jprdonnelly/docs
1
0
Fork 0
mirror of synced 2025-12-19 18:10:59 -05:00
Code Issues Projects Releases Wiki Activity

Deprecate GHES 3.1 (#28798)

Browse Source 
* add 3.1 to deprecated versions

* rewrite img src to use azure blob storage in archive script

Co-authored-by: rachmari <rachmari@users.noreply.github.com>

* remove static files for ghes 3.1

* remove liquid conditionals and content for ghes 3.1

* remove outdated hardware reqs reusable

* Fix liquid conditional uncaught by script

* Close liquid conditionals missed by script

* Apply @mattpollard's suggestions

Co-authored-by: Matt Pollard <mattpollard@users.noreply.github.com>

Co-authored-by: rachmari <rachmari@users.noreply.github.com>
Co-authored-by: Matt Pollard <mattpollard@users.noreply.github.com>
This commit is contained in:
Hector Alfaro
2022-07-11 17:17:09 -04:00
committed by GitHub
parent efaf5f825d
commit 95e6f3d3ab
672 changed files with 873 additions and 1047890 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md
View File

@@ -129,9 +129,9 @@ Email notifications from {% data variables.product.product_location %} contain t
| --- | --- |
| `From` address | This address will always be {% ifversion fpt or ghec %}'`notifications@github.com`'{% else %}'the no-reply email address configured by your site administrator'{% endif %}. |
| `To` field | This field connects directly to the thread.{% ifversion not ghae %} If you reply to the email, you'll add a new comment to the conversation.{% endif %} |
| `Cc` address | {% data variables.product.product_name %} will `Cc` you if you're subscribed to a conversation. The second `Cc` email address matches the notification reason. The suffix for these notification reasons is {% data variables.notifications.cc_address %}. The possible notification reasons are: <ul><li>`assign`: You were assigned to an issue or pull request.</li><li>`author`: You created an issue or pull request.</li><li>`ci_activity`: A {% data variables.product.prodname_actions %} workflow run that you triggered was completed.</li><li>`comment`: You commented on an issue or pull request.</li><li>`manual`: There was an update to an issue or pull request you manually subscribed to.</li><li>`mention`: You were mentioned on an issue or pull request.</li><li>`push`: Someone committed to a pull request you're subscribed to.</li><li>`review_requested`: You or a team you're a member of was requested to review a pull request.</li>{% ifversion fpt or ghes or ghae or ghec %}<li>`security_alert`: {% data variables.product.prodname_dotcom %} detected a vulnerability in a repository you receive alerts for.</li>{% endif %}<li>`state_change`: An issue or pull request you're subscribed to was either closed or opened.</li><li>`subscribed`: There was an update in a repository you're watching.</li><li>`team_mention`: A team you belong to was mentioned on an issue or pull request.</li><li>`your_activity`: You opened, commented on, or closed an issue or pull request.</li></ul> |
| `mailing list` field | This field identifies the name of the repository and its owner. The format of this address is always `<repository name>.<repository owner>.{% data variables.command_line.backticks %}`. |{% ifversion fpt or ghes or ghae or ghec %}
| `X-GitHub-Severity` field | {% data reusables.repositories.security-alerts-x-github-severity %} The possible severity levels are:<ul><li>`low`</li><li>`moderate`</li><li>`high`</li><li>`critical`</li></ul>For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." |{% endif %}
| `Cc` address | {% data variables.product.product_name %} will `Cc` you if you're subscribed to a conversation. The second `Cc` email address matches the notification reason. The suffix for these notification reasons is {% data variables.notifications.cc_address %}. The possible notification reasons are: <ul><li>`assign`: You were assigned to an issue or pull request.</li><li>`author`: You created an issue or pull request.</li><li>`ci_activity`: A {% data variables.product.prodname_actions %} workflow run that you triggered was completed.</li><li>`comment`: You commented on an issue or pull request.</li><li>`manual`: There was an update to an issue or pull request you manually subscribed to.</li><li>`mention`: You were mentioned on an issue or pull request.</li><li>`push`: Someone committed to a pull request you're subscribed to.</li><li>`review_requested`: You or a team you're a member of was requested to review a pull request.</li><li>`security_alert`: {% data variables.product.prodname_dotcom %} detected a vulnerability in a repository you receive alerts for.</li><li>`state_change`: An issue or pull request you're subscribed to was either closed or opened.</li><li>`subscribed`: There was an update in a repository you're watching.</li><li>`team_mention`: A team you belong to was mentioned on an issue or pull request.</li><li>`your_activity`: You opened, commented on, or closed an issue or pull request.</li></ul> |
| `mailing list` field | This field identifies the name of the repository and its owner. The format of this address is always `<repository name>.<repository owner>.{% data variables.command_line.backticks %}`. |
| `X-GitHub-Severity` field | {% data reusables.repositories.security-alerts-x-github-severity %} The possible severity levels are:<ul><li>`low`</li><li>`moderate`</li><li>`high`</li><li>`critical`</li></ul>For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." |
## Choosing your notification settings
@@ -139,8 +139,8 @@ Email notifications from {% data variables.product.product_location %} contain t
{% data reusables.notifications-v2.manage-notifications %}
3. On the notifications settings page, choose how you receive notifications when:
- There are updates in repositories or team discussions you're watching or in a conversation you're participating in. For more information, see "[About participating and watching notifications](#about-participating-and-watching-notifications)."
- You gain access to a new repository or you've joined a new team. For more information, see "[Automatic watching](#automatic-watching)."{% ifversion fpt or ghes or ghae or ghec %}
- There are new {% data variables.product.prodname_dependabot_alerts %} in your repository. For more information, see "[{% data variables.product.prodname_dependabot_alerts %} notification options](#dependabot-alerts-notification-options)." {% endif %} {% ifversion fpt or ghec %}
- You gain access to a new repository or you've joined a new team. For more information, see "[Automatic watching](#automatic-watching)."
- There are new {% data variables.product.prodname_dependabot_alerts %} in your repository. For more information, see "[{% data variables.product.prodname_dependabot_alerts %} notification options](#dependabot-alerts-notification-options)." {% ifversion fpt or ghec %}
- There are workflow runs updates on repositories set up with {% data variables.product.prodname_actions %}. For more information, see "[{% data variables.product.prodname_actions %} notification options](#github-actions-notification-options)."{% endif %}{% ifversion fpt or ghec or ghes > 3.3 or ghae-issue-5668 %}
- There are new deploy keys added to repositories that belong to organizations that you're an owner of. For more information, see "[Organization alerts notification options](#organization-alerts-notification-options)."{% endif %}
@@ -194,7 +194,6 @@ If you are a member of more than one organization, you can configure each one to
5. Select one of your verified email addresses, then click **Save**.
![Switching your per-org email address](/assets/images/help/notifications/notifications_switching_org_email.gif)
{% ifversion fpt or ghes or ghae or ghec %}
## {% data variables.product.prodname_dependabot_alerts %} notification options
{% data reusables.notifications.vulnerable-dependency-notification-enable %}
@@ -202,7 +201,6 @@ If you are a member of more than one organization, you can configure each one to
{% data reusables.notifications.vulnerable-dependency-notification-options %}
For more information about the notification delivery methods available to you, and advice on optimizing your notifications for {% data variables.product.prodname_dependabot_alerts %}, see "[Configuring notifications for {% data variables.product.prodname_dependabot_alerts %}](/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts)."
{% endif %}
{% ifversion fpt or ghes or ghec %}
## {% data variables.product.prodname_actions %} notification options

12
content/account-and-profile/managing-subscriptions-and-notifications-on-github/viewing-and-triaging-notifications/managing-notifications-from-your-inbox.md
View File

@@ -112,15 +112,13 @@ To filter notifications for specific activity on {% data variables.product.produ
- `is:gist`
- `is:issue-or-pull-request`
- `is:release`
- `is:repository-invitation`{% ifversion fpt or ghes or ghae or ghec %}
- `is:repository-vulnerability-alert`{% endif %}{% ifversion fpt or ghec %}
- `is:repository-invitation`
- `is:repository-vulnerability-alert`{% ifversion fpt or ghec %}
- `is:repository-advisory`{% endif %}
- `is:team-discussion`{% ifversion fpt or ghec %}
- `is:discussion`{% endif %}
{% ifversion fpt or ghes or ghae or ghec %}
For information about reducing noise from notifications for {% data variables.product.prodname_dependabot_alerts %}, see "[Configuring notifications for {% data variables.product.prodname_dependabot_alerts %}](/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts)."
{% endif %}
You can also use the `is:` query to describe how the notification was triaged.
@@ -142,8 +140,8 @@ To filter notifications by why you've received an update, you can use the `reaso
| `reason:invitation` | When you're invited to a team, organization, or repository.
| `reason:manual` | When you click **Subscribe** on an issue or pull request you weren't already subscribed to.
| `reason:mention` | You were directly @mentioned.
| `reason:review-requested` | You or a team you're on have been requested to review a pull request.{% ifversion fpt or ghes or ghae or ghec %}
| `reason:security-alert` | When a security alert is issued for a repository.{% endif %}
| `reason:review-requested` | You or a team you're on have been requested to review a pull request.
| `reason:security-alert` | When a security alert is issued for a repository.
| `reason:state-change` | When the state of a pull request or issue is changed. For example, an issue is closed or a pull request is merged.
| `reason:team-mention` | When a team you're a member of is @mentioned.
| `reason:ci-activity` | When a repository has a CI update, such as a new workflow run status.
@@ -161,7 +159,6 @@ For example, to see notifications from the octo-org organization, use `org:octo-
{% endif %}
{% ifversion fpt or ghes or ghae or ghec %}
## {% data variables.product.prodname_dependabot %} custom filters
{% ifversion fpt or ghec or ghes > 3.2 %}
@@ -182,4 +179,3 @@ If you use {% data variables.product.prodname_dependabot %} to tell you about in
For more information about {% data variables.product.prodname_dependabot %}, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
{% endif %}
{% endif %}

2
content/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/about-your-organizations-profile.md
View File

@@ -20,7 +20,7 @@ You can optionally choose to add a description, location, website, and email add
{% ifversion fpt %}
Organizations that use {% data variables.product.prodname_ghe_cloud %} can confirm their organization's identity and display a "Verified" badge on their organization's profile page by verifying the organization's domains with {% data variables.product.product_name %}. For more information, see "[Verifying or approving a domain for your organization](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization)" in the {% data variables.product.prodname_ghe_cloud %} documenatation.
{% elsif ghec or ghes > 3.1 %}
{% elsif ghec or ghes %}
To confirm your organization's identity and display a "Verified" badge on your organization profile page, you can verify your organization's domains with {% data variables.product.prodname_dotcom %}. For more information, see "[Verifying or approving a domain for your organization](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization)."
{% endif %}

2
content/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/setting-your-profile-to-private.md
View File

@@ -1,6 +1,6 @@
---
title: Setting your profile to private
intro: A private profile displays only limited information, and hides some activity.
intro: 'A private profile displays only limited information, and hides some activity.'
versions:
fpt: '*'
topics:

2
content/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-personal-account-settings/managing-your-theme-settings.md
View File

@@ -4,7 +4,7 @@ intro: 'You can manage how {% data variables.product.product_name %} looks to yo
versions:
fpt: '*'
ghae: '*'
ghes: '>=3.2'
ghes: '*'
ghec: '*'
topics:
- Accounts

12
content/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-personal-account-settings/permission-levels-for-a-personal-account-repository.md
View File

@@ -41,11 +41,11 @@ The repository owner has full control of the repository. In addition to the acti
| Delete the repository | "[Deleting a repository](/repositories/creating-and-managing-repositories/deleting-a-repository)" |
| Manage the repository's topics | "[Classifying your repository with topics](/github/administering-a-repository/classifying-your-repository-with-topics)" |{% ifversion fpt or ghec %}
| Manage security and analysis settings for the repository | "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" |{% endif %}{% ifversion fpt or ghec %}
| Enable the dependency graph for a private repository | "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)" |{% endif %}{% ifversion fpt or ghes > 3.1 or ghec or ghae %}
| Delete and restore packages | "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)" |{% endif %}
| Enable the dependency graph for a private repository | "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)" |{% endif %}
| Delete and restore packages | "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)" |
| Customize the repository's social media preview | "[Customizing your repository's social media preview](/github/administering-a-repository/customizing-your-repositorys-social-media-preview)" |
| Create a template from the repository | "[Creating a template repository](/github/creating-cloning-and-archiving-repositories/creating-a-template-repository)" |{% ifversion fpt or ghes or ghae or ghec %}
| Control access to {% data variables.product.prodname_dependabot_alerts %}| "[Managing security and analysis settings for your repository](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)" |{% endif %}{% ifversion fpt or ghec %}
| Create a template from the repository | "[Creating a template repository](/github/creating-cloning-and-archiving-repositories/creating-a-template-repository)" |
| Control access to {% data variables.product.prodname_dependabot_alerts %}| "[Managing security and analysis settings for your repository](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)" |{% ifversion fpt or ghec %}
| Dismiss {% data variables.product.prodname_dependabot_alerts %} in the repository | "[Viewing and updating {% data variables.product.prodname_dependabot_alerts %}](/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts)" |
| Manage data use for a private repository | "[Managing data use settings for your private repository](/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository)"|{% endif %}
| Define code owners for the repository | "[About code owners](/github/creating-cloning-and-archiving-repositories/about-code-owners)" |
@@ -68,8 +68,8 @@ Collaborators can also perform the following actions.
| Action | More information |
| :- | :- |
| Fork the repository | "[About forks](/pull-requests/collaborating-with-pull-requests/working-with-forks/about-forks)" |{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
| Rename a branch other than the default branch | "[Renaming a branch](/github/administering-a-repository/renaming-a-branch)" |{% endif %}
| Fork the repository | "[About forks](/pull-requests/collaborating-with-pull-requests/working-with-forks/about-forks)" |
| Rename a branch other than the default branch | "[Renaming a branch](/github/administering-a-repository/renaming-a-branch)" |
| Create, edit, and delete comments on commits, pull requests, and issues in the repository | <ul><li>"[About issues](/github/managing-your-work-on-github/about-issues)"</li><li>"[Commenting on a pull request](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/commenting-on-a-pull-request)"</li><li>"[Managing disruptive comments](/communities/moderating-comments-and-conversations/managing-disruptive-comments)"</li></ul> |
| Create, assign, close, and re-open issues in the repository | "[Managing your work with issues](/github/managing-your-work-on-github/managing-your-work-with-issues)" |
| Manage labels for issues and pull requests in the repository | "[Labeling issues and pull requests](/github/managing-your-work-on-github/labeling-issues-and-pull-requests)" |

5
content/actions/automating-builds-and-tests/building-and-testing-net.md
View File

@@ -179,7 +179,6 @@ After a workflow completes, you can upload the resulting artifacts for analysis.
For more information, see "[Persisting workflow data using artifacts](/github/automating-your-workflow-with-github-actions/persisting-workflow-data-using-artifacts)."
```yaml
name: dotnet package
@@ -225,10 +224,10 @@ on:
jobs:
deploy:
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
packages: write
contents: read{% endif %}
contents: read
steps:
- uses: {% data reusables.actions.action-checkout %}
- uses: {% data reusables.actions.action-setup-dotnet %}

4
content/actions/automating-builds-and-tests/building-and-testing-ruby.md
View File

@@ -279,10 +279,10 @@ on:
jobs:
build:
name: Build + Publish
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
packages: write
contents: read{% endif %}
contents: read
steps:
- uses: {% data reusables.actions.action-checkout %}

2
content/actions/deployment/about-deployments/about-continuous-deployment.md
View File

@@ -29,7 +29,7 @@ You can set up a {% data variables.product.prodname_actions %} workflow to deplo
You can configure your CD workflow to run when a {% data variables.product.product_name %} event occurs (for example, when new code is pushed to the default branch of your repository), on a set schedule, manually, or when an external event occurs using the repository dispatch webhook. For more information about when your workflow can run, see "[Events that trigger workflows](/actions/reference/events-that-trigger-workflows)."
{% data variables.product.prodname_actions %} provides features that give you more control over deployments. For example, you can use environments to require approval for a job to proceed, restrict which branches can trigger a workflow, or limit access to secrets. {% ifversion fpt or ghae or ghes > 3.1 or ghec %}You can use concurrency to limit your CD pipeline to a maximum of one in-progress deployment and one pending deployment. {% endif %}For more information about these features, see "[Deploying with GitHub Actions](/actions/deployment/deploying-with-github-actions)" and "[Using environments for deployment](/actions/deployment/using-environments-for-deployment)."
{% data variables.product.prodname_actions %} provides features that give you more control over deployments. For example, you can use environments to require approval for a job to proceed, restrict which branches can trigger a workflow, or limit access to secrets. You can use concurrency to limit your CD pipeline to a maximum of one in-progress deployment and one pending deployment. For more information about these features, see "[Deploying with GitHub Actions](/actions/deployment/deploying-with-github-actions)" and "[Using environments for deployment](/actions/deployment/using-environments-for-deployment)."
{% ifversion fpt or ghec or ghae-issue-4856 or ghes > 3.4 %}

8
content/actions/deployment/targeting-different-environments/using-environments-for-deployment.md
View File

@@ -34,7 +34,7 @@ Organizations that use {% data variables.product.prodname_ghe_cloud %} can confi
## Environment protection rules
Environment protection rules require specific conditions to pass before a job referencing the environment can proceed. {% ifversion fpt or ghae or ghes > 3.1 or ghec %}You can use environment protection rules to require a manual approval, delay a job, or restrict the environment to certain branches.{% else %}You can use environment protection rules to require a manual approval or delay a job.{% endif %}
Environment protection rules require specific conditions to pass before a job referencing the environment can proceed. You can use environment protection rules to require a manual approval, delay a job, or restrict the environment to certain branches.
### Required reviewers
@@ -46,7 +46,6 @@ For more information on reviewing jobs that reference an environment with requir
Use a wait timer to delay a job for a specific amount of time after the job is initially triggered. The time (in minutes) must be an integer between 0 and 43,200 (30 days).
{% ifversion fpt or ghae or ghes > 3.1 or ghec %}
### Deployment branches
Use deployment branches to restrict which branches can deploy to the environment. Below are the options for deployment branches for an environment:
@@ -56,7 +55,6 @@ Use deployment branches to restrict which branches can deploy to the environment
* **Selected branches**: Only branches that match your specified name patterns can deploy to the environment.
For example, if you specify `releases/*` as a deployment branch rule, only branches whose name begins with `releases/` can deploy to the environment. (Wildcard characters will not match `/`. To match branches that begin with `release/` and contain an additional single slash, use `release/*/*`.) If you add `main` as a deployment branch rule, a branch named `main` can also deploy to the environment. For more information about syntax options for deployment branches, see the [Ruby File.fnmatch documentation](https://ruby-doc.org/core-2.5.1/File.html#method-c-fnmatch).
{% endif %}
## Environment secrets
Secrets stored in an environment are only available to workflow jobs that reference the environment. If the environment requires approval, a job cannot access environment secrets until one of the required reviewers approves it. For more information about secrets, see "[Encrypted secrets](/actions/reference/encrypted-secrets)."
@@ -101,7 +99,7 @@ Secrets stored in an environment are only available to workflow jobs that refere
1. Enter the secret value.
1. Click **Add secret**.
{% ifversion fpt or ghae or ghes > 3.1 or ghec %}You can also create and configure environments through the REST API. For more information, see "[Environments](/rest/reference/repos#environments)" and "[Secrets](/rest/reference/actions#secrets)."{% endif %}
You can also create and configure environments through the REST API. For more information, see "[Environments](/rest/reference/repos#environments)" and "[Secrets](/rest/reference/actions#secrets)."
Running a workflow that references an environment that does not exist will create an environment with the referenced name. The newly created environment will not have any protection rules or secrets configured. Anyone that can edit workflows in the repository can create environments via a workflow file, but only repository admins can configure the environment.
@@ -125,7 +123,7 @@ Deleting an environment will delete all secrets and protection rules associated
1. Next to the environment that you want to delete, click {% octicon "trash" aria-label="The trash icon" %}.
2. Click **I understand, delete this environment**.
{% ifversion fpt or ghae or ghes > 3.1 or ghec %}You can also delete environments through the REST API. For more information, see "[Environments](/rest/reference/repos#environments)."{% endif %}
You can also delete environments through the REST API. For more information, see "[Environments](/rest/reference/repos#environments)."
## How environments relate to deployments

1
content/actions/examples/index.md
View File

@@ -12,3 +12,4 @@ children:
- using-the-github-cli-on-a-runner
- using-concurrency-expressions-and-a-test-matrix
---

6
content/actions/examples/using-concurrency-expressions-and-a-test-matrix.md
View File

@@ -1,11 +1,11 @@
---
title: Using concurrency, expressions, and a test matrix
shortTitle: Using concurrency, expressions, and a test matrix
title: 'Using concurrency, expressions, and a test matrix'
shortTitle: 'Using concurrency, expressions, and a test matrix'
intro: 'How to use advanced {% data variables.product.prodname_actions %} features for continuous integration (CI).'
versions:
fpt: '*'
ghes: '>= 3.5'
ghae: 'issue-4925'
ghae: issue-4925
ghec: '*'
type: how_to
topics:

4
content/actions/hosting-your-own-runners/adding-self-hosted-runners.md
View File

@@ -56,7 +56,7 @@ You can add self-hosted runners to a single repository. To add a self-hosted run
{% data reusables.repositories.navigate-to-repo %}
{% data reusables.repositories.sidebar-settings %}
{% data reusables.repositories.settings-sidebar-actions-runners %}
1. Under {% ifversion ghes > 3.1 or ghae or ghec %}"Runners"{% else %}"Self-hosted runners"{% endif %}, click **Add runner**.
1. Under {% ifversion ghes or ghae or ghec %}"Runners"{% else %}"Self-hosted runners"{% endif %}, click **Add runner**.
{% data reusables.actions.self-hosted-runner-configure %}
{% endif %}
{% data reusables.actions.self-hosted-runner-check-installation-success %}
@@ -77,7 +77,7 @@ You can add self-hosted runners at the organization level, where they can be use
{% data reusables.organizations.navigate-to-org %}
{% data reusables.organizations.org_settings %}
{% data reusables.organizations.settings-sidebar-actions-runners %}
1. Under {% ifversion ghes > 3.1 or ghae %}"Runners", click **Add new**, then click **New runner**.{% elsif ghes < 3.2 %}"Self-hosted runners", click **Add runner**."{% endif %}
1. Under {% ifversion ghes or ghae %}"Runners", click **Add new**, then click **New runner**.{% endif %}
{% data reusables.actions.self-hosted-runner-configure %}
{% endif %}
{% data reusables.actions.self-hosted-runner-check-installation-success %}

4
content/actions/hosting-your-own-runners/customizing-the-containers-used-by-jobs.md
View File

@@ -1,8 +1,8 @@
---
title: Customizing the containers used by jobs
intro: 'You can customize how your self-hosted runner invokes a container for a job.'
intro: You can customize how your self-hosted runner invokes a container for a job.
versions:
feature: 'container-hooks'
feature: container-hooks
type: reference
miniTocMaxHeadingLevel: 4
shortTitle: Customize containers used by jobs

13
content/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups.md
View File

@@ -65,7 +65,7 @@ When creating a group, you must choose a policy that defines which repositories{
{% data reusables.organizations.navigate-to-org %}
{% data reusables.organizations.org_settings %}
{% data reusables.organizations.settings-sidebar-actions-runner-groups %}
1. Under {% ifversion ghes > 3.1 or ghae %}"Runners"{% elsif ghes < 3.2 %}"Self-hosted runners"{% endif %}, click **Add new**, and then **New group**.
1. Under {% ifversion ghes or ghae %}"Runners"{% endif %}, click **Add new**, and then **New group**.
![Add runner group](/assets/images/help/settings/actions-org-add-runner-group.png)
1. Enter a name for your runner group, and assign a policy for repository access.
@@ -202,7 +202,7 @@ If you don't specify a runner group during the registration process, your new se
2. Select the **Runner group** drop-down.
3. In "Move runner to group", choose a destination group for the runner.
{% elsif ghae or ghes < 3.4 %}
1. In the {% ifversion ghes > 3.1 or ghae %}"Runner groups"{% elsif ghes < 3.2 %}"Self-hosted runners"{% endif %} section of the settings page, locate the current group of the runner you want to move and expand the list of group members.
1. In the {% ifversion ghes or ghae %}"Runner groups"{% endif %} section of the settings page, locate the current group of the runner you want to move and expand the list of group members.
![View runner group members](/assets/images/help/settings/actions-org-runner-group-members.png)
2. Select the checkbox next to the self-hosted runner, and then click **Move to group** to see the available destinations.
![Runner group member move](/assets/images/help/settings/actions-org-runner-group-member-move.png)
@@ -214,18 +214,11 @@ If you don't specify a runner group during the registration process, your new se
Self-hosted runners are automatically returned to the default group when their group is removed.
{% ifversion ghes > 3.1 or ghae or ghec %}
{% ifversion ghes or ghae or ghec %}
{% data reusables.actions.self-hosted-runner-groups-navigate-to-repo-org-enterprise %}
1. In the list of groups, to the right of the group you want to delete, click {% octicon "kebab-horizontal" aria-label="The horizontal kebab icon" %}.
2. To remove the group, click **Remove group**.
3. Review the confirmation prompts, and click **Remove this runner group**.
{% elsif ghes < 3.2 %}
1. In the "Self-hosted runners" section of the settings page, locate the group you want to delete, and click the {% octicon "kebab-horizontal" aria-label="The horizontal kebab icon" %} button.
![View runner group settings](/assets/images/help/settings/actions-org-runner-group-kebab.png)
1. To remove the group, click **Remove group**.
![View runner group settings](/assets/images/help/settings/actions-org-runner-group-remove.png)
1. Review the confirmation prompts, and click **Remove this runner group**.
{% endif %}
{% endif %}

5
content/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners.md
View File

@@ -24,7 +24,7 @@ shortTitle: Monitor & troubleshoot
{% data reusables.actions.self-hosted-runner-navigate-repo-and-org %}
{% data reusables.organizations.settings-sidebar-actions-runners %}
1. Under {% ifversion fpt or ghes > 3.1 or ghae or ghec %}"Runners"{% else %}"Self-hosted runners"{% endif %}, you can view a list of registered runners, including the runner's name, labels, and status.
1. Under "Runners", you can view a list of registered runners, including the runner's name, labels, and status.
The status can be one of the following:
@@ -167,7 +167,6 @@ If you want to customize the self-hosted runner application service, do not dire
{% endmac %}
{% windows %}
## Using PowerShell to check the self-hosted runner application service
@@ -265,4 +264,4 @@ User=runner-user
{% data reusables.actions.upgrade-runners-before-upgrade-ghes %}
If your runners are offline for this reason, manually update the runners. For more information, see the installation instructions for [the latest release](https://github.com/actions/runner/releases/latest) in the actions/runner repository.
{% endif %}
{% endif %}

2
content/actions/hosting-your-own-runners/running-scripts-before-or-after-a-job.md
View File

@@ -2,7 +2,7 @@
title: Running scripts before or after a job
intro: 'Scripts can automatically execute on a self-hosted runner, directly before or after a job.'
versions:
feature: 'job-hooks-for-runners'
feature: job-hooks-for-runners
type: tutorial
miniTocMaxHeadingLevel: 3
shortTitle: Run a script before or after a job

3
content/actions/index.md
View File

@@ -52,7 +52,7 @@ versions:
children:
- /quickstart
- /learn-github-actions
- /examples
- /examples
- /using-workflows
- /using-jobs
- /managing-workflow-runs
@@ -69,3 +69,4 @@ children:
- /creating-actions
- /guides
---

2
content/actions/learn-github-actions/contexts.md
View File

@@ -798,4 +798,4 @@ jobs:
{% endraw %}
{% endif %}
{% endif %}
{% endif %}

2
content/actions/learn-github-actions/finding-and-customizing-actions.md
View File

@@ -158,7 +158,7 @@ steps:
### Using SHAs
If you need more reliable versioning, you should use the SHA value associated with the version of the action. SHAs are immutable and therefore more reliable than tags or branches. However this approach means you will not automatically receive updates for an action, including important bug fixes and security updates. {% ifversion fpt or ghes > 3.0 or ghae or ghec %}You must use a commit's full SHA value, and not an abbreviated value. {% endif %}This example targets an action's SHA:
If you need more reliable versioning, you should use the SHA value associated with the version of the action. SHAs are immutable and therefore more reliable than tags or branches. However this approach means you will not automatically receive updates for an action, including important bug fixes and security updates. You must use a commit's full SHA value, and not an abbreviated value. This example targets an action's SHA:
```yaml
steps:

4
content/actions/managing-issues-and-pull-requests/adding-labels-to-issues.md
View File

@@ -40,9 +40,9 @@ In the tutorial, you will first make a workflow file that uses the [`andymckay/l
- opened
jobs:
label_issues:
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
issues: write{% endif %}
issues: write
steps:
- name: Label issues
uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90

4
content/actions/managing-issues-and-pull-requests/closing-inactive-issues.md
View File

@@ -37,10 +37,10 @@ In the tutorial, you will first make a workflow file that uses the [`actions/sta
jobs:
close-issues:
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: write{% endif %}
pull-requests: write
steps:
- uses: {% data reusables.actions.action-stale %}
with:

4
content/actions/managing-issues-and-pull-requests/commenting-on-an-issue-when-a-label-is-added.md
View File

@@ -41,9 +41,9 @@ In the tutorial, you will first make a workflow file that uses the [`peter-evans
jobs:
add-comment:
if: github.event.label.name == 'help-wanted'
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
issues: write{% endif %}
issues: write
steps:
- name: Add comment
uses: peter-evans/create-or-update-comment@a35cf36e5301d70b76f316e867e7788a55a31dae

4
content/actions/managing-issues-and-pull-requests/removing-a-label-when-a-card-is-added-to-a-project-board-column.md
View File

@@ -42,10 +42,10 @@ In the tutorial, you will first make a workflow file that uses the [`andymckay/l
jobs:
remove_labels:
if: github.event.project_card.column_id == '12345678'
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: write{% endif %}
pull-requests: write
steps:
- name: remove labels
uses: andymckay/labeler@5c59dabdfd4dd5bd9c6e6d255b01b9d764af4414

4
content/actions/managing-issues-and-pull-requests/scheduling-issue-creation.md
View File

@@ -40,9 +40,9 @@ In the tutorial, you will first make a workflow file that uses the [`imjohnbo/is
jobs:
create_issue:
name: Create team sync issue
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
issues: write{% endif %}
issues: write
steps:
- name: Create team sync issue
uses: imjohnbo/issue-bot@3daae12aa54d38685d7ff8459fc8a2aee8cea98b

2
content/actions/managing-workflow-runs/re-running-workflows-and-jobs.md
View File

@@ -1,6 +1,6 @@
---
title: Re-running workflows and jobs
intro: You can re-run a workflow run{% ifversion re-run-jobs %}, all failed jobs in a workflow run, or specific jobs in a workflow run{% endif %} up to 30 days after its initial run.
intro: 'You can re-run a workflow run{% ifversion re-run-jobs %}, all failed jobs in a workflow run, or specific jobs in a workflow run{% endif %} up to 30 days after its initial run.'
permissions: People with write permissions to a repository can re-run workflows in the repository.
miniTocMaxHeadingLevel: 3
redirect_from:

2
content/actions/managing-workflow-runs/reviewing-deployments.md
View File

@@ -14,7 +14,7 @@ versions:
Jobs that reference an environment configured with required reviewers will wait for an approval before starting. While a job is awaiting approval, it has a status of "Waiting". If a job is not approved within 30 days, the workflow run will be automatically canceled.
For more information about environments and required approvals, see "[Using environments for deployment](/actions/deployment/using-environments-for-deployment)."{% ifversion fpt or ghae or ghes > 3.1 or ghec %} For information about how to review deployments with the REST API, see "[Workflow Runs](/rest/reference/actions#workflow-runs)."{% endif %}
For more information about environments and required approvals, see "[Using environments for deployment](/actions/deployment/using-environments-for-deployment)." For information about how to review deployments with the REST API, see "[Workflow Runs](/rest/reference/actions#workflow-runs)."
## Approving or rejecting a job

4
content/actions/monitoring-and-troubleshooting-workflows/about-monitoring-and-troubleshooting.md
View File

@@ -22,8 +22,6 @@ miniTocMaxHeadingLevel: 3
{% endif %}
{% ifversion fpt or ghae or ghes > 3.0 or ghec %}
### Using the visualization graph
Every workflow run generates a real-time graph that illustrates the run progress. You can use this graph to monitor and debug workflows. For example:
@@ -32,8 +30,6 @@ Every workflow run generates a real-time graph that illustrates the run progress
For more information, see "[Using the visualization graph](/actions/monitoring-and-troubleshooting-workflows/using-the-visualization-graph)."
{% endif %}
### Adding a workflow status badge
{% data reusables.repositories.actions-workflow-status-badge-intro %}

8
content/actions/publishing-packages/publishing-docker-images.md
View File

@@ -153,10 +153,10 @@ on:
jobs:
push_to_registry:
name: Push Docker image to GitHub Packages
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
packages: write
contents: read{% endif %}
contents: read
steps:
- name: Check out the repo
uses: {% data reusables.actions.action-checkout %}
@@ -203,10 +203,10 @@ on:
jobs:
push_to_registries:
name: Push Docker image to multiple registries
runs-on: {% ifversion ghes %}[self-hosted]{% else %}ubuntu-latest{% endif %}{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: {% ifversion ghes %}[self-hosted]{% else %}ubuntu-latest{% endif %}
permissions:
packages: write
contents: read{% endif %}
contents: read
steps:
- name: Check out the repo
uses: {% data reusables.actions.action-checkout %}

12
content/actions/publishing-packages/publishing-java-packages-with-gradle.md
View File

@@ -154,10 +154,10 @@ on:
types: [created]
jobs:
publish:
runs-on: ubuntu-latest {% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
contents: read
packages: write {% endif %}
packages: write
steps:
- uses: {% data reusables.actions.action-checkout %}
- uses: {% data reusables.actions.action-setup-java %}
@@ -175,7 +175,7 @@ jobs:
```
{% data reusables.actions.gradle-workflow-steps %}
1. Runs the [`gradle/gradle-build-action`](https://github.com/gradle/gradle-build-action) action with the `publish` argument to publish to {% data variables.product.prodname_registry %}. The `GITHUB_TOKEN` environment variable will be set with the content of the `GITHUB_TOKEN` secret. {% ifversion fpt or ghes > 3.1 or ghae or ghec %}The `permissions` key specifies the access that the `GITHUB_TOKEN` secret will allow.{% endif %}
1. Runs the [`gradle/gradle-build-action`](https://github.com/gradle/gradle-build-action) action with the `publish` argument to publish to {% data variables.product.prodname_registry %}. The `GITHUB_TOKEN` environment variable will be set with the content of the `GITHUB_TOKEN` secret. The `permissions` key specifies the access that the `GITHUB_TOKEN` secret will allow.
For more information about using secrets in your workflow, see "[Creating and using encrypted secrets](/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)."
@@ -232,10 +232,10 @@ on:
types: [created]
jobs:
publish:
runs-on: ubuntu-latest {% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
contents: read
packages: write {% endif %}
packages: write
steps:
- uses: {% data reusables.actions.action-checkout %}
- name: Set up Java
@@ -256,6 +256,6 @@ jobs:
```
{% data reusables.actions.gradle-workflow-steps %}
1. Runs the [`gradle/gradle-build-action`](https://github.com/gradle/gradle-build-action) action with the `publish` argument to publish to the `OSSRH` Maven repository and {% data variables.product.prodname_registry %}. The `MAVEN_USERNAME` environment variable will be set with the contents of your `OSSRH_USERNAME` secret, and the `MAVEN_PASSWORD` environment variable will be set with the contents of your `OSSRH_TOKEN` secret. The `GITHUB_TOKEN` environment variable will be set with the content of the `GITHUB_TOKEN` secret. {% ifversion fpt or ghes > 3.1 or ghae or ghec %}The `permissions` key specifies the access that the `GITHUB_TOKEN` secret will allow.{% endif %}
1. Runs the [`gradle/gradle-build-action`](https://github.com/gradle/gradle-build-action) action with the `publish` argument to publish to the `OSSRH` Maven repository and {% data variables.product.prodname_registry %}. The `MAVEN_USERNAME` environment variable will be set with the contents of your `OSSRH_USERNAME` secret, and the `MAVEN_PASSWORD` environment variable will be set with the contents of your `OSSRH_TOKEN` secret. The `GITHUB_TOKEN` environment variable will be set with the content of the `GITHUB_TOKEN` secret. The `permissions` key specifies the access that the `GITHUB_TOKEN` secret will allow.
For more information about using secrets in your workflow, see "[Creating and using encrypted secrets](/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)."

9
content/actions/publishing-packages/publishing-java-packages-with-maven.md
View File

@@ -73,7 +73,6 @@ With this configuration, you can create a workflow that publishes your package t
In the deploy step, you’ll need to set the environment variables to the username that you authenticate with to the repository, and to a secret that you’ve configured with the password or token to authenticate with. For more information, see "[Creating and using encrypted secrets](/github/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets)."
```yaml{:copy}
name: Publish package to the Maven Central Repository
on:
@@ -143,10 +142,10 @@ on:
types: [created]
jobs:
publish:
runs-on: ubuntu-latest {% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
contents: read
packages: write {% endif %}
packages: write
steps:
- uses: {% data reusables.actions.action-checkout %}
- uses: {% data reusables.actions.action-setup-java %}
@@ -180,10 +179,10 @@ on:
types: [created]
jobs:
publish:
runs-on: ubuntu-latest {% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
contents: read
packages: write {% endif %}
packages: write
steps:
- uses: {% data reusables.actions.action-checkout %}
- name: Set up Java for publishing to Maven Central Repository

4
content/actions/publishing-packages/publishing-nodejs-packages.md
View File

@@ -128,10 +128,10 @@ on:
types: [created]
jobs:
build:
runs-on: ubuntu-latest {% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
contents: read
packages: write {% endif %}
packages: write
steps:
- uses: {% data reusables.actions.action-checkout %}
# Setup .npmrc file to publish to GitHub Packages

23
content/actions/security-guides/automatic-token-authentication.md
View File

@@ -31,13 +31,11 @@ The token is also available in the `github.token` context. For more information,
You can use the `GITHUB_TOKEN` by using the standard syntax for referencing secrets: {%raw%}`${{ secrets.GITHUB_TOKEN }}`{% endraw %}. Examples of using the `GITHUB_TOKEN` include passing the token as an input to an action, or using it to make an authenticated {% ifversion fpt or ghec %}{% data variables.product.prodname_dotcom %}{% else %}{% data variables.product.product_name %}{% endif %} API request.
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
{% note %}
**Important:** An action can access the `GITHUB_TOKEN` through the `github.token` context even if the workflow does not explicitly pass the `GITHUB_TOKEN` to the action. As a good security practice, you should always make sure that actions only have the minimum access they require by limiting the permissions granted to the `GITHUB_TOKEN`. For more information, see "[Permissions for the `GITHUB_TOKEN`](#permissions-for-the-github_token)."
{% endnote %}
{% endif %}
{% data reusables.actions.actions-do-not-trigger-workflows %}
@@ -56,9 +54,9 @@ on: [ push ]
jobs:
create_commit:
runs-on: ubuntu-latest {% ifversion fpt or ghes > 3.1 or ghae or ghec %}
runs-on: ubuntu-latest
permissions:
issues: write {% endif %}
issues: write
steps:
- name: Create issue using REST API
run: |
@@ -77,7 +75,6 @@ jobs:
For information about the API endpoints {% data variables.product.prodname_github_apps %} can access with each permission, see "[{% data variables.product.prodname_github_app %} Permissions](/rest/reference/permissions-required-for-github-apps)."
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
The following table shows the permissions granted to the `GITHUB_TOKEN` by default. People with admin permissions to an {% ifversion not ghes %}enterprise, organization, or repository,{% else %}organization or repository{% endif %} can set the default permissions to be either permissive or restricted. For information on how to set the default permissions for the `GITHUB_TOKEN` for your enterprise, organization, or repository, see "[Enforcing policies for {% data variables.product.prodname_actions %} in your enterprise](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-github-actions-policies-for-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise)," "[Disabling or limiting {% data variables.product.prodname_actions %} for your organization](/github/setting-up-and-managing-organizations-and-teams/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization)," or "[Managing {% data variables.product.prodname_actions %} settings for a repository](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository)."
| Scope | Default access<br>(permissive) | Default access<br>(restricted) | Maximum access<br>by forked repos |
@@ -97,24 +94,9 @@ The following table shows the permissions granted to the `GITHUB_TOKEN` by defau
| repository-projects | read/write | none | read |
| security-events | read/write | none | read |
| statuses | read/write | none | read |
{% else %}
| Scope | Access type | Access by forked repos |
|----------|-------------|--------------------------|
| actions | read/write | read |
| checks | read/write | read |
| contents | read/write | read |
| deployments | read/write | read |
| issues | read/write | read |
| metadata | read | read |
| packages | read/write | read |
| pull-requests | read/write | read |
| repository-projects | read/write | read |
| statuses | read/write | read |
{% endif %}
{% data reusables.actions.workflow-runs-dependabot-note %}
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
### Modifying the permissions for the `GITHUB_TOKEN`
You can modify the permissions for the `GITHUB_TOKEN` in individual workflow files. If the default permissions for the `GITHUB_TOKEN` are restrictive, you may have to elevate the permissions to allow some actions and commands to run successfully. If the default permissions are permissive, you can edit the workflow file to remove some permissions from the `GITHUB_TOKEN`. As a good security practice, you should grant the `GITHUB_TOKEN` the least required access.
@@ -134,7 +116,6 @@ For full details of the `permissions` key, see "[Workflow syntax for {% data var
The permissions for the `GITHUB_TOKEN` are initially set to the default setting for the enterprise, organization, or repository. If the default is set to the restricted permissions at any of these levels then this will apply to the relevant repositories. For example, if you choose the restricted default at the organization level then all repositories in that organization will use the restricted permissions as the default. The permissions are then adjusted based on any configuration within the workflow file, first at the workflow level and then at the job level. Finally, if the workflow was triggered by a pull request from a forked repository, and the **Send write tokens to workflows from pull requests** setting is not selected, the permissions are adjusted to change any write permissions to read only.
### Granting additional permissions
{% endif %}
If you need a token that requires permissions that aren't available in the `GITHUB_TOKEN`, you can create a personal access token and set it as a secret in your repository:

24
content/actions/security-guides/security-hardening-for-github-actions.md
View File

@@ -40,8 +40,8 @@ To help prevent accidental disclosure, {% data variables.product.product_name %}
- Audit how secrets are used, to help ensure they’re being handled as expected. You can do this by reviewing the source code of the repository executing the workflow, and checking any actions used in the workflow. For example, check that they’re not sent to unintended hosts, or explicitly being printed to log output.
- View the run logs for your workflow after testing valid/invalid inputs, and check that secrets are properly redacted, or not shown. It's not always obvious how a command or tool you’re invoking will send errors to `STDOUT` and `STDERR`, and secrets might subsequently end up in error logs. As a result, it is good practice to manually review the workflow logs after testing valid and invalid inputs.
- **Use credentials that are minimally scoped**
- Make sure the credentials being used within workflows have the least privileges required, and be mindful that any user with write access to your repository has read access to all secrets configured in your repository. {% ifversion fpt or ghes > 3.1 or ghae or ghec %}
- Actions can use the `GITHUB_TOKEN` by accessing it from the `github.token` context. For more information, see "[Contexts](/actions/learn-github-actions/contexts#github-context)." You should therefore make sure that the `GITHUB_TOKEN` is granted the minimum required permissions. It's good security practice to set the default permission for the `GITHUB_TOKEN` to read access only for repository contents. The permissions can then be increased, as required, for individual jobs within the workflow file. For more information, see "[Authentication in a workflow](/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token)." {% endif %}
- Make sure the credentials being used within workflows have the least privileges required, and be mindful that any user with write access to your repository has read access to all secrets configured in your repository.
- Actions can use the `GITHUB_TOKEN` by accessing it from the `github.token` context. For more information, see "[Contexts](/actions/learn-github-actions/contexts#github-context)." You should therefore make sure that the `GITHUB_TOKEN` is granted the minimum required permissions. It's good security practice to set the default permission for the `GITHUB_TOKEN` to read access only for repository contents. The permissions can then be increased, as required, for individual jobs within the workflow file. For more information, see "[Authentication in a workflow](/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token)."
- **Audit and rotate registered secrets**
- Periodically review the registered secrets to confirm they are still required. Remove those that are no longer needed.
- Rotate secrets periodically to reduce the window of time during which a compromised secret is valid.
@@ -179,8 +179,6 @@ You can help mitigate this risk by following these good practices:
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
* **Audit the source code of the action**
Ensure that the action is handling the content of your repository and secrets as expected. For example, check that secrets are not sent to unintended hosts, or are not inadvertently logged.
@@ -249,14 +247,14 @@ The attacker server can use the {% ifversion fpt or ghec %}{% data variables.pro
## Considering cross-repository access
{% data variables.product.prodname_actions %} is intentionally scoped for a single repository at a time. The `GITHUB_TOKEN` grants the same level of access as a write-access user, because any write-access user can access this token by creating or modifying a workflow file{% ifversion fpt or ghes > 3.1 or ghae or ghec %}, elevating the permissions of the `GITHUB_TOKEN` if necessary{% endif %}. Users have specific permissions for each repository, so allowing the `GITHUB_TOKEN` for one repository to grant access to another would impact the {% data variables.product.prodname_dotcom %} permission model if not implemented carefully. Similarly, caution must be taken when adding {% data variables.product.prodname_dotcom %} authentication tokens to a workflow, because this can also affect the {% data variables.product.prodname_dotcom %} permission model by inadvertently granting broad access to collaborators.
{% data variables.product.prodname_actions %} is intentionally scoped for a single repository at a time. The `GITHUB_TOKEN` grants the same level of access as a write-access user, because any write-access user can access this token by creating or modifying a workflow file, elevating the permissions of the `GITHUB_TOKEN` if necessary. Users have specific permissions for each repository, so allowing the `GITHUB_TOKEN` for one repository to grant access to another would impact the {% data variables.product.prodname_dotcom %} permission model if not implemented carefully. Similarly, caution must be taken when adding {% data variables.product.prodname_dotcom %} authentication tokens to a workflow, because this can also affect the {% data variables.product.prodname_dotcom %} permission model by inadvertently granting broad access to collaborators.
We have [a plan on the {% data variables.product.prodname_dotcom %} roadmap](https://github.com/github/roadmap/issues/74) to support a flow that allows cross-repository access within {% data variables.product.product_name %}, but this is not yet a supported feature. Currently, the only way to perform privileged cross-repository interactions is to place a {% data variables.product.prodname_dotcom %} authentication token or SSH key as a secret within the workflow. Because many authentication token types do not allow for granular access to specific resources, there is significant risk in using the wrong token type, as it can grant much broader access than intended.
This list describes the recommended approaches for accessing repository data within a workflow, in descending order of preference:
1. **The `GITHUB_TOKEN`**
- This token is intentionally scoped to the single repository that invoked the workflow, and {% ifversion fpt or ghes > 3.1 or ghae or ghec %}can have {% else %}has {% endif %}the same level of access as a write-access user on the repository. The token is created before each job begins and expires when the job is finished. For more information, see "[Authenticating with the GITHUB_TOKEN](/actions/configuring-and-managing-workflows/authenticating-with-the-github_token)."
- This token is intentionally scoped to the single repository that invoked the workflow, and can have the same level of access as a write-access user on the repository. The token is created before each job begins and expires when the job is finished. For more information, see "[Authenticating with the GITHUB_TOKEN](/actions/configuring-and-managing-workflows/authenticating-with-the-github_token)."
- The `GITHUB_TOKEN` should be used whenever possible.
2. **Repository deploy key**
- Deploy keys are one of the only credential types that grant read or write access to a single repository, and can be used to interact with another repository within a workflow. For more information, see "[Managing deploy keys](/developers/overview/managing-deploy-keys#deploy-keys)."
@@ -277,7 +275,7 @@ This list describes the recommended approaches for accessing repository data wit
{% ifversion fpt or ghec %}**Self-hosted**{% elsif ghes or ghae %}Self-hosted{% endif %} runners for {% data variables.product.product_name %} do not have guarantees around running in ephemeral clean virtual machines, and can be persistently compromised by untrusted code in a workflow.
{% ifversion fpt or ghec %}As a result, self-hosted runners should almost [never be used for public repositories](/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories) on {% data variables.product.product_name %}, because any user can open pull requests against the repository and compromise the environment. Similarly, be{% elsif ghes or ghae %}Be{% endif %} cautious when using self-hosted runners on private or internal repositories, as anyone who can fork the repository and open a pull request (generally those with read access to the repository) are able to compromise the self-hosted runner environment, including gaining access to secrets and the `GITHUB_TOKEN` which{% ifversion fpt or ghes > 3.1 or ghae or ghec %}, depending on its settings, can grant {% else %} grants {% endif %}write access to the repository. Although workflows can control access to environment secrets by using environments and required reviews, these workflows are not run in an isolated environment and are still susceptible to the same risks when run on a self-hosted runner.
{% ifversion fpt or ghec %}As a result, self-hosted runners should almost [never be used for public repositories](/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories) on {% data variables.product.product_name %}, because any user can open pull requests against the repository and compromise the environment. Similarly, be{% elsif ghes or ghae %}Be{% endif %} cautious when using self-hosted runners on private or internal repositories, as anyone who can fork the repository and open a pull request (generally those with read access to the repository) are able to compromise the self-hosted runner environment, including gaining access to secrets and the `GITHUB_TOKEN` which, depending on its settings, can grant write access to the repository. Although workflows can control access to environment secrets by using environments and required reviews, these workflows are not run in an isolated environment and are still susceptible to the same risks when run on a self-hosted runner.
When a self-hosted runner is defined at the organization or enterprise level, {% data variables.product.product_name %} can schedule workflows from multiple repositories onto the same runner. Consequently, a security compromise of these environments can result in a wide impact. To help reduce the scope of a compromise, you can create boundaries by organizing your self-hosted runners into separate groups. You can restrict what {% ifversion restrict-groups-to-workflows %}workflows, {% endif %}organizations and repositories can access runner groups. For more information, see "[Managing access to self-hosted runners using groups](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups)."
@@ -350,21 +348,21 @@ The following tables describe the {% data variables.product.prodname_actions %}
|------------------|-------------------
| `enterprise.register_self_hosted_runner` | Triggered when a new self-hosted runner is registered. For more information, see "[Adding a self-hosted runner to an enterprise](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-enterprise)."
| `enterprise.remove_self_hosted_runner` | Triggered when a self-hosted runner is removed.
| `enterprise.runner_group_runners_updated` | Triggered when a runner group's member list is updated. For more information, see "[Set self-hosted runners in a group for an organization](/rest/reference/actions#set-self-hosted-runners-in-a-group-for-an-organization)."{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
| `enterprise.runner_group_runners_updated` | Triggered when a runner group's member list is updated. For more information, see "[Set self-hosted runners in a group for an organization](/rest/reference/actions#set-self-hosted-runners-in-a-group-for-an-organization)."
| `enterprise.self_hosted_runner_online` | Triggered when the runner application is started. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `enterprise.self_hosted_runner_offline` | Triggered when the runner application is stopped. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."{% endif %}
| `enterprise.self_hosted_runner_offline` | Triggered when the runner application is stopped. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `enterprise.self_hosted_runner_updated` | Triggered when the runner application is updated. Can be viewed using the REST API and the UI. This event is not included when you export the audit log as JSON data or a CSV file. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners)" and "[Reviewing the audit log for your organization](/organizations/keeping-your-organization-secure/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log)."
| `org.register_self_hosted_runner` | Triggered when a new self-hosted runner is registered. For more information, see "[Adding a self-hosted runner to an organization](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization)."
| `org.remove_self_hosted_runner` | Triggered when a self-hosted runner is removed. For more information, see [Removing a runner from an organization](/actions/hosting-your-own-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization).
| `org.runner_group_runners_updated` | Triggered when a runner group's list of members is updated. For more information, see "[Set self-hosted runners in a group for an organization](/rest/reference/actions#set-self-hosted-runners-in-a-group-for-an-organization)."
| `org.runner_group_updated` | Triggered when the configuration of a self-hosted runner group is changed. For more information, see "[Changing the access policy of a self-hosted runner group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group)."{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
| `org.runner_group_updated` | Triggered when the configuration of a self-hosted runner group is changed. For more information, see "[Changing the access policy of a self-hosted runner group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group)."
| `org.self_hosted_runner_online` | Triggered when the runner application is started. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `org.self_hosted_runner_offline` | Triggered when the runner application is stopped. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."{% endif %}
| `org.self_hosted_runner_offline` | Triggered when the runner application is stopped. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `org.self_hosted_runner_updated` | Triggered when the runner application is updated. Can be viewed using the REST API and the UI; not visible in the JSON/CSV export. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners)."
| `repo.register_self_hosted_runner` | Triggered when a new self-hosted runner is registered. For more information, see "[Adding a self-hosted runner to a repository](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository)."
| `repo.remove_self_hosted_runner` | Triggered when a self-hosted runner is removed. For more information, see "[Removing a runner from a repository](/actions/hosting-your-own-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository)."{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
| `repo.remove_self_hosted_runner` | Triggered when a self-hosted runner is removed. For more information, see "[Removing a runner from a repository](/actions/hosting-your-own-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository)."
| `repo.self_hosted_runner_online` | Triggered when the runner application is started. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `repo.self_hosted_runner_offline` | Triggered when the runner application is stopped. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."{% endif %}
| `repo.self_hosted_runner_offline` | Triggered when the runner application is stopped. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `repo.self_hosted_runner_updated` | Triggered when the runner application is updated. Can be viewed using the REST API and the UI; not visible in the JSON/CSV export. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners)."
### Events for self-hosted runner groups

2
content/actions/using-workflows/caching-dependencies-to-speed-up-workflows.md
View File

@@ -9,7 +9,7 @@ redirect_from:
- /actions/guides/caching-dependencies-to-speed-up-workflows
- /actions/advanced-guides/caching-dependencies-to-speed-up-workflows
versions:
feature: 'actions-caching'
feature: actions-caching
type: tutorial
topics:
- Workflows

5
content/actions/using-workflows/triggering-a-workflow.md
View File

@@ -184,7 +184,7 @@ For more information about contexts, see "[Contexts](/actions/learn-github-actio
## Further controlling how your workflow will run
If you want more granular control than events, event activity types, or event filters provide, you can use conditionals{% ifversion fpt or ghae or ghes > 3.1 or ghec %} and environments{% endif %} to control whether individual jobs or steps in your workflow will run.
If you want more granular control than events, event activity types, or event filters provide, you can use conditionals and environments to control whether individual jobs or steps in your workflow will run.
### Using conditionals
@@ -237,8 +237,6 @@ jobs:
For more information about what information is available in the event context, see "[Using event information](#using-event-information)." For more information about how to use conditionals, see "[Expressions](/actions/learn-github-actions/expressions)."
{% ifversion fpt or ghae or ghes > 3.1 or ghec %}
### Using environments to manually trigger workflow jobs
If you want to manually trigger a specific job in a workflow, you can use an environment that requires approval from a specific team or user. First, configure an environment with required reviewers. For more information, see "[Using environments for deployment](/actions/deployment/targeting-different-environments/using-environments-for-deployment)." Then, reference the environment name in a job in your workflow using the `environment:` key. Any job referencing the environment will not run until at least one reviewer approves the job.
@@ -272,7 +270,6 @@ jobs:
{% data reusables.gated-features.environments %}
{% endnote %}
{% endif %}
## Available events

10
content/actions/using-workflows/workflow-syntax-for-github-actions.md
View File

@@ -174,13 +174,10 @@ A boolean specifying whether the secret must be supplied.
{% data reusables.actions.workflow-dispatch-inputs %}
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
## `permissions`
{% data reusables.actions.jobs.section-assigning-permissions-to-jobs %}
{% endif %}
## `env`
A `map` of environment variables that are available to the steps of all jobs in the workflow. You can also set environment variables that are only available to the steps of a single job or to a single step. For more information, see [`jobs.<job_id>.env`](#jobsjob_idenv) and [`jobs.<job_id>.steps[*].env`](#jobsjob_idstepsenv).
@@ -204,12 +201,10 @@ env:
{% data reusables.actions.jobs.setting-default-values-for-jobs-defaults-run %}
{% ifversion fpt or ghae or ghes > 3.1 or ghec %}
## `concurrency`
{% data reusables.actions.jobs.section-using-concurrency %}
{% endif %}
## `jobs`
{% data reusables.actions.jobs.section-using-jobs-in-a-workflow %}
@@ -222,13 +217,10 @@ env:
{% data reusables.actions.jobs.section-using-jobs-in-a-workflow-name %}
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
### `jobs.<job_id>.permissions`
{% data reusables.actions.jobs.section-assigning-permissions-to-jobs-specific %}
{% endif %}
## `jobs.<job_id>.needs`
{% data reusables.actions.jobs.section-using-jobs-in-a-workflow-needs %}
@@ -245,12 +237,10 @@ env:
{% data reusables.actions.jobs.section-using-environments-for-jobs %}
{% ifversion fpt or ghae or ghes > 3.1 or ghec %}
## `jobs.<job_id>.concurrency`
{% data reusables.actions.jobs.section-using-concurrency-jobs %}
{% endif %}
## `jobs.<job_id>.outputs`
{% data reusables.actions.jobs.section-defining-outputs-for-jobs %}

2
content/admin/all-releases.md
View File

@@ -1,6 +1,6 @@
---
title: GitHub Enterprise Server releases
intro: "{% data variables.product.company_short %} releases new versions of {% data variables.product.product_name %} regularly. You can review supported versions, see deprecation dates, and browse documentation for the release you've deployed."
intro: '{% data variables.product.company_short %} releases new versions of {% data variables.product.product_name %} regularly. You can review supported versions, see deprecation dates, and browse documentation for the release you''ve deployed.'
allowTitleToDifferFromFilename: true
versions:
ghes: '*'

4
content/admin/code-security/managing-github-advanced-security-for-your-enterprise/configuring-secret-scanning-for-your-appliance.md
View File

@@ -57,7 +57,7 @@ The SSSE3 set of instructions is required because {% data variables.product.prod
{% data reusables.enterprise_site_admin_settings.access-settings %}
{% data reusables.enterprise_site_admin_settings.management-console %}
{% data reusables.enterprise_management_console.advanced-security-tab %}
1. Under "{% ifversion ghes < 3.2 %}{% data variables.product.prodname_advanced_security %}{% else %}Security{% endif %}," click **{% data variables.product.prodname_secret_scanning_caps %}**.
1. Under "Security," click **{% data variables.product.prodname_secret_scanning_caps %}**.
![Checkbox to enable or disable {% data variables.product.prodname_secret_scanning %}](/assets/images/enterprise/management-console/enable-secret-scanning-checkbox.png)
{% data reusables.enterprise_management_console.save-settings %}
@@ -68,6 +68,6 @@ The SSSE3 set of instructions is required because {% data variables.product.prod
{% data reusables.enterprise_site_admin_settings.access-settings %}
{% data reusables.enterprise_site_admin_settings.management-console %}
{% data reusables.enterprise_management_console.advanced-security-tab %}
1. Under "{% ifversion ghes < 3.2 %}{% data variables.product.prodname_advanced_security %}{% else %}Security{% endif %}," unselect **{% data variables.product.prodname_secret_scanning_caps %}**.
1. Under "Security," unselect **{% data variables.product.prodname_secret_scanning_caps %}**.
![Checkbox to enable or disable {% data variables.product.prodname_secret_scanning %}](/assets/images/enterprise/management-console/secret-scanning-disable.png)
{% data reusables.enterprise_management_console.save-settings %}

2
content/admin/code-security/managing-github-advanced-security-for-your-enterprise/deploying-github-advanced-security-in-your-enterprise.md
View File

@@ -290,7 +290,7 @@ GitHub helps you avoid using third-party software that contains known vulnerabil
| Dependency Management Tool | Description |
|----|----|
| Dependabot Alerts | You can track your repository's dependencies and receive Dependabot alerts when your enterprise detects insecure dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)." |
| Dependency Graph | The dependency graph is a summary of the manifest and lock files stored in a repository. It shows you the ecosystems and packages your codebase depends on (its dependencies) and the repositories and packages that depend on your project (its dependents). For more information, see "[About the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)." |{% ifversion ghes > 3.1 or ghec %}
| Dependency Graph | The dependency graph is a summary of the manifest and lock files stored in a repository. It shows you the ecosystems and packages your codebase depends on (its dependencies) and the repositories and packages that depend on your project (its dependents). For more information, see "[About the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)." |{% ifversion ghes or ghec %}
| Dependency Review | If a pull request contains changes to dependencies, you can view a summary of what has changed and whether there are known vulnerabilities in any of the dependencies. For more information, see "[About dependency review](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review)" or "[Reviewing Dependency Changes in a Pull Request](/github/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request)." | {% endif %} {% ifversion ghec or ghes > 3.2 %}
| Dependabot Security Updates | Dependabot can fix vulnerable dependencies for you by raising pull requests with security updates. For more information, see "[About Dependabot security updates](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)." |
| Dependabot Version Updates | Dependabot can be used to keep the packages you use updated to the latest versions. For more information, see "[About Dependabot version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates)." | {% endif %}

12
content/admin/code-security/managing-github-advanced-security-for-your-enterprise/enabling-github-advanced-security-for-your-enterprise.md
View File

@@ -58,8 +58,8 @@ For guidance on a phased deployment of GitHub Advanced Security, see "[Deploying
{% data reusables.enterprise_site_admin_settings.access-settings %}
{% data reusables.enterprise_site_admin_settings.management-console %}
{% data reusables.enterprise_management_console.advanced-security-tab %}{% ifversion ghes %}
1. Under "{% ifversion ghes < 3.2 %}{% data variables.product.prodname_advanced_security %}{% else %}Security{% endif %}," select the features that you want to enable and deselect any features you want to disable.
{% ifversion ghes > 3.1 %}![Checkbox to enable or disable {% data variables.product.prodname_advanced_security %} features](/assets/images/enterprise/3.2/management-console/enable-security-checkboxes.png){% else %}![Checkbox to enable or disable {% data variables.product.prodname_advanced_security %} features](/assets/images/enterprise/management-console/enable-advanced-security-checkboxes.png){% endif %}{% else %}
1. Under "Security," select the features that you want to enable and deselect any features you want to disable.
{% ifversion ghes %}![Checkbox to enable or disable {% data variables.product.prodname_advanced_security %} features](/assets/images/enterprise/3.2/management-console/enable-security-checkboxes.png){% else %}![Checkbox to enable or disable {% data variables.product.prodname_advanced_security %} features](/assets/images/enterprise/management-console/enable-advanced-security-checkboxes.png){% endif %}{% else %}
1. Under "{% data variables.product.prodname_advanced_security %}," click **{% data variables.product.prodname_code_scanning_capc %}**.
![Checkbox to enable or disable {% data variables.product.prodname_code_scanning %}](/assets/images/enterprise/management-console/enable-code-scanning-checkbox.png){% endif %}
{% data reusables.enterprise_management_console.save-settings %}
@@ -84,8 +84,8 @@ For example, you can enable any {% data variables.product.prodname_GH_advanced_s
```shell
ghe-config app.secret-scanning.enabled true
```
- To enable the dependency graph, enter the following {% ifversion ghes > 3.1 %}command{% else %}commands{% endif %}.
{% ifversion ghes > 3.1 %}```shell
- To enable the dependency graph, enter the following {% ifversion ghes %}command{% else %}commands{% endif %}.
{% ifversion ghes %}```shell
ghe-config app.dependency-graph.enabled true
```
{% else %}```shell
@@ -103,8 +103,8 @@ For example, you can enable any {% data variables.product.prodname_GH_advanced_s
```shell
ghe-config app.secret-scanning.enabled false
```
- To disable the dependency graph, enter the following {% ifversion ghes > 3.1 %}command{% else %}commands{% endif %}.
{% ifversion ghes > 3.1 %}```shell
- To disable the dependency graph, enter the following {% ifversion ghes %}command{% else %}commands{% endif %}.
{% ifversion ghes %}```shell
ghe-config app.dependency-graph.enabled false
```
{% else %}```shell

2
content/admin/code-security/managing-github-advanced-security-for-your-enterprise/index.md
View File

@@ -1,7 +1,7 @@
---
title: Managing GitHub Advanced Security for your enterprise
shortTitle: GitHub Advanced Security
intro: "You can configure {% data variables.product.prodname_advanced_security %} and manage use by your enterprise to suit your organization's needs."
intro: 'You can configure {% data variables.product.prodname_advanced_security %} and manage use by your enterprise to suit your organization''s needs.'
product: '{% data reusables.gated-features.ghas %}'
redirect_from:
- /enterprise/admin/configuration/configuring-advanced-security-features

6
content/admin/code-security/managing-supply-chain-security-for-your-enterprise/enabling-the-dependency-graph-for-your-enterprise.md
View File

@@ -18,7 +18,7 @@ topics:
After you enable the dependency graph for your enterprise, you can enable {% data variables.product.prodname_dependabot %} to detect insecure dependencies in your repository{% ifversion ghes > 3.2 %} and automatically fix the vulnerabilities{% endif %}. For more information, see "[Enabling {% data variables.product.prodname_dependabot %} for your enterprise](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise)."
{% ifversion ghes > 3.1 %}
{% ifversion ghes %}
You can enable the dependency graph via the {% data variables.enterprise.management_console %} or the administrative shell. We recommend using the {% data variables.enterprise.management_console %} unless {% data variables.product.product_location %} uses clustering.
## Enabling the dependency graph via the {% data variables.enterprise.management_console %}
@@ -36,12 +36,10 @@ If your {% data variables.product.product_location %} uses clustering, you canno
## Enabling the dependency graph via the administrative shell
{% endif %}{% ifversion ghes < 3.2 %}
## Enabling the dependency graph
{% endif %}
{% data reusables.enterprise_site_admin_settings.sign-in %}
1. In the administrative shell, enable the dependency graph on {% data variables.product.product_location %}:
{% ifversion ghes > 3.1 %}```shell
{% ifversion ghes %}```shell
ghe-config app.dependency-graph.enabled true
```
{% else %}```shell

4
content/admin/configuration/configuring-github-connect/enabling-server-statistics-for-your-enterprise.md
View File

@@ -2,10 +2,10 @@
title: Enabling Server Statistics for your enterprise
intro: 'You can analyze your own aggregate data from {% data variables.product.prodname_ghe_server %} and help us improve {% data variables.product.company_short %} products by enabling {% data variables.product.prodname_server_statistics %}.'
versions:
feature: 'server-statistics'
feature: server-statistics
redirect_from:
- /early-access/github/analyze-how-your-team-works-with-server-statistics/about-server-statistics/enabling-server-statistics
topics:
topics:
- Enterprise
shortTitle: Server Statistics
---

29
content/admin/configuration/configuring-your-enterprise/command-line-utilities.md
View File

@@ -48,7 +48,7 @@ $ ghe-announce -u
You can also set an announcement banner using the enterprise settings on {% data variables.product.product_name %}. For more information, see "[Customizing user messages on your instance](/enterprise/admin/user-management/customizing-user-messages-on-your-instance#creating-a-global-announcement-banner)."
{% endif %}
{% ifversion ghes > 3.1 %}
{% ifversion ghes %}
<!--For earlier releases of GHES, see the previous service `ghe-resque-info`-->
### ghe-aqueduct
@@ -288,33 +288,6 @@ Use this command to immediately unlock the {% data variables.enterprise.manageme
$ ghe-reactivate-admin-login
```
{% ifversion ghes < 3.2 %}
<!--For more recent releases of GHES, see the replacement service `ghe-aqueduct`-->
### ghe-resque-info
This utility displays information on background jobs, both active and in the queue. It provides the same job count numbers as the admin stats bar at the top of every page.
This utility can help identify whether the Resque server is having problems processing background jobs. Any of the following scenarios might be indicative of a problem with Resque:
* The number of background jobs is increasing, while the active jobs remain the same.
* The event feeds are not updating.
* Webhooks are not being triggered.
* The web interface is not updating after a Git push.
If you suspect Resque is failing, contact {% data variables.contact.contact_ent_support %} for help.
With this command, you can also pause or resume jobs in the queue.
```shell
$ ghe-resque-info
# lists queues and the number of currently queued jobs
$ ghe-resque-info -p <em>QUEUE</em>
# pauses the specified queue
$ ghe-resque-info -r <em>QUEUE</em>
# resumes the specified queue
```
{% endif %}
### ghe-saml-mapping-csv

4
content/admin/configuration/configuring-your-enterprise/configuring-rate-limits.md
View File

@@ -40,7 +40,7 @@ Setting secondary rate limits protects the overall level of service on {% data v
{% data reusables.enterprise_site_admin_settings.access-settings %}
{% data reusables.enterprise_site_admin_settings.management-console %}
{% ifversion ghes > 3.1 %}
{% ifversion ghes %}
2. Under "Rate Limiting", select **Enable Secondary Rate Limiting**.
![Checkbox for enabling secondary rate limiting](/assets/images/enterprise/management-console/secondary-rate-limits-checkbox.png)
{% else %}
@@ -101,4 +101,4 @@ By default, the rate limit for {% data variables.product.prodname_actions %} is
```
1. Wait for the configuration run to complete.
{% endif %}
{% endif %}

2
content/admin/configuration/configuring-your-enterprise/configuring-the-referrer-policy-for-your-enterprise.md
View File

@@ -3,7 +3,7 @@ title: Configuring the referrer policy for your enterprise
shortTitle: Configure referrer policy
intro: 'You can increase the privacy of {% data variables.product.product_location %} by configuring the policy for cross-origin requests.'
versions:
ghes: '>=3.2'
ghes: '*'
type: how_to
topics:
- Enterprise

6
content/admin/configuration/configuring-your-enterprise/configuring-web-commit-signing.md
View File

@@ -1,7 +1,7 @@
---
title: Configuring web commit signing
shortTitle: Configure web commit signing
intro: You can enable auto-signing of commits made in the web interface of {% data variables.product.product_name %}.
intro: 'You can enable auto-signing of commits made in the web interface of {% data variables.product.product_name %}.'
versions:
ghes: '>=3.5'
type: how_to
@@ -11,7 +11,7 @@ topics:
- Fundamentals
- Identity
- Security
permissions: Site administrators can configure web commit signing for {% data variables.product.product_location %}.
permissions: 'Site administrators can configure web commit signing for {% data variables.product.product_location %}.'
---
## About web commit signing
@@ -73,4 +73,4 @@ You can disable web commit signing for {% data variables.product.product_locatio
```bash{:copy}
ghe-config-apply
```
```

2
content/admin/configuration/configuring-your-enterprise/managing-github-mobile-for-your-enterprise.md
View File

@@ -20,7 +20,7 @@ shortTitle: Manage GitHub Mobile
You can allow or disallow people from using {% data variables.product.prodname_mobile %} to authenticate to {% data variables.product.product_location %} and access your instance's data. By default, {% data variables.product.prodname_mobile %} is{% ifversion ghes > 3.3 %} enabled for people who use {% data variables.product.product_location %}.{% else %} not enabled for people who use {% data variables.product.product_location %}. To allow connection to your instance with {% data variables.product.prodname_mobile %}, you must enable the feature for your instance.{% endif %}
{% ifversion ghes < 3.6 and ghes > 3.1 %}
{% ifversion ghes < 3.6 %}
{% note %}
**Note:** If you upgrade to {% data variables.product.prodname_ghe_server %} 3.4.0 or later and have not previously disabled or enabled {% data variables.product.prodname_mobile %}, {% data variables.product.prodname_mobile %} will be enabled by default. If you previously disabled or enabled {% data variables.product.prodname_mobile %} for your instance, your preference will be preserved upon upgrade. For more information about upgrading your instance, see "[Upgrading {% data variables.product.product_name %}](/admin/enterprise-management/updating-the-virtual-machine-and-physical-resources/upgrading-github-enterprise-server)."

2
content/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise.md
View File

@@ -5,7 +5,7 @@ intro: 'You can verify your ownership of domains with {% data variables.product.
product: '{% data reusables.gated-features.verify-and-approve-domain %}'
versions:
ghec: '*'
ghes: '>=3.2'
ghes: '*'
permissions: Enterprise owners can verify or approve a domain for an enterprise account.
type: how_to
topics:

2
content/admin/enterprise-management/monitoring-your-appliance/about-system-logs.md
View File

@@ -59,4 +59,4 @@ The support bundle includes system logs and all audit information is logged to t
## Further reading
- [Linux man page for the `journalctl` command](http://man7.org/linux/man-pages/man1/journalctl.1.html)
- [Linux man page for the `journalctl` command](http://man7.org/linux/man-pages/man1/journalctl.1.html)

4
content/admin/enterprise-management/updating-the-virtual-machine-and-physical-resources/index.md
View File

@@ -2,8 +2,8 @@
title: Updating the virtual machine and physical resources
intro: 'Upgrading the virtual software and virtual hardware requires some downtime for your instance, so be sure to plan your upgrade in advance.'
redirect_from:
- '/enterprise/admin/guides/installation/upgrading-the-vm'
- '/enterprise/admin/guides/installation/upgrading-physical-resources'
- /enterprise/admin/guides/installation/upgrading-the-vm
- /enterprise/admin/guides/installation/upgrading-physical-resources
- /enterprise/admin/installation/updating-the-virtual-machine-and-physical-resources
- /enterprise/admin/enterprise-management/updating-the-virtual-machine-and-physical-resources
versions:

2
content/admin/enterprise-management/updating-the-virtual-machine-and-physical-resources/upgrade-requirements.md
View File

@@ -48,8 +48,6 @@ curl -s http://localhost:9201/audit_log/_stats/store | jq ._all.primaries.store.
```
Use the number to estimate the amount of disk space the MySQL audit logs will need. The script also monitors your free disk space while the import is in progress. Monitoring this number is especially useful if your free disk space is close to the amount of disk space necessary for migration.
{% data reusables.enterprise_installation.upgrade-hardware-requirements %}
## Next steps
After reviewing these recommendations and requirements, you can upgrade {% data variables.product.prodname_ghe_server %}. For more information, see "[Upgrading {% data variables.product.prodname_ghe_server %}](/enterprise/admin/guides/installation/upgrading-github-enterprise-server/)."

2
content/admin/enterprise-management/updating-the-virtual-machine-and-physical-resources/upgrading-github-enterprise-server.md
View File

@@ -38,8 +38,6 @@ shortTitle: Upgrading GHES
{% endnote %}
{% data reusables.enterprise_installation.upgrade-hardware-requirements %}
## Taking a snapshot
A snapshot is a checkpoint of a virtual machine (VM) at a point in time. We highly recommend taking a snapshot before upgrading your virtual machine so that if an upgrade fails, you can revert your VM back to the snapshot. We only recommend taking a VM snapshot when the appliance is powered down or in maintenance mode and all background jobs have finished.

2
content/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/about-github-actions-for-enterprises.md
View File

@@ -1,7 +1,7 @@
---
title: About GitHub Actions for enterprises
shortTitle: About GitHub Actions
intro: "{% data variables.product.prodname_actions %} can improve developer productivity by automating your enterprise's software development cycle."
intro: '{% data variables.product.prodname_actions %} can improve developer productivity by automating your enterprise''s software development cycle.'
versions:
ghec: '*'
ghes: '*'

16
content/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server.md
View File

@@ -33,16 +33,7 @@ This article explains how site administrators can configure {% data variables.pr
## Review hardware requirements
{%- ifversion ghes < 3.2 %}
The CPU and memory resources available to {% data variables.product.product_location %} determine the maximum job throughput for {% data variables.product.prodname_actions %}. {% data reusables.actions.minimum-hardware %}
Internal testing at {% data variables.product.company_short %} demonstrated the following maximum throughput for {% data variables.product.prodname_ghe_server %} instances with a range of CPU and memory configurations. You may see different throughput depending on the overall levels of activity on your instance.
{%- endif %}
{%- ifversion ghes > 3.1 %}
{%- ifversion ghes %}
The CPU and memory resources available to {% data variables.product.product_location %} determine the number of jobs that can be run concurrently without performance loss. {% data reusables.actions.minimum-hardware %}
@@ -50,11 +41,6 @@ The peak quantity of concurrent jobs running without performance loss depends on
{% endif %}
{%- ifversion ghes < 3.2 %}
{% data reusables.actions.hardware-requirements-before %}
{%- endif %}
{%- ifversion ghes = 3.2 %}

4
content/admin/guides.md
View File

@@ -13,8 +13,8 @@ learningTracks:
- '{% ifversion ghae %}get_started_with_github_ae{% endif %}'
- '{% ifversion ghes %}deploy_an_instance{% endif %}'
- '{% ifversion ghes %}upgrade_your_instance{% endif %}'
- adopting_github_actions_for_your_enterprise_ghec
- adopting_github_actions_for_your_enterprise_ghes_and_ghae
- adopting_github_actions_for_your_enterprise_ghec
- adopting_github_actions_for_your_enterprise_ghes_and_ghae
- '{% ifversion ghes %}increase_fault_tolerance{% endif %}'
- '{% ifversion ghes %}improve_security_of_your_instance{% endif %}'
- '{% ifversion ghes > 2.22 %}configure_github_actions{% endif %}'

2
content/admin/identity-and-access-management/index.md
View File

@@ -1,6 +1,6 @@
---
title: Identity and access management
intro: You can configure how people access {% ifversion ghec or ghae %}your enterprise on {% data variables.product.product_name %}{% elsif ghes %}{% data variables.product.product_location %}{% endif %}.
intro: 'You can configure how people access {% ifversion ghec or ghae %}your enterprise on {% data variables.product.product_name %}{% elsif ghes %}{% data variables.product.product_location %}{% endif %}.'
redirect_from:
- /enterprise/admin/authentication
- /admin/authentication

4
content/admin/identity-and-access-management/managing-iam-for-your-enterprise/about-authentication-for-your-enterprise.md
View File

@@ -1,7 +1,7 @@
---
title: About authentication for your enterprise
shortTitle: About authentication
intro: You {% ifversion ghae %}must configure SAML single sign-on (SSO) so people can{% else %}can choose how people{% endif %} authenticate to access {% ifversion ghec %}your enterprise's resources on {% data variables.product.product_name %}{% elsif ghes %}{% data variables.product.product_location %}{% elsif ghae %}your enterprise on {% data variables.product.product_name %}{% endif %}.
intro: 'You {% ifversion ghae %}must configure SAML single sign-on (SSO) so people can{% else %}can choose how people{% endif %} authenticate to access {% ifversion ghec %}your enterprise''s resources on {% data variables.product.product_name %}{% elsif ghes %}{% data variables.product.product_location %}{% elsif ghae %}your enterprise on {% data variables.product.product_name %}{% endif %}.'
versions:
ghec: '*'
ghes: '*'
@@ -135,4 +135,4 @@ If you choose to use external authentication, you can also configure fallback au
- "[About enterprise accounts](/admin/overview/about-enterprise-accounts)"
{%- ifversion ghec %}
- "[Can I create accounts for people in my organization?](/organizations/managing-membership-in-your-organization/can-i-create-accounts-for-people-in-my-organization)"
{% endif %}
{% endif %}

2
content/admin/identity-and-access-management/managing-iam-for-your-enterprise/allowing-built-in-authentication-for-users-outside-your-provider.md
View File

@@ -1,6 +1,6 @@
---
title: Allowing built-in authentication for users outside your provider
intro: "You can configure fallback authentication to allow built-in authentication for people who don't have an account on your CAS, LDAP, or SAML authentication provider."
intro: 'You can configure fallback authentication to allow built-in authentication for people who don''t have an account on your CAS, LDAP, or SAML authentication provider.'
redirect_from:
- /enterprise/admin/user-management/allowing-built-in-authentication-for-users-outside-your-identity-provider
- /enterprise/admin/authentication/allowing-built-in-authentication-for-users-outside-your-identity-provider

4
content/admin/identity-and-access-management/managing-iam-for-your-enterprise/username-considerations-for-external-authentication.md
View File

@@ -1,7 +1,7 @@
---
title: Username considerations for external authentication
shortTitle: Username considerations
intro: "{% ifversion ghes or ghec %}When you use {% ifversion ghes %}CAS, LDAP, or SAML for authentication{% elsif ghec %}{% data variables.product.prodname_emus %}{% endif %}, {% endif %}{% data variables.product.product_name %} follows certain rules to determine the username for each user account {% ifversion ghec or ghae %}in your enterprise{% elsif ghes %}on your instance{% endif %}."
intro: '{% ifversion ghes or ghec %}When you use {% ifversion ghes %}CAS, LDAP, or SAML for authentication{% elsif ghec %}{% data variables.product.prodname_emus %}{% endif %}, {% endif %}{% data variables.product.product_name %} follows certain rules to determine the username for each user account {% ifversion ghec or ghae %}in your enterprise{% elsif ghes %}on your instance{% endif %}.'
miniTocMaxHeadingLevel: 3
versions:
ghec: '*'
@@ -154,4 +154,4 @@ To resolve username conflicts in Okta, update the attribute mapping settings for
1. Click **Sign On**.
1. In the "Settings" section, click **Edit**.
1. Update the "Application username format."
{% endif %}
{% endif %}

2
content/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/downloading-your-enterprise-accounts-single-sign-on-recovery-codes.md
View File

@@ -1,7 +1,7 @@
---
title: Downloading your enterprise account's single sign-on recovery codes
shortTitle: Download recovery codes
intro: "To ensure that you can access {% data variables.product.product_name %} if your identity provider (IdP) is unavailable, you should download your enterprise account's single sign-on (SSO) recovery codes."
intro: 'To ensure that you can access {% data variables.product.product_name %} if your identity provider (IdP) is unavailable, you should download your enterprise account''s single sign-on (SSO) recovery codes.'
versions:
ghec: '*'
type: how_to

2
content/admin/identity-and-access-management/using-built-in-authentication/configuring-built-in-authentication.md
View File

@@ -1,7 +1,7 @@
---
title: Configuring built-in authentication
intro: 'When you use the default authentication method, all authentication details are stored on {% data variables.product.product_location %}.'
permissions: Site administrators can configure authentication for a {% data variables.product.product_name %} instance.
permissions: 'Site administrators can configure authentication for a {% data variables.product.product_name %} instance.'
redirect_from:
- /enterprise/admin/user-management/using-built-in-authentication
- /enterprise/admin/authentication/using-built-in-authentication

4
content/admin/identity-and-access-management/using-built-in-authentication/disabling-unauthenticated-sign-ups.md
View File

@@ -7,8 +7,8 @@ redirect_from:
- /admin/authentication/disabling-unauthenticated-sign-ups
- /enterprise/admin/authentication/authenticating-users-for-your-github-enterprise-server-instance/disabling-unauthenticated-sign-ups
- /admin/identity-and-access-management/authenticating-users-for-your-github-enterprise-server-instance/disabling-unauthenticated-sign-ups
intro: "If you're using built-in authentication for {% data variables.product.product_location %}, you can block unauthenticated people from creating new user accounts on your instance."
permissions: Site administrators can disable unauthenticated sign-ups on a {% data variables.product.product_name %} instance.
intro: 'If you''re using built-in authentication for {% data variables.product.product_location %}, you can block unauthenticated people from creating new user accounts on your instance.'
permissions: 'Site administrators can disable unauthenticated sign-ups on a {% data variables.product.product_name %} instance.'
versions:
ghes: '*'
type: how_to

2
content/admin/identity-and-access-management/using-built-in-authentication/index.md
View File

@@ -1,7 +1,7 @@
---
title: Using built-in authentication
shortTitle: Built-in authentication
intro: "If you don't use a centralized, external system for your users' identity, you can use built-in authentication to allow {% data variables.product.prodname_ghe_server %} to manage accounts and perform local authentication."
intro: 'If you don''t use a centralized, external system for your users'' identity, you can use built-in authentication to allow {% data variables.product.prodname_ghe_server %} to manage accounts and perform local authentication.'
versions:
ghes: '*'
topics:

4
content/admin/identity-and-access-management/using-built-in-authentication/inviting-people-to-use-your-instance.md
View File

@@ -1,9 +1,9 @@
---
title: Inviting people to use your instance
intro: When you use built-in authentication for {% data variables.product.product_name %}, you can invite people by email address to create a user account on your instance.
intro: 'When you use built-in authentication for {% data variables.product.product_name %}, you can invite people by email address to create a user account on your instance.'
versions:
ghes: '*'
permissions: Enterprise owners can invite people to create a user account on a {% data variables.product.product_name %} instance.
permissions: 'Enterprise owners can invite people to create a user account on a {% data variables.product.product_name %} instance.'
type: how_to
topics:
- Accounts

4
content/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-support-for-your-idps-conditional-access-policy.md
View File

@@ -4,7 +4,7 @@ shortTitle: Conditional access policy
intro: 'When your enterprise uses OIDC SSO, {% data variables.product.prodname_dotcom %} will validate access to your enterprise and its resources using your IdP''s Conditional Access Policy (CAP).'
product: '{% data reusables.gated-features.emus %}'
versions:
feature: 'oidc-for-emu'
feature: oidc-for-emu
topics:
- Accounts
- Authentication
@@ -44,4 +44,4 @@ When {% data variables.product.prodname_github_apps %} and {% data variables.pro
You can contact the owners of the apps you want to use, ask for their IP ranges, and configure your IdP's CAP to allow access from those IP ranges. If you're unable to contact the owners, you can review your IdP sign-in logs to review the IP addresses seen in the requests, then allow-list those addresses.
You can also enable IP allow list configuration for installed {% data variables.product.prodname_github_apps %}. When enabled, all {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_oauth_apps %} will continue working regardless of the originating IP address. For more information, see "[Enforcing policies for security settings in your enterprise](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#allowing-access-by-github-apps)."
You can also enable IP allow list configuration for installed {% data variables.product.prodname_github_apps %}. When enabled, all {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_oauth_apps %} will continue working regardless of the originating IP address. For more information, see "[Enforcing policies for security settings in your enterprise](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise#allowing-access-by-github-apps)."

2
content/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users.md
View File

@@ -4,7 +4,7 @@ shortTitle: OIDC for managed users
intro: 'You can automatically manage access to your enterprise account on {% data variables.product.prodname_dotcom %} by configuring OpenID Connect (OIDC) single sign-on (SSO) and enable support for your IdP''s Conditional Access Policy (CAP).'
product: '{% data reusables.gated-features.emus %}'
versions:
feature: 'oidc-for-emu'
feature: oidc-for-emu
topics:
- Accounts
- Authentication

4
content/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/migrating-from-saml-to-oidc.md
View File

@@ -4,7 +4,7 @@ shortTitle: Migrating from SAML to OIDC
intro: 'If you''re using SAML to authenticate members in your {% data variables.product.prodname_emu_enterprise %}, you can migrate to OpenID Connect (OIDC) and benefit from support for your IdP''s Conditional Access Policy.'
product: '{% data reusables.gated-features.emus %}'
versions:
feature: 'oidc-for-emu'
feature: oidc-for-emu
topics:
- Accounts
- Authentication
@@ -55,4 +55,4 @@ If you're new to {% data variables.product.prodname_emus %} and haven't yet conf
1. To save your changes, at the top of the form, click **Save**.
1. In Azure Portal, copy the users and groups from the old {% data variables.product.prodname_emu_idp_application %} application to the new {% data variables.product.prodname_emu_idp_oidc_application %} application.
1. Test your configuration by provisioning a single new user.
1. If your test is successful, start provisioning for all users by clicking **Start provisioning**.
1. If your test is successful, start provisioning for all users by clicking **Start provisioning**.

2
content/admin/identity-and-access-management/using-ldap-for-enterprise-iam/index.md
View File

@@ -1,7 +1,7 @@
---
title: Using LDAP for enterprise IAM
shortTitle: LDAP for enterprise IAM
intro: You can centrally manage accounts and access to {% data variables.product.product_location %} by integrating with your existing LDAP directory.
intro: 'You can centrally manage accounts and access to {% data variables.product.product_location %} by integrating with your existing LDAP directory.'
versions:
ghes: '*'
children:

2
content/admin/identity-and-access-management/using-ldap-for-enterprise-iam/using-ldap.md
View File

@@ -11,7 +11,7 @@ redirect_from:
- /admin/authentication/using-ldap
- /enterprise/admin/authentication/authenticating-users-for-your-github-enterprise-server-instance/using-ldap
- /admin/identity-and-access-management/authenticating-users-for-your-github-enterprise-server-instance/using-ldap
intro: If you use Lightweight Directory Access Protocol (LDAP) to centralize access across applications, you can integrate {% data variables.product.product_name %} by configuring LDAP authentication for your instance.
intro: 'If you use Lightweight Directory Access Protocol (LDAP) to centralize access across applications, you can integrate {% data variables.product.product_name %} by configuring LDAP authentication for your instance.'
versions:
ghes: '*'
type: how_to

4
content/admin/identity-and-access-management/using-saml-for-enterprise-iam/enabling-encrypted-assertions.md
View File

@@ -1,8 +1,8 @@
---
title: Enabling encrypted assertions
shortTitle: Enable encrypted assertions
intro: You can improve {% data variables.product.product_location %}'s security with SAML single sign-on (SSO) by encrypting the messages that your SAML identity provider (IdP) sends.
permissions: Site administrators can configure encrypted assertions for a {% data variables.product.product_name %} instance.
intro: 'You can improve {% data variables.product.product_location %}''s security with SAML single sign-on (SSO) by encrypting the messages that your SAML identity provider (IdP) sends.'
permissions: 'Site administrators can configure encrypted assertions for a {% data variables.product.product_name %} instance.'
versions:
ghes: '> 3.3'
type: how_to

2
content/admin/identity-and-access-management/using-saml-for-enterprise-iam/saml-configuration-reference.md
View File

@@ -1,5 +1,5 @@
---
title: 'SAML configuration reference'
title: SAML configuration reference
shortTitle: SAML reference
intro: 'You can see SAML metadata for {% ifversion ghec %}your organization or enterprise on {% data variables.product.product_name %}{% elsif ghes %}{% data variables.product.product_location %}{% elsif ghae %}your enterprise on {% data variables.product.product_name %}{% endif %}, and you can learn more about available SAML attributes and response requirements.'
versions:

2
content/admin/identity-and-access-management/using-saml-for-enterprise-iam/troubleshooting-saml-authentication.md
View File

@@ -1,7 +1,7 @@
---
title: Troubleshooting SAML authentication
shortTitle: Troubleshoot SAML SSO
intro: If you use SAML single sign-on (SSO) and people are unable to authenticate to access {% data variables.product.product_location %}, you can troubleshoot the problem.
intro: 'If you use SAML single sign-on (SSO) and people are unable to authenticate to access {% data variables.product.product_location %}, you can troubleshoot the problem.'
versions:
ghes: '*'
type: how_to

2
content/admin/identity-and-access-management/using-saml-for-enterprise-iam/updating-a-users-saml-nameid.md
View File

@@ -1,7 +1,7 @@
---
title: Updating a user's SAML NameID
shortTitle: Update SAML NameID
intro: When an account's `NameID` changes on your identity provider (IdP) and the person can no longer {% ifversion ghes or ghae %}sign into {% data variables.product.product_location %}{% elsif ghec %}authenticate to access your enterprise's resources{% endif %}, you must {% ifversion ghec %}either contact {% data variables.product.company_short %} Support or revoke the person's linked identity{% elsif ghes %}update the `NameID` mapping on {% data variables.product.product_location %}{% elsif ghae %}contact {% data variables.product.company_short %} Support{% endif %}.
intro: 'When an account''s `NameID` changes on your identity provider (IdP) and the person can no longer {% ifversion ghes or ghae %}sign into {% data variables.product.product_location %}{% elsif ghec %}authenticate to access your enterprise''s resources{% endif %}, you must {% ifversion ghec %}either contact {% data variables.product.company_short %} Support or revoke the person''s linked identity{% elsif ghes %}update the `NameID` mapping on {% data variables.product.product_location %}{% elsif ghae %}contact {% data variables.product.company_short %} Support{% endif %}.'
versions:
ghes: '*'
type: how_to

2
content/admin/installation/setting-up-a-github-enterprise-server-instance/setting-up-a-staging-instance.md
View File

@@ -1,6 +1,6 @@
---
title: Setting up a staging instance
intro: You can set up a {% data variables.product.product_name %} instance in a separate, isolated environment, and use the instance to validate and test changes.
intro: 'You can set up a {% data variables.product.product_name %} instance in a separate, isolated environment, and use the instance to validate and test changes.'
redirect_from:
- /enterprise/admin/installation/setting-up-a-staging-instance
- /admin/installation/setting-up-a-staging-instance

4
content/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/about-server-statistics.md
View File

@@ -2,11 +2,11 @@
title: About Server Statistics
intro: 'You can use {% data variables.product.prodname_server_statistics %} to analyze your own aggregate data from {% data variables.product.prodname_ghe_server %}, and help us improve {% data variables.product.company_short %} products.'
versions:
feature: 'server-statistics'
feature: server-statistics
permissions: 'Enterprise owners can enable {% data variables.product.prodname_server_statistics %}.'
redirect_from:
- /early-access/github/analyze-how-your-team-works-with-server-statistics/about-server-statistics
topics:
topics:
- Enterprise
---

2
content/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/exporting-server-statistics.md
View File

@@ -3,7 +3,7 @@ title: Exporting Server Statistics
shortTitle: Export Server Statistics
intro: 'You can use your own tools to analyze your {% data variables.product.prodname_ghe_server %} usage over time by downloading your {% data variables.product.prodname_server_statistics %} metrics in a CSV or JSON file.'
versions:
feature: 'server-statistics'
feature: server-statistics
redirect_from:
- /early-access/github/analyze-how-your-team-works-with-server-statistics/exploring-server-statistics
---

5
content/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/index.md
View File

@@ -3,9 +3,10 @@ title: Analyzing how your team works with Server Statistics
shortTitle: Server Statistics
intro: 'To analyze how your team works, understand the value you get from {% data variables.product.prodname_ghe_server %}, and help us improve our products, you can use {% data variables.product.prodname_server_statistics %} to review your usage data for {% data variables.product.prodname_ghe_server %} and share this aggregate data with {% data variables.product.company_short %}.'
versions:
feature: 'server-statistics'
feature: server-statistics
children:
- /about-server-statistics
- /exporting-server-statistics
- /requesting-server-statistics-using-the-rest-api
---
---

2
content/admin/monitoring-activity-in-your-enterprise/analyzing-how-your-team-works-with-server-statistics/requesting-server-statistics-using-the-rest-api.md
View File

@@ -3,7 +3,7 @@ title: Requesting Server Statistics using the REST API
shortTitle: Server Statistics and REST API
intro: 'You can use your own tools to analyze your {% data variables.product.prodname_ghe_server %} usage over time by requesting the {% data variables.product.prodname_server_statistics %} metrics collected using the REST API.'
versions:
feature: 'server-statistics'
feature: server-statistics
redirect_from:
- /early-access/github/analyze-how-your-team-works-with-server-statistics/requesting-server-statistics-using-the-rest-api
---

5
content/admin/monitoring-activity-in-your-enterprise/exploring-user-activity/index.md
View File

@@ -1,6 +1,6 @@
---
title: Exploring user activity in your enterprise
intro: You can view user and system activity by leveraging dashboards, webhooks and log forwarding.
intro: 'You can view user and system activity by leveraging dashboards, webhooks and log forwarding.'
versions:
ghec: '*'
ghes: '*'
@@ -10,7 +10,8 @@ topics:
children:
- /activity-dashboard
- /viewing-push-logs
- /log-forwarding
- /log-forwarding
- /managing-global-webhooks
shortTitle: Explore user activity
---

3
content/admin/monitoring-activity-in-your-enterprise/index.md
View File

@@ -1,6 +1,6 @@
---
title: Monitoring activity in your enterprise
intro: You can view user and system activity by leveraging audit logs{% ifversion ghes or ghae %}, push logs, dashboards, webhooks, and log forwarding{% else %}and webhooks{% endif %}.
intro: 'You can view user and system activity by leveraging audit logs{% ifversion ghes or ghae %}, push logs, dashboards, webhooks, and log forwarding{% else %}and webhooks{% endif %}.'
redirect_from:
- /enterprise/admin/installation/monitoring-activity-on-your-github-enterprise-server-instance
versions:
@@ -15,3 +15,4 @@ children:
- /analyzing-how-your-team-works-with-server-statistics
shortTitle: Monitor activity
---

2
content/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/accessing-the-audit-log-for-your-enterprise.md
View File

@@ -2,7 +2,7 @@
title: Accessing the audit log for your enterprise
intro: You can view aggregated actions from all of the organizations owned by an enterprise account in the enterprise's audit log.
shortTitle: Access audit logs
permissions: Enterprise owners {% ifversion ghes %}and site administrators {% endif %}can access the audit log.
permissions: 'Enterprise owners {% ifversion ghes %}and site administrators {% endif %}can access the audit log.'
redirect_from:
- /github/setting-up-and-managing-your-enterprise/managing-organizations-in-your-enterprise-account/viewing-the-audit-logs-for-organizations-in-your-enterprise-account
- /articles/viewing-the-audit-logs-for-organizations-in-your-business-account

41
content/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise.md
View File

@@ -31,7 +31,6 @@ The scope of the events that appear in your enterprise's audit log depend on whe
- If your enterprise uses {% data variables.product.prodname_emus %}, the audit log also includes user events for {% data variables.product.prodname_managed_users %}, such as each time the user logs in to {% data variables.product.product_name %}. For a list of these events, see "[Reviewing your security log](/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log#security-log-actions)."
{% endif %}
{%- ifversion fpt or ghec %}
## `account` category actions
@@ -92,7 +91,7 @@ The scope of the events that appear in your enterprise's audit log depend on whe
{%- ifversion ghec %}
| `business.add_support_entitlee` | A support entitlement was added to a member of an enterprise. For more information, see "[Managing support entitlements for your enterprise](/admin/user-management/managing-users-in-your-enterprise/managing-support-entitlements-for-your-enterprise)."
{%- endif %}
{%- ifversion ghes > 3.0 or ghae %}
{%- ifversion ghes or ghae %}
| `business.advanced_security_policy_update` | An enterprise owner{% ifversion ghes %} or site administrator{% endif %} created, updated, or removed a policy for {% data variables.product.prodname_GH_advanced_security %}. For more information, see "[Enforcing policies for {% data variables.product.prodname_advanced_security %} in your enterprise](/admin/policies/enforcing-policies-for-advanced-security-in-your-enterprise)."
{%- endif %}
{%- ifversion ghec %}
@@ -123,7 +122,7 @@ The scope of the events that appear in your enterprise's audit log depend on whe
| `business.members_can_update_protected_branches.disable` | The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.
| `business.members_can_update_protected_branches.enable` | The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.
| `business.remove_admin` | An enterprise owner{% ifversion ghes %} or site administrator{% endif %} was removed from an enterprise.
{%- ifversion ghes > 3.1 %}
{%- ifversion ghes %}
| `business.referrer_override_enable` | An enterprise owner or site administrator enabled the referrer policy override. For more information, see "[Configuring the referrer policy for your enterprise](/admin/configuration/configuring-your-enterprise/configuring-the-referrer-policy-for-your-enterprise)."
| `business.referrer_override_disable` | An enterprise owner or site administrator disabled the referrer policy override. For more information, see "[Configuring the referrer policy for your enterprise](/admin/configuration/configuring-your-enterprise/configuring-the-referrer-policy-for-your-enterprise)."
{%- endif %}
@@ -250,7 +249,6 @@ Action | Description
| `dependabot_security_updates_new_repos.enable` | An enterprise owner{% ifversion ghes %} or site administrator{% endif %} enabled {% data variables.product.prodname_dependabot_security_updates %} for all new repositories.
{%- endif %}
{%- ifversion fpt or ghec or ghes or ghae %}
## `dependency_graph` category actions
| Action | Description
@@ -264,7 +262,6 @@ Action | Description
|--------|-------------
| `dependency_graph_new_repos.disable` | An enterprise owner{% ifversion ghes %} or site administrator{% endif %} disabled the dependency graph for all new repositories. For more information, see "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)."
| `dependency_graph_new_repos.enable` | An enterprise owner{% ifversion ghes %} or site administrator{% endif %} enabled the dependency graph for all new repositories.
{%- endif %}
{%- ifversion fpt or ghec %}
## `discussion` category actions
@@ -327,7 +324,7 @@ Action | Description
{%- ifversion ghec %}
| `enterprise.runner_group_visiblity_updated` | The visibility of a {% data variables.product.prodname_actions %} self-hosted runner group was updated via the REST API. For more information, see "[Update a self-hosted runner group for an organization](/rest/reference/actions#update-a-self-hosted-runner-group-for-an-organization)."
{%- endif %}
{%- ifversion ghec or ghes > 3.1 or ghae %}
{%- ifversion ghec or ghes or ghae %}
| `enterprise.self_hosted_runner_online` | The {% data variables.product.prodname_actions %} runner application was started. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `enterprise.self_hosted_runner_offline` | The {% data variables.product.prodname_actions %} runner application was stopped. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
{%- endif %}
@@ -611,7 +608,6 @@ Action | Description
| `org.accept_business_invitation` | An invitation sent to an organization to join an enterprise was accepted. {% ifversion ghec %}For more information, see "[Inviting an organization to join your enterprise account](/admin/user-management/managing-organizations-in-your-enterprise/adding-organizations-to-your-enterprise#inviting-an-organization-to-join-your-enterprise-account)."{% endif %}
| `org.add_billing_manager` | A billing manager was added to an organization. {% ifversion fpt or ghec %}For more information, see "[Adding a billing manager to your organization](/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization)."{% endif %}
| `org.add_member` | A user joined an organization.
{%- ifversion ghes > 3.0 or ghae or ghec %}
| `org.advanced_security_disabled_for_new_repos` | {% data variables.product.prodname_GH_advanced_security %} was disabled for new repositories in an organization.
| `org.advanced_security_disabled_on_all_repos` | {% data variables.product.prodname_GH_advanced_security %} was disabled for all repositories in an organization.
| `org.advanced_security_enabled_for_new_repos` | {% data variables.product.prodname_GH_advanced_security %} was enabled for new repositories in an organization.
@@ -619,7 +615,6 @@ Action | Description
| `org.advanced_security_policy_selected_member_disabled` | An enterprise owner prevented {% data variables.product.prodname_GH_advanced_security %} features from being enabled for repositories owned by the organization. {% data reusables.advanced-security.more-information-about-enforcement-policy %}
| `org.advanced_security_policy_selected_member_enabled` | An enterprise owner allowed {% data variables.product.prodname_GH_advanced_security %} features to be enabled for repositories owned by the organization. {% data reusables.advanced-security.more-information-about-enforcement-policy %}
| `org.advanced_security_policy_update` | An organization owner updated polices for {% data variables.product.prodname_GH_advanced_security %} in an enterprise. {% data reusables.advanced-security.more-information-about-enforcement-policy %}
{%- endif %}
| `org.async_delete` | A user initiated a background job to delete an organization.
{%- ifversion ghec %}
| `org.audit_log_export` | An organization owner created an export of the organization audit log. If the export included a query, the log will list the query used and the number of audit log entries matching that query. For more information, see "[Exporting audit log activity for your enterprise](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise)."
@@ -717,10 +712,8 @@ Action | Description
| `org.secret_scanning_push_protection_disable` | An organization owner or administrator disabled push protection for secret scanning. For more information, see "[Protecting pushes with secret scanning](/enterprise-cloud@latest/code-security/secret-scanning/protecting-pushes-with-secret-scanning)."
| `org.secret_scanning_push_protection_enable` | An organization owner or administrator enabled push protection for secret scanning.
{%- endif %}
{%- ifversion fpt or ghec or ghes > 3.1 or ghae %}
| `org.self_hosted_runner_online` | The runner application was started. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `org.self_hosted_runner_offline` | The runner application was stopped. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
{%- endif %}
{%- ifversion fpt or ghec or ghes %}
| `org.self_hosted_runner_updated` | The runner application was updated. Can be viewed using the REST API and the UI; not visible in the JSON/CSV export. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners)."
{%- endif %}
@@ -780,7 +773,7 @@ Action | Description
| `organization_default_label.update` | A default label for repositories in an organization was edited. For more information, see "[Editing a default label](/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#editing-a-default-label)."
| `organization_default_label.destroy` | A default label for repositories in an organization was deleted. For more information, see "[Deleting a default label](/organizations/managing-organization-settings/managing-default-labels-for-repositories-in-your-organization#deleting-a-default-label)."
{%- ifversion fpt or ghec or ghes > 3.1 %}
{%- ifversion fpt or ghec or ghes %}
## `organization_domain` category actions
| Action | Description
@@ -799,23 +792,21 @@ Action | Description
| `organization_projects_change.enable` | Organization projects were enabled for all organizations in an enterprise. For more information, see "[Enforcing a policy for organization-wide project boards](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-project-board-policies-in-your-enterprise#enforcing-a-policy-for-organization-wide-project-boards)."
{%- endif %}
{%- ifversion fpt or ghec or ghes > 3.0 or ghae %}
## `packages` category actions
| Action | Description
|--------|-------------
| `packages.insecure_hash` | Maven published an insecure hash for a specific package version.
| `packages.package_deleted` | A package was deleted from an organization.{% ifversion fpt or ghec or ghes > 3.1 %} For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% endif %}
| `packages.package_deleted` | A package was deleted from an organization.{% ifversion fpt or ghec or ghes %} For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% endif %}
| `packages.package_published` | A package was published or republished to an organization.
| `packages.package_restored` | An entire package was restored.{% ifversion fpt or ghec or ghes > 3.1 %} For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% endif %}
| `packages.package_version_deleted` | A specific package version was deleted.{% ifversion fpt or ghec or ghes > 3.1 %} For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% endif %}
| `packages.package_restored` | An entire package was restored.{% ifversion fpt or ghec or ghes %} For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% endif %}
| `packages.package_version_deleted` | A specific package version was deleted.{% ifversion fpt or ghec or ghes %} For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% endif %}
| `packages.package_version_published` | A specific package version was published or republished to a package.
| `packages.package_version_restored` | A specific package version was deleted.{% ifversion fpt or ghec or ghes > 3.1 %} For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% endif %}
| `packages.package_version_restored` | A specific package version was deleted.{% ifversion fpt or ghec or ghes %} For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% endif %}
| `packages.part_upload` | A specific package version was partially uploaded to an organization.
| `packages.upstream_package_fetched` | A specific package version was fetched from the npm upstream proxy.
| `packages.version_download` | A specific package version was downloaded.
| `packages.version_upload` | A specific package version was uploaded.
{%- endif %}
{%- ifversion fpt or ghec %}
## `pages_protected_domain` category actions
@@ -958,7 +949,6 @@ Action | Description
[add key]: /authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account
[deploy key]: /developers/overview/managing-deploy-keys#deploy-keys
{%- ifversion fpt or ghec or ghes > 3.1 or ghae %}
## `pull_request` category actions
| Action | Description
@@ -992,7 +982,6 @@ Action | Description
| `pull_request_review_comment.create` | A review comment was added to a pull request. For more information, see "[About pull request reviews](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews)."
| `pull_request_review_comment.delete` | A review comment on a pull request was deleted.
| `pull_request_review_comment.update` | A review comment on a pull request was changed.
{%- endif %}
## `repo` category actions
@@ -1052,11 +1041,9 @@ Action | Description
| `repo.set_actions_fork_pr_approvals_policy` | The setting for requiring approvals for workflows from public forks was changed for a repository. For more information, see "[Configuring required approval for workflows from public forks](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks)."
{%- endif %}
| `repo.set_actions_retention_limit` | The retention period for {% data variables.product.prodname_actions %} artifacts and logs in a repository was changed. For more information, see "[Configuring the retention period for {% data variables.product.prodname_actions %} artifacts and logs in your repository](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository)."
{%- ifversion fpt or ghec or ghes > 3.1 or ghae %}
| `repo.self_hosted_runner_online` | The runner application was started. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `repo.self_hosted_runner_offline` | The runner application was stopped. Can only be viewed using the REST API; not visible in the UI or JSON/CSV export. For more information, see "[Checking the status of a self-hosted runner](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners#checking-the-status-of-a-self-hosted-runner)."
| `repo.self_hosted_runner_updated` | The runner application was updated. Can be viewed using the REST API and the UI; not visible in the JSON/CSV export. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners)."
{%- endif %}
| `repo.staff_unlock` | An enterprise administrator or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.
| `repo.transfer` | A user accepted a request to receive a transferred repository.
| `repo.transfer_outgoing` | A repository was transferred to another repository network.
@@ -1155,7 +1142,6 @@ Action | Description
| `repository_visibility_change.disable` | The ability for enterprise members to update a repository's visibility was disabled. Members are unable to change repository visibilities in an organization, or all organizations in an enterprise.
| `repository_visibility_change.enable` | The ability for enterprise members to update a repository's visibility was enabled. Members are able to change repository visibilities in an organization, or all organizations in an enterprise.
{%- ifversion fpt or ghec or ghes or ghae %}
## `repository_vulnerability_alert` category actions
| Action | Description
@@ -1163,7 +1149,6 @@ Action | Description
| `repository_vulnerability_alert.create` | {% data variables.product.product_name %} created a {% data variables.product.prodname_dependabot %} alert for a repository that uses an insecure dependency. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts)."
| `repository_vulnerability_alert.dismiss` | An organization owner or repository administrator dismissed a {% data variables.product.prodname_dependabot %} alert about a vulnerable dependency{% ifversion GH-advisory-db-supports-malware %} or malware{% endif %}.
| `repository_vulnerability_alert.resolve` | Someone with write access to a repository pushed changes to update and resolve a {% data variables.product.prodname_dependabot %} alert in a project dependency.
{%- endif %}
{%- ifversion fpt or ghec %}
## `repository_vulnerability_alerts` category actions
@@ -1182,7 +1167,7 @@ Action | Description
| `required_status_check.create` | A status check was marked as required for a protected branch. For more information, see "[Require status checks before merging](/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches#require-status-checks-before-merging)."
| `required_status_check.destroy` | A status check was no longer marked as required for a protected branch. For more information, see "[Require status checks before merging](/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches#require-status-checks-before-merging)."
{%- ifversion ghec or ghes > 3.1 %}
{%- ifversion ghec or ghes %}
## `restrict_notification_delivery` category actions
| Action | Description
@@ -1300,12 +1285,12 @@ Action | Description
{%- ifversion ghes %}
| `staff.search_audit_log` | A site administrator performed a search of the site admin audit log.
{%- endif %}
| `staff.set_domain_token_expiration` | {% ifversion ghes %}A site administrator or {% endif %}GitHub staff set the verification code expiry time for an organization or enterprise domain. {% ifversion ghec or ghes > 3.1 %}For more information, see "[Verifying or approving a domain for your organization](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization)" and "[Verifying or approving a domain for your enterprise](/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise)."{% endif %}
| `staff.set_domain_token_expiration` | {% ifversion ghes %}A site administrator or {% endif %}GitHub staff set the verification code expiry time for an organization or enterprise domain. {% ifversion ghec or ghes %}For more information, see "[Verifying or approving a domain for your organization](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization)" and "[Verifying or approving a domain for your enterprise](/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise)."{% endif %}
{%- ifversion ghes %}
| `staff.unlock` | A site administrator unlocked (temporarily gained full access to) all of a user's private repositories.
{%- endif %}
| `staff.unverify_domain` | {% ifversion ghes %}A site administrator or {% endif %}GitHub staff unverified an organization or enterprise domain. {% ifversion ghec or ghes > 3.1 %}For more information, see "[Verifying or approving a domain for your organization](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization)" and "[Verifying or approving a domain for your enterprise](/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise)."{% endif %}
| `staff.verify_domain` | {% ifversion ghes %}A site administrator or {% endif %}GitHub staff verified an organization or enterprise domain. {% ifversion ghec or ghes > 3.1 %}For more information, see "[Verifying or approving a domain for your organization](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization)" and "[Verifying or approving a domain for your enterprise](/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise)."{% endif %}
| `staff.unverify_domain` | {% ifversion ghes %}A site administrator or {% endif %}GitHub staff unverified an organization or enterprise domain. {% ifversion ghec or ghes %}For more information, see "[Verifying or approving a domain for your organization](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization)" and "[Verifying or approving a domain for your enterprise](/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise)."{% endif %}
| `staff.verify_domain` | {% ifversion ghes %}A site administrator or {% endif %}GitHub staff verified an organization or enterprise domain. {% ifversion ghec or ghes %}For more information, see "[Verifying or approving a domain for your organization](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization)" and "[Verifying or approving a domain for your enterprise](/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise)."{% endif %}
{%- ifversion ghes %}
| `staff.view_audit_log` | A site administrator viewed the site admin audit log.
{%- endif %}
@@ -1426,8 +1411,6 @@ Action | Description
| `user_license.update` | A seat license type for a user in an enterprise was changed.
{%- endif %}
{% ifversion fpt or ghec or ghes > 3.1 or ghae %}
## `workflows` category actions
{% data reusables.audit_log.audit-log-events-workflows %}
{%- endif %}

2
content/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise.md
View File

@@ -1,6 +1,6 @@
---
title: Exporting audit log activity for your enterprise
intro: 'You can export audit and Git events data to a file for offline analysis.'
intro: You can export audit and Git events data to a file for offline analysis.
shortTitle: Export audit logs
permissions: Enterprise owners can export the audit log.
miniTocMaxHeadingLevel: 3

1
content/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/index.md
View File

@@ -18,3 +18,4 @@ children:
- /using-the-audit-log-api-for-your-enterprise
- /audit-log-events-for-your-enterprise
---

2
content/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/searching-the-audit-log-for-your-enterprise.md
View File

@@ -2,7 +2,7 @@
title: Searching the audit log for your enterprise
intro: You can search an extensive list of audited actions in your enterprise.
shortTitle: Search audit logs
permissions: Enterprise owners {% ifversion ghes %}and site administrators {% endif %}can search the audit log.
permissions: 'Enterprise owners {% ifversion ghes %}and site administrators {% endif %}can search the audit log.'
redirect_from:
- /enterprise/admin/articles/searching-the-audit-log
- /enterprise/admin/installation/searching-the-audit-log

6
content/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/using-the-audit-log-api-for-your-enterprise.md
View File

@@ -2,11 +2,11 @@
title: Using the audit log API for your enterprise
intro: 'You can programmatically retrieve enterprise events with the{% ifversion ghec or ghes > 3.2 %} REST or{% endif %} GraphQL API.'
shortTitle: Audit log API
permissions: Enterprise owners {% ifversion ghes %}and site administrators {% endif %}can use the audit log API.
permissions: 'Enterprise owners {% ifversion ghes %}and site administrators {% endif %}can use the audit log API.'
miniTocMaxHeadingLevel: 3
versions:
ghec: '*'
ghes: '>=3.0'
ghes: '*'
ghae: '*'
type: tutorial
topics:
@@ -22,7 +22,6 @@ You can interact with the audit log using the GraphQL API{% ifversion ghec or gh
Timestamps and date fields in the API response are measured in [UTC epoch milliseconds](http://en.wikipedia.org/wiki/Unix_time).
{% ifversion ghec or ghes > 3.0 or ghae %}
## Querying the audit log GraphQL API
To ensure your intellectual property is secure, and you maintain compliance for your enterprise, you can use the audit log GraphQL API to keep copies of your audit log data and monitor:
@@ -107,7 +106,6 @@ This query uses the [AuditEntry](/graphql/reference/interfaces#auditentry) inter
For more query examples, see the [platform-samples repository](https://github.com/github/platform-samples/blob/master/graphql/queries).
{% endif %}
{% ifversion ghec or ghes > 3.2 or ghae-issue-6648 %}
## Querying the audit log REST API

2
content/admin/overview/about-github-enterprise-server.md
View File

@@ -1,6 +1,6 @@
---
title: About GitHub Enterprise Server
intro: "{% data variables.product.product_name %} is a software development platform that you can host in a private environment."
intro: '{% data variables.product.product_name %} is a software development platform that you can host in a private environment.'
versions:
ghes: '*'
type: overview

2
content/admin/overview/accessing-compliance-reports-for-your-enterprise.md
View File

@@ -1,6 +1,6 @@
---
title: Accessing compliance reports for your enterprise
intro: "You can access {% data variables.product.company_short %}'s compliance reports, such as our SOC reports and Cloud Security Alliance CAIQ self-assessment (CSA CAIQ), for your enterprise."
intro: 'You can access {% data variables.product.company_short %}''s compliance reports, such as our SOC reports and Cloud Security Alliance CAIQ self-assessment (CSA CAIQ), for your enterprise.'
versions:
ghec: '*'
type: how_to

2
content/admin/overview/creating-an-enterprise-account.md
View File

@@ -1,6 +1,6 @@
---
title: Creating an enterprise account
intro: "If you're currently using {% data variables.product.prodname_ghe_cloud %} with a single organization, you can create an enterprise account to centrally manage multiple organizations."
intro: 'If you''re currently using {% data variables.product.prodname_ghe_cloud %} with a single organization, you can create an enterprise account to centrally manage multiple organizations.'
versions:
ghec: '*'
type: how_to

2
content/admin/overview/system-overview.md
View File

@@ -1,6 +1,6 @@
---
title: System overview
intro: "Learn more about {% data variables.product.product_name %}'s system internals, functionality, and security."
intro: 'Learn more about {% data variables.product.product_name %}''s system internals, functionality, and security.'
redirect_from:
- /enterprise/admin/installation/system-overview
- /enterprise/admin/overview/system-overview

2
content/admin/packages/configuring-package-ecosystem-support-for-your-enterprise.md
View File

@@ -25,7 +25,7 @@ To prevent new packages from being uploaded, you can set an ecosystem you previo
1. Under "Ecosystem Toggles", for each package type, select **Enabled**, **Read-Only**, or **Disabled**.
{%- ifversion ghes > 3.4 %}{% note -%}
**Note**: Subdomain isolation must be enabled to toggle the {% data variables.product.prodname_container_registry %} options.
{%- endnote %}{%- endif %}{%- ifversion ghes > 3.1 %}
{%- endnote %}{%- endif %}{%- ifversion ghes %}
![Ecosystem toggles](/assets/images/enterprise/site-admin-settings/ecosystem-toggles.png){% else %}
![Ecosystem toggles](/assets/images/enterprise/3.1/site-admin-settings/ecosystem-toggles.png){% endif %}
{% data reusables.enterprise_management_console.save-settings %}

2
content/admin/policies/enforcing-policies-for-your-enterprise/about-enterprise-policies.md
View File

@@ -27,4 +27,4 @@ Another way to enforce standards within your enterprise is to use pre-receive ho
## Further reading
- "[About enterprise accounts](/admin/overview/about-enterprise-accounts)"
- "[About enterprise accounts](/admin/overview/about-enterprise-accounts)"

2
content/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise.md
View File

@@ -115,7 +115,7 @@ If a policy is enabled for an enterprise, the policy can be selectively disabled
{% data reusables.enterprise-accounts.actions-tab %}
{% data reusables.actions.private-repository-forks-configure %}
{% ifversion ghec or ghes > 3.1 or ghae %}
{% ifversion ghec or ghes or ghae %}
## Enforcing a policy for workflow permissions in your enterprise

10
content/admin/policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise.md
View File

@@ -72,16 +72,16 @@ If an enterprise owner disallows members from creating certain types of reposito
{% endif %}
## Enforcing a policy for {% ifversion ghec or ghes > 3.1 or ghae %}base{% else %}default{% endif %} repository permissions
## Enforcing a policy for {% ifversion ghec or ghes or ghae %}base{% else %}default{% endif %} repository permissions
Across all organizations owned by your enterprise, you can set a {% ifversion ghec or ghes > 3.1 or ghae %}base{% else %}default{% endif %} repository permission level (none, read, write, or admin) for organization members, or allow owners to administer the setting on the organization level.
Across all organizations owned by your enterprise, you can set a {% ifversion ghec or ghes or ghae %}base{% else %}default{% endif %} repository permission level (none, read, write, or admin) for organization members, or allow owners to administer the setting on the organization level.
{% data reusables.enterprise-accounts.access-enterprise %}
{% data reusables.enterprise-accounts.policies-tab %}
{% data reusables.enterprise-accounts.repositories-tab %}
4. Under "{% ifversion ghec or ghes > 3.1 or ghae %}Base{% else %}Default{% endif %} permissions", review the information about changing the setting. {% data reusables.enterprise-accounts.view-current-policy-config-orgs %}
5. Under "{% ifversion ghec or ghes > 3.1 or ghae %}Base{% else %}Default{% endif %} permissions", use the drop-down menu and choose a policy.
{% ifversion ghec or ghes > 3.1 or ghae %}
4. Under "{% ifversion ghec or ghes or ghae %}Base{% else %}Default{% endif %} permissions", review the information about changing the setting. {% data reusables.enterprise-accounts.view-current-policy-config-orgs %}
5. Under "{% ifversion ghec or ghes or ghae %}Base{% else %}Default{% endif %} permissions", use the drop-down menu and choose a policy.
{% ifversion ghec or ghes or ghae %}
![Drop-down menu with repository permissions policy options](/assets/images/help/business-accounts/repository-permissions-policy-drop-down.png)
{% else %}
![Drop-down menu with repository permissions policy options](/assets/images/enterprise/business-accounts/repository-permissions-policy-drop-down.png)

2
content/admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise.md
View File

@@ -4,7 +4,7 @@ intro: You can prevent your enterprise's information from leaking into personal
product: '{% data reusables.gated-features.restrict-email-domain %}'
versions:
ghec: '*'
ghes: '>=3.2'
ghes: '*'
permissions: Enterprise owners can restrict email notifications for an enterprise.
type: how_to
topics:

2
content/admin/user-management/managing-organizations-in-your-enterprise/managing-your-role-in-an-organization-owned-by-your-enterprise.md
View File

@@ -57,4 +57,4 @@ If an organization enforces SAML SSO, you cannot use the enterprise settings to
After you've joined the organization, you can use the enterprise settings to manage your role in the organization, such as becoming an organization owner. For more information, see "[Managing your role with the enterprise settings](#managing-your-role-with-the-enterprise-settings)."
{% endif %}
{% endif %}

6
content/admin/user-management/managing-organizations-in-your-enterprise/restoring-a-deleted-organization.md
View File

@@ -1,6 +1,6 @@
---
title: Restoring a deleted organization
intro: "You can partially restore an organization that was previously deleted on {% data variables.product.product_location %}."
intro: 'You can partially restore an organization that was previously deleted on {% data variables.product.product_location %}.'
versions:
ghes: '*'
type: how_to
@@ -9,7 +9,7 @@ topics:
- Enterprise
- Organizations
shortTitle: Restore organization
permissions: Site administers can restore an organization on {% data variables.product.product_name %}.
permissions: 'Site administers can restore an organization on {% data variables.product.product_name %}.'
---
## About organization restoration
@@ -50,4 +50,4 @@ In all the search phrases below, replace ORGANIZATION with the name of the organ
1. Manually re-add the team members. For more information, see "[Adding organization members to a team](/organizations/organizing-members-into-teams/adding-organization-members-to-a-team)."
1. To find the repositories that the team was granted access to, search for `action:team.add_repository team:"ORGANIZATION/TEAM"`.
1. To find the access level that the team was granted for each repository, search for `action:team.update_repository_permission team:"ORGANIZATION/TEAM"`.
1. Manually give the team access again. For more information, see "[Managing team access to an organization repository](/organizations/managing-access-to-your-organizations-repositories/managing-team-access-to-an-organization-repository)."
1. Manually give the team access again. For more information, see "[Managing team access to an organization repository](/organizations/managing-access-to-your-organizations-repositories/managing-team-access-to-an-organization-repository)."

6
content/admin/user-management/managing-users-in-your-enterprise/removing-a-member-from-your-enterprise.md
View File

@@ -1,9 +1,9 @@
---
title: Removing a member from your enterprise
intro: 'You can remove a member from all organizations owned by your enterprise.'
intro: You can remove a member from all organizations owned by your enterprise.
permissions: Enterprise owners can remove an enterprise member from the enterprise.
versions:
feature: 'remove-enterprise-members'
feature: remove-enterprise-members
type: how_to
topics:
- Enterprise
@@ -30,4 +30,4 @@ If your enterprise or any of the organizations owned by your enterprise uses an
{% data reusables.enterprise-accounts.people-tab %}
1. To the right of the person you want to remove, select the {% octicon "gear" aria-label="The gear icon" %} dropdown menu and click **Remove from enterprise**.
![Screenshot of the "Remove from enterprise" option for an enterprise member](/assets/images/help/business-accounts/remove-member.png)
![Screenshot of the "Remove from enterprise" option for an enterprise member](/assets/images/help/business-accounts/remove-member.png)

Some files were not shown because too many files have changed in this diff Show More