[pull] main from mdn:main

.github/CODEOWNERS

@@ -8,41 +8,36 @@
 # Default content owners
 /files/en-us/ @mdn/yari-content-mdn
 
+# MDN Firefox release notes
+/files/en-us/mozilla/ @mdn/core-yari-content
+
+# Mozilla Add-ons
+/files/en-us/mozilla/add-ons/ @mdn/yari-content-mozilla-add-ons
+
 # Accessibility
 /files/en-us/web/accessibility/ @mdn/yari-content-accessibility
-/files/en-us/learn/accessibility/ @mdn/yari-content-accessibility
+
+# Web API
+/files/en-us/web/api/ @mdn/yari-content-web-api
 
 # CSS
 /files/en-us/web/css/ @mdn/yari-content-css
-/files/en-us/learn/css/ @mdn/yari-content-css
 
 # HTML
 /files/en-us/web/html/ @mdn/yari-content-html
-/files/en-us/learn/html/ @mdn/yari-content-html
-
-# JavaScript
-/files/en-us/web/javascript/ @mdn/yari-content-javascript
-/files/en-us/learn/javascript/ @mdn/yari-content-javascript
 
 # HTTP
 /files/en-us/web/http/ @mdn/yari-content-http
-/files/en-us/learn/server-side/ @mdn/yari-content-http
 
-# Web API
-/files/en-us/web/api/ @mdn/yari-content-web-api
-
-# Mozilla Add-ons
-/files/en-us/mozilla/add-ons/ @mdn/yari-content-mozilla-add-ons
+# JavaScript
+/files/en-us/web/javascript/ @mdn/yari-content-javascript
 
 # MathML
 /files/en-us/web/mathml/ @mdn/content-mathml
 
-# MDN Firefox Release Notes
-/files/en-us/mozilla/firefox @mdn/core-yari-content
-
-# New templates and sidebars
+# Templates and sidebars (rari)
 /files/jsondata/L10n-Template.json @mdn/core-dev
-/files/sidebars @mdn/core-dev
+/files/sidebars/ @mdn/core-dev
 
 # ============================= CONTROL FILES ============================= #
 # The CODEOWNERS file must end with these matches: Any pull request changing

.github/issue-regex-labeler.yml

@@ -19,27 +19,29 @@ Content:HTTP:
 Content:JS:
   - '\/docs\/Web\/JavaScript'
 Content:Learn:
-  - '\/docs\/Learn\/(Common|Front|Getting|Learning|Performance)'
-Content:Learn:Accessibility:
-  - '\/docs\/Learn\/Accessibility'
-Content:Learn:Client-side:
-  - '\/docs\/Learn\/Tools_and_testing\/(Client-side|Understanding_client-side)'
-Content:Learn:Cross-Browser-Testing:
-  - '\/docs\/Learn\/Tools_and_testing\/Cross_browser_testing'
-Content:Learn:CSS:
-  - '\/docs\/Learn\/CSS'
-Content:Learn:Django:
-  - '\/docs\/Learn\/Server-side\/Django'
-Content:Learn:Express:
-  - '\/docs\/Learn\/Server-side\/Express_Nodejs'
-Content:Learn:Forms:
-  - '\/docs\/Learn\/Forms'
-Content:Learn:GitHub:
-  - '\/docs\/Learn\/Tools_and_testing\/GitHub'
-Content:Learn:HTML:
-  - '\/docs\/Learn\/HTML'
-Content:Learn:JavaScript:
-  - '\/docs\/Learn\/JavaScript'
+  - '\/docs\/Learn_web_development\/'
+# Mapping for old directories, see https://github.com/mdn/content/pull/36967
+#
+# Content:Learn:Accessibility:
+#   - '\/docs\/Learn\/Accessibility'
+# Content:Learn:Client-side:
+#   - '\/docs\/Learn\/Tools_and_testing\/(Client-side|Understanding_client-side)'
+# Content:Learn:Cross-Browser-Testing:
+#   - '\/docs\/Learn\/Tools_and_testing\/Cross_browser_testing'
+# Content:Learn:CSS:
+#   - '\/docs\/Learn\/CSS'
+# Content:Learn:Django:
+#   - '\/docs\/Learn\/Server-side\/Django'
+# Content:Learn:Express:
+#   - '\/docs\/Learn\/Server-side\/Express_Nodejs'
+# Content:Learn:Forms:
+#   - '\/docs\/Learn\/Forms'
+# Content:Learn:GitHub:
+#   - '\/docs\/Learn\/Tools_and_testing\/GitHub'
+# Content:Learn:HTML:
+#   - '\/docs\/Learn\/HTML'
+# Content:Learn:JavaScript:
+#   - '\/docs\/Learn\/JavaScript'
 Content:Manifest:
   - '\/docs\/Web\/Manifest'
 Content:MathML:

.github/labeler.yml

@@ -57,62 +57,53 @@ Content:JS:
 Content:Learn:
   - changed-files:
       - all-globs-to-any-file:
-          - files/en-us/learn/**
-          - "!files/en-us/learn/accessibility/**"
-          - "!files/en-us/learn/tools_and_testing/client-side_javascript_frameworks/**"
-          - "!files/en-us/learn/tools_and_testing/understanding_client-side_tools/**"
-          - "!files/en-us/learn/tools_and_testing/cross_browser_testing/**"
-          - "!files/en-us/learn/css/**"
-          - "!files/en-us/learn/server-side/django/**"
-          - "!files/en-us/learn/server-side/express_nodejs/**"
-          - "!files/en-us/learn/forms/**"
-          - "!files/en-us/learn/tools_and_testing/github/**"
-          - "!files/en-us/learn/html/**"
-          - "!files/en-us/learn/javascript/**"
+          - files/en-us/learn_web_development/**
   - changed-files:
       - any-glob-to-any-file:
           - files/en-us/web/tutorials/**
-Content:Learn:Accessibility:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/accessibility/**
-Content:Learn:Client-side:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/tools_and_testing/client-side_javascript_frameworks/**
-          - files/en-us/learn/tools_and_testing/understanding_client-side_tools/**
-Content:Learn:Cross-Browser-Testing:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/tools_and_testing/cross_browser_testing/**
-Content:Learn:CSS:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/css/**
-Content:Learn:Django:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/server-side/django/**
-Content:Learn:Express:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/server-side/express_nodejs/**
-Content:Learn:Forms:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/forms/**
-Content:Learn:GitHub:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/tools_and_testing/github/**
-Content:Learn:HTML:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/html/**
-Content:Learn:JavaScript:
-  - changed-files:
-      - any-glob-to-any-file:
-          - files/en-us/learn/javascript/**
+# Mapping for old directories, see https://github.com/mdn/content/pull/36967
+#
+# Content:Learn:Accessibility:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/accessibility/**
+# Content:Learn:Client-side:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/tools_and_testing/client-side_javascript_frameworks/**
+#           - files/en-us/learn/tools_and_testing/understanding_client-side_tools/**
+# Content:Learn:Cross-Browser-Testing:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/tools_and_testing/cross_browser_testing/**
+# Content:Learn:CSS:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/css/**
+# Content:Learn:Django:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/server-side/django/**
+# Content:Learn:Express:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/server-side/express_nodejs/**
+# Content:Learn:Forms:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/forms/**
+# Content:Learn:GitHub:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/tools_and_testing/github/**
+# Content:Learn:HTML:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/html/**
+# Content:Learn:JavaScript:
+#   - changed-files:
+#       - any-glob-to-any-file:
+#           - files/en-us/learn/javascript/**
 Content:Manifest:
   - changed-files:
       - any-glob-to-any-file:
@@ -170,7 +161,6 @@ Content:Other:
   - changed-files:
       - any-glob-to-any-file:
           - files/en-us/related/**
-          - files/en-us/web/demos/**
           - files/en-us/web/exslt/**
           - files/en-us/web/opensearch/**
           - files/en-us/web/privacy/**

.github/workflows/auto-cleanup-bot.yml

@@ -5,6 +5,10 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+# No GITHUB_TOKEN permissions, as we only use it to increase API limit.
+# We use AUTOMERGE_TOKEN to create the PR.
+permissions: {}
+
 jobs:
   fix:
     if: github.repository == 'mdn/content'
@@ -35,7 +39,7 @@ jobs:
 
       - name: Create PR with only fixable issues
         if: success()
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
         with:
           commit-message: "chore: auto-fix Markdownlint, Prettier, and front-matter issues"
           branch: markdownlint-auto-cleanup
@@ -50,7 +54,7 @@ jobs:
 
       - name: Create PR with notice on unfixed issues
         if: failure()
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
         with:
           commit-message: "chore: auto-fix Markdownlint, Prettier, and front-matter issues"
           branch: markdownlint-auto-cleanup

.github/workflows/auto-merge.yml

@@ -3,12 +3,15 @@ name: auto-merge
 on:
   pull_request_target:
 
+# No GITHUB_TOKEN permissions, as we use AUTOMERGE_TOKEN instead.
+permissions: {}
+
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
-      - uses: ahmadnassri/action-dependabot-auto-merge@v2.6
+      - uses: ahmadnassri/action-dependabot-auto-merge@45fc124d949b19b6b8bf6645b6c9d55f4f9ac61a # v2.6.6
         with:
           github-token: ${{ secrets.AUTOMERGE_TOKEN }}
           command: "squash and merge"

.github/workflows/idle-issues.yml

@@ -3,6 +3,12 @@ on:
   schedule:
     - cron: "49 11,23 * * *"
 
+permissions:
+  # Label issues.
+  issues: write
+  # Label pull requests.
+  pull-requests: write
+
 jobs:
   idle:
     uses: mdn/workflows/.github/workflows/idle.yml@main

.github/workflows/interfacedata-updater.yml

@@ -6,6 +6,9 @@ on:
     - cron: "0 0 * * 6"
   workflow_dispatch:
 
+# No GITHUB_TOKEN permissions, as we use AUTOMERGE_TOKEN instead.
+permissions: {}
+
 jobs:
   update:
     if: github.repository == 'mdn/content'
@@ -35,7 +38,7 @@ jobs:
         run: node scripts/update-interface-data.js ../webref/
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
         with:
           path: mdn-content
           token: ${{ secrets.AUTOMERGE_TOKEN }}

.github/workflows/issue-regex-labeler.yml

@@ -3,6 +3,10 @@ on:
   issues:
     types: [opened]
 
+permissions:
+  # Label issues.
+  issues: write
+
 jobs:
   issue-labeler:
     runs-on: ubuntu-latest

.github/workflows/lock-closed.yml

@@ -3,6 +3,14 @@ on:
   schedule:
     - cron: "0 9 1 * *"
 
+permissions:
+  # Lock discussions.
+  discussions: write
+  # Lock issues.
+  issues: write
+  # Lock pull requests.
+  pull-requests: write
+
 jobs:
   lock:
     uses: mdn/workflows/.github/workflows/lock-closed.yml@main

.github/workflows/markdown-lint.yml

@@ -13,6 +13,9 @@ on:
       - .github/workflows/markdown-lint.yml
       - .github/workflows/markdownlint-problem-matcher.json
 
+# No GITHUB_TOKEN permissions, as we only use it to increase API limit.
+permissions: {}
+
 jobs:
   docs:
     runs-on: ubuntu-latest

.github/workflows/new-issues.yml

@@ -6,12 +6,16 @@ on:
       - reopened
       - opened
 
+permissions:
+  # Label issues.
+  issues: write
+
 jobs:
   label-new-issues:
     runs-on: ubuntu-latest
     steps:
       - name: initial labelling
-        uses: andymckay/labeler@master
+        uses: andymckay/labeler@3a4296e9dcdf9576b0456050db78cfd34853f260 # master
         with:
           add-labels: "needs triage"
           ignore-if-assigned: true

.github/workflows/ping-other-repos.yml

@@ -11,6 +11,10 @@ name: Ping other repos
 on:
   push:
     branches: [main]
+
+# No GITHUB_TOKEN permissions, as we use REPO_PINGER_MDN_SPEC_LINKS.
+permissions: {}
+
 jobs:
   ping:
     # Don't run in forks, or when Dependabot merges a PR.
@@ -22,7 +26,7 @@ jobs:
       - name: Ping w3c/mdn-spec-links
         # This is one of many possible repos we can ping. When adding other
         # repos, you can follow this w3c/mdn-spec-links one as an example.
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
         with:
           token: ${{ secrets.REPO_PINGER_MDN_SPEC_LINKS }}
           repository: w3c/mdn-spec-links