/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows).                  |
 | `job_workflow_sha`| For jobs using a reusable workflow, the commit SHA for the reusable workflow file.                   |
@@ -107,6 +107,12 @@ If you need more granular trust conditions, you can customize the {% ifversion g
 
 There are also many additional claims supported in the OIDC token that can be used for setting these conditions. In addition, your cloud provider could allow you to assign a role to the access tokens, letting you specify even more granular permissions.
 
+{% ifversion dependabot-oidc-support %}
+
+OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs have an `event_name` claim of `dynamic`. If your trust policy is intended to authorize only {% data variables.product.prodname_actions %} workflows and your cloud provider supports conditions on `event_name`, allow only the event names expected by your workflows.
+
+{% endif %}
+
 > [!NOTE]
 > To control how your cloud provider issues access tokens, you **must** define at least one condition, so that untrusted repositories can’t request access tokens for your cloud resources.
 

content/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-jfrog.md

@@ -45,7 +45,7 @@ In order to use ARC, ensure you have the following.
 
     For additional Helm configuration options, see [`values.yaml`](https://github.com/actions/actions-runner-controller/blob/master/charts/gha-runner-scale-set-controller/values.yaml) in the ARC documentation.
 
-1. To enable ARC to authenticate to {% data variables.product.company_short %}, generate a {% data variables.product.pat_v1 %}. For more information, see [AUTOTITLE](/actions/how-tos/manage-runners/use-actions-runner-controller/authenticate-to-the-api#authenticating-arc-with-a-personal-access-token-classic).
+1. To enable ARC to authenticate to {% data variables.product.company_short %}, choose an authentication method for your runner scale set. If you are registering runners at the repository or organization level, we recommend authenticating with a {% data variables.product.prodname_github_app %}. Runner scale sets registered at the enterprise level require {% data variables.product.pat_v1 %} authentication. For more information, see [AUTOTITLE](/actions/how-tos/manage-runners/use-actions-runner-controller/authenticate-to-the-api).
 
 ## Configuring a runner scale set
 
@@ -56,10 +56,11 @@ In order to use ARC, ensure you have the following.
     * Update the `INSTALLATION_NAME` value carefully. You will use the installation name as the value of `runs-on` in your workflows. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idruns-on).
     * Update the `NAMESPACE` value to the location you want the runner pods to be created.
     * Set `GITHUB_CONFIG_URL` to the URL of your repository, organization, or enterprise. This is the entity that the runners will belong to.
+    * This example uses a {% data variables.product.pat_v1 %} to keep the initial setup short. For repository or organization runner scale sets, use a {% data variables.product.prodname_github_app %} in production environments when possible.
     {% ifversion fpt %}
-    * Set `GITHUB_PAT` to a {% data variables.product.company_short %} {% data variables.product.pat_generic %} with the `repo` and `admin:org` scopes for repository and organization runners.
+    * Set `GITHUB_PAT` to a {% data variables.product.company_short %} {% data variables.product.pat_v1 %} with the `repo` and `admin:org` scopes for repository and organization runners.
     {% else %}
-    * Set `GITHUB_PAT` to a {% data variables.product.company_short %} {% data variables.product.pat_generic %} with the `repo` and `manage_runners:org` scopes for repository and organization runners, and the `manage_runners:enterprise` scope for enterprise runners.
+    * Set `GITHUB_PAT` to a {% data variables.product.company_short %} {% data variables.product.pat_v1 %} with the `repo` and `manage_runners:org` scopes for repository and organization runners, and the `manage_runners:enterprise` scope for enterprise runners.
     {% endif %}
     * This example command installs the latest version of the Helm chart. To install a specific version, you can pass the `--version` argument with the version of the chart you wish to install. You can find the list of releases in the [GitHub Container Registry](https://github.com/actions/actions-runner-controller/pkgs/container/actions-runner-controller-charts%2Fgha-runner-scale-set).