Add more guardrails for low-value PRs (#62947)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/triage-unallowed-contributions.yml

@@ -40,13 +40,13 @@ jobs:
           filters: 'src/workflows/unallowed-contribution-filters.yml'
 
       - name: Set up Node and dependencies
-        if: ${{ steps.filter.outputs.notAllowed || steps.filter.outputs.contentTypes}}
+        if: ${{ steps.filter.outputs.notAllowed == 'true' || steps.filter.outputs.contentTypes == 'true' }}
         uses: ./.github/actions/node-npm-setup
 
       # When there are changes to files we can't accept, leave a comment
-      # explaining this to the PR author
+      # explaining this to the PR author, and why their PR will close
       - name: "Comment about changes we can't accept"
-        if: ${{ steps.filter.outputs.notAllowed || steps.filter.outputs.contentTypes}}
+        if: ${{ steps.filter.outputs.notAllowed == 'true' || steps.filter.outputs.contentTypes == 'true' }}
         run: npm run unallowed-contributions
         env:
           REPO_OWNER_AND_NAME: ${{ github.repository }}

src/workflows/unallowed-contribution-filters.yml

@@ -1,11 +1,10 @@
 notAllowed:
+  - '*'
   - '.devcontainer/**'
   - '.github/**'
   - 'data/reusables/rai/**'
-  - 'Dockerfile*'
   - 'src/**'
-  - 'package*.json'
-  - 'content/actions/how-tos/security-for-github-actions/security-hardening-your-deployments/**'
+  - 'content/actions/how-tos/secure-your-work/security-harden-deployments/**'
 contentTypes:
   - 'content/**'
 # allows getting a list of just added files from the dorny/paths-filter action

src/workflows/unallowed-contributions.ts

@@ -46,12 +46,24 @@ async function main() {
   const listUnallowedChangedFiles = unallowedChangedFiles.map((file) => `\n - ${file}`).join('')
   const listUnallowedFiles = filters.notAllowed.map((file: string) => `\n - ${file}`).join('')
 
-  const reviewMessage = `👋 Hey there spelunker. It looks like you've modified some files that we can't accept as contributions:${listUnallowedChangedFiles}\n\nYou'll need to revert all of the files you changed that match that list using [GitHub Desktop](https://docs.github.com/en/free-pro-team@latest/desktop/contributing-and-collaborating-using-github-desktop/managing-commits/reverting-a-commit-in-github-desktop) or \`git checkout origin/main <file name>\`. Once you get those files reverted, we can continue with the review process. :octocat:\n\nThe complete list of files we can't accept are:${listUnallowedFiles}\n\nWe also can't accept contributions to files in the content directory with frontmatter \`contentType: rai\`.`
+  const reviewMessage = `👋 Hi there! It looks like you've modified some files that we can't accept as contributions:${listUnallowedChangedFiles}\n\nYou'll need to raise a new PR that doesn't include those files, before we can review.\n\nThe complete list of files we can't accept are:${listUnallowedFiles}\n\nWe also can't accept contributions to files in the content directory with frontmatter \`contentType: rai\`. You can always check out our full [contribution guidelines](https://docs.github.com/en/contributing).`
 
   let workflowFailMessage =
     "It looks like you've modified some files that we can't accept as contributions."
   let createdComment
 
+  // Add the `invalid` label so the PR gets closed
+  try {
+    await octokit.rest.issues.addLabels({
+      owner,
+      repo,
+      issue_number: Number(PR_NUMBER || ''),
+      labels: ['invalid'],
+    })
+  } catch (err) {
+    console.log('Error adding the `invalid` label.', err)
+  }
+
   try {
     createdComment = await octokit.rest.issues.createComment({
       owner,