[DO NOT MERGE] GitHub AE consumables beta megabranch (#17620)
* Empty commit * updated beta note for GHAE * more GHAE update + resolve conflict * more GHAE updates + prepare for screenshots * Apply suggestions from code review Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * address remaining review comments * Revise "About GitHub AE" (#17679) * add screenshots to the Configuring article * reworked to have a separate GHAE section * list numbering * more work on screenshots and conditions * add GHAE screenshots in article * review screenshots in article * added more screenshots and updated more articles * screenshot madness * fix liquid versioning * refactor the ghae script * [GHAE CB/Feb 22]: Add article about data residency for GitHub AE (#17847) * add missing GHAE versioning to article * move screenshots to GHAE asset directory * forgot to change the path for these two images * replace CBB screenshot + add better screenshot * [GHAE CB/Feb 22]: Document upgrades for GitHub AE (#17848) * Version article for GitHub AE * Replace unused variable * Incorporate reviewer feedback * Update intro Co-authored-by: Ethan P <56270045+ethanpalm@users.noreply.github.com> * [GHAE] Enable IP allow list (#17691) * Notes for CC * Updat permission leves chart * Add updated article to further reading * Update gated feature callout with GitHub AE * Version "Managing allowed IP addresses for your organization" for AE * Update images * Update "Restricting network traffic to your enterprise" with new procedures * remove todo note * Update audited actions * Update info about Premium Runners * Use reusable for Premium Runners * Change "Premium Runners" to "AE hosted runners" * Incorporate reviewer feedback * Use correct reusable * Version reusable correctly * [Feb 22] GHAE: Code scanning beta (#17830) * Add "github-ae" to all the frontmatter * GHAE-ify the reusables * Add some more changes * Re-use some content * 🔪 Semmle links * Revert change re "--external-repository-token" in the CodeQL runner * Update CodeQL runner token scopes * Update two screenshots * Remove mention of GitHub.com from AE + other fixes * Apply suggestions from code review Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> * Use `product_name` variable instead of `product_location` * Remove confusing phrase * [Feb 22] GHAE: Code scanning API and webhook docs (#17883) * Version API and webhook docs * Actually add versioning for GHAE * Fix anchor * [TEMPORARY] Preview for API endpoints * Revert API previews * Update procedure step Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> * Update docs for AzureAD Group SCIM support in GHAE (#17892) * [GHAE CB] SMTP bootstrapping flow (#17888) * draft * update with AE conntent * update with tons of versioning * remove that lie * fill out the rest of these steps * update with correct versioning * more edits * add images * reversion most of ae article * fix versioning * format correctlly * words matter * last image * update with permmissions * update versioning * add link * apply feedback ❤️ * update with differrent spacing * update with feedback * more feedback * Temporary GHAE release notes for consumables beta launch (#17859) * Create release-notes.md * Add frontmatter * Add to index file * Update github-ae-release-notes.md * Add release notes from Google Doc * Update finalized docs links that have been reviewed * OAuth device flow link update * version for AE * few fixes * Update content/admin/overview/github-ae-release-notes.md * small edits * whoops * commit * update with different links * used wrong reusable * fix more brokenness * Update repository-references.js * Update repository-references.js Co-authored-by: Meg Bird <megbird@github.com> Co-authored-by: Kevin Heis <heiskr@users.noreply.github.com> * [GHAE] Audit public repos (#17917) * verifying what we mean by public * Apply suggestions from code review * Update content/developers/apps/installing-github-apps.md Co-authored-by: Laura Coursen <lecoursen@github.com> * fixing placememnt of liquid conditional Co-authored-by: Laura Coursen <lecoursen@github.com> * GHAE packages beta (#17786) Co-authored-by: jmarlena <6732600+jmarlena@users.noreply.github.com> Co-authored-by: Martin Lopes <martin389@github.com> * fix broken links * [GHAE CB/March 01]: GitHub Actions on GHAE (beta) (#17725) * Added initial layout for premium runners * Restructured content * Added placeholder for removing premium runner * Added versioning and warning note for self-hosted runners * Added versioning and beta notice for actions content * Rephrased beta note * Added versioning for API docs, fixes * Added versioning fixes * Split Github-hosted and premium topics into separate articles * Added edits * Restructured some topics * Revised "Using premium runners in a workflow" * Some small fixes * Fixed typo * Added fixes to reusable * Added edits * Made section titles consistent * Added billing, group mgmt, reusable steps * Cropped certain screenshots for future-proofing * Removed superfluous reusable * Added fixes * Revert "Cropped certain screenshots for future-proofing" This reverts commit c7f24f31fa30d4fe3de2b63fc3cd5feba44ef518. * Added new section for custom images * Added versioning for enterprise-admin operations * Added edits * Added edits * Update adding-premium-runners.md * Removed SHR screenshots. Intending to update them when UI is available. * Update using-labels-with-premium-runners.md * Added custom labels section * Added preview of API docs changes * Added versioning for ip allow list section * Removed removal article * Renamed premium runners to AE hosted runners * Re-added added API preview * Fixed links, updated software specs * Revised "Software specifications" based on feedback * Fixed typos * Small fixes * Added new article "Creating custom images" * Moved "Creating custom images" link * Apply suggestions from code review Co-authored-by: ahdbilal <55514721+ahdbilal@users.noreply.github.com> * Added update from review * Added updates from tech review * Apply suggestions from code review Co-authored-by: ahdbilal <55514721+ahdbilal@users.noreply.github.com> * Added updates from tech review * Added updates from tech review * Added updates from tech review * Added updates from tech review * Fixed reusable * Added fixes * Added update from tech review * Removed the dereferenced OpenAPI schema files * Added fixes * Fixed links * Fixed links * Apply suggestions from code review Co-authored-by: jmarlena <6732600+jmarlena@users.noreply.github.com> * Added updates from peer review * Removed sections that are not in beta * Update viewing-your-github-actions-usage.md * Update viewing-job-execution-time.md * Update index.md * Update about-github-hosted-runners.md * Restored versioning to match GHES approach * Fixed link * Restored self-hosted runner reference to UI steps. * Updated screenshots * Updated screenshots and procedures * Small edits to screenshots * Added AE url info for SHR * Removed superfluous versioning * Update security-hardening-for-github-actions.md * Update actions-shared.md * Small edits * Update usage-limits-billing-and-administration.md * Update managing-complex-workflows.md * Additional versioning * Additional versioning * version environments api and checkrun deployments for ghae (#17991) Co-authored-by: Martin Lopes <martin389@github.com> * Update reviewing-the-audit-log-for-your-organization.md * Added versioning for enterprise policy settings * version configuring artifact retention for AE * remove AE versioning for connecting to Marketplace * Apply suggestions from code review Co-authored-by: Joe Bourne <thejoebourneidentity@github.com> * Update content/admin/github-actions/getting-started-with-github-actions-for-github-ae.md Co-authored-by: Joe Bourne <thejoebourneidentity@github.com> * rewording not public to private * fixing liquid * Fixed elseif entries * Added expectations note * Revised label management article for AE hosted runners * Added enterprise-admin note for adding AE hosted runners * Update enterprise-admin.md * Update self-hosted-runner-security.md * Versioned reusable for AE * Empty commit for CI Co-authored-by: ahdbilal <55514721+ahdbilal@users.noreply.github.com> Co-authored-by: jmarlena <6732600+jmarlena@users.noreply.github.com> Co-authored-by: skedwards88 <skedwards88@github.com> Co-authored-by: Leona B. Campbell <3880403+runleonarun@users.noreply.github.com> Co-authored-by: Joe Bourne <thejoebourneidentity@github.com> Co-authored-by: runleonarun <runleonarun@github.com> * Update OpenAPI Descriptions for GHAE * Update content/admin/overview/github-ae-release-notes.md Co-authored-by: Ethan Palm <56270045+ethanpalm@users.noreply.github.com> Co-authored-by: mchammer01 <42146119+mchammer01@users.noreply.github.com> Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> Co-authored-by: shati-patel <shati-patel@github.com> Co-authored-by: Sarah Schneider <sarahs@github.com> Co-authored-by: skedwards88 <skedwards88@github.com> Co-authored-by: Sarah Schneider <sarahs@users.noreply.github.com> Co-authored-by: Melanie Yarbrough <11952755+myarb@users.noreply.github.com> Co-authored-by: Felicity Chapman <felicitymay@github.com> Co-authored-by: Meg Bird <megbird@github.com> Co-authored-by: Kevin Heis <heiskr@users.noreply.github.com> Co-authored-by: Leona B. Campbell <3880403+runleonarun@users.noreply.github.com> Co-authored-by: Laura Coursen <lecoursen@github.com> Co-authored-by: jmarlena <6732600+jmarlena@users.noreply.github.com> Co-authored-by: Martin Lopes <martin389@github.com> Co-authored-by: ahdbilal <55514721+ahdbilal@users.noreply.github.com> Co-authored-by: Joe Bourne <thejoebourneidentity@github.com> Co-authored-by: runleonarun <runleonarun@github.com> Co-authored-by: github-openapi-bot <69533958+github-openapi-bot@users.noreply.github.com>
This commit is contained in:
Matt Pollard
@@ -9,6 +9,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.secret-scanning.beta %}
|
||||
@@ -35,7 +36,7 @@ When {% data variables.product.prodname_secret_scanning %} detects a set of cred
|
||||
### About {% data variables.product.prodname_secret_scanning %} for private repositories
|
||||
{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% if currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
### About {% data variables.product.prodname_secret_scanning %} on {% data variables.product.product_name %}
|
||||
|
||||
{% data variables.product.prodname_secret_scanning_caps %} is available on all organization-owned repositories as part of {% data variables.product.prodname_GH_advanced_security %}. It is not available on user-owned repositories.
|
||||
|
||||
@@ -3,7 +3,8 @@ title: About securing your repository
|
||||
intro: '{% data variables.product.product_name %} provides a number of ways that you can help keep your repository secure.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
### Setting up your repository securely
|
||||
@@ -14,6 +15,7 @@ The first step to securing a repository is to set up who can see and modify your
|
||||
|
||||
{% data variables.product.prodname_dotcom %} has a growing set of security features that help you keep your code secure. You can find these on the **Security** tab for your repository.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
#### Available for all repositories
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
@@ -31,7 +33,7 @@ The first step to securing a repository is to set up who can see and modify your
|
||||
and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% if currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
- **{% data variables.product.prodname_dependabot_alerts %}**
|
||||
|
||||
View alerts about dependencies that are known to contain security vulnerabilities, and manage these alerts. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
|
||||
@@ -42,12 +44,15 @@ The first step to securing a repository is to set up who can see and modify your
|
||||
|
||||
Use {% data variables.product.prodname_dependabot %} to automatically raise pull requests to keep your dependencies up-to-date. This helps reduce your exposure to older versions of dependencies. Using newer versions makes it easier to apply patches if security vulnerabilities are discovered, and also makes it easier for {% data variables.product.prodname_dependabot_security_updates %} to successfully raise pull requests to upgrade vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/github/administering-a-repository/about-dependabot-version-updates)."
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
|
||||
#### Available {% if currentVersion == "free-pro-team@latest" %}for public repositories and for repositories {% endif %}with {% data variables.product.prodname_advanced_security %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
These features are available {% if currentVersion == "free-pro-team@latest" %}for all public repositories, and for private repositories owned by organizations with {% else %}if you have {% endif %}an {% data variables.product.prodname_advanced_security %} license. {% data reusables.advanced-security.more-info-ghas %}
|
||||
{% endif %}
|
||||
|
||||
- **{% data variables.product.prodname_code_scanning_capc %} alerts**
|
||||
|
||||
@@ -63,6 +68,7 @@ These features are available {% if currentVersion == "free-pro-team@latest" %}fo
|
||||
- **Dependency review** - Show the full impact of changes to dependencies and see details of any vulnerable versions before you merge a pull request. For more information, see "[Reviewing dependency changes in a pull request](/github/collaborating-with-issues-and-pull-requests/reviewing-dependency-changes-in-a-pull-request)."
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion != "github-ae@latest" %}
|
||||
### Exploring dependencies
|
||||
{% data variables.product.prodname_dotcom %}'s dependency graph allows you to explore:
|
||||
|
||||
@@ -72,3 +78,4 @@ These features are available {% if currentVersion == "free-pro-team@latest" %}fo
|
||||
You must enable the dependency graph before {% data variables.product.prodname_dotcom %} can generate {% data variables.product.prodname_dependabot_alerts %} for dependencies with security vulnerabilities. {% if currentVersion == "free-pro-team@latest" %}Enabling the dependency graph also enables {% data variables.product.prodname_dotcom %} to run dependency reviews of pull requests.{% endif %}
|
||||
|
||||
You can find the dependency graph on the **Insights** tab for your repository. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
{% endif %}
|
||||
|
||||
@@ -7,7 +7,8 @@ redirect_from:
|
||||
product: '{% data reusables.gated-features.secret-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.secret-scanning.beta %}
|
||||
@@ -26,7 +27,6 @@ versions:
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-settings %}
|
||||
{% data reusables.repositories.navigate-to-security-and-analysis %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}
|
||||
4. You may need to enable {% data variables.product.prodname_GH_advanced_security %} to activate the button for "{% data variables.product.prodname_secret_scanning_caps %}". To the right of "{% data variables.product.prodname_GH_advanced_security %}", click **Enable**.
|
||||
|
||||
@@ -34,10 +34,18 @@ versions:
|
||||
|
||||
6. When you enable {% data variables.product.prodname_GH_advanced_security %} this may automatically enable {% data variables.product.prodname_secret_scanning %} for the repository (this is controlled by the organization configuration). If "{% data variables.product.prodname_secret_scanning_caps %}" is shown with an **Enable** button, you still need to enable {% data variables.product.prodname_secret_scanning %} by clicking **Enable**. If you see a **Disable** button, {% data variables.product.prodname_secret_scanning %} is already enabled.
|
||||
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion == "enterprise-server@3.0" %}
|
||||
4. To the right of "{% data variables.product.prodname_secret_scanning_caps %}", click **Enable**.
|
||||
{% elsif currentVersion == "enterprise-server@3.0" %}
|
||||
7. To the right of "{% data variables.product.prodname_secret_scanning_caps %}", click **Enable**.
|
||||
|
||||
{% endif %}
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
1. Before you can enable {% data variables.product.prodname_secret_scanning %}, you need to enable {% data variables.product.prodname_GH_advanced_security %} first. To the right of "{% data variables.product.prodname_GH_advanced_security %}", click **Enable**.
|
||||
|
||||
2. Click **Enable {% data variables.product.prodname_GH_advanced_security %} for this repository** to confirm the action.
|
||||
|
||||
3. To the right of "{% data variables.product.prodname_secret_scanning_caps %}", click **Enable**.
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Excluding alerts from {% data variables.product.prodname_secret_scanning %} in {% if currentVersion == "free-pro-team@latest" %}private {% endif %}repositories
|
||||
|
||||
|
||||
@@ -4,6 +4,7 @@ intro: 'You can configure the retention period for {% data variables.product.pro
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.23'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.actions.about-artifact-log-retention %}
|
||||
|
||||
@@ -4,6 +4,7 @@ intro: 'Repository owners can disable, enable, and limit {% data variables.produ
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.actions.enterprise-beta %}
|
||||
|
||||
@@ -5,6 +5,7 @@ product: '{% data reusables.gated-features.secret-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.secret-scanning.beta %}
|
||||
@@ -13,20 +14,28 @@ versions:
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
3. In the left sidebar, click **Detected secrets**.
|
||||
|
||||
3. In the left sidebar, click **Secret scanning alerts**.
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
|
||||
{% endif %}
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% endif %}
|
||||
4. Under "Secret scanning" click the alert you want to view.
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
|
||||
{% endif %}
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% if currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
|
||||
{% endif %}
|
||||
1. Optionally, use the "Mark as" drop-down menu and click a reason for resolving an alert.
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% endif %}
|
||||
5. Optionally, use the "Mark as" drop-down menu and click a reason for resolving an alert.
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
|
||||
{% endif %}
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% if currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
@@ -26,31 +27,38 @@ You can manage a subset of security and analysis features for public repositorie
|
||||
|
||||
### Enabling or disabling security and analysis features{% if currentVersion == "free-pro-team@latest" %} for private repositories{% endif %}
|
||||
|
||||
You can manage the security and analysis features for your {% if currentVersion == "free-pro-team@latest" %}private or internal {% endif %}repository. If your organization or enterprise has a license for {% data variables.product.prodname_GH_advanced_security %} then extra options are available. {% data reusables.advanced-security.more-info-ghas %}
|
||||
You can manage the security and analysis features for your {% if currentVersion == "free-pro-team@latest" %}private or internal {% endif %}repository.{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %} If your organization or enterprise has a license for {% data variables.product.prodname_GH_advanced_security %} then extra options are available. {% data reusables.advanced-security.more-info-ghas %}{% endif %}
|
||||
|
||||
{% data reusables.security.security-and-analysis-features-enable-read-only %}
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-settings %}
|
||||
{% data reusables.repositories.navigate-to-security-and-analysis %}
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
4. Under "Configure security and analysis features", to the right of the feature, click **Disable** or **Enable**. {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}If the control for "{% data variables.product.prodname_secret_scanning_caps %}" is not active, you need to enable {% data variables.product.prodname_GH_advanced_security %} first.
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note:** If you disable {% data variables.product.prodname_GH_advanced_security %}, both {% data variables.product.prodname_secret_scanning %} and {% data variables.product.prodname_code_scanning %} are disabled. Any workflows, SARIF uploads, or API calls for {% data variables.product.prodname_code_scanning %} will fail.
|
||||
{% endnote %}
|
||||
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion == "enterprise-server@3.0" %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if currentVersion == "enterprise-server@3.0" %}
|
||||
|
||||
{% endif %}
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
4. Under "Configure security and analysis features", to the right of the feature, click **Disable** or **Enable**. Before you can enable "{% data variables.product.prodname_secret_scanning %}" for your repository, you need to enable {% data variables.product.prodname_GH_advanced_security %}.
|
||||
|
||||
{% endif %}
|
||||
|
||||
|
||||
### Granting access to security alerts
|
||||
|
||||
After you enable {% data variables.product.prodname_dependabot %} or {% data variables.product.prodname_secret_scanning %} alerts for a repository in an organization, organization owners and repository administrators can view the alerts by default. You can give additional teams and people access to the alerts for a repository.
|
||||
After you enable {% if currentVersion != "github-ae@latest" %}{% data variables.product.prodname_dependabot %} or {% endif %}{% data variables.product.prodname_secret_scanning %} alerts for a repository in an organization, organization owners and repository administrators can view the alerts by default. You can give additional teams and people access to the alerts for a repository.
|
||||
|
||||
{% note %}
|
||||
|
||||
Organization owners and repository administrators can only grant access to view security alerts, such as {% data variables.product.prodname_dependabot %} and {% data variables.product.prodname_secret_scanning %} alerts, to people or teams who have write access to the repo.
|
||||
Organization owners and repository administrators can only grant access to view security alerts, such as {% data variables.product.prodname_secret_scanning %} alerts, to people or teams who have write access to the repo.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
@@ -64,8 +72,17 @@ Organization owners and repository administrators can only grant access to view
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
|
||||
{% endif %}
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
5. Click **Save changes**.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
|
||||
{% endif %}
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Removing access to security alerts
|
||||
|
||||
@@ -79,6 +96,9 @@ Organization owners and repository administrators can only grant access to view
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
|
||||
{% endif %}
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Further reading
|
||||
|
||||
|
||||
@@ -7,5 +7,6 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -35,7 +36,7 @@ You can use {% data variables.product.prodname_code_scanning %} with {% data var
|
||||
|
||||
{% data reusables.code-scanning.supported-languages %}
|
||||
|
||||
You can view and contribute to the queries for {% data variables.product.prodname_code_scanning %} in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{% data variables.product.prodname_codeql %} queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) in the {% data variables.product.prodname_codeql %} documentation.
|
||||
You can view and contribute to the queries for {% data variables.product.prodname_code_scanning %} in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{% data variables.product.prodname_codeql %} queries](https://codeql.github.com/docs/writing-codeql-queries/codeql-queries/) in the {% data variables.product.prodname_codeql %} documentation.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
|
||||
|
||||
@@ -6,6 +6,7 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -17,7 +18,7 @@ If you use a third-party static analysis tool that can produce results as Static
|
||||
|
||||
### Integrations with webhooks
|
||||
|
||||
You can use {% data variables.product.prodname_code_scanning %} webhooks to build or set up integrations, such as [{% data variables.product.prodname_github_app %}s](/apps/building-github-apps/) or [{% data variables.product.prodname_oauth_app %}s](/apps/building-oauth-apps/), that subscribe to {% data variables.product.prodname_code_scanning %} events in your repository. For example, you could build an integration that creates an issue on {% data variables.product.product_location %} or sends you a Slack notification when a new {% data variables.product.prodname_code_scanning %} alert is added in your repository. For more information, see "[Creating webhooks](/developers/webhooks-and-events/creating-webhooks)" and "[Webhook events and payloads](/developers/webhooks-and-events/webhook-events-and-payloads#code_scanning_alert)."
|
||||
You can use {% data variables.product.prodname_code_scanning %} webhooks to build or set up integrations, such as [{% data variables.product.prodname_github_app %}s](/apps/building-github-apps/) or [{% data variables.product.prodname_oauth_app %}s](/apps/building-oauth-apps/), that subscribe to {% data variables.product.prodname_code_scanning %} events in your repository. For example, you could build an integration that creates an issue on {% data variables.product.product_name %} or sends you a Slack notification when a new {% data variables.product.prodname_code_scanning %} alert is added in your repository. For more information, see "[Creating webhooks](/developers/webhooks-and-events/creating-webhooks)" and "[Webhook events and payloads](/developers/webhooks-and-events/webhook-events-and-payloads#code_scanning_alert)."
|
||||
|
||||
### Further reading
|
||||
|
||||
|
||||
@@ -7,5 +7,6 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ miniTocMaxHeadingLevel: 4
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -14,9 +15,9 @@ versions:
|
||||
|
||||
### About {% data variables.product.prodname_code_scanning %} configuration
|
||||
|
||||
You can run {% data variables.product.prodname_code_scanning %} within {% data variables.product.product_location %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system, using the {% data variables.product.prodname_codeql_runner %}. For more information about {% data variables.product.prodname_actions %}, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)."
|
||||
You can run {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_name %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system, using the {% data variables.product.prodname_codeql_runner %}. For more information about {% data variables.product.prodname_actions %}, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)."
|
||||
|
||||
This article is about running {% data variables.product.prodname_code_scanning %} within {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_ghe_server %}{% else %}{% data variables.product.prodname_dotcom %}{% endif %}.
|
||||
This article is about running {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_name %}.
|
||||
|
||||
Before you can configure {% data variables.product.prodname_code_scanning %} for a repository, you must set up {% data variables.product.prodname_code_scanning %} by adding a {% data variables.product.prodname_actions %} workflow to the repository. For more information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/setting-up-code-scanning-for-a-repository)."
|
||||
|
||||
@@ -203,13 +204,17 @@ jobs:
|
||||
|
||||
{% data reusables.code-scanning.run-additional-queries %}
|
||||
|
||||
To add one or more queries, add a `with: queries:` entry within the `uses: github/codeql-action/init@v1` section of the workflow.
|
||||
To add one or more queries, add a `with: queries:` entry within the `uses: github/codeql-action/init@v1` section of the workflow. If the queries are in a private repository, use the `external-repository-token` parameter to specify a token that has access to the private repository.
|
||||
|
||||
{% raw %}
|
||||
``` yaml
|
||||
- uses: github/codeql-action/init@v1
|
||||
with:
|
||||
queries: COMMA-SEPARATED LIST OF PATHS
|
||||
# Optional. Provide a token to access private repositories.
|
||||
external-repository-token: ${{ secrets.ACCESS_TOKEN }}
|
||||
```
|
||||
{% endraw %}
|
||||
|
||||
You can also specify query suites in the value of `queries`. Query suites are collections of queries, usually grouped by purpose or language.
|
||||
|
||||
@@ -219,12 +224,15 @@ If you are also using a configuration file for custom settings, any additional q
|
||||
|
||||
In the following example, the `+` symbol ensures that the specified additional queries are used together with any queries specified in the referenced configuration file.
|
||||
|
||||
{% raw %}
|
||||
``` yaml
|
||||
- uses: github/codeql-action/init@v1
|
||||
with:
|
||||
config-file: ./.github/codeql/codeql-config.yml
|
||||
queries: +security-and-quality,octo-org/python-qlpack/show_ifs.ql@main
|
||||
external-repository-token: ${{ secrets.ACCESS_TOKEN }}
|
||||
```
|
||||
{% endraw %}
|
||||
|
||||
### Using a custom configuration file
|
||||
|
||||
@@ -238,9 +246,19 @@ In the workflow file, use the `config-file` parameter of the `init` action to sp
|
||||
config-file: ./.github/codeql/codeql-config.yml
|
||||
```
|
||||
|
||||
The configuration file can be located within the local repository, or in a remote, public repository. Using a remote, public repository allows you to specify configuration options for multiple repositories in a single place. When you reference a configuration file located in a remote repository, you can use the _OWNER/REPOSITORY/FILENAME@BRANCH_ syntax. For example, _monacorp/shared/codeql-config.yml@main_.
|
||||
{% data reusables.code-scanning.custom-configuration-file %}
|
||||
|
||||
The settings in the file are written in YAML format.
|
||||
If the configuration file is located in an external private repository, use the `external-repository-token` parameter of the `init` action to specify a token that has access to the private repository.
|
||||
|
||||
{% raw %}
|
||||
```yaml
|
||||
uses: github/codeql-action/init@v1
|
||||
with:
|
||||
external-repository-token: ${{ secrets.ACCESS_TOKEN }}
|
||||
```
|
||||
{% endraw %}
|
||||
|
||||
The settings in the configuration file are written in YAML format.
|
||||
|
||||
#### Specifying additional queries
|
||||
|
||||
@@ -296,25 +314,6 @@ You can quickly analyze small portions of a monorepo when you modify code in spe
|
||||
|
||||
{% data reusables.code-scanning.autobuild-add-build-steps %} For more information about how to configure {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} for compiled languages, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages)."
|
||||
|
||||
### Accessing private repositories
|
||||
|
||||
If your workflow for {% data variables.product.prodname_code_scanning %} accesses a private repository, other than the repository that contains the workflow, you'll need to configure Git to authenticate with a personal access token. Define the secret in the runner environment by using `jobs.<job_id>.steps[*].env` in your workflow before any {% data variables.product.prodname_codeql %} actions. For more information, see "[Creating a personal access token for the command line](/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line)" and "[Creating and storing encrypted secrets](/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets)."
|
||||
|
||||
For example, the following configuration has Git replace the full URLs to the `ghost/foo`, `ghost/bar`, and `ghost/baz` repositories on {% data variables.product.prodname_dotcom_the_website %} with URLs that include the personal access token that you store in the `ACCESS_TOKEN` environment variable.
|
||||
|
||||
{% raw %}
|
||||
```yaml
|
||||
steps:
|
||||
- name: Configure access to private repositories
|
||||
env:
|
||||
TOKEN: ${{ secrets.ACCESS_TOKEN }}
|
||||
run: |
|
||||
git config --global url."https://${TOKEN}@github.com/ghost/foo".insteadOf "https://github.com/ghost/foo"
|
||||
git config --global url."https://${TOKEN}@github.com/ghost/bar".insteadOf "https://github.com/ghost/bar"
|
||||
git config --global url."https://${TOKEN}@github.com/ghost/baz".insteadOf "https://github.com/ghost/baz"
|
||||
```
|
||||
{% endraw %}
|
||||
|
||||
### Uploading {% data variables.product.prodname_code_scanning %} data to {% data variables.product.prodname_dotcom %}
|
||||
|
||||
{% data variables.product.prodname_dotcom %} can display code analysis data generated externally by a third-party tool. You can upload code analysis data with the `upload-sarif` action. For more information, see "[Uploading a SARIF file to GitHub](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)."
|
||||
|
||||
@@ -9,6 +9,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta-codeql-runner %}
|
||||
@@ -85,6 +86,8 @@ Use the `--config-file` flag of the `init` command to specify the configuration
|
||||
$ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-config.yml
|
||||
```
|
||||
|
||||
{% data reusables.code-scanning.custom-configuration-file %}
|
||||
|
||||
#### Example configuration files
|
||||
|
||||
{% data reusables.code-scanning.example-configuration-files %}
|
||||
@@ -145,7 +148,7 @@ Attempts to build the code for the compiled languages C/C++, C#, and Java. For t
|
||||
|
||||
#### `analyze`
|
||||
|
||||
Analyzes the code in the {% data variables.product.prodname_codeql %} databases and uploads results to {% data variables.product.product_location %}.
|
||||
Analyzes the code in the {% data variables.product.prodname_codeql %} databases and uploads results to {% data variables.product.product_name %}.
|
||||
|
||||
| Flag | Required | Input value |
|
||||
| ---- |:--------:| ----------- |
|
||||
@@ -155,7 +158,7 @@ Analyzes the code in the {% data variables.product.prodname_codeql %} databases
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
|
||||
| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |
|
||||
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
|
||||
| `--no-upload` | | None. Stops the {% data variables.product.prodname_codeql_runner %} from uploading the results to {% data variables.product.product_location %}. |
|
||||
| `--no-upload` | | None. Stops the {% data variables.product.prodname_codeql_runner %} from uploading the results to {% data variables.product.product_name %}. |
|
||||
| `--output-dir` | | Directory where the output SARIF files are stored. The default is in the directory of temporary files. |
|
||||
| `--ram` | | Amount of memory to use when running queries. The default is to use all available memory. |
|
||||
| <nobr>`--no-add-snippets`</nobr> | | None. Excludes code snippets from the SARIF output. |
|
||||
@@ -166,7 +169,7 @@ Analyzes the code in the {% data variables.product.prodname_codeql %} databases
|
||||
|
||||
#### `upload`
|
||||
|
||||
Uploads SARIF files to {% data variables.product.product_location %}.
|
||||
Uploads SARIF files to {% data variables.product.product_name %}.
|
||||
|
||||
{% note %}
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -32,7 +33,10 @@ If your workflow uses a `language` matrix, `autobuild` attempts to build each of
|
||||
|
||||
{% note %}
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}**Note**: For instructions on how to make sure your {% data variables.actions.hosted_runner %} has the required software installed, see "[Creating custom images](/actions/using-github-hosted-runners/creating-custom-images)."
|
||||
{% else %}
|
||||
**Note**: If you use self-hosted runners for {% data variables.product.prodname_actions %}, you may need to install additional software to use the `autobuild` process. Additionally, if your repository requires a specific version of a build tool, you may need to install it manually. For more information, see "[Specifications for {% data variables.product.prodname_dotcom %}-hosted runners](/actions/reference/specifications-for-github-hosted-runners/#supported-software)".
|
||||
{% endif %}
|
||||
|
||||
{% endnote %}
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
### Table of Contents
|
||||
|
||||
@@ -9,5 +9,6 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ permissions: 'If you have write permission to a repository you can manage {% dat
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/managing-alerts-from-automated-code-scanning
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/managing-alerts-from-code-scanning
|
||||
|
||||
@@ -6,6 +6,7 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
@@ -8,6 +8,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
<!--UI-LINK: When GitHub Enterprise Server doesn't have GitHub Actions set up, the Security > Code scanning alerts view links to this article.-->
|
||||
|
||||
@@ -23,9 +24,9 @@ If you use a continuous integration or continuous delivery/deployment (CI/CD) sy
|
||||
|
||||
{% data reusables.code-scanning.about-code-scanning %} For information, see "[About {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)."
|
||||
|
||||
You can use the {% data variables.product.prodname_codeql_runner %} to run {% data variables.product.prodname_code_scanning %} on code that you're processing in a third-party continuous integration (CI) system. Alternatively, you can use {% data variables.product.prodname_actions %} to run {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_location %}. For information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/setting-up-code-scanning-for-a-repository)."
|
||||
You can use the {% data variables.product.prodname_codeql_runner %} to run {% data variables.product.prodname_code_scanning %} on code that you're processing in a third-party continuous integration (CI) system. Alternatively, you can use {% data variables.product.prodname_actions %} to run {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_name %}. For information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/setting-up-code-scanning-for-a-repository)."
|
||||
|
||||
The {% data variables.product.prodname_codeql_runner %} is a command-line tool that runs {% data variables.product.prodname_codeql %} analysis on a checkout of a {% data variables.product.prodname_dotcom %} repository. You add the runner to your third-party system, then call the runner to analyze code and upload the results to {% data variables.product.product_location %}. These results are displayed as {% data variables.product.prodname_code_scanning %} alerts in the repository.
|
||||
The {% data variables.product.prodname_codeql_runner %} is a command-line tool that runs {% data variables.product.prodname_codeql %} analysis on a checkout of a {% data variables.product.prodname_dotcom %} repository. You add the runner to your third-party system, then call the runner to analyze code and upload the results to {% data variables.product.product_name %}. These results are displayed as {% data variables.product.prodname_code_scanning %} alerts in the repository.
|
||||
|
||||
{% note %}
|
||||
|
||||
@@ -40,7 +41,7 @@ The {% data variables.product.prodname_codeql_runner %} is a command-line tool t
|
||||
|
||||
### Downloading the {% data variables.product.prodname_codeql_runner %}
|
||||
|
||||
You can download the {% data variables.product.prodname_codeql_runner %} from https://github.com/github/codeql-action/releases. On some operating systems, you may need to change permissions for the downloaded file before you can run it.
|
||||
You can download the {% data variables.product.prodname_codeql_runner %} from https://{% if currentVersion == "enterprise-server@2.22" or currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases. On some operating systems, you may need to change permissions for the downloaded file before you can run it.
|
||||
|
||||
On Linux:
|
||||
|
||||
@@ -59,33 +60,33 @@ On Windows, the `codeql-runner-win.exe` file usually requires no change to permi
|
||||
|
||||
### Adding the {% data variables.product.prodname_codeql_runner %} to your CI system
|
||||
|
||||
Once you download the {% data variables.product.prodname_codeql_runner %} and verify that it can be executed, you should make the runner available to each CI server that you intend to use for {% data variables.product.prodname_code_scanning %}. For example, you might configure each server to copy the runner from a central, internal location. Alternatively, you could use the REST API to get the runner directly from GitHub, for example:
|
||||
Once you download the {% data variables.product.prodname_codeql_runner %} and verify that it can be executed, you should make the runner available to each CI server that you intend to use for {% data variables.product.prodname_code_scanning %}. For example, you might configure each server to copy the runner from a central, internal location. Alternatively, you could use the REST API to get the runner directly from {% data variables.product.prodname_dotcom %}, for example:
|
||||
|
||||
```shell
|
||||
wget https://github.com/github/codeql-action/releases/latest/download/codeql-runner-linux
|
||||
wget https://{% if currentVersion == "enterprise-server@2.22" or currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases/latest/download/codeql-runner-linux
|
||||
chmod +x codeql-runner-linux
|
||||
```
|
||||
|
||||
In addition to this, each CI server also needs:
|
||||
|
||||
- A {% data variables.product.prodname_github_app %} or personal access token for the {% data variables.product.prodname_codeql_runner %} to use. You must use an access token with the `security_events` scope, or a {% data variables.product.prodname_github_app %} with the `security_events` write permission. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- A {% data variables.product.prodname_github_app %} or personal access token for the {% data variables.product.prodname_codeql_runner %} to use. You must use an access token with the `repo` scope, or a {% data variables.product.prodname_github_app %} with the `security_events` write permission, and `metadata` and `contents` read permissions. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- Access to the {% data variables.product.prodname_codeql %} bundle associated with this release of the {% data variables.product.prodname_codeql_runner %}. This package contains queries and libraries needed for {% data variables.product.prodname_codeql %} analysis, plus the {% data variables.product.prodname_codeql %} CLI, which is used internally by the runner. For information, see "[{% data variables.product.prodname_codeql %} CLI](https://codeql.github.com/docs/codeql-cli/)."
|
||||
|
||||
The options for providing access to the {% data variables.product.prodname_codeql %} bundle are:
|
||||
|
||||
1. Allow the CI servers access to {% data variables.product.prodname_dotcom_the_website %} so that the {% data variables.product.prodname_codeql_runner %} can download the bundle automatically.
|
||||
1. Manually download/extract the bundle, store it with other central resources, and use the `--codeql-path` flag to specify the location of the bundle in calls to initialize the {% data variables.product.prodname_codeql_runner %}.
|
||||
{% if enterpriseServerVersions contains currentVersion %}
|
||||
1. You can mirror the `github/codeql-action` repository on {% data variables.product.product_location %}. Unless you specify the <nobr>`--codeql-path`</nobr> flag, the runner automatically checks for the bundle in this location and on {% data variables.product.prodname_dotcom_the_website %}.{% endif %}
|
||||
1. Allow the CI servers access to https://{% if currentVersion == "enterprise-server@2.22" or currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action so that the {% data variables.product.prodname_codeql_runner %} can download the bundle automatically.
|
||||
{% if currentVersion == "enterprise-server@2.22" %}
|
||||
1. Mirror the `github/codeql-action` repository on {% data variables.product.product_name %}. Unless you specify the <nobr>`--codeql-path`</nobr> flag, the runner automatically checks for the bundle in this location and on {% data variables.product.prodname_dotcom_the_website %}.{% endif %}
|
||||
1. Manually download/extract the bundle, store it with other central resources, and use the <nobr>`--codeql-path`</nobr> flag to specify the location of the bundle in calls to initialize the {% data variables.product.prodname_codeql_runner %}.
|
||||
|
||||
### Calling the {% data variables.product.prodname_codeql_runner %}
|
||||
|
||||
You should call the {% data variables.product.prodname_codeql_runner %} from the checkout location of the repository you want to analyze. The two main commands are:
|
||||
|
||||
1. `init` required to initialize the runner and create a {% data variables.product.prodname_codeql %} database for each language to be analyzed. These databases are populated and analyzed by subsequent commands.
|
||||
1. `analyze` required to populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload results to {% data variables.product.product_location %}.
|
||||
1. `analyze` required to populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload results to {% data variables.product.product_name %}.
|
||||
|
||||
For both commands, you must specify the URL of {% data variables.product.product_location %}, the repository *OWNER/NAME*, and the GitHub Apps or personal access token to use for authentication. You also need to specify the location of the CodeQL bundle unless the CI server has access to download it directly from the `github/codeql-action` repository on {% data variables.product.prodname_dotcom_the_website %}{% if enterpriseServerVersions contains currentVersion %} or mirrored on {% data variables.product.product_location %}{% endif %}.
|
||||
For both commands, you must specify the URL of {% data variables.product.product_name %}, the repository *OWNER/NAME*, and the {% data variables.product.prodname_github_apps %} or personal access token to use for authentication. You also need to specify the location of the CodeQL bundle, unless the CI server has access to download it directly from the `github/codeql-action` repository.
|
||||
|
||||
You can configure where the {% data variables.product.prodname_codeql_runner %} stores the CodeQL bundle for future analysis on a server using the <nobr>`--tools-dir`</nobr> flag and where it stores temporary files during analysis using <nobr>`--temp-dir`</nobr>.
|
||||
|
||||
@@ -121,7 +122,7 @@ This example runs {% data variables.product.prodname_codeql %} analysis on a Lin
|
||||
> Successfully uploaded results
|
||||
```
|
||||
|
||||
The server has access to download the {% data variables.product.prodname_codeql %} bundle directly from the `github/codeql-action` repository on {% data variables.product.prodname_dotcom_the_website %}{% if enterpriseServerVersions contains currentVersion %} or mirrored on {% data variables.product.product_location %}{% endif %}, so there is no need to use the `--codeql-path` flag. When the analysis is complete, the {% data variables.product.prodname_codeql_runner %} uploads the results to the {% data variables.product.prodname_code_scanning %} view. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
The server has access to download the {% data variables.product.prodname_codeql %} bundle directly from the `github/codeql-action` repository, so there is no need to use the `--codeql-path` flag. When the analysis is complete, the {% data variables.product.prodname_codeql_runner %} uploads the results to the {% data variables.product.prodname_code_scanning %} view. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
#### Compiled language example
|
||||
|
||||
@@ -142,14 +143,15 @@ This example is similar to the previous example, however this time the repositor
|
||||
. /srv/checkout/example-repo-2/codeql-runner/codeql-env.sh".
|
||||
```
|
||||
|
||||
1. Run the script generated by the `init` action to set up the environment to monitor the build.
|
||||
1. Source the script generated by the `init` action to set up the environment to monitor the build. Note the leading dot and space in the following code snippet.
|
||||
|
||||
```shell
|
||||
$ . /srv/checkout/example-repo-2/codeql-runner/codeql-env.sh
|
||||
```
|
||||
|
||||
1. Build the code.
|
||||
1. Populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload the results to GitHub.
|
||||
1. Build the code. On macOS, you need to prefix the build command with the environment variable `$CODEQL_RUNNER`. For more information, see "[Troubleshooting CodeQL code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-codeql-code-scanning-in-your-ci-system#no-code-found-during-the-build)."
|
||||
|
||||
1. Populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload the results to {% data variables.product.prodname_dotcom %}.
|
||||
|
||||
```shell
|
||||
$ /path/to-runner/codeql-runner-linux analyze --repository octo-org/example-repo-2
|
||||
|
||||
@@ -8,6 +8,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
@@ -11,6 +11,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -28,7 +29,7 @@ You decide how to generate {% data variables.product.prodname_code_scanning %} a
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
3. To the right of "{% data variables.product.prodname_code_scanning_capc %}", click **Set up {% data variables.product.prodname_code_scanning %}**. {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}If {% data variables.product.prodname_code_scanning %} is missing, you need to ask an organization owner or repository administrator to enable {% data variables.product.prodname_GH_advanced_security %}. For more information, see "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization)" or "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."{% endif %}
|
||||
3. To the right of "{% data variables.product.prodname_code_scanning_capc %} alerts", click **Set up {% data variables.product.prodname_code_scanning %}**. {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}If {% data variables.product.prodname_code_scanning %} is missing, you need to ask an organization owner or repository administrator to enable {% data variables.product.prodname_GH_advanced_security %}. For more information, see "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization)" or "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."{% endif %}
|
||||
|
||||
4. Under "Get started with {% data variables.product.prodname_code_scanning %}", click **Set up this workflow** on the {% data variables.product.prodname_codeql_workflow %} or on a third-party workflow.
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ permissions: 'If you have read permission for a repository, you can see annotati
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -31,7 +32,7 @@ When you look at the **Files changed** tab for a pull request, you see annotatio
|
||||
|
||||
|
||||
|
||||
If you have write permission for the repository, some annotations contain links with extra context for the alert. In the example above, from {% data variables.product.prodname_codeql %} analysis, you can click **user-provided value** to see where the untrusted data enters the data flow (this is referred to as the source). In this case you can also view the full path from the source to the code that uses the data (the sink) by clicking **Show paths**. This makes it easy to check whether the data is untrusted or if the analysis failed to recognize a data sanitization step between the source and the sink. For information about analyzing data flow using {% data variables.product.prodname_codeql %}, see "[About data flow analysis](https://help.semmle.com/QL/learn-ql/intro-to-data-flow.html)."
|
||||
If you have write permission for the repository, some annotations contain links with extra context for the alert. In the example above, from {% data variables.product.prodname_codeql %} analysis, you can click **user-provided value** to see where the untrusted data enters the data flow (this is referred to as the source). In this case you can also view the full path from the source to the code that uses the data (the sink) by clicking **Show paths**. This makes it easy to check whether the data is untrusted or if the analysis failed to recognize a data sanitization step between the source and the sink. For information about analyzing data flow using {% data variables.product.prodname_codeql %}, see "[About data flow analysis](https://codeql.github.com/docs/writing-codeql-queries/about-data-flow-analysis/)."
|
||||
|
||||
To see more information about an alert, users with write permission can click the **Show more details** link shown in the annotation. This allows you to see all of the context and metadata provided by the tool in an alert view. In the example below, you can see tags showing the severity, type, and relevant common weakness enumerations (CWEs) for the problem. The view also shows which commit introduced the problem.
|
||||
|
||||
|
||||
@@ -8,6 +8,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta-codeql-runner %}
|
||||
@@ -51,4 +52,7 @@ If the `analyze` command for the {% data variables.product.prodname_codeql_runne
|
||||
|
||||
{% endnote %}
|
||||
|
||||
1. You're analyzing a compiled language on macOS without using the `autobuild` command and you run the build steps yourself after the `init` step. If SIP (System Integrity Protection) is enabled, which is the default on recent versions of OSX, analysis might fail. To fix this, prefix the build command with the `$CODEQL_RUNNER` environment variable.
|
||||
For example, if your build command is `cmd arg1 arg2`, you should run `$CODEQL_RUNNER cmd arg1 arg2`.
|
||||
|
||||
1. The code is built in a container or on a separate machine. If you use a containerized build or if you outsource the build to another machine, make sure to run the {% data variables.product.prodname_codeql_runner %} in the container or on the machine where your build task takes place. For more information, see "[Running CodeQL code scanning in a container](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-a-container)."
|
||||
|
||||
@@ -8,6 +8,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
@@ -9,6 +9,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
@@ -7,5 +7,6 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
|
||||
@@ -4,6 +4,7 @@ intro: '{% data variables.product.prodname_dotcom %} makes extra security featur
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
### About {% data variables.product.prodname_GH_advanced_security %}
|
||||
@@ -36,16 +37,21 @@ For information about {% data variables.product.prodname_advanced_security %} fe
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
### Enabling {% data variables.product.prodname_advanced_security %} features on {% data variables.product.prodname_ghe_server %}
|
||||
{% if currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
### Enabling {% data variables.product.prodname_advanced_security %} features on {% data variables.product.product_name %}
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
The site administrator must enable {% data variables.product.prodname_advanced_security %} for {% data variables.product.product_location %} before you can use these features. For more information, see "[Configuring Advanced Security features](/admin/configuration/configuring-advanced-security-features)."
|
||||
{% endif %}
|
||||
|
||||
Once your system is set up, you can enable and disable these features at the organization or repository level. For more information, see "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization)" and "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
For information about purchasing a license for {% data variables.product.prodname_GH_advanced_security %}, contact {% data variables.contact.contact_enterprise_sales %}.
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion != "github-ae@latest" %}
|
||||
### Enabling {% data variables.product.prodname_advanced_security %} features on {% data variables.product.prodname_dotcom_the_website %}
|
||||
|
||||
For public repositories on {% data variables.product.prodname_dotcom_the_website %}, these features are permanently on and are only disabled if you change the visibility of the project so that the code is no longer public.
|
||||
@@ -60,3 +66,4 @@ If you have an enterprise account, license use for the enterprise is shown on yo
|
||||
|
||||
For information about purchasing a license for {% data variables.product.prodname_GH_advanced_security %}, contact {% data variables.contact.contact_enterprise_sales %}.
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
@@ -45,7 +45,7 @@ You can search for the following information across all repositories you can acc
|
||||
- [Discussions](/github/searching-for-information-on-github/searching-discussions){% endif %}
|
||||
- [Code](/articles/searching-code)
|
||||
- [Commits](/articles/searching-commits)
|
||||
- [Users](/articles/searching-users){% if currentVersion == "free-pro-team@latest" %}
|
||||
- [Users](/articles/searching-users){% if currentVersion == "free-pro-team@latest" or currentVersion == "github-ae@latest" or currentVersion ver_gt "enterprise-server@2.1" %}
|
||||
- [Packages](/github/searching-for-information-on-github/searching-for-packages){% endif %}
|
||||
- [Wikis](/articles/searching-wikis)
|
||||
|
||||
|
||||
@@ -4,6 +4,7 @@ intro: 'You can configure the retention period for {% data variables.product.pro
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.23'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.actions.about-artifact-log-retention %}
|
||||
|
||||
@@ -4,6 +4,7 @@ intro: 'Organization owners can disable, enable, and limit GitHub Actions for an
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.actions.enterprise-beta %}
|
||||
|
||||
@@ -4,10 +4,11 @@ intro: You can restrict access to your organization's assets by configuring a li
|
||||
product: '{% data reusables.gated-features.allowed-ip-addresses %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
Organization owners can manage allowed IP addresses for an organization.
|
||||
|
||||
|
||||
### About allowed IP addresses
|
||||
|
||||
You can restrict access to organization assets by configuring an allow list for specific IP addresses. {% data reusables.identity-and-permissions.ip-allow-lists-example-and-restrictions %}
|
||||
@@ -16,7 +17,7 @@ You can restrict access to organization assets by configuring an allow list for
|
||||
|
||||
{% data reusables.identity-and-permissions.ip-allow-lists-enable %}
|
||||
|
||||
You can also configure allowed IP addresses for the organizations in an enterprise account. For more information, see "[Enforcing security settings in your enterprise account](/github/setting-up-and-managing-your-enterprise/enforcing-security-settings-in-your-enterprise-account#managing-allowed-ip-addresses-for-organizations-in-your-enterprise-account)."
|
||||
You can also configure allowed IP addresses for the organizations in an enterprise account. For more information, see {% if currentVersion == "github-ae@latest" %}"[Restricting network traffic to your enterprise](/admin/configuration/restricting-network-traffic-to-your-enterprise)." {% else %}"[Enforcing security settings in your enterprise account](/github/setting-up-and-managing-your-enterprise/enforcing-security-settings-in-your-enterprise-account#managing-allowed-ip-addresses-for-organizations-in-your-enterprise-account)."{% endif %}
|
||||
|
||||
### Adding an allowed IP address
|
||||
|
||||
@@ -60,4 +61,12 @@ You can also configure allowed IP addresses for the organizations in an enterpri
|
||||
|
||||
### Using {% data variables.product.prodname_actions %} with an IP allow list
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% data reusables.github-actions.ip-allow-list-hosted-runners %}
|
||||
|
||||
{% else %}
|
||||
|
||||
{% data reusables.github-actions.ip-allow-list-self-hosted-runners %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
@@ -7,6 +7,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
### About management of security and analysis settings
|
||||
@@ -29,6 +30,8 @@ The page that's displayed allows you to enable or disable all security and analy
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@3.0" %}If you have a license for {% data variables.product.prodname_GH_advanced_security %}, the page will also contain options to enable and disable {% data variables.product.prodname_advanced_security %} features. Any repositories that use {% data variables.product.prodname_GH_advanced_security %} are listed at the bottom of the page.{% endif %}
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}The page will also contain options to enable and disable {% data variables.product.prodname_advanced_security %} features.{% endif %}
|
||||
|
||||
### Enabling or disabling a feature for all existing repositories
|
||||
|
||||
You can enable or disable features for all repositories. {% if currentVersion == "free-pro-team@latest" %}The impact of your changes on repositories in your organization is determined by their visibility:
|
||||
@@ -39,37 +42,53 @@ You can enable or disable features for all repositories. {% if currentVersion ==
|
||||
- **{% data variables.product.prodname_GH_advanced_security %}** - Your changes affect only private repositories because {% data variables.product.prodname_GH_advanced_security %} and the related features are always enabled for public repositories.
|
||||
- **{% data variables.product.prodname_secret_scanning_caps %}** - Your changes affect only private repositories where {% data variables.product.prodname_GH_advanced_security %} is also enabled. {% data variables.product.prodname_secret_scanning_caps %} is always enabled for public repositories.{% endif %}
|
||||
|
||||
{% data reusables.advanced-security.note-org-enable-uses-seats %}
|
||||
{% data reusables.advanced-security.note-org-enable-uses-seats %}
|
||||
|
||||
1. Go to the security and analysis settings for your organization. For more information, see "[Displaying the security and analysis settings](#displaying-the-security-and-analysis-settings)."
|
||||
1. Under "Configure security and analysis features", to the right of the feature, click **Disable all** or **Enable all**.
|
||||
2. Under "Configure security and analysis features", to the right of the feature, click **Disable all** or **Enable all**.
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}
|
||||
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% endif %}
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
|
||||
{% endif %}
|
||||
2. Optionally, enable the feature by default for new repositories in your organization.
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% endif %}
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
3. Optionally, enable the feature by default for new repositories in your organization.
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}
|
||||
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% endif %}
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
|
||||
{% endif %}
|
||||
3. Click **Disable FEATURE** or **Enable FEATURE** to disable or enable the feature for all the repositories in your organization.
|
||||
4. Click **Disable FEATURE** or **Enable FEATURE** to disable or enable the feature for all the repositories in your organization.
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}
|
||||
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% endif %}
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
3. Click **Enable for all eligible repositories** to enable the feature for all the new repositories in your organization that will have {% data variables.product.prodname_advanced_security %} enabled.
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Enabling or disabling a feature automatically when new repositories are added
|
||||
|
||||
1. Go to the security and analysis settings for your organization. For more information, see "[Displaying the security and analysis settings](#displaying-the-security-and-analysis-settings)."
|
||||
1. Under "Configure security and analysis features", to the right of the feature, enable or disable the feature by default for new repositories{% if currentVersion == "free-pro-team@latest" %}, or all new private repositories,{% endif %} in your organization.
|
||||
2. Under "Configure security and analysis features", to the right of the feature, enable or disable the feature by default for new repositories{% if currentVersion == "free-pro-team@latest" %}, or all new private repositories,{% endif %} in your organization.
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}
|
||||
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% endif %}
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
|
||||
{% endif %}
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% data reusables.advanced-security.note-org-enable-uses-seats %}
|
||||
|
||||
@@ -117,6 +136,6 @@ You can manage the use of {% data variables.product.prodname_GH_advanced_securit
|
||||
|
||||
- "[About securing your repository](/github/administering-a-repository/about-securing-your-repository)"
|
||||
- "[About secret scanning](/github/administering-a-repository/about-secret-scanning)"{% if currentVersion == "free-pro-team@latest" %}
|
||||
- "[Keeping your dependencies updated automatically](/github/administering-a-repository/keeping-your-dependencies-updated-automatically)"{% endif %}
|
||||
- "[Keeping your dependencies updated automatically](/github/administering-a-repository/keeping-your-dependencies-updated-automatically)"{% endif %}{% if currentVersion != "github-ae@latest" %}
|
||||
- "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)"
|
||||
- "[Managing vulnerabilities in your project's dependencies](/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies)"
|
||||
- "[Managing vulnerabilities in your project's dependencies](/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies)"{% endif %}
|
||||
|
||||
@@ -6,9 +6,10 @@ product: '{% data reusables.gated-features.pages %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
redirect_from:
|
||||
- /github/setting-up-and-managing-organizations-and-teams/disabling-publication-of-github-pages-sites-for-your-organization
|
||||
|
||||
|
||||
---
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
|
||||
@@ -116,6 +116,7 @@ Organization members can have *owner*{% if currentVersion == "free-pro-team@late
|
||||
| [View people with access to an organization repository](/articles/viewing-people-with-access-to-your-repository) | **X** | |
|
||||
| [Export a list of people with access to an organization repository](/articles/viewing-people-with-access-to-your-repository/#exporting-a-list-of-people-with-access-to-your-repository) | **X** | |{% if currentVersion ver_gt "enterprise-server@2.19" or currentVersion == "github-ae@latest" %}
|
||||
| Manage default labels (see "[Managing default labels for repositories in your organization](/articles/managing-default-labels-for-repositories-in-your-organization)") | **X** | |{% endif %}
|
||||
{% if currentVersion == "github-ae@latest" %}| Manage IP allow lists (see "[Restricting network traffic to your enterprise](/admin/configuration/restricting-network-traffic-to-your-enterprise)") | **X** | |{% endif %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
|
||||
@@ -87,10 +87,10 @@ In addition to managing organization-level settings, organization owners have ad
|
||||
| Create, edit, run, re-run, and cancel [GitHub Actions workflows](/actions/automating-your-workflow-with-github-actions/) | | | **X** | **X** | **X** |{% endif %}
|
||||
| Create and edit releases | | | **X** | **X** | **X** |
|
||||
| View draft releases | | | **X** | **X** | **X** |
|
||||
| Edit a repository's description | | | | **X** | **X** |{% if currentVersion == "free-pro-team@latest" %}
|
||||
| Edit a repository's description | | | | **X** | **X** |{% if currentVersion == "free-pro-team@latest" or currentVersion == "github-ae@latest" %}
|
||||
| [View and install packages](/packages/publishing-and-managing-packages) | **X** | **X** | **X** | **X** | **X** |
|
||||
| [Publish packages](/packages/publishing-and-managing-packages/publishing-a-package) | | | **X** | **X** | **X** |
|
||||
| [Delete packages](/packages/learn-github-packages/deleting-and-restoring-a-package) | | | | | **X** | {% endif %}
|
||||
| {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}[Delete and restore packages](/packages/learn-github-packages/deleting-and-restoring-a-package){% elsif currentVersion ver_lt "enterprise-server@3.1" or currentVersion == "github-ae@latest" %}[Delete packages](/packages/learn-github-packages/deleting-a-package){% endif %} | | | | | **X** | {% endif %}
|
||||
| Manage [topics](/articles/classifying-your-repository-with-topics) | | | | **X** | **X** |
|
||||
| Enable wikis and restrict wiki editors | | | | **X** | **X** |
|
||||
| Enable project boards | | | | **X** | **X** |
|
||||
@@ -130,22 +130,22 @@ In addition to managing organization-level settings, organization owners have ad
|
||||
| [Create new discussions and comment on existing discussions](/discussions/collaborating-with-your-community-using-discussions/participating-in-a-discussion) | **X** | **X** | **X** | **X** | **X** |
|
||||
| [Delete a discussion](/discussions/managing-discussions-for-your-community/managing-discussions-in-your-repository#deleting-a-discussion) | | | | **X** | **X** |{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" or currentVersion == "github-ae@latest" %}
|
||||
#### Permission requirements for security features
|
||||
|
||||
In this section, you can find the repository permission levels required for security features, such as {% data variables.product.prodname_dependabot %} and {% data variables.product.prodname_advanced_security %} features.
|
||||
In this section, you can find the repository permission levels required for security features, such as {% data variables.product.prodname_advanced_security %} features.
|
||||
|
||||
| Repository action | Read | Triage | Write | Maintain | Admin |
|
||||
|:---|:---:|:---:|:---:|:---:|:---:|{% if currentVersion == "free-pro-team@latest" %}
|
||||
| Receive [{% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies) in a repository | | | | | **X** |
|
||||
| [Dismiss {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository) | | | | | **X** |
|
||||
| [Designate additional people or teams to receive {% data variables.product.prodname_dependabot_alerts %}](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts) for vulnerable dependencies | | | | | **X** |
|
||||
| Create [security advisories](/github/managing-security-vulnerabilities/about-github-security-advisories) | | | | | **X** |{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
| Create [security advisories](/github/managing-security-vulnerabilities/about-github-security-advisories) | | | | | **X** |{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
| Manage access to {% data variables.product.prodname_GH_advanced_security %} features (see "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization)") | | | | | **X** |{% endif %}{% if currentVersion == "free-pro-team@latest" %}
|
||||
| [Enable the dependency graph](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-and-dependents-of-a-repository) for a private repository | | | | | **X** |
|
||||
| [View dependency reviews](/github/collaborating-with-issues-and-pull-requests/reviewing-dependency-changes-in-a-pull-request) | **X** | **X** | **X** | **X** | **X** |{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
| [View dependency reviews](/github/collaborating-with-issues-and-pull-requests/reviewing-dependency-changes-in-a-pull-request) | **X** | **X** | **X** | **X** | **X** |{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" or currentVersion == "github-ae@latest" %}
|
||||
| [View {% data variables.product.prodname_code_scanning %} alerts on pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests) | **X** | **X** | **X** | **X** | **X** |
|
||||
| [List, dismiss, and delete {% data variables.product.prodname_code_scanning %} alerts](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository) | | | **X** | **X** | **X** |{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
| [List, dismiss, and delete {% data variables.product.prodname_code_scanning %} alerts](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository) | | | **X** | **X** | **X** |{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
| [View {% data variables.product.prodname_secret_scanning %} alerts in a repository](/github/administering-a-repository/managing-alerts-from-secret-scanning) | | | | | **X** |
|
||||
| [Resolve, revoke or re-open {% data variables.product.prodname_secret_scanning %} alerts](/github/administering-a-repository/managing-alerts-from-secret-scanning) | | | | | **X** |
|
||||
| [Designate additional people or teams to receive {% data variables.product.prodname_secret_scanning %} alerts](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts) in repositories | | | | | **X** |{% endif %}
|
||||
|
||||
@@ -58,10 +58,10 @@ To search for specific events, use the `action` qualifier in your query. Actions
|
||||
| [`repo`](#repo-category-actions) | Contains activities related to the repositories owned by your organization.{% if currentVersion == "free-pro-team@latest" %}
|
||||
| [`repository_advisory`](#repository_advisory-category-actions) | Contains repository-level activities related to security advisories in the {% data variables.product.prodname_advisory_database %}. For more information, see "[About {% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
| [`repository_content_analysis`](#repository_content_analysis-category-actions) | Contains all activities related to [enabling or disabling data use for a private repository](/articles/about-github-s-use-of-your-data).{% endif %}{% if currentVersion != "github-ae@latest" %}
|
||||
| [`repository_dependency_graph`](#repository_dependency_graph-category-actions) | Contains repository-level activities related to enabling or disabling the dependency graph for a {% if currentVersion == "free-pro-team@latest" %}private {% endif %}repository. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
| [`repository_dependency_graph`](#repository_dependency_graph-category-actions) | Contains repository-level activities related to enabling or disabling the dependency graph for a {% if currentVersion == "free-pro-team@latest" %}private {% endif %}repository. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
| [`repository_secret_scanning`](#repository_secret_scanning-category-actions) | Contains repository-level activities related to secret scanning. For more information, see "[About secret scanning](/github/administering-a-repository/about-secret-scanning)." {% endif %}{% if currentVersion != "github-ae@latest" %}
|
||||
| [`repository_vulnerability_alert`](#repository_vulnerability_alert-category-actions) | Contains all activities related to [{% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies).{% endif %}{% if currentVersion == "free-pro-team@latest" %}
|
||||
| [`repository_vulnerability_alerts`](#repository_vulnerability_alerts-category-actions) | Contains repository-level configuration activities for {% data variables.product.prodname_dependabot %} alerts. {% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
| [`repository_vulnerability_alerts`](#repository_vulnerability_alerts-category-actions) | Contains repository-level configuration activities for {% data variables.product.prodname_dependabot %} alerts. {% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
| [`secret_scanning`](#secret_scanning-category-actions) | Contains organization-level configuration activities for secret scanning in existing repositories. For more information, see "[About secret scanning](/github/administering-a-repository/about-secret-scanning)."
|
||||
| [`secret_scanning_new_repos`](#secret_scanning_new_repos-category-actions) | Contains organization-level configuration activities for secret scanning for new repositories created in the organization. {% endif %}{% if currentVersion == "free-pro-team@latest" %}
|
||||
| [`sponsors`](#sponsors-category-actions) | Contains all events related to sponsor buttons (see "[Displaying a sponsor button in your repository](/articles/displaying-a-sponsor-button-in-your-repository)"){% endif %}
|
||||
@@ -530,7 +530,7 @@ For more information, see "[Managing the publication of {% data variables.produc
|
||||
| `disable` | Triggered when a repository owner or person with admin access to the repository disables the dependency graph for a {% if currentVersion == "free-pro-team@latest" %}private {% endif %}repository. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
| `enable` | Triggered when a repository owner or person with admin access to the repository enables the dependency graph for a {% if currentVersion == "free-pro-team@latest" %}private {% endif %}repository.
|
||||
|
||||
{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
#### `repository_secret_scanning` category actions
|
||||
|
||||
| Action | Description
|
||||
@@ -556,7 +556,7 @@ For more information, see "[Managing the publication of {% data variables.produc
|
||||
| `disable` | Triggered when a repository owner or person with admin access to the repository disables {% data variables.product.prodname_dependabot_alerts %}.
|
||||
| `enable` | Triggered when a repository owner or person with admin access to the repository enables {% data variables.product.prodname_dependabot_alerts %}.
|
||||
|
||||
{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
|
||||
#### `secret_scanning` category actions
|
||||
|
||||
| Action | Description
|
||||
@@ -616,7 +616,7 @@ For more information, see "[Managing the publication of {% data variables.produc
|
||||
| `disable` | Triggered when an organization owner disables team discussions for an organization. For more information, see "[Disabling team discussions for your organization](/articles/disabling-team-discussions-for-your-organization)."
|
||||
| `enable` | Triggered when an organization owner enables team discussions for an organization.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" or currentVersion == "github-ae@latest"%}
|
||||
#### `workflows` category actions
|
||||
|
||||
{% data reusables.actions.actions-audit-events-workflow %}
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
---
|
||||
title: Synchronizing a team with an identity provider group
|
||||
intro: 'You can synchronize a {% data variables.product.prodname_dotcom %} team with an identity provider (IdP) group to automatically add and remove team members.'
|
||||
intro: 'You can synchronize a {% data variables.product.product_name %} team with an identity provider (IdP) group to automatically add and remove team members.'
|
||||
product: '{% data reusables.gated-features.team-synchronization %}'
|
||||
permissions: 'Organization owners and team maintainers can synchronize a {% data variables.product.prodname_dotcom %} team with an IdP group.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.gated-features.okta-team-sync %}
|
||||
@@ -13,29 +14,36 @@ versions:
|
||||
|
||||
{% data reusables.identity-and-permissions.about-team-sync %}
|
||||
|
||||
You can connect up to five IdP groups to a {% data variables.product.prodname_dotcom %} team. An IdP group can be assigned to multiple {% data variables.product.prodname_dotcom %} teams without restriction.
|
||||
{% if currentVersion == "free-pro-team@latest" %}You can connect up to five IdP groups to a {% data variables.product.product_name %} team.{% elsif currentVersion == "github-ae@latest" %}You can connect a team on {% data variables.product.product_name %} to one IdP group. All users in the group are automatically added to the team and also added to the parent organization as members. When you disconnect a group from a team, users who became members of the organization via team membership are removed from the organization.{% endif %} You can assign an IdP group to multiple {% data variables.product.product_name %} teams.
|
||||
|
||||
Team synchronization does not support IdP groups with more than 5000 members.
|
||||
{% if currentVersion == "free-pro-team@latest" %}Team synchronization does not support IdP groups with more than 5000 members.{% endif %}
|
||||
|
||||
Once a {% data variables.product.prodname_dotcom %} team is connected to an IdP group, your IdP administrator must make team membership changes through the identity provider. You cannot manage team membership on {% data variables.product.product_name %} or using the API.
|
||||
Once a {% data variables.product.prodname_dotcom %} team is connected to an IdP group, your IdP administrator must make team membership changes through the identity provider. You cannot manage team membership on {% data variables.product.product_name %}{% if currentVersion == "free-pro-team@latest" %}or using the API{% endif %}.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
All team membership changes made through your IdP will appear in the audit log on {% data variables.product.product_name %} as changes made by the team synchronization bot. Your IdP will send team membership data to {% data variables.product.prodname_dotcom %} once every hour.
|
||||
Connecting a team to an IdP group may remove some team members. For more information, see "[Requirements for members of synchronized teams](#requirements-for-members-of-synchronized-teams)."
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
When group membership changes on your IdP, your IdP sends a SCIM request with the changes to {% data variables.product.product_name %} according to the schedule determined by your IdP. Any requests that change {% data variables.product.prodname_dotcom %} team or organization membership will register in the audit log as changes made by the account used to configure user provisioning. For more information about this account, see "[Configuring user provisioning for your enterprise](/admin/authentication/configuring-user-provisioning-for-your-enterprise)." For more information about SCIM request schedules, see "[Check the status of user provisioning](https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user)" in the Microsoft Docs.
|
||||
{% endif %}
|
||||
|
||||
Parent teams cannot synchronize with IdP groups. If the team you want to connect to an IdP group is a parent team, we recommend creating a new team or removing the nested relationships that make your team a parent team. For more information, see "[About teams](/articles/about-teams#nested-teams)," "[Creating a team](/github/setting-up-and-managing-organizations-and-teams/creating-a-team)," and "[Moving a team in your organization's hierarchy](/articles/moving-a-team-in-your-organizations-hierarchy)."
|
||||
|
||||
To manage repository access for any {% data variables.product.prodname_dotcom %} team, including teams connected to an IdP group, you must make changes with {% data variables.product.product_name %}. For more information, see "[About teams](/articles/about-teams)" and "[Managing team access to an organization repository](/articles/managing-team-access-to-an-organization-repository)."
|
||||
|
||||
You can also manage team synchronization with the API. For more information, see "[Team synchronization](/rest/reference/teams#team-sync)."
|
||||
{% if currentVersion == "free-pro-team@latest" %}You can also manage team synchronization with the API. For more information, see "[Team synchronization](/rest/reference/teams#team-sync)."{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
### Requirements for members of synchronized teams
|
||||
|
||||
After you connect a team to an IdP group, team synchronization will add each member of the IdP group to the corresponding team on {% data variables.product.prodname_dotcom %} only if:
|
||||
- The person is a member of the organization on {% data variables.product.prodname_dotcom %}.
|
||||
- The person has already logged in with their user account on {% data variables.product.prodname_dotcom %} and authenticated to the organization or enterprise account via SAML single sign-on at least once.
|
||||
After you connect a team to an IdP group, team synchronization will add each member of the IdP group to the corresponding team on {% data variables.product.product_name %} only if:
|
||||
- The person is a member of the organization on {% data variables.product.product_name %}.
|
||||
- The person has already logged in with their user account on {% data variables.product.product_name %} and authenticated to the organization or enterprise account via SAML single sign-on at least once.
|
||||
- The person's SSO identity is a member of the IdP group.
|
||||
|
||||
Existing teams or group members who do not meet these criteria will be automatically removed from the team on {% data variables.product.prodname_dotcom %} and lose access to repositories. Revoking a user's linked identity will also remove the user from from any teams mapped to IdP groups. For more information, see "[Viewing and managing a member's SAML access to your organization](/github/setting-up-and-managing-organizations-and-teams/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity)" and "[Viewing and managing a user's SAML access to your enterprise](/github/setting-up-and-managing-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise#viewing-and-revoking-a-linked-identity)."
|
||||
Existing teams or group members who do not meet these criteria will be automatically removed from the team on {% data variables.product.product_name %} and lose access to repositories. Revoking a user's linked identity will also remove the user from from any teams mapped to IdP groups. For more information, see "[Viewing and managing a member's SAML access to your organization](/github/setting-up-and-managing-organizations-and-teams/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-a-linked-identity)" and "[Viewing and managing a user's SAML access to your enterprise](/github/setting-up-and-managing-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise#viewing-and-revoking-a-linked-identity)."
|
||||
|
||||
A removed team member can be added back to a team automatically once they have authenticated to the organization or enterprise account using SSO and are moved to the connected IdP group.
|
||||
|
||||
@@ -43,32 +51,49 @@ To avoid unintentionally removing team members, we recommend enforcing SAML SSO
|
||||
|
||||
If your organization is owned by an enterprise account, enabling team synchronization for the enterprise account will override your organization-level team synchronization settings. For more information, see "[Managing team synchronization for organizations in your enterprise account](/github/setting-up-and-managing-your-enterprise/managing-team-synchronization-for-organizations-in-your-enterprise-account)."
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Prerequisites
|
||||
|
||||
Before you can connect a team with an identity provider group, an organization or enterprise owner must enable team synchronization for your organization or enterprise account. For more information, see "[Managing team synchronization for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-team-synchronization-for-your-organization)" and "[Managing team synchronization for organizations in your enterprise account](/github/setting-up-and-managing-your-enterprise/managing-team-synchronization-for-organizations-in-your-enterprise-account)."
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
Before you can connect a {% data variables.product.product_name %} team with an identity provider group, an organization or enterprise owner must enable team synchronization for your organization or enterprise account. For more information, see "[Managing team synchronization for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-team-synchronization-for-your-organization)" and "[Managing team synchronization for organizations in your enterprise account](/github/setting-up-and-managing-your-enterprise/managing-team-synchronization-for-organizations-in-your-enterprise-account)."
|
||||
|
||||
To avoid unintentionally removing team members, visit the administrative portal for your IdP and confirm that each current team member is also in the IdP groups that you want to connect to this team. If you don't have this access to your identity provider, you can reach out to your IdP administrator.
|
||||
|
||||
You must authenticate using SAML SSO. For more information, see "[Authenticating with SAML single sign-on](/articles/authenticating-with-saml-single-sign-on)."
|
||||
|
||||
{% elsif currentVersion == "github-ae@latest" %}
|
||||
Before you can connect a {% data variables.product.product_name %} team with an IdP group, you must first configure user provisioning for {% data variables.product.product_location %} using a supported System for Cross-domain Identity Management (SCIM). For more information, see "[Configuring user provisioning for your enterprise](/admin/authentication/configuring-user-provisioning-for-your-enterprise)."
|
||||
|
||||
Once user provisioning for {% data variables.product.product_name %} is configured using SCIM, you can assign the {% data variables.product.product_name %} application to every IdP group that you want to use on {% data variables.product.product_name %}. For more information, see [Configure automatic user provisioning to GitHub AE](https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/github-ae-provisioning-tutorial#step-5-configure-automatic-user-provisioning-to-github-ae) in the Microsoft Docs.
|
||||
{% endif %}
|
||||
|
||||
### Connecting an IdP group to a team
|
||||
|
||||
When you connect an IdP group to a {% data variables.product.product_name %} team, all users in the group are automatically added to the team. {% if currentVersion == "github-ae@latest" %}Any users who were not already members of the parent organization members are also added to the organization.{% endif %}
|
||||
|
||||
{% data reusables.profile.access_profile %}
|
||||
{% data reusables.profile.access_org %}
|
||||
{% data reusables.organizations.specific_team %}
|
||||
{% data reusables.organizations.team_settings %}
|
||||
5. Under "Identity Provider Groups", use the drop-down menu, and select up to 5 identity provider groups.
|
||||
|
||||
6. Click **Save changes**.
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
6. Under "Identity Provider Groups", use the drop-down menu, and select up to 5 identity provider groups.
|
||||
{% elsif currentVersion == "github-ae@latest" %}
|
||||
6. Under "Identity Provider Group", use the drop-down menu, and select an identity provider group from the list.
|
||||
{% endif %}
|
||||
7. Click **Save changes**.
|
||||
|
||||
### Disconnecting an IdP group from a team
|
||||
|
||||
If you disconnect an IdP group from a {% data variables.product.prodname_dotcom %} team, team members that were assigned to the {% data variables.product.prodname_dotcom %} team through the IdP group will be removed from the team.
|
||||
If you disconnect an IdP group from a {% data variables.product.prodname_dotcom %} team, team members that were assigned to the {% data variables.product.prodname_dotcom %} team through the IdP group will be removed from the team. {% if currentVersion == "github-ae@latest" %} Any users who were members of the parent organization only because of that team connection are also removed from the organization.{% endif %}
|
||||
|
||||
{% data reusables.profile.access_profile %}
|
||||
{% data reusables.profile.access_org %}
|
||||
{% data reusables.organizations.specific_team %}
|
||||
{% data reusables.organizations.team_settings %}
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
6. Under "Identity Provider Groups", to the right of the IdP group you want to disconnect, click {% octicon "x" aria-label="X symbol" %}.
|
||||
|
||||
{% elsif currentVersion == "github-ae@latest" %}
|
||||
6. Under "Identity Provider Group", to the right of the IdP group you want to disconnect, click {% octicon "x" aria-label="X symbol" %}.
|
||||
{% endif %}
|
||||
7. Click **Save changes**.
|
||||
|
||||
@@ -8,6 +8,7 @@ miniTocMaxHeadingLevel: 4
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.23'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.actions.about-artifact-log-retention %}
|
||||
|
||||
@@ -35,8 +35,8 @@ The repository owner has full control of the repository. In addition to the acti
|
||||
| Delete the repository | "[Deleting a repository](/github/administering-a-repository/deleting-a-repository)" |
|
||||
| Manage the repository's topics | "[Classifying your repository with topics](/github/administering-a-repository/classifying-your-repository-with-topics)" |{% if currentVersion == "free-pro-team@latest" %}
|
||||
| Manage security and analysis settings for the repository | "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" |{% endif %}{% if currentVersion == "free-pro-team@latest" %}
|
||||
| Enable the dependency graph for a private repository | "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)" |{% endif %}{% if currentVersion == "free-pro-team@latest" %}
|
||||
| Delete packages | "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)" |{% endif %}
|
||||
| Enable the dependency graph for a private repository | "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)" |{% endif %}
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}| Delete and restore packages | "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)" |{% elsif currentVersion ver_lt "enterprise-server@3.1" or currentVersion == "github-ae@latest" %}| Delete packages | "[Deleting packages](/packages/learn-github-packages/deleting-a-package)" |{% endif %}
|
||||
| Customize the repository's social media preview | "[Customizing your repository's social media preview](/github/administering-a-repository/customizing-your-repositorys-social-media-preview)" |
|
||||
| Create a template from the repository | "[Creating a template repository](/github/creating-cloning-and-archiving-repositories/creating-a-template-repository)" |{% if currentVersion == "free-pro-team@latest" or enterpriseServerVersions contains currentVersion %}
|
||||
| Receive {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %} for vulnerable dependencies | "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" |{% endif %}{% if currentVersion == "free-pro-team@latest" %}
|
||||
@@ -76,7 +76,7 @@ Collaborators can also perform the following actions.
|
||||
| Submit a review on a pull request that affects the mergeability of the pull request | "[Reviewing proposed changes in a pull request](/github/collaborating-with-issues-and-pull-requests/reviewing-proposed-changes-in-a-pull-request)" |
|
||||
| Create and edit a wiki for the repository | "[About wikis](/github/building-a-strong-community/about-wikis)" |
|
||||
| Create and edit releases for the repository | "[Managing releases in a repository](/github/administering-a-repository/managing-releases-in-a-repository)" |
|
||||
| Act as a code owner for the repository | "[About code owners](/articles/about-code-owners)" |{% if currentVersion == "free-pro-team@latest" %}
|
||||
| Act as a code owner for the repository | "[About code owners](/articles/about-code-owners)" |{% if currentVersion == "free-pro-team@latest" or currentVersion == "github-ae@latest" %}
|
||||
| Publish, view, or install packages | "[Publishing and managing packages](/github/managing-packages-with-github-packages/publishing-and-managing-packages)" |{% endif %}
|
||||
| Remove themselves as collaborators on the repository | "[Removing yourself from a collaborator's repository](/github/setting-up-and-managing-your-github-user-account/removing-yourself-from-a-collaborators-repository)" |
|
||||
|
||||
|
||||
Reference in New Issue
Block a user