Timeline: tag event stories with taxonomy data-* attributes (all five surfaces)

[janmaarten-a11y]

Part of github/primer#6664 (epic github/primer#6654).

This PR tags all five Timeline event story surfaces with the taxonomy data-* attribute contract: License Compliance, Code Scanning, Dependabot, Secret Scanning, and Issues. License Compliance landed first as the proof-of-pattern, and the other four follow the same approach.

The change is Storybook-only and adds no consumer-facing behavior. It only adds attributes to the rendered <li> rows, so visuals are unchanged. Each surface lives in its own file.

How it works

Every <Timeline.Item> for a cataloged event now spreads the data-* attribute set produced by the taxonomy module (#8180, packages/react/src/Timeline/taxonomy/), documented in github/primer#6888. Each file adds a small local helper that calls the module's toEventDataAttributes serializer and derives category and visibility from that surface's catalog, so the stories stay in sync with the source of truth rather than hand-typing values. data-actor-type resolves at runtime from each row's rendered actor login via actorTypeForLogin, and is omitted when a row renders no actor.

Timeline.Item forwards arbitrary props to its <li>, so the attributes land directly on the row element.

What each surface tags

• License Compliance: all 9 leaves, fully cataloged, nothing untagged.
• Code Scanning: 15 rows. Detection group (detected, appeared, reappeared) and fixed are system events with no actor. Closures, reopen, and the delegated-dismissal pair carry user actors.
• Dependabot: 23 rows. opened and fixed render the Dependabot bot actor; dismissed and reopened fold manual (user) and automated (bot) paths; the delegated-dismissal group is reviews.
• Secret Scanning: 21 rows tagged, 11 left untagged (see below).
• Issues: 80 rows tagged, 5 left untagged. Metadata events (labels, assignees, milestones, project fields, issue types, rename) carry data-event-visibility="auditOnly" straight from the catalog.

Judgment calls and untagged rows for review

These are the places where the mapping was not a clean 1:1, called out so a reviewer can confirm each one.

Code Scanning, configuration-deleted maps to closed: the two "Configuration deleted" rows in EventFixed are the ALERT_CLOSED_BECAME_OUTDATED event, which the catalog folds into closed (a system closure), not fixed. They carry data-event-type="closed" and no actor. The two "Fixed in branch" rows carry data-event-type="fixed".

Secret Scanning, GitHub system actor resolves to user: the system "GitHub" identity on detected and the automated validity-change rows resolves to data-actor-type="user", because actorTypeForLogin("GitHub") returns user (GitHub is not in the bot set). Whether a system identity should classify as user or bot is worth confirming.

Secret Scanning, rows left untagged because they have no catalog leaf or are parked or shared:

• "Bypass requested" and "Bypass approved" (the delegated-bypass flow, which has no catalog leaf; the catalog's dismissal leaves are the separate delegated-closure flow)
• "Reported" (EventReport): the catalog maps Report to validity_changed, but github/primer#6888 flags that mapping as unconfirmed (open item 2), so the row is left untagged rather than emit an unconfirmed value
• "Dismissal request cancelled" (Secret Scanning has no dismissal_cancelled leaf, unlike Dependabot)
• EventMetadata "Extended metadata found" and "removed" (parked per github/primer#6888)
• EventAssignment (all five variants): a cross-surface shared event, deliberately out of the per-surface catalog

Issues, five variants left untagged. Each is a metadata or audit-only event the taxonomy does not yet enumerate as a distinct leaf, so it is a candidate leaf to add in a follow-up, not a defect. Tagging one now would mean emitting a data-event-type with no catalog backing, which would break the single source of truth:

• "Converted from draft"
• "Marked as canonical", "Unmarked as duplicate", "Unmarked as canonical" (the catalog has only marked_as_duplicate)
• "Labels added and removed" (one row representing two events, labeled plus unlabeled)

Dependabot's EventAssignment and EventCopilotWork are also left untagged as shared and parked events, consistent with Secret Scanning.

Testing

Validated with the repo's own gates: prettier, eslint, and type-check (15/15 tasks) all pass with zero new errors. Each surface was additionally rendered headlessly in real Chromium, confirming the <li> rows carry the expected attributes and that the untagged rows carry none, with zero console errors.

These files stay out of Timeline.docs.json and build.ts by design.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 620253e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR