diff --git a/content/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners.md b/content/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners.md index 6e20859156..6bc28e5c75 100644 --- a/content/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners.md +++ b/content/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners.md @@ -58,10 +58,10 @@ The {% data variables.product.prodname_actions %} service will then automaticall By default, self-hosted runners will automatically perform a software update whenever a new version of the runner software is available. If you use ephemeral runners in containers then this can lead to repeated software updates when a new runner version is released. Turning off automatic updates allows you to update the runner version on the container image directly on your own schedule. -If you want to turn off automatic software updates and install software updates yourself, you can specify the `--disableupdate` parameter when starting the runner. For example: +To turn off automatic software updates and install software updates yourself, specify the `--disableupdate` flag when registering your runner using `config.sh`. For example: ```shell -./run.sh --disableupdate +./config.sh --url https://github.com/octo-org --token example-token --disableupdate ``` If you disable automatic updates, you must still update your runner version regularly. New functionality in {% data variables.product.prodname_actions %} requires changes in both the {% data variables.product.prodname_actions %} service _and_ the runner software. The runner may not be able to correctly process jobs that take advantage of new features in {% data variables.product.prodname_actions %} without a software update. diff --git a/content/actions/security-guides/security-hardening-for-github-actions.md b/content/actions/security-guides/security-hardening-for-github-actions.md index 63f865b05d..efbb783477 100644 --- a/content/actions/security-guides/security-hardening-for-github-actions.md +++ b/content/actions/security-guides/security-hardening-for-github-actions.md @@ -48,6 +48,12 @@ To help prevent accidental disclosure, {% data variables.product.product_name %} - **Consider requiring review for access to secrets** - You can use required reviewers to protect environment secrets. A workflow job cannot access environment secrets until approval is granted by a reviewer. For more information about storing secrets in environments or requiring reviews for environments, see "[Encrypted secrets](/actions/reference/encrypted-secrets)" and "[Using environments for deployment](/actions/deployment/using-environments-for-deployment)." +{% warning %} + +**Warning**: Any user with write access to your repository has read access to all secrets configured in your repository. Therefore, you should ensure that the credentials being used within workflows have the least privileges required. + +{% endwarning %} + ## Using `CODEOWNERS` to monitor changes You can use the `CODEOWNERS` feature to control how changes are made to your workflow files. For example, if all your workflow files are stored in `.github/workflows`, you can add this directory to the code owners list, so that any proposed changes to these files will first require approval from a designated reviewer. diff --git a/content/rest/overview/libraries.md b/content/rest/overview/libraries.md index 0128487f72..0dec46d608 100644 --- a/content/rest/overview/libraries.md +++ b/content/rest/overview/libraries.md @@ -18,12 +18,18 @@ topics:

Octokit comes in many flavors

Use the official Octokit library, or choose between any of the available third party libraries.

+{% warning %} + +Warning: As of late October 2021, the offical Octokit libraries are not currently maintained. + +{% endwarning %} + # Third-party libraries ### Clojure