use azure blob storage for archived enterprise versions (#31883)
Co-authored-by: Laura Coursen <lecoursen@github.com> Co-authored-by: mchammer01 <42146119+mchammer01@users.noreply.github.com>
This commit is contained in:
Rachael Sewell
@@ -47,7 +47,7 @@ As a first step, you want to make a complete inventory of your dependencies. The
|
||||
|
||||
### Automatic detection of vulnerabilities in dependencies
|
||||
|
||||
{% data variables.product.prodname_dependabot %} can help you by monitoring your dependencies and notifying you when they contain a known vulnerability. {% ifversion fpt or ghec or ghes > 3.2 %}You can even enable {% data variables.product.prodname_dependabot %} to automatically raise pull requests that update the dependency to a secure version.{% endif %} For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts)"{% ifversion fpt or ghec or ghes > 3.2 %} and "[About Dependabot security updates](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)"{% endif %}.
|
||||
{% data variables.product.prodname_dependabot %} can help you by monitoring your dependencies and notifying you when they contain a known vulnerability. {% ifversion fpt or ghec or ghes %}You can even enable {% data variables.product.prodname_dependabot %} to automatically raise pull requests that update the dependency to a secure version.{% endif %} For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts)"{% ifversion fpt or ghec or ghes %} and "[About Dependabot security updates](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)"{% endif %}.
|
||||
|
||||
### Assessment of exposure to risk from a vulnerable dependency
|
||||
|
||||
@@ -81,15 +81,13 @@ If your organization uses {% data variables.product.prodname_GH_advanced_securit
|
||||
You can configure {% data variables.product.prodname_secret_scanning %} to check for secrets issued by many service providers and to notify you when any are detected. You can also define custom patterns to detect additional secrets at the repository, organization, or enterprise level. For more information, see "[About secret scanning](/code-security/secret-scanning/about-secret-scanning)" and "[Secret scanning patterns](/code-security/secret-scanning/secret-scanning-patterns)."
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec or ghes > 3.2 or ghae %}
|
||||
### Secure storage of secrets you use in {% data variables.product.product_name %}
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
Besides your code, you probably need to use secrets in other places. For example, to allow {% data variables.product.prodname_actions %} workflows, {% data variables.product.prodname_dependabot %}, or your {% data variables.product.prodname_github_codespaces %} development environment to communicate with other systems. For more information on how to securely store and use secrets, see "[Encrypted secrets in Actions](/actions/security-guides/encrypted-secrets)," "[Managing encrypted secrets for Dependabot](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot)," and "[Managing encrypted secrets for your codespaces](/codespaces/managing-your-codespaces/managing-encrypted-secrets-for-your-codespaces)."
|
||||
{% endif %}
|
||||
|
||||
{% ifversion ghes > 3.2 or ghae %}
|
||||
{% ifversion ghes or ghae %}
|
||||
Besides your code, you probably need to use secrets in other places. For example, to allow {% data variables.product.prodname_actions %} workflows{% ifversion ghes %} or {% data variables.product.prodname_dependabot %}{% endif %} to communicate with other systems. For more information on how to securely store and use secrets, see "[Encrypted secrets in Actions](/actions/security-guides/encrypted-secrets){% ifversion ghes %}" and "[Managing encrypted secrets for Dependabot](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot)."{% else %}."{% endif %}
|
||||
{% endif %}
|
||||
|
||||
|
||||
@@ -19,8 +19,6 @@ redirect_from:
|
||||
- /code-security/supply-chain-security/about-dependency-review
|
||||
---
|
||||
|
||||
{% data reusables.dependency-review.beta %}
|
||||
|
||||
## About dependency review
|
||||
|
||||
{% data reusables.dependency-review.feature-overview %}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: About supply chain security
|
||||
intro: '{% data variables.product.product_name %} helps you secure your supply chain, from understanding the dependencies in your environment, to knowing about vulnerabilities in those dependencies{% ifversion fpt or ghec or ghes > 3.2 %}, and patching them{% endif %}.'
|
||||
intro: '{% data variables.product.product_name %} helps you secure your supply chain, from understanding the dependencies in your environment, to knowing about vulnerabilities in those dependencies{% ifversion fpt or ghec or ghes %}, and patching them{% endif %}.'
|
||||
miniTocMaxHeadingLevel: 3
|
||||
shortTitle: Supply chain security
|
||||
redirect_from:
|
||||
@@ -27,13 +27,13 @@ With the accelerated use of open source, most projects depend on hundreds of ope
|
||||
|
||||
You add dependencies directly to your supply chain when you specify them in a manifest file or a lockfile. Dependencies can also be included transitively, that is, even if you don’t specify a particular dependency, but a dependency of yours uses it, then you’re also dependent on that dependency.
|
||||
|
||||
{% data variables.product.product_name %} offers a range of features to help you understand the dependencies in your environment{% ifversion ghes < 3.3 or ghae %} and know about vulnerabilities in those dependencies{% endif %}{% ifversion fpt or ghec or ghes > 3.2 %}, know about vulnerabilities in those dependencies, and patch them{% endif %}.
|
||||
{% data variables.product.product_name %} offers a range of features to help you understand the dependencies in your environment{% ifversion ghae %} and know about vulnerabilities in those dependencies{% endif %}{% ifversion fpt or ghec or ghes %}, know about vulnerabilities in those dependencies, and patch them{% endif %}.
|
||||
|
||||
The supply chain features on {% data variables.product.product_name %} are:
|
||||
- **Dependency graph**
|
||||
- **Dependency review**
|
||||
- **{% data variables.product.prodname_dependabot_alerts %} **
|
||||
{% ifversion fpt or ghec or ghes > 3.2 %}- **{% data variables.product.prodname_dependabot_updates %}**
|
||||
{% ifversion fpt or ghec or ghes %}- **{% data variables.product.prodname_dependabot_updates %}**
|
||||
- **{% data variables.product.prodname_dependabot_security_updates %}**
|
||||
- **{% data variables.product.prodname_dependabot_version_updates %}**{% endif %}
|
||||
|
||||
@@ -43,7 +43,7 @@ Other supply chain features on {% data variables.product.prodname_dotcom %} rely
|
||||
|
||||
- Dependency review uses the dependency graph to identify dependency changes and help you understand the security impact of these changes when you review pull requests.
|
||||
- {% data variables.product.prodname_dependabot %} cross-references dependency data provided by the dependency graph with the list of advisories published in the {% data variables.product.prodname_advisory_database %}, scans your dependencies and generates {% data variables.product.prodname_dependabot_alerts %} when a potential vulnerability {% ifversion GH-advisory-db-supports-malware %}or malware{% endif %} is detected.
|
||||
{% ifversion fpt or ghec or ghes > 3.2 %}- {% data variables.product.prodname_dependabot_security_updates %} use the dependency graph and {% data variables.product.prodname_dependabot_alerts %} to help you update dependencies with known vulnerabilities in your repository.
|
||||
{% ifversion fpt or ghec or ghes %}- {% data variables.product.prodname_dependabot_security_updates %} use the dependency graph and {% data variables.product.prodname_dependabot_alerts %} to help you update dependencies with known vulnerabilities in your repository.
|
||||
|
||||
{% data variables.product.prodname_dependabot_version_updates %} don't use the dependency graph and rely on the semantic versioning of dependencies instead. {% data variables.product.prodname_dependabot_version_updates %} help you keep your dependencies updated, even when they don’t have any vulnerabilities.
|
||||
{% endif %}
|
||||
@@ -79,9 +79,9 @@ For more information about dependency review, see "[About dependency review](/co
|
||||
|
||||
### What is Dependabot
|
||||
|
||||
{% data variables.product.prodname_dependabot %} keeps your dependencies up to date by informing you of any security vulnerabilities in your dependencies{% ifversion fpt or ghec or ghes > 3.2 %}, and automatically opens pull requests to upgrade your dependencies to the next available secure version when a {% data variables.product.prodname_dependabot %} alert is triggered, or to the latest version when a release is published{% else %} so that you can update that dependency{% endif %}.
|
||||
{% data variables.product.prodname_dependabot %} keeps your dependencies up to date by informing you of any security vulnerabilities in your dependencies{% ifversion fpt or ghec or ghes %}, and automatically opens pull requests to upgrade your dependencies to the next available secure version when a {% data variables.product.prodname_dependabot %} alert is triggered, or to the latest version when a release is published{% else %} so that you can update that dependency{% endif %}.
|
||||
|
||||
{% ifversion fpt or ghec or ghes > 3.2 %}
|
||||
{% ifversion fpt or ghec or ghes %}
|
||||
The term "{% data variables.product.prodname_dependabot %}" encompasses the following features:
|
||||
- {% data variables.product.prodname_dependabot_alerts %}—Displayed notification on the **Security** tab for the repository, and in the repository's dependency graph. The alert includes a link to the affected file in the project, and information about a fixed version.
|
||||
- {% data variables.product.prodname_dependabot_updates %}:
|
||||
@@ -117,7 +117,7 @@ The term "{% data variables.product.prodname_dependabot %}" encompasses the foll
|
||||
|
||||
For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)."
|
||||
|
||||
{% ifversion fpt or ghec or ghes > 3.2 %}
|
||||
{% ifversion fpt or ghec or ghes %}
|
||||
#### What are Dependabot updates
|
||||
|
||||
There are two types of {% data variables.product.prodname_dependabot_updates %}: {% data variables.product.prodname_dependabot %} _security_ updates and _version_ updates. {% data variables.product.prodname_dependabot %} generates automatic pull requests to update your dependencies in both cases, but there are several differences.
|
||||
@@ -166,7 +166,7 @@ Any repository type:
|
||||
- **Dependency graph** and **{% data variables.product.prodname_dependabot_alerts %}**—not enabled by default. Both features are configured at an enterprise level by the enterprise owner. For more information, see {% ifversion ghes %}"[Enabling the dependency graph for your enterprise](/admin/code-security/managing-supply-chain-security-for-your-enterprise/enabling-the-dependency-graph-for-your-enterprise)" and {% endif %}"[Enabling {% data variables.product.prodname_dependabot %} for your enterprise](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise)."
|
||||
- **Dependency review**—available when dependency graph is enabled for {% data variables.location.product_location %} and {% data variables.product.prodname_advanced_security %} is enabled for the organization or repository. For more information, see "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)."
|
||||
{% endif %}
|
||||
{% ifversion ghes > 3.2 %}
|
||||
{% ifversion ghes %}
|
||||
- **{% data variables.product.prodname_dependabot_security_updates %}**—not enabled by default. You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For information about enabling security updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates)."
|
||||
- **{% data variables.product.prodname_dependabot_version_updates %}**—not enabled by default. People with write permissions to a repository can enable {% data variables.product.prodname_dependabot_version_updates %}. For information about enabling version updates, see "[Configuring {% data variables.product.prodname_dependabot_version_updates %}](/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates)."
|
||||
{% endif %}
|
||||
|
||||
@@ -79,11 +79,7 @@ The recommended formats explicitly define which versions are used for all direct
|
||||
{%- ifversion github-actions-in-dependency-graph %}
|
||||
| {% data variables.product.prodname_actions %} workflows<sup>[†]</sup> | YAML | `.yml`, `.yaml` | `.yml`, `.yaml` |
|
||||
{%- endif %}
|
||||
{%- ifversion fpt or ghec or ghes > 3.2 or ghae %}
|
||||
| Go modules | Go | `go.sum` | `go.mod`, `go.sum` |
|
||||
{%- elsif ghes = 3.2 %}
|
||||
| Go modules | Go | `go.mod` | `go.mod` |
|
||||
{%- endif %}
|
||||
| Maven | Java, Scala | `pom.xml` | `pom.xml` |
|
||||
| npm | JavaScript | `package-lock.json` | `package-lock.json`, `package.json`|
|
||||
| pip | Python | `requirements.txt`, `pipfile.lock` | `requirements.txt`, `pipfile`, `pipfile.lock`, `setup.py`<sup>[‡]</sup> |
|
||||
|
||||
@@ -4,7 +4,7 @@ intro: You can use dependency review to catch vulnerabilities before they are ad
|
||||
shortTitle: Configure dependency review
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '>= 3.2'
|
||||
ghes: '*'
|
||||
ghae: '*'
|
||||
ghec: '*'
|
||||
type: how_to
|
||||
@@ -16,8 +16,6 @@ topics:
|
||||
- Pull requests
|
||||
---
|
||||
|
||||
{% data reusables.dependency-review.beta %}
|
||||
|
||||
## About dependency review
|
||||
|
||||
{% data reusables.dependency-review.feature-overview %}
|
||||
@@ -46,8 +44,7 @@ Dependency review is available when dependency graph is enabled for {% data vari
|
||||
{% data reusables.repositories.sidebar-settings %}
|
||||
{% data reusables.repositories.navigate-to-code-security-and-analysis %}
|
||||
1. Under "Configure security and analysis features", check if the dependency graph is enabled.
|
||||
1. If dependency graph is enabled, click **Enable** next to "{% data variables.product.prodname_GH_advanced_security %}" to enable {% data variables.product.prodname_advanced_security %}, including dependency review. The enable button is disabled if your enterprise has no available licenses for {% data variables.product.prodname_advanced_security %}.{% ifversion ghes < 3.3 %}
|
||||
{% endif %}{% ifversion ghes > 3.2 %}
|
||||
1. If dependency graph is enabled, click **Enable** next to "{% data variables.product.prodname_GH_advanced_security %}" to enable {% data variables.product.prodname_advanced_security %}, including dependency review. The enable button is disabled if your enterprise has no available licenses for {% data variables.product.prodname_advanced_security %}.{% ifversion ghes %}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
@@ -62,5 +62,5 @@ Yes, the dependency graph has two categories of limits:
|
||||
|
||||
- "[About the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)"
|
||||
- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"
|
||||
- "[Troubleshooting the detection of vulnerable dependencies](/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies)"{% ifversion fpt or ghec or ghes > 3.2 %}
|
||||
- "[Troubleshooting the detection of vulnerable dependencies](/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies)"{% ifversion fpt or ghec or ghes %}
|
||||
- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"{% endif %}
|
||||
|
||||
Reference in New Issue
Block a user