Skip to content

Commit f4e736b

Browse files
authored
Merge branch 'main' into cloning-context
2 parents 08eee07 + 120d70b commit f4e736b

9 files changed

Lines changed: 53 additions & 21 deletions

File tree

73.7 KB
Loading

‎content/actions/creating-actions/creating-a-javascript-action.md‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,13 @@ Once you complete this project, you should understand how to build your own Java
3535

3636
### Prerequisites
3737

38-
Before you begin, you'll need to download Node.js and create a GitHub repository.
38+
Before you begin, you'll need to download Node.js and create a public {% data variables.product.prodname_dotcom %} repository.
3939

4040
1. Download and install Node.js 12.x, which includes npm.
4141

4242
https://nodejs.org/en/download/current/
4343

44-
1. Create a new repository on {% data variables.product.product_location %}. You can choose any repository name or use "hello-world-javascript-action" like this example. You can add these files after your project has been pushed to {% data variables.product.product_name %}. For more information, see "[Create a new repository](/articles/creating-a-new-repository)."
44+
1. Create a new public repository on {% data variables.product.product_location %} and call it "hello-world-javascript-action". For more information, see "[Create a new repository](/articles/creating-a-new-repository)."
4545

4646
1. Clone your repository to your computer. For more information, see "[Cloning a repository](/articles/cloning-a-repository)."
4747

@@ -51,18 +51,16 @@ Before you begin, you'll need to download Node.js and create a GitHub repository
5151
cd hello-world-javascript-action
5252
```
5353

54-
1. From your terminal, initialize the directory with a `package.json` file.
54+
1. From your terminal, initialize the directory with npm to generate a `package.json` file.
5555

5656
```shell
5757
npm init -y
5858
```
5959

6060
### Creating an action metadata file
6161

62-
Create a new file `action.yml` in the `hello-world-javascript-action` directory with the following example code. For more information, see "[Metadata syntax for {% data variables.product.prodname_actions %}](/actions/creating-actions/metadata-syntax-for-github-actions)."
62+
Create a new file named `action.yml` in the `hello-world-javascript-action` directory with the following example code. For more information, see "[Metadata syntax for {% data variables.product.prodname_actions %}](/actions/creating-actions/metadata-syntax-for-github-actions)."
6363

64-
65-
**action.yml**
6664
```yaml
6765
name: 'Hello World'
6866
description: 'Greet someone and record the time'
@@ -108,7 +106,7 @@ GitHub Actions provide context information about the webhook event, Git refs, wo
108106

109107
Add a new file called `index.js`, with the following code.
110108

111-
**index.js**
109+
{% raw %}
112110
```javascript
113111
const core = require('@actions/core');
114112
const github = require('@actions/github');
@@ -126,6 +124,7 @@ try {
126124
core.setFailed(error.message);
127125
}
128126
```
127+
{% endraw %}
129128

130129
If an error is thrown in the above `index.js` example, `core.setFailed(error.message);` uses the actions toolkit [`@actions/core`](https://github.com/actions/toolkit/tree/main/packages/core) package to log a message and set a failing exit code. For more information, see "[Setting exit codes for actions](/actions/creating-actions/setting-exit-codes-for-actions)."
131130

@@ -143,7 +142,6 @@ In your `hello-world-javascript-action` directory, create a `README.md` file tha
143142
- Environment variables the action uses.
144143
- An example of how to use your action in a workflow.
145144

146-
**README.md**
147145
```markdown
148146
# Hello world javascript action
149147

@@ -180,7 +178,7 @@ It's best practice to also add a version tag for releases of your action. For mo
180178
```shell
181179
git add action.yml index.js node_modules/* package.json package-lock.json README.md
182180
git commit -m "My first action is ready"
183-
git tag -a -m "My first action release" v1
181+
git tag -a -m "My first action release" v1.1
184182
git push --follow-tags
185183
```
186184

@@ -205,7 +203,7 @@ Checking in your `node_modules` directory can cause problems. As an alternative,
205203
```shell
206204
git add action.yml dist/index.js node_modules/*
207205
git commit -m "Use vercel/ncc"
208-
git tag -a -m "My first action release" v1
206+
git tag -a -m "My first action release" v1.1
209207
git push --follow-tags
210208
```
211209

@@ -217,10 +215,11 @@ Now you're ready to test your action out in a workflow. When an action is in a p
217215

218216
#### Example using a public action
219217

220-
The following workflow code uses the completed hello world action in the `actions/hello-world-javascript-action` repository. Copy the workflow code into a `.github/workflows/main.yml` file, but replace the `actions/hello-world-javascript-action` repository with the repository you created. You can also replace the `who-to-greet` input with your name.
218+
This example demonstrates how your new public action can be run from within an external repository.
219+
220+
Copy the following YAML into a new file at `.github/workflows/main.yml`, and update the `uses: octocat/hello-world-javascript-action@v1.1` line with your username and the name of the public repository you created above. You can also replace the `who-to-greet` input with your name.
221221

222222
{% raw %}
223-
**.github/workflows/main.yml**
224223
```yaml
225224
on: [push]
226225

@@ -231,7 +230,7 @@ jobs:
231230
steps:
232231
- name: Hello world action step
233232
id: hello
234-
uses: actions/hello-world-javascript-action@v1.1
233+
uses: octocat/hello-world-javascript-action@v1.1
235234
with:
236235
who-to-greet: 'Mona the Octocat'
237236
# Use the output from the `hello` step
@@ -240,6 +239,8 @@ jobs:
240239
```
241240
{% endraw %}
242241
242+
When this workflow is triggered, the runner will download the `hello-world-javascript-action` action from your public repository and then execute it.
243+
243244
#### Example using a private action
244245

245246
Copy the workflow code into a `.github/workflows/main.yml` file in your action's repository. You can also replace the `who-to-greet` input with your name.

‎content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,18 @@ For more information about the `pull_request` event, see "[Workflow syntax for {
8181

8282
If you scan pull requests, then the results appear as alerts in a pull request check. For more information, see "[Triaging code scanning alerts in pull requests](/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests)."
8383

84+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
85+
#### Defining the alert severities causing pull request check failure
86+
87+
By default, only alerts with the severity level of `error` will cause a pull request check failure, and a check will still succeed with alerts of lower severities. You can change the levels of alert severities that will cause a pull request check failure in your repository settings.
88+
89+
{% data reusables.repositories.navigate-to-repo %}
90+
{% data reusables.repositories.sidebar-settings %}
91+
{% data reusables.repositories.navigate-to-security-and-analysis %}
92+
1. Under "Code scanning", to the right of "Check Failure", use the drop-down menu to select the level of severity you would like to cause a pull request check failure.
93+
![Check failure setting](/assets/images/help/repository/code-scanning-check-failure-setting.png)
94+
{% endif %}
95+
8496
#### Avoiding unnecessary scans of pull requests
8597

8698
You might want to avoid a code scan being triggered on specific pull requests targeted against the default branch, irrespective of which files have been changed. You can configure this by specifying `on:pull_request:paths-ignore` or `on:pull_request:paths` in the {% data variables.product.prodname_code_scanning %} workflow. For example, if the only changes in a pull request are to files with the file extensions `.md` or `.txt` you can use the following `paths-ignore` array.

‎content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,11 @@ topics:
2727

2828
In repositories where {% data variables.product.prodname_code_scanning %} is configured as a pull request check, {% data variables.product.prodname_code_scanning %} checks the code in the pull request. By default, this is limited to pull requests that target the default branch, but you can change this configuration within {% data variables.product.prodname_actions %} or in a third-party CI/CD system. If merging the changes would introduce new {% data variables.product.prodname_code_scanning %} alerts to the target branch, these are reported as check results in the pull request. The alerts are also shown as annotations in the **Files changed** tab of the pull request. If you have write permission for the repository, you can see any existing {% data variables.product.prodname_code_scanning %} alerts on the **Security** tab. For information about repository alerts, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)."
2929

30-
If {% data variables.product.prodname_code_scanning %} has any results with a severity of `error`, the check fails and the error is reported in the check results. If all the results found by {% data variables.product.prodname_code_scanning %} have lower severities, the alerts are treated as warnings or notices and the check succeeds. If your pull request targets a protected branch that uses {% data variables.product.prodname_code_scanning %}, and the repository owner has configured required status checks, then you must either fix or dismiss all error alerts before the pull request can be merged. For more information, see "[About protected branches](/github/administering-a-repository/about-protected-branches#require-status-checks-before-merging)."
30+
If {% data variables.product.prodname_code_scanning %} has any results with a severity of `error`, the check fails and the error is reported in the check results. If all the results found by {% data variables.product.prodname_code_scanning %} have lower severities, the alerts are treated as warnings or notices and the check succeeds.
31+
32+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}You can override the default behavior in your repository settings, by specifying the level of severities that will cause a pull request check failure. For more information, see "[Defining the alert severities causing pull request check failure](/code-security/secure-coding/configuring-code-scanning#defining-the-alert-severities-causing-pull-request-check-failure)".
33+
34+
{% endif %}If your pull request targets a protected branch that uses {% data variables.product.prodname_code_scanning %}, and the repository owner has configured required status checks, then you must either fix or dismiss all error alerts before the pull request can be merged. For more information, see "[About protected branches](/github/administering-a-repository/about-protected-branches#require-status-checks-before-merging)."
3135

3236
![Failed {% data variables.product.prodname_code_scanning %} check on a pull request](/assets/images/help/repository/code-scanning-check-failure.png)
3337

‎content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ Dependencies ignored by using the `@dependabot ignore` command are stored centra
298298

299299
You can check whether a repository has stored `ignore` preferences by searching the repository for `"@dependabot ignore" in:comments`. If you wish to un-ignore a dependency ignored this way, re-open the pull request.
300300

301-
For more information about the `@dependabot ignore` commands, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates)."
301+
For more information about the `@dependabot ignore` commands, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands)."
302302

303303
##### Specifying dependencies and versions to ignore
304304

‎content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates.md‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,21 @@ By default, {% data variables.product.prodname_dependabot %} automatically rebas
3737

3838
### Managing {% data variables.product.prodname_dependabot %} pull requests with comment commands
3939

40-
{% data variables.product.prodname_dependabot %} responds to simple commands in comments. Each pull request contains details of the commands you can use to process the pull request, for example: to merge, squash, reopen, close, or rebase the pull request. The aim is to make it as easy as possible for you to triage these automatically generated pull requests.
40+
{% data variables.product.prodname_dependabot %} responds to simple commands in comments. Each pull request contains details of the commands you can use to process the pull request (for example: to merge, squash, reopen, close, or rebase the pull request) under the "{% data variables.product.prodname_dependabot %} commands and options" section. The aim is to make it as easy as possible for you to triage these automatically generated pull requests.
41+
42+
You can use any of the following commands on a {% data variables.product.prodname_dependabot %} pull request.
43+
44+
- `@dependabot cancel merge` cancels a previously requested merge.
45+
- `@dependabot close` closes the pull request and prevents {% data variables.product.prodname_dependabot %} from recreating that pull request. You can achieve the same result by closing the pull request manually.
46+
- `@dependabot ignore this dependency` closes the pull request and prevents {% data variables.product.prodname_dependabot %} from creating any more pull requests for this dependency (unless you reopen the pull request or upgrade to the suggested version of the dependency yourself).
47+
- `@dependabot ignore this major version` closes the pull request and prevents {% data variables.product.prodname_dependabot %} from creating any more pull requests for this major version (unless you reopen the pull request or upgrade to this major version yourself).
48+
- `@dependabot ignore this minor version` closes the pull request and prevents {% data variables.product.prodname_dependabot %} from creating any more pull requests for this minor version (unless you reopen the pull request or upgrade to this minor version yourself).
49+
- `@dependabot merge` merges the pull request once your CI tests have passed.
50+
- `@dependabot rebase` rebases the pull request.
51+
- `@dependabot recreate` recreates the pull request, overwriting any edits that have been made to the pull request.
52+
- `@dependabot reopen` reopens the pull request if the pull request is closed.
53+
- `@dependabot squash and merge` squashes and merges the pull request once your CI tests have passed.
54+
55+
{% data variables.product.prodname_dependabot %} will react with a "thumbs up" emoji to acknowledge the command, and may respond with a comment on the pull request. While {% data variables.product.prodname_dependabot %} usually responds quickly, some commands may take several minutes to complete if {% data variables.product.prodname_dependabot %} is busy processing other updates or commands.
4156

4257
If you run any of the commands for ignoring dependencies or versions, {% data variables.product.prodname_dependabot %} stores the preferences for the repository centrally. While this is a quick solution, for repositories with more than one contributor it is better to explicitly define the dependencies and versions to ignore in the configuration file. This makes it easy for all contributors to see why a particular dependency isn't being updated automatically. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore)."

‎content/github/searching-for-information-on-github/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: Searching for information on GitHub
3+
intro: Use different types of searches to find the information you want.
34
redirect_from:
45
- /categories/78/articles/
56
- /categories/search/
@@ -14,4 +15,3 @@ children:
1415
- /getting-started-with-searching-on-github
1516
- /searching-on-github
1617
---
17-

‎data/reusables/gpg/copy-gpg-key-id.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
1. From the list of GPG keys, copy the GPG key ID you'd like to use. In this example, the GPG key ID is `3AA5C34371567BD2`:
1+
1. From the list of GPG keys, copy the long form of the GPG key ID you'd like to use. In this example, the GPG key ID is `3AA5C34371567BD2`:
22
```shell
3-
$ gpg --list-secret-keys --keyid-format LONG
3+
$ gpg --list-secret-keys --keyid-format=long
44
/Users/hubot/.gnupg/secring.gpg
55
------------------------------------
66
sec 4096R/<em>3AA5C34371567BD2</em> 2016-03-10 [expires: 2017-03-10]

‎data/reusables/gpg/list-keys-with-note.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

2-
1. Use the `gpg --list-secret-keys --keyid-format LONG` command to list GPG keys for which you have both a public and private key. A private key is required for signing commits or tags.
2+
1. Use the `gpg --list-secret-keys --keyid-format=long` command to list the long form of the GPG keys for which you have both a public and private key. A private key is required for signing commits or tags.
33
```shell
4-
$ gpg --list-secret-keys --keyid-format LONG
4+
$ gpg --list-secret-keys --keyid-format=long
55
```
66
{% note %}
77

0 commit comments

Comments
 (0)