Generalize the copilot-setup-steps.yml sample introduction

.github/workflows/changelog-agent.yml

@@ -420,14 +420,15 @@ jobs:
         uses: actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 # v3
         with:
           provider: copilot
-          # No model is pinned: actions/ai-inference forwards --model to the
-          # Copilot CLI only when it differs from its GitHub Models default, so
-          # omitting it lets the CLI pick its own current default (latest Sonnet)
-          # and avoids breaking when a pinned slug (e.g. gpt-4.1) is retired.
+          # Must be an explicit empty string, not omitted. This action defaults
+          # `model` to "gpt-4.1" and always forwards it as --model, and that slug
+          # is retired, so omitting the input fails with:
+          #   Error: Model "gpt-4.1" from --model flag is not available.
+          # An empty string makes the action skip --model entirely and lets the
+          # Copilot CLI pick its own current default. See actions/ai-inference#271.
+          model: ''
           prompt-file: prompt.txt
           system-prompt-file: system-prompt.txt
-          max-completion-tokens: 1000
-          temperature: 0.3
         env:
           COPILOT_GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_COPILOT }}
 

.github/workflows/check-for-spammy-prs.yml

@@ -28,14 +28,18 @@ jobs:
             const repo = 'docs'
             const pull_number = context.payload.pull_request.number
 
-            const { data: files } = await github.rest.pulls.listFiles({
-              owner: owner,
-              repo: repo,
-              pull_number: pull_number,
-            });
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner,
+              repo,
+              pull_number,
+              per_page: 100,
+            })
 
             const onlyDeletes = files.length > 0 && files.every(f => f.status === 'removed')
-            const isEmptyCommit = !files.length 
+            const onlyDeletesLines =
+              files.some(file => file.deletions > 0) &&
+              files.every(file => file.additions === 0)
+            const isEmptyCommit = !files.length
             const touchesTooMany = files.length > 10
             const isBlankLineEdit = files.length > 0 && files.every(file => {
               const changedLines = (file.patch || '')
@@ -47,19 +51,34 @@ jobs:
             const onlyRenames = files.length > 0 && files.every(f => f.status === 'renamed')
 
             // Close the PR and add the invalid label
-            if (onlyDeletes || isEmptyCommit || touchesTooMany || isBlankLineEdit || onlyRenames) {
-              await github.rest.issues.update({
-                owner: owner,
-                repo: repo,
+            if (
+              onlyDeletesLines ||
+              onlyDeletes ||
+              isEmptyCommit ||
+              touchesTooMany ||
+              isBlankLineEdit ||
+              onlyRenames
+            ) {
+              await github.rest.issues.addLabels({
+                owner,
+                repo,
                 issue_number: pull_number,
                 labels: ['invalid'],
-              });
+              })
 
               // Comment on the PR
               await github.rest.issues.createComment({
-                owner: owner,
-                repo: repo,
+                owner,
+                repo,
                 issue_number: pull_number,
-                body: `This pull request may have been opened accidentally. I'm going to close it now, but feel free to check out our [contribution guidelines](https://docs.github.com/en/contributing), or raise an issue.`,
-              });
+                body: onlyDeletesLines
+                  ? `This pull request only removes existing content. Before submitting a content-removal pull request, please [open an issue](https://github.com/github/docs/issues/new/choose) explaining the proposed removal and wait for approval from the GitHub Docs team. Once the change has been approved, you can open a new pull request and link it to the issue.`
+                  : `This pull request may have been opened accidentally. I'm going to close it now, but feel free to check out our [contribution guidelines](https://docs.github.com/en/contributing), or raise an issue.`,
+              })
+
+              if (onlyDeletesLines) {
+                core.setFailed(
+                  'This pull request only deletes lines. An approved issue is required first.',
+                )
+              }
             }

.github/workflows/reviewers-docs-engineering.yml

@@ -54,11 +54,22 @@ jobs:
       # These are usually cross-platform `npm install` churn from contributors
       # editing content. We comment with reset instructions instead of pulling in
       # docs-engineering for review.
+      #
+      # Dependabot is exempt. Its security updates for transitive dependencies
+      # change only the lockfile, because the dependency is not in package.json.
+      # Those PRs are intentional, so the reset instructions are wrong and
+      # suppressing the review request leaves them with no reviewer at all.
       - name: Detect lockfile-only churn
         id: detect
         env:
           GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
+          if [ "$PR_AUTHOR" = "dependabot[bot]" ]; then
+            echo "Author is Dependabot; skipping lockfile churn detection."
+            echo "lockfile_only=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           changed=$(gh pr diff "$PR" --name-only)
           echo "Changed files:"
           echo "$changed"

.github/workflows/sync-graphql.yml

@@ -95,7 +95,7 @@ jobs:
         with:
           slack_token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
           message: |
-            ⚠️ GraphQL Sync found ${{ needs.update_graphql_files.outputs.ignored-count }} ignored change types: ${{ needs.update_graphql_files.outputs.ignored-types }}
+            :graphql: GraphQL Sync found ${{ needs.update_graphql_files.outputs.ignored-count }} ignored change types: ${{ needs.update_graphql_files.outputs.ignored-types }}
 
             These change types are not in CHANGES_TO_REPORT and were silently ignored. Consider reviewing if they should be added to the changelog.
 

.github/workflows/sync-sdk-docs.yml

@@ -24,6 +24,7 @@ on:
     types: [opened, synchronize, reopened]
     paths:
       - '.github/workflows/sync-sdk-docs.yml'
+      - 'content/copilot/get-started/sdk-quickstart.md'
       - 'src/workflows/sync-sdk-docs/**'
 
 concurrency:
@@ -77,6 +78,10 @@ jobs:
       - name: Copy SDK docs
         run: |
           mkdir -p "$SDK_DOCS_TARGET"
+          # Pages relocated out of this tree into hand-authored content are not
+          # excluded here — they are removed by the RELOCATED_PAGES map in
+          # src/workflows/sync-sdk-docs/normalize-sdk-docs.ts, which also
+          # repoints inbound links at their new URLs.
           rsync -av --exclude='.validation/' --exclude='developer-docs/' "$SDK_TMP/docs/" "$SDK_DOCS_TARGET/"
           echo "Copied $(find "$SDK_DOCS_TARGET" -name '*.md' | wc -l | tr -d ' ') markdown files"
 

content/actions/concepts/workflows-and-actions/dependency-caching.md

@@ -31,9 +31,9 @@ For more information on workflow run artifacts, see [AUTOTITLE](/actions/tutoria
 
 Caches are shared based on the branch or tag a workflow run uses, not on the identity of the workflow or job. See [AUTOTITLE](/actions/reference/workflows-and-actions/events-that-trigger-workflows) and the `GITHUB_REF` for the branch used for various workflow triggers. Any run that can read a cache restores its contents as-is, so you should treat restored files as untrusted input and never store secrets or other sensitive data in a cache.
 
-Untrusted workflows can read sensitive cache contents, such as when a `pull_request` from a fork restores a cache. Poisoned caches can lead to code execution in trusted workflows. To limit the risk of cache poisoning, {% data variables.product.github %} gives workflows that run in response to low-trust triggers read-only access to caches in the default branch's scope.
+Untrusted workflows can read sensitive cache contents, such as when a `pull_request` from a fork restores a cache. Poisoned caches can lead to code execution in trusted workflows. To limit the risk of cache poisoning, {% data variables.product.github %} gives workflows that run in response to low-trust triggers read-only access to caches in the default branch's scope.{% ifversion actions-cache-mode %} A workflow or job can override this read-only restriction by explicitly declaring a write-capable `cache-mode`, which reintroduces the cache-poisoning risk for that workflow.{% endif %}
 
-For details on cache scope, access restrictions, and best practices for using caches securely, see [AUTOTITLE](/actions/reference/workflows-and-actions/dependency-caching#cache-access-for-low-trust-workflow-triggers).
+For the trusted-versus-low-trust trigger breakdown and default cache behavior, see [AUTOTITLE](/actions/reference/workflows-and-actions/dependency-caching#cache-access-for-low-trust-workflow-triggers). For cache-specific security guidance, see [AUTOTITLE](/actions/reference/workflows-and-actions/dependency-caching#best-practices-for-using-caches-securely).
 
 ## Next steps
 

content/actions/how-tos/reuse-automations/reuse-workflows.md

@@ -303,6 +303,22 @@ jobs:
 
 For more information on using job outputs, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idoutputs). If you want to share something other than a variable (e.g. a build artifact) between workflows, see [AUTOTITLE](/actions/tutorials/store-and-share-data).
 
+{% ifversion actions-cache-mode %}
+
+## Controlling cache access in reusable workflows
+
+You can use the `cache-mode` key to grant a reusable workflow the least amount of {% data variables.product.prodname_actions %} cache access it needs. The value can be `read`, `write`, `write-only`, or `none`. If you omit `cache-mode`, a `read` or `write` default is used based on the trigger type. For the full syntax and the meaning of each value, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#cache-mode). For trigger-dependent defaults, see [AUTOTITLE](/actions/reference/dependency-caching-reference#defaults).
+
+When a caller workflow calls a reusable workflow, `cache-mode` propagates to the called workflow. An explicit `cache-mode` on the calling job, or inherited from the caller workflow, limits the cache access the called workflow can request.
+
+If the calling job neither sets nor inherits an explicit `cache-mode`, the called workflow can explicitly request `write` even when the caller's low-trust trigger defaults to `read`. To cap a called workflow at read-only access, set `cache-mode: read` on the job that calls it.
+
+If a called workflow declares a `cache-mode` that requests access beyond this explicit limit, the run does not start and {% data variables.product.github %} reports a validation error. For example, a caller that allows at most `read` cannot call a workflow that declares `write`. Because `read` grants restore access and `write-only` grants save access, the two are non-overlapping capabilities, so a mismatch between them is also an over-request. For example, a `write-only` caller cannot call a workflow that declares `read`.
+
+For more information about cache access and the four modes, see [AUTOTITLE](/actions/reference/dependency-caching-reference#controlling-cache-access-with-cache-mode).
+
+{% endif %}
+
 ## Monitoring which workflows are being used
 
 {% ifversion fpt or ghes %}

content/actions/reference/security/securely-using-pull_request_target.md

@@ -67,7 +67,7 @@ If you have confirmed you need `pull_request_target`, apply these controls to li
 
 * **Restrict secrets.** Confirm that the permissions set on the `GITHUB_TOKEN` have the least privileges and that only the necessary repository and organization secrets are used for the workflow. For more information, see [AUTOTITLE](/actions/tutorials/authenticate-with-github_token#modifying-the-permissions-for-the-github_token).
 
-* **Understand the impact to caching.** To reduce the risk of cache poisoning, workflows triggered by `pull_request_target` have read-only access to the cache in the default branch's scope. These workflows can restore existing cache entries but cannot create or overwrite them, so they cannot affect the execution of other, unrelated, workflows through the shared cache. If such a workflow attempts to save a cache, the save fails but the step and the job continue, and the failure is reported as a warning in the workflow log. If your workflow needs to populate the cache, save it from a workflow that runs on a trusted trigger such as `push`. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/dependency-caching#cache-access-for-low-trust-workflow-triggers).
+* **Understand the impact to caching.** To reduce the risk of cache poisoning, workflows triggered by `pull_request_target` have read-only access to the cache in the default branch's scope. These workflows can restore existing cache entries but cannot create or overwrite them, so they cannot affect the execution of other, unrelated, workflows through the shared cache. If such a workflow attempts to save a cache, the save fails but the step and the job continue, and the failure is reported as a warning in the workflow log. If your workflow needs to populate the cache, save it from a workflow that runs on a trusted trigger such as `push`.{% ifversion actions-cache-mode %} A workflow or job can opt out of this read-only restriction by explicitly declaring a write-capable `cache-mode`, but doing so on a `pull_request_target` workflow reintroduces the cache-poisoning risk this restriction is designed to prevent.{% endif %} For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/dependency-caching#cache-access-for-low-trust-workflow-triggers).
 
 * **Ensure the underlying compute is isolated and ephemeral.** If self-hosted runners are used, you must confirm that the runner environment is properly restricted from internal resources and is not reused across {% data variables.product.prodname_actions %} runs. For more information, see [AUTOTITLE](/actions/reference/security/secure-use#hardening-for-self-hosted-runners).