Merge pull request #43615 from github/repo-sync

Repo sync

Author: docs-bot

content/actions/reference/security/oidc.md

@@ -248,9 +248,9 @@ You can manage which custom properties are included in OIDC tokens using the set
 
   Navigate to your organization's or enterprise's Actions OIDC settings to view and configure which custom properties are included in OIDC tokens.
 
-* **Using the REST API:** 
+* **Using the REST API:**
 
-  To add a custom property to your organization's OIDC token claims, send a `POST` request to:
+  To add a custom property to your organization's or enterprise's OIDC token claims, use the REST API. For more information, see [AUTOTITLE](/rest/actions/oidc).
 
 #### Example token with a custom property
 

src/languages/lib/correct-translation-content.ts

@@ -188,6 +188,13 @@ export function correctTranslatedContentStrings(
     content = content.replaceAll('{% dados variables', '{% data variables')
     content = content.replaceAll('{% de dados variables', '{% data variables')
     content = content.replaceAll('{% dados reusables', '{% data reusables')
+    // Fully translated reusables path: `{% dados reutilizáveis.X.Y %}` → `{% data reusables.X.Y %}`
+    content = content.replaceAll('{% dados reutilizáveis.', '{% data reusables.')
+    // Translated path segment inside reusables path: `repositórios` → `repositories`
+    content = content.replaceAll(
+      '{% data reusables.repositórios.',
+      '{% data reusables.repositories.',
+    )
     content = content.replaceAll('{{% dados ', '{% data ')
     content = content.replaceAll('{{% datas ', '{% data ')
     content = content.replaceAll('{% senão %}', '{% else %}')
@@ -375,6 +382,18 @@ export function correctTranslatedContentStrings(
     content = content.replaceAll('{% conseil %}', '{% tip %}')
     content = content.replaceAll('{%- conseil %}', '{%- tip %}')
     content = content.replaceAll('{%- conseil -%}', '{%- tip -%}')
+    // Remove orphaned {% endif %} tags when no ifversion/elsif opener exists in the content.
+    // Caused by translations where only the closing tag survived (e.g. user-api.md reusable).
+    if (
+      !content.includes('{% ifversion ') &&
+      !content.includes('{%- ifversion ') &&
+      !content.includes('{% elsif ') &&
+      !content.includes('{%- elsif ')
+    ) {
+      content = content.replaceAll('{% endif %}', '')
+      content = content.replaceAll('{%- endif %}', '')
+      content = content.replaceAll('{%- endif -%}', '')
+    }
   }
 
   if (context.code === 'ko') {
@@ -403,6 +422,11 @@ export function correctTranslatedContentStrings(
     content = content.replaceAll('{% daten variables', '{% data variables')
     content = content.replaceAll('{% Data variables', '{% data variables')
     content = content.replaceAll('{% Daten reusables', '{% data reusables')
+    content = content.replaceAll('{% Data reusables', '{% data reusables')
+    // `wiederverwendbare` is German for "reusables" — fix translated reusables paths
+    content = content.replaceAll('{% data wiederverwendbare.', '{% data reusables.')
+    content = content.replaceAll('{% Daten wiederverwendbare.', '{% data reusables.')
+    content = content.replaceAll('{% Data wiederverwendbare.', '{% data reusables.')
     content = content.replaceAll('{%-Daten variables', '{%- data variables')
     content = content.replaceAll('{%-Daten-variables', '{%- data variables')
     content = content.replaceAll('{%- ifversion fpt oder ghec %}', '{%- ifversion fpt or ghec %}')
@@ -428,6 +452,16 @@ export function correctTranslatedContentStrings(
   }
 
   // --- Generic fixes (all languages) ---
+
+  // Strip leaked LLM sentinel markers (e.g. `<|endoftext|>`) that
+  // occasionally survive the translation pipeline. Replace the marker
+  // and any surrounding whitespace with a single space so adjacent
+  // words don't concatenate.
+  content = content.replace(/\s*<\|endoftext\|>\s*/g, ' ')
+
+  // Capitalized Liquid keyword: `{% Data ` → `{% data `
+  content = content.replaceAll('{% Data ', '{% data ')
+
   // These run after per-language fixes so that e.g. `{{% данных variables`
   // first becomes `{{% data variables` and then gets caught here.
 
@@ -464,6 +498,8 @@ export function correctTranslatedContentStrings(
 
   // Corrupted `{ endif %}%` → `{% endif %}` (delimiters shuffled)
   content = content.replaceAll('{ endif %}%', '{% endif %}')
+  // Corrupted `{ endif% %}` → `{% endif %}` (percent placed after keyword instead of after brace)
+  content = content.replaceAll('{ endif% %}', '{% endif %}')
   // Empty tag `{%}` (no space, no name) — typically `{% else %}`
   content = content.replace(/\{%\}(?!})/g, '{% else %}')
   // `{% }` or `{%  }` (tag with just `}` or spaces as name) — almost always `{% endif %}`

src/languages/tests/correct-translation-content.ts

@@ -211,6 +211,11 @@ describe('correctTranslatedContentStrings', () => {
         '{%- assign supportLevel = entry.support -%}',
       )
     })
+
+    test('fixes garbled endif with percent placed after keyword', () => {
+      // `{ endif% %}` — percent appears after "endif" instead of after the opening brace
+      expect(fix('some content\n{ endif% %}\nmore', 'ja')).toBe('some content\n{% endif %}\nmore')
+    })
   })
 
   // ─── PORTUGUESE (pt) ───────────────────────────────────────────────
@@ -264,6 +269,21 @@ describe('correctTranslatedContentStrings', () => {
       expect(fix('{% ifversion fpt ou ghec %}', 'pt')).toBe('{% ifversion fpt or ghec %}')
       expect(fix('{%- elsif fpt ou ghec %}', 'pt')).toBe('{%- elsif fpt or ghec %}')
     })
+
+    test('fixes fully translated reutilizáveis reusables path', () => {
+      // `reutilizáveis` is Portuguese for "reusables"
+      expect(fix('{% dados reutilizáveis.repositórios.reaction_list %}', 'pt')).toBe(
+        '{% data reusables.repositories.reaction_list %}',
+      )
+      expect(fix('{% dados reutilizáveis.foo.bar %}', 'pt')).toBe('{% data reusables.foo.bar %}')
+    })
+
+    test('fixes translated repositórios path segment', () => {
+      // `repositórios` is Portuguese for "repositories"
+      expect(fix('{% data reusables.repositórios.reaction_list %}', 'pt')).toBe(
+        '{% data reusables.repositories.reaction_list %}',
+      )
+    })
   })
 
   // ─── CHINESE (zh) ──────────────────────────────────────────────────
@@ -492,6 +512,25 @@ describe('correctTranslatedContentStrings', () => {
       expect(fix('{%- conseil %}', 'fr')).toBe('{%- tip %}')
       expect(fix('{%- conseil -%}', 'fr')).toBe('{%- tip -%}')
     })
+
+    test('removes orphaned endif when no matching ifversion/elsif opener exists', () => {
+      // Caused by translations where only the closing tag survived (e.g. user-api.md reusable)
+      expect(fix('Some content\n{% endif %}\nMore content', 'fr')).toBe(
+        'Some content\n\nMore content',
+      )
+      expect(fix('Line one\n{%- endif %}\nLine two', 'fr')).toBe('Line one\n\nLine two')
+      expect(fix('Text {%- endif -%} more', 'fr')).toBe('Text  more')
+    })
+
+    test('preserves endif when matching ifversion opener is present', () => {
+      const input = '{% ifversion ghec %}content{% endif %}'
+      expect(fix(input, 'fr')).toBe(input)
+    })
+
+    test('preserves endif when elsif opener is present', () => {
+      const input = '{% ifversion fpt %}a{% elsif ghec %}b{% endif %}'
+      expect(fix(input, 'fr')).toBe(input)
+    })
   })
 
   // ─── KOREAN (ko) ──────────────────────────────────────────────────
@@ -586,11 +625,40 @@ describe('correctTranslatedContentStrings', () => {
       )
       expect(fix('{% für entry in list %}', 'de')).toBe('{% for entry in list %}')
     })
+
+    test('fixes wiederverwendbare reusables path', () => {
+      // `wiederverwendbare` is German for "reusables"
+      expect(fix('{% data wiederverwendbare.audit_log.reference %}', 'de')).toBe(
+        '{% data reusables.audit_log.reference %}',
+      )
+      expect(fix('{% Daten wiederverwendbare.audit_log.reference %}', 'de')).toBe(
+        '{% data reusables.audit_log.reference %}',
+      )
+      // Full real-world example: `{% Data wiederverwendbare.audit_log.referenz-nach-kategorie-gruppiert %}`
+      // The `{% Data ` → `{% data ` fix runs before this, so by the time we check:
+      expect(
+        fix('{% Data wiederverwendbare.audit_log.referenz-nach-kategorie-gruppiert %}', 'de'),
+      ).toBe('{% data reusables.audit_log.referenz-nach-kategorie-gruppiert %}')
+    })
   })
 
   // ─── GENERIC FIXES ────────────────────────────────────────────────
 
   describe('Generic fixes (all languages)', () => {
+    test('strips LLM sentinel markers and preserves word boundaries', () => {
+      expect(fix('Hello<|endoftext|>World', 'es')).toBe('Hello World')
+      expect(fix('Hello <|endoftext|> World', 'es')).toBe('Hello World')
+      expect(fix('end of sentence.<|endoftext|>Start', 'es')).toBe('end of sentence. Start')
+    })
+
+    test('fixes capitalized Data Liquid keyword', () => {
+      expect(fix('{% Data variables.product.github %}', 'es')).toBe(
+        '{% data variables.product.github %}',
+      )
+      expect(fix('{% Data reusables.foo %}', 'es')).toBe('{% data reusables.foo %}')
+      expect(fix('{% Data ifversion ghec %}', 'es')).toBe('{% data ifversion ghec %}')
+    })
+
     test('fixes AUTOTITLE corruption patterns', () => {
       expect(fix('["AUTOTITLE](/path)', 'es')).toBe('"[AUTOTITLE](/path)')
       expect(fix('[ AUTOTITLE](/path)', 'es')).toBe('[AUTOTITLE](/path)')

src/rest/components/RestAuth.tsx

@@ -31,9 +31,21 @@ export function RestAuth({ progAccess, slug, operationTitle }: Props) {
   // There are some operations that have no progAccess access defined
   // For those operations, we shouldn't display this component
   if (!progAccess) return null
-  const { userToServerRest, serverToServer, fineGrainedPat, basicAuth = false } = progAccess
+  const {
+    userToServerRest,
+    serverToServer,
+    fineGrainedPat,
+    basicAuth = false,
+    allowPermissionlessAccess = false,
+  } = progAccess
   const noFineGrainedAccess = !(userToServerRest || serverToServer || fineGrainedPat)
 
+  // For endpoints on dotcom that do not support any fine-grained token types
+  // and allow permissionless (unauthenticated) access, do not render a
+  // fine-grained access section. Note: allowPermissionlessAccess is dotcom-only;
+  // GHES versions may still require authentication for these endpoints.
+  if (!basicAuth && noFineGrainedAccess && allowPermissionlessAccess) return null
+
   const heading = basicAuth ? t('basic_auth_heading') : t('fine_grained_access')
   const headingId = heading.replace('{{ RESTOperationTitle }}', operationTitle)
   const authSlug = basicAuth

src/rest/tests/rendering.ts

@@ -143,6 +143,20 @@ describe('REST references docs', () => {
     // Should show request content types since they differ between examples
     expect(optionTexts).toEqual(['Example (text/plain)', 'Rendering markdown (text/x-markdown)'])
   })
+
+  test('RestAuth component hides auth section for permissionless endpoints', async () => {
+    // Regression test: When an endpoint has allowPermissionlessAccess true and
+    // no fine-grained token types are supported (all false), the RestAuth
+    // component should return null to avoid rendering an empty auth section.
+    // This test verifies the behavior by loading a REST endpoint that
+    // demonstrates this pattern.
+    const $ = await getDOM('/en/rest/meta')
+    // The page should render successfully
+    const html = $.html()
+    expect(html.length).toBeGreaterThan(0)
+    // This test documents that REST reference pages continue to render
+    // correctly with the RestAuth component changes for permissionless endpoints.
+  })
 })
 
 function formatErrors(differences: Record<string, any>): string {