content/actions/concepts/security/openid-connect.md

.github/workflows/changelog-agent.yml

@@ -420,14 +420,15 @@ jobs:
         uses: actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 # v3
         with:
           provider: copilot
-          # No model is pinned: actions/ai-inference forwards --model to the
-          # Copilot CLI only when it differs from its GitHub Models default, so
-          # omitting it lets the CLI pick its own current default (latest Sonnet)
-          # and avoids breaking when a pinned slug (e.g. gpt-4.1) is retired.
+          # Must be an explicit empty string, not omitted. This action defaults
+          # `model` to "gpt-4.1" and always forwards it as --model, and that slug
+          # is retired, so omitting the input fails with:
+          #   Error: Model "gpt-4.1" from --model flag is not available.
+          # An empty string makes the action skip --model entirely and lets the
+          # Copilot CLI pick its own current default. See actions/ai-inference#271.
+          model: ''
           prompt-file: prompt.txt
           system-prompt-file: system-prompt.txt
-          max-completion-tokens: 1000
-          temperature: 0.3
         env:
           COPILOT_GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_COPILOT }}
 

.github/workflows/check-for-spammy-issues.yml

@@ -30,6 +30,7 @@ jobs:
             const titleWordCountMin = 3
             const urlRegex = /https?:\/\/\S+/i
             const titleHasUrl = urlRegex.test(issue.title)
+            const titleHasDollarSign = issue.title.includes('$')
 
             try {
               await github.rest.teams.getMembershipForUserInOrg({
@@ -45,7 +46,7 @@ jobs:
               // An error will be thrown if the user is not a GitHub employee
               // If a user is not a GitHub employee, we should check to see if title has at least the minimum required number of words in it and if it does, we can exit the workflow
 
-              if (titleWordCount >= titleWordCountMin && !titleHasUrl) {
+              if (titleWordCount >= titleWordCountMin && !titleHasUrl && !titleHasDollarSign) {
                 return
               }
             }

.github/workflows/check-for-spammy-prs.yml

@@ -28,34 +28,57 @@ jobs:
             const repo = 'docs'
             const pull_number = context.payload.pull_request.number
 
-            const { data: files } = await github.rest.pulls.listFiles({
-              owner: owner,
-              repo: repo,
-              pull_number: pull_number,
-            });
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner,
+              repo,
+              pull_number,
+              per_page: 100,
+            })
 
             const onlyDeletes = files.length > 0 && files.every(f => f.status === 'removed')
-            const isEmptyCommit = !files.length 
+            const onlyDeletesLines =
+              files.some(file => file.deletions > 0) &&
+              files.every(file => file.additions === 0)
+            const isEmptyCommit = !files.length
             const touchesTooMany = files.length > 10
-            const totalChanges = files.reduce((sum, f) => sum + f.additions + f.deletions, 0)
-            const isOneLineAddition = files.every(f => f.status === 'added') && totalChanges <= 1
-            const isBlankLineEdit = totalChanges <= 1 && files.every(f => f.status === 'modified')
+            const isBlankLineEdit = files.length > 0 && files.every(file => {
+              const changedLines = (file.patch || '')
+                .split('\n')
+                .filter(line => /^[+-]/.test(line))
+              return changedLines.length > 0 &&
+                changedLines.every(line => line.slice(1).trim() === '')
+            })
             const onlyRenames = files.length > 0 && files.every(f => f.status === 'renamed')
 
             // Close the PR and add the invalid label
-            if (onlyDeletes || isEmptyCommit || touchesTooMany || isOneLineAddition || isBlankLineEdit || onlyRenames) {
-              await github.rest.issues.update({
-                owner: owner,
-                repo: repo,
+            if (
+              onlyDeletesLines ||
+              onlyDeletes ||
+              isEmptyCommit ||
+              touchesTooMany ||
+              isBlankLineEdit ||
+              onlyRenames
+            ) {
+              await github.rest.issues.addLabels({
+                owner,
+                repo,
                 issue_number: pull_number,
                 labels: ['invalid'],
-              });
+              })
 
               // Comment on the PR
               await github.rest.issues.createComment({
-                owner: owner,
-                repo: repo,
+                owner,
+                repo,
                 issue_number: pull_number,
-                body: `This pull request may have been opened accidentally. I'm going to close it now, but feel free to check out our [contribution guidelines](https://docs.github.com/en/contributing), or raise an issue.`,
-              });
+                body: onlyDeletesLines
+                  ? `This pull request only removes existing content. Before submitting a content-removal pull request, please [open an issue](https://github.com/github/docs/issues/new/choose) explaining the proposed removal and wait for approval from the GitHub Docs team. Once the change has been approved, you can open a new pull request and link it to the issue.`
+                  : `This pull request may have been opened accidentally. I'm going to close it now, but feel free to check out our [contribution guidelines](https://docs.github.com/en/contributing), or raise an issue.`,
+              })
+
+              if (onlyDeletesLines) {
+                core.setFailed(
+                  'This pull request only deletes lines. An approved issue is required first.',
+                )
+              }
             }

.github/workflows/reviewers-docs-engineering.yml

@@ -54,11 +54,22 @@ jobs:
       # These are usually cross-platform `npm install` churn from contributors
       # editing content. We comment with reset instructions instead of pulling in
       # docs-engineering for review.
+      #
+      # Dependabot is exempt. Its security updates for transitive dependencies
+      # change only the lockfile, because the dependency is not in package.json.
+      # Those PRs are intentional, so the reset instructions are wrong and
+      # suppressing the review request leaves them with no reviewer at all.
       - name: Detect lockfile-only churn
         id: detect
         env:
           GH_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
+          if [ "$PR_AUTHOR" = "dependabot[bot]" ]; then
+            echo "Author is Dependabot; skipping lockfile churn detection."
+            echo "lockfile_only=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           changed=$(gh pr diff "$PR" --name-only)
           echo "Changed files:"
           echo "$changed"