Merge branch 'main' into datalist-types

Author: caugner

.github/CODEOWNERS

@@ -6,4 +6,19 @@
 # https://docs.github.com/en/free-pro-team@latest/github/creating-cloning-and-archiving-repositories/about-code-owners
 
 /schemas/ @mdn/bcd-owners
-/.github/workflows/ @mdn/core-dev
+
+/.github/ @mdn/engineering
+/.vscode/ @mdn/engineering
+/lint/    @mdn/engineering
+/scripts/ @mdn/engineering
+/types/   @mdn/engineering
+/utils/   @mdn/engineering
+/*        @mdn/engineering
+/package.json      @mdn/engineering @mdn-bot @mdn/bcd-releasers
+/package-lock.json @mdn/engineering @mdn-bot @mdn/bcd-releasers
+/SECURITY.md @mdn/engineering
+
+# Exclude some paths
+/.github/ISSUE_TEMPLATE/
+/.github/PULL_REQUESET_TEMPLATE.md
+/*.md

.github/dependabot.yml

@@ -1,17 +1,27 @@
 version: 2
 updates:
   - package-ecosystem: npm
-    directory: "/"
+    directory: /
     schedule:
       interval: daily
       time: "11:00"
-    open-pull-requests-limit: 10
-    labels:
-      - "infra"
-      - "dependencies"
-  - package-ecosystem: "github-actions"
-    directory: "/"
+    groups:
+      npm:
+        update-types:
+          - minor
+          - patch
+        exclude-patterns:
+          - "@ddbeck/mdn-content-inventory"
+          - web-features
+          - web-specs
+    commit-message:
+      prefix: chore
+      include: scope
+
+  - package-ecosystem: github-actions
+    directory: /
     schedule:
-      interval: "daily"
-    labels:
-      - "infra"
+      interval: weekly
+    commit-message:
+      prefix: ci
+      include: scope

.github/labeler.yml

@@ -36,6 +36,10 @@ data:mathml:
   - changed-files:
       - any-glob-to-any-file:
           - "mathml/**"
+data:mediatypes:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "mediatypes/**"
 data:svg:
   - changed-files:
       - any-glob-to-any-file:

.github/workflows/add-push-artifacts.yml

@@ -11,23 +11,23 @@ jobs:
     name: Enumerate and diff features
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0 # get the full repository checkout, not just the inciting commit
           persist-credentials: false
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version-file: ".nvmrc"
           cache: npm
           package-manager-cache: true
       - run: npm ci
       - run: npx tsx ./scripts/enumerate-features.ts features.json
       - run: npx tsx ./scripts/diff-features.ts --no-github --format=json > features.diff.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: enumerate-features
           path: features.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: diff-features
           path: features.diff.json

.github/workflows/auto-merge.yml

@@ -5,14 +5,26 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  pull-requests: write
+# No GITHUB_TOKEN permissions, because we use GH_TOKEN instead.
+permissions: {}
 
 jobs:
   auto-merge:
-    uses: mdn/workflows/.github/workflows/auto-merge.yml@main
-    with:
-      target-repo: "mdn/browser-compat-data"
-    secrets:
-      GH_TOKEN: ${{ secrets.GH_TOKEN }}
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+
+    steps:
+      - name: Dependabot metadata
+        id: dependabot-metadata
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
+        with:
+          github-token: ${{ secrets.GH_TOKEN }}
+
+      - name: Squash and merge
+
+        if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor' && !startsWith(steps.dependabot-metadata.outputs.previous-version, '0.') || steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' && !startsWith(steps.dependabot-metadata.outputs.previous-version, '0.0.') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+        run: |
+          gh pr review ${{ github.event.pull_request.html_url }} --approve
+          gh pr merge ${{ github.event.pull_request.html_url }} --auto --squash

.github/workflows/close-incomplete-issues.yml

@@ -11,7 +11,7 @@ jobs:
   close-issues-if-invalid:
     runs-on: ubuntu-latest
     steps:
-      - uses: queengooborg/invalid-issue-closer@43bf1ddff3e83d208b77a3e364f7b5e22f6a9657 # v1.6.0
+      - uses: queengooborg/invalid-issue-closer@a76c4a636b1346d4554befcadd45eb0f23283580 # v1.6.1
         id: blank-body-check
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -21,7 +21,7 @@ jobs:
             This issue has been identified as spam and has been automatically closed and locked.  Do not use this repository for posting spam.
           normalize-newlines: true
           body-is-blank: true
-      - uses: queengooborg/invalid-issue-closer@43bf1ddff3e83d208b77a3e364f7b5e22f6a9657 # v1.6.0
+      - uses: queengooborg/invalid-issue-closer@a76c4a636b1346d4554befcadd45eb0f23283580 # v1.6.1
         if: steps.blank-body-check.outputs.was-closed == 'false'
         id: spam-check
         with:
@@ -33,7 +33,7 @@ jobs:
             If you believe this issue was incorrectly classified as spam, please comment below.  A maintainer will review, and reopen if necessary.
           normalize-newlines: true
           is-spammy: true
-      - uses: queengooborg/invalid-issue-closer@43bf1ddff3e83d208b77a3e364f7b5e22f6a9657 # v1.6.0
+      - uses: queengooborg/invalid-issue-closer@a76c4a636b1346d4554befcadd45eb0f23283580 # v1.6.1
         if: steps.spam-check.outputs.was-closed == 'false'
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/issue-regex-labeler.yml

@@ -12,7 +12,7 @@ jobs:
   issue-labeler:
     runs-on: ubuntu-latest
     steps:
-      - uses: github/issue-labeler@v3.4
+      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
         with:
           configuration-path: .github/issue-regex-labeler.yml
           enable-versioned-regex: 0

.github/workflows/labeler.yml

@@ -11,13 +11,13 @@ jobs:
   label-py-path:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           sync-labels: true
 
   label-by-size:
-    if: github.actor != 'dependabot[bot]' && !startsWith(github.event.pull_request.title, 'Release v')
+    if: github.secret_source == 'Actions' && !startsWith(github.event.pull_request.title, 'Release v')
     needs: label-py-path
     runs-on: ubuntu-latest
     steps: