Merge remote-tracking branch 'origin/main' into new-grid-based-interactive-layout

# Conflicts:
#	dotcom-rendering/src/layouts/InteractiveLayout.tsx

Co-authored-by: frederickobrien <11380557+frederickobrien@users.noreply.github.com>

Author: Copilot

.github/workflows/ab-testing-ci.yml

@@ -20,7 +20,7 @@ jobs:
       run:
         working-directory: ab-testing
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Node environment
         uses: ./.github/actions/setup-node-env
@@ -42,7 +42,7 @@ jobs:
       FASTLY_API_TOKEN: ${{ secrets.FASTLY_PROD_API_TOKEN }}
     needs: [ab-testing-checks]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Node environment
         uses: ./.github/actions/setup-node-env
@@ -68,7 +68,7 @@ jobs:
       contents: read
     needs: [ab-testing-checks]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Node environment
         uses: ./.github/actions/setup-node-env
@@ -93,7 +93,7 @@ jobs:
       contents: read
     needs: [ab-testing-checks]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Node environment
         uses: ./.github/actions/setup-node-env
@@ -123,7 +123,7 @@ jobs:
       contents: read
     needs: [ab-testing-checks]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Node environment
         uses: ./.github/actions/setup-node-env
@@ -157,7 +157,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -196,7 +196,7 @@ jobs:
         run: pnpm  --filter @guardian/ab-testing-cdk synth
 
       - name: Riff-Raff Upload
-        uses: guardian/actions-riff-raff@v4.3.4
+        uses: guardian/actions-riff-raff@v4.3.6
         with:
           roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
           githubToken: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-check.yml

@@ -2,7 +2,7 @@ name: DCR Build Check
 on:
   merge_group:
     types: [checks_requested]
-  push:
+  pull_request:
     paths-ignore:
       - 'dotcom-rendering/docs/**'
 
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node environment
         uses: ./.github/actions/setup-node-env

.github/workflows/bundle-analyser.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node environment
         uses: ./.github/actions/setup-node-env

.github/workflows/check-chromatic-paths.yml

@@ -18,10 +18,10 @@ jobs:
     outputs:
       relevant: ${{ steps.filter.outputs.relevant }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
         id: filter
         with:
           # Only run Chromatic if files that affect visual rendering have changed.

.github/workflows/check-islands.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node environment
         uses: ./.github/actions/setup-node-env

.github/workflows/cicd.yml

@@ -23,19 +23,24 @@ jobs:
       production-image-digest: ${{ needs.production-container.outputs.imageDigest }}
 
   prettier:
+    if: github.ref != 'refs/heads/main'
     uses: ./.github/workflows/prettier.yml
 
   jest:
+    if: github.ref != 'refs/heads/main'
     uses: ./.github/workflows/jest.yml
 
   lint:
+    if: github.ref != 'refs/heads/main'
     uses: ./.github/workflows/lint.yml
 
   islands:
+    if: github.ref != 'refs/heads/main'
     uses: ./.github/workflows/check-islands.yml
 
   playwright:
     needs: [container]
+    if: github.ref != 'refs/heads/main'
     uses: ./.github/workflows/playwright.yml
     with:
       container-image: ${{ needs.container.outputs.container-image }}
@@ -46,7 +51,16 @@ jobs:
       contents: read
       pull-requests: write # required by riff-raff action
     needs: [container, islands, prettier, jest, lint, playwright]
-    if: github.event_name == 'push' # We don't need a riff-raff deployment for merge_group events
+    # We don't need a riff-raff deployment for merge_group events.
+    # `!cancelled()` forces this job to be evaluated even when some of the
+    # `needs` jobs are skipped (the checks are skipped on push to main), and
+    # `!contains(needs.*.result, 'failure')` still blocks publish if any needed
+    # job actually failed. Without a status-check function here, a skipped
+    # dependency would cause this job to be skipped as well.
+    if: >-
+      !cancelled() &&
+      !contains(needs.*.result, 'failure') &&
+      github.event_name == 'push'
     uses: ./.github/workflows/publish.yml
     with:
       container-image: ${{ needs.container.outputs.container-image }}

.github/workflows/container-production.yml

@@ -21,7 +21,8 @@ jobs:
         id: get-build-facts
 
   build-production-image:
-    runs-on: ubuntu-latest
+    # ECS tasks run on ARM, so we use the arm runner to natively build the containaer image (rather than rely on emulation)
+    runs-on: ubuntu-24.04-arm
     needs:
       - facts
     permissions:
@@ -30,12 +31,12 @@ jobs:
     outputs:
       imageDigest: ${{ steps.publish-image.outputs.imageDigest }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
       - name: Add commit hash for PRout
         working-directory: dotcom-rendering
         run: echo 'export const GIT_COMMIT_HASH = "${{ needs.facts.outputs.commitSha }}";' > src/server/prout.ts
       - name: Build image
-        run: docker buildx build -f Production.dockerfile -t ${{ github.repository }}:latest .
+        run: docker buildx build --platform linux/arm64 -f Production.dockerfile -t ${{ github.repository }}:latest .
       - name: Publish Image
         uses: guardian/actions-publish-image@v0.0.2
         id: publish-image

.github/workflows/container.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node environment
         uses: ./.github/actions/setup-node-env

.github/workflows/dcr-chromatic.yml

@@ -3,8 +3,6 @@ name: DCR Chromatic 👓
 on:
   merge_group:
     types: [checks_requested]
-  push:
-    branches: [main]
   pull_request:
     types: [opened, labeled, synchronize]
 
@@ -21,24 +19,26 @@ jobs:
     # reported. When skipping, Chromatic posts a passing status without building Storybook.
     steps:
       - name: Checkout - On Pull Request
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         if: ${{ github.event_name == 'pull_request'}}
         with:
           fetch-depth: 0
           # By default the pull_request event will run on a ephermeral merge commit which simulates a merge between the pull request
           # and the target branch. This can cause issues with Chromatic https://www.chromatic.com/docs/turbosnap#github-pullrequest-triggers
           # Hopefully by checking out the HEAD commit of a PR instead of the merge commit we can avoid some of those issues.
-          ref: ${{ github.event.pull_request.head.sha }}
+          # We fallback to github.sha in case the workflow is triggered by a merge_group event, which doesn't have a pull_request object, see https://www.chromatic.com/docs/faq/merge-queue-ref/
+          ref: ${{ github.event.pull_request.head.ref || github.sha }}
+
       - name: Checkout - On Push Event
-        uses: actions/checkout@v6
-        if: ${{ github.event_name == 'push' || github.event_name == 'merge_group' }}
+        uses: actions/checkout@v7
+        if: ${{ github.event_name == 'merge_group' }}
         with:
           fetch-depth: 0
 
       - name: Set up Node environment
         # Only needed for a full Chromatic run.
         if: |
-          (github.event_name == 'push' || github.event_name == 'merge_group') ||
+          github.event_name == 'merge_group' ||
           (github.event_name == 'pull_request' &&
             contains(github.event.pull_request.labels.*.name, 'run_chromatic'))
         uses: ./.github/actions/setup-node-env
@@ -51,7 +51,7 @@ jobs:
           NODE_OPTIONS: '--max_old_space_size=4096'
         uses: chromaui/action@v17.4.1
         if: |
-          (github.event_name == 'push' || github.event_name == 'merge_group') ||
+          github.event_name == 'merge_group' ||
           (github.event_name == 'pull_request' &&
             contains(github.event.pull_request.labels.*.name, 'run_chromatic')) ||
           (github.event_name == 'pull_request' && needs.check-paths.outputs.relevant != 'true')

.github/workflows/delete-old-packages.yml

@@ -25,4 +25,4 @@ jobs:
           package-name: 'dotcom-rendering'
           package-type: 'container'
           min-versions-to-keep: ${{ env.NUM_OF_VERSIONS_TO_KEEP }}
-          ignore-versions: main
+          delete-only-untagged-versions: 'true'