.circleci/dynamic_config.yml

@@ -10,7 +10,7 @@
 version: 2.1
 
 orbs:
-  browser-tools: circleci/browser-tools@1.1.3
+  browser-tools: circleci/browser-tools@1.4.0
   devinfra: angular/dev-infra@1.0.7
 
 parameters:
@@ -317,21 +317,14 @@ jobs:
     steps:
       - custom_attach_workspace
       - install_python
-      - run:
-          name: Decrypt Credentials
-          # Note: when changing the image, you might have to re-encrypt the credentials with a
-          # matching version of openssl.
-          # See https://stackoverflow.com/a/43847627/2116927 for more info.
-          command: |
-            openssl aes-256-cbc -d -in .circleci/github_token -k "${KEY}" -out ~/github_token -md md5
       - run:
           name: Deployment to Snapshot
-          command: |
-            yarn admin snapshots --verbose --githubTokenFile=${HOME}/github_token
+          command: yarn admin snapshots --verbose
       - fail_fast
 
   publish_artifacts:
     executor: action-executor
+    resource_class: medium
     environment:
     steps:
       - custom_attach_workspace
@@ -342,7 +335,7 @@ jobs:
           name: Copy tarballs to folder
           command: |
             mkdir -p dist/artifacts/
-            cp dist/*.tgz dist/artifacts/
+            cp dist/releases/*.tgz dist/artifacts/
       - store_artifacts:
           path: dist/artifacts/
           destination: angular

.github/angular-robot.yml

@@ -67,21 +67,21 @@ triage:
   defaultMilestone: 12,
   # arrays of labels that determine if an issue has been triaged by the caretaker
   l1TriageLabels:
-    - - 'comp: *'
+    - - 'area: *'
   # arrays of labels that determine if an issue has been fully triaged
   l2TriageLabels:
     - - 'type: bug/fix'
       - 'severity*'
       - 'freq*'
-      - 'comp: *'
+      - 'area: *'
     - - 'type: feature'
-      - 'comp: *'
+      - 'area: *'
     - - 'type: refactor'
-      - 'comp: *'
+      - 'area: *'
     - - 'type: RFC / Discussion / question'
-      - 'comp: *'
+      - 'area: *'
     - - 'type: docs'
-      - 'comp: *'
+      - 'area: *'
 
 # Size checking
 size:

.github/dependabot.yml

@@ -8,7 +8,7 @@ updates:
     commit-message:
       prefix: 'build'
     labels:
-      - 'comp: build & ci'
+      - 'area: build & ci'
       - 'target: patch'
       - 'action: merge'
     # Disable version updates

.github/workflows/assistant-to-the-branch-manager.yml

@@ -0,0 +1,21 @@
+name: DevInfra
+
+on:
+  push:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review, labeled]
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  assistant_to_the_branch_manager:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3.3.0
+        with:
+          persist-credentials: false
+      - uses: angular/dev-infra/github-actions/branch-manager@ee27e18676602a29b20703051ac303ea6386e54f
+        with:
+          angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/dev-infra.yml

@@ -12,14 +12,14 @@ jobs:
   labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
-      - uses: angular/dev-infra/github-actions/commit-message-based-labels@2e999e1982762a32f68ba8afa02b8bfdac8495b8
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3.3.0
+      - uses: angular/dev-infra/github-actions/commit-message-based-labels@ee27e18676602a29b20703051ac303ea6386e54f
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
   post_approval_changes:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
-      - uses: angular/dev-infra/github-actions/post-approval-changes@2e999e1982762a32f68ba8afa02b8bfdac8495b8
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3.3.0
+      - uses: angular/dev-infra/github-actions/post-approval-changes@ee27e18676602a29b20703051ac303ea6386e54f
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/feature-requests.yml

@@ -16,6 +16,6 @@ jobs:
     if: github.repository == 'angular/angular-cli'
     runs-on: ubuntu-latest
     steps:
-      - uses: angular/dev-infra/github-actions/feature-request@2e999e1982762a32f68ba8afa02b8bfdac8495b8
+      - uses: angular/dev-infra/github-actions/feature-request@ee27e18676602a29b20703051ac303ea6386e54f
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/lock-closed.yml

@@ -13,6 +13,6 @@ jobs:
   lock_closed:
     runs-on: ubuntu-latest
     steps:
-      - uses: angular/dev-infra/github-actions/lock-closed@2e999e1982762a32f68ba8afa02b8bfdac8495b8
+      - uses: angular/dev-infra/github-actions/lock-closed@ee27e18676602a29b20703051ac303ea6386e54f
         with:
           lock-bot-key: ${{ secrets.LOCK_BOT_PRIVATE_KEY }}

.github/workflows/scorecard.yml

@@ -25,27 +25,27 @@ jobs:
 
     steps:
       - name: 'Checkout code'
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3.2.0
         with:
           persist-credentials: false
 
       - name: 'Run analysis'
-        uses: ossf/scorecard-action@e363bfca00e752f91de7b7d2a77340e2e523cb18 # tag=v2.0.4
+        uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # tag=v2.1.2
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
 
       # Upload the results as artifacts.
       - name: 'Upload artifact'
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3.1.0
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # tag=v3.1.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@807578363a7869ca324a79039e6db9c843e0e100 # tag=v2.1.27
+        uses: github/codeql-action/upload-sarif@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # tag=v2.1.37
         with:
           sarif_file: results.sarif

.ng-dev/github.mts

@@ -8,4 +8,5 @@ export const github: GithubConfig = {
   owner: 'angular',
   name: 'angular-cli',
   mainBranchName: 'main',
+  useNgDevAuthService: true,
 };

.ng-dev/pull-request.mts

@@ -7,9 +7,6 @@ import { PullRequestConfig } from '@angular/ng-dev';
 export const pullRequest: PullRequestConfig = {
   githubApiMerge: {
     default: 'rebase',
-    labels: [{ pattern: 'squash commits', method: 'squash' }],
+    labels: [{ pattern: 'merge: squash commits', method: 'squash' }],
   },
-  mergeReadyLabel: 'action: merge',
-  caretakerNoteLabel: 'action: merge-assistance',
-  commitMessageFixupLabel: 'needs commit fixup',
 };

.ng-dev/release.mts

@@ -1,8 +1,5 @@
-import '../lib/bootstrap-local.js';
-
 import { ReleaseConfig } from '@angular/ng-dev';
 import packages from '../lib/packages.js';
-import buildPackages from '../scripts/build.js';
 
 const npmPackages = Object.entries(packages.releasePackages).map(([name, { experimental }]) => ({
   name,
@@ -13,7 +10,12 @@ const npmPackages = Object.entries(packages.releasePackages).map(([name, { exper
 export const release: ReleaseConfig = {
   representativeNpmPackage: '@angular/cli',
   npmPackages,
-  buildPackages: () => buildPackages.default(),
+  buildPackages: async () => {
+    // The `performNpmReleaseBuild` function is loaded at runtime to avoid loading additional
+    // files and dependencies unless a build is required.
+    const { performNpmReleaseBuild } = await import('../scripts/build-packages-dist.mjs');
+    return performNpmReleaseBuild();
+  },
   releaseNotes: {
     groupOrder: [
       '@angular/cli',