1
0
mirror of synced 2025-12-19 18:10:59 -05:00

Remove a chunk of product_name from /admin (#54056)

Co-authored-by: Kevin Heis <heiskr@users.noreply.github.com>
Co-authored-by: Sarah Schneider <sarahs@users.noreply.github.com>
This commit is contained in:
Isaac Brown
2025-01-27 09:51:48 +00:00
committed by GitHub
parent 9257623369
commit a333768fa3
51 changed files with 119 additions and 119 deletions

View File

@@ -1,6 +1,6 @@
--- ---
title: Configuring email for notifications title: Configuring email for notifications
intro: 'To make it easy for users to respond quickly to activity on {% data variables.product.product_name %}, you can configure {% data variables.location.product_location %} to send email notifications for issue, pull request, and commit comments.' intro: 'To make it easy for users to respond quickly to activity, you can configure {% data variables.location.product_location %} to send email notifications for issue, pull request, and commit comments.'
redirect_from: redirect_from:
- /enterprise/admin/guides/installation/email-configuration - /enterprise/admin/guides/installation/email-configuration
- /enterprise/admin/articles/configuring-email - /enterprise/admin/articles/configuring-email

View File

@@ -21,7 +21,7 @@ To enable interactive maps, you must provide authentication credentials for Azur
{% ifversion ghes < 3.13 %} {% ifversion ghes < 3.13 %}
> [!WARNING] > [!WARNING]
> Authentication with Azure Maps using an API token is {% data variables.release-phases.retired %} in {% data variables.product.product_name %} {{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}4{% elsif ghes = 3.11 %}1{% endif %} and later. If you upgrade to the latest release of {% data variables.product.product_name %} on an instance already configured to authenticate with an API token, interactive maps will be disabled. You must reconfigure authentication using role-based access control (RBAC) for an application on a Microsoft Entra ID (previously known as Azure AD) tenant. {% data reusables.enterprise.azure-maps-auth-deprecation-link %} > Authentication with Azure Maps using an API token is {% data variables.release-phases.retired %} in {% data variables.product.prodname_ghe_server %} {{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}4{% elsif ghes = 3.11 %}1{% endif %} and later. If you upgrade to the latest release of {% data variables.product.prodname_ghe_server %} on an instance already configured to authenticate with an API token, interactive maps will be disabled. You must reconfigure authentication using role-based access control (RBAC) for an application on a Microsoft Entra ID (previously known as Azure AD) tenant. {% data reusables.enterprise.azure-maps-auth-deprecation-link %}
{% endif %} {% endif %}
@@ -29,7 +29,7 @@ To enable interactive maps, you must provide authentication credentials for Azur
{% ifversion ghes < 3.12 %} {% ifversion ghes < 3.12 %}
The following prerequisites apply if your instance runs {% data variables.product.product_name %} {{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}4{% elsif ghes = 3.11 %}1{% endif %} or later. The following prerequisites apply if your instance runs {% data variables.product.prodname_ghe_server %} {{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}4{% elsif ghes = 3.11 %}1{% endif %} or later.
{% endif %} {% endif %}
@@ -41,7 +41,7 @@ The following prerequisites apply if your instance runs {% data variables.produc
{% ifversion ghes < 3.12 %} {% ifversion ghes < 3.12 %}
If your instance runs {% ifversion ghes < 3.11 %}a release of {% data variables.product.product_name %} in the {{ allVersions[currentVersion].currentRelease }} series earlier than {% else %}{% data variables.product.product_name %} {% endif %}{{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}3{% elsif ghes = 3.11 %}0{% endif %}, you must provide an API token for Azure Maps instead. If your instance runs {% ifversion ghes < 3.11 %}a release of {% data variables.product.prodname_ghe_server %} in the {{ allVersions[currentVersion].currentRelease }} series earlier than {% else %}{% data variables.product.prodname_ghe_server %} {% endif %}{{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}3{% elsif ghes = 3.11 %}0{% endif %}, you must provide an API token for Azure Maps instead.
{% data reusables.enterprise.azure-maps-auth-warning %} {% data reusables.enterprise.azure-maps-auth-warning %}
@@ -51,7 +51,7 @@ If your instance runs {% ifversion ghes < 3.11 %}a release of {% data variables.
{% ifversion ghes < 3.12 %} {% ifversion ghes < 3.12 %}
To configure authentication for Azure Maps using RBAC, your instance must run {% data variables.product.product_name %} {{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}4{% elsif ghes = 3.11 %}1{% endif %} or later. To configure authentication for Azure Maps using RBAC, your instance must run {% data variables.product.prodname_ghe_server %} {{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}4{% elsif ghes = 3.11 %}1{% endif %} or later.
{% endif %} {% endif %}
@@ -93,10 +93,10 @@ After you create an application on your Entra ID tenant and generate a secret fo
1. {% ifversion ghes > 3.11 %}Below the headings, type or paste{% else %}Enter{% endif %} your authentication details for Azure Maps. 1. {% ifversion ghes > 3.11 %}Below the headings, type or paste{% else %}Enter{% endif %} your authentication details for Azure Maps.
{%- ifversion ghes < 3.11 %} {%- ifversion ghes < 3.11 %}
* If your instance runs {% ifversion ghes < 3.11 %}a release of {% data variables.product.product_name %} in the {{ allVersions[currentVersion].currentRelease }} series earlier than {% else %}{% data variables.product.product_name %} {% endif %}{{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}3{% elsif ghes = 3.11 %}0{% endif %}, below "Azure Maps API Token", type or paste your token. * If your instance runs {% ifversion ghes < 3.11 %}a release of {% data variables.product.prodname_ghe_server %} in the {{ allVersions[currentVersion].currentRelease }} series earlier than {% else %}{% data variables.product.prodname_ghe_server %} {% endif %}{{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}3{% elsif ghes = 3.11 %}0{% endif %}, below "Azure Maps API Token", type or paste your token.
{% data reusables.enterprise.azure-maps-auth-warning %} {% data reusables.enterprise.azure-maps-auth-warning %}
* If your instance runs {% data variables.product.product_name %} {{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}4{% elsif ghes = 3.11 %}1{% endif %} or later, below the headings, type or paste the following information. * If your instance runs {% data variables.product.prodname_ghe_server %} {{ allVersions[currentVersion].currentRelease }}.{% ifversion ghes = 3.10 %}4{% elsif ghes = 3.11 %}1{% endif %} or later, below the headings, type or paste the following information.
{%- endif %} {%- endif %}
* Optionally, to change the style of rendered maps, under "Basemap ID", type the ID for the style you'd like to use. * Optionally, to change the style of rendered maps, under "Basemap ID", type the ID for the style you'd like to use.

View File

@@ -17,7 +17,7 @@ topics:
- Performance - Performance
--- ---
## About rate limits for {% data variables.product.product_name %} ## About rate limits for {% data variables.product.prodname_ghe_server %}
To prevent excessive use of resources on {% data variables.location.product_location %} that could affect the instance's availability or performance for all users, you can configure rate limits. Rate limits are configurable for the {% data variables.product.prodname_enterprise_api %} and {% data variables.product.prodname_actions %}. To prevent excessive use of resources on {% data variables.location.product_location %} that could affect the instance's availability or performance for all users, you can configure rate limits. Rate limits are configurable for the {% data variables.product.prodname_enterprise_api %} and {% data variables.product.prodname_actions %}.
@@ -78,15 +78,15 @@ You can apply a rate limit to {% data variables.product.prodname_actions %} work
### About rate limits for {% data variables.product.prodname_actions %} ### About rate limits for {% data variables.product.prodname_actions %}
Your {% data variables.product.product_name %} instance assigns each {% data variables.product.prodname_actions %} workflow job to a runner. If your instance cannot immediately assign a job to an available runner, the job will wait in a queue until a runner is available. If {% data variables.product.prodname_actions %} experiences sustained high load, the queue can back up, and the performance of {% data variables.location.product_location %} may degrade. Your {% data variables.product.prodname_ghe_server %} instance assigns each {% data variables.product.prodname_actions %} workflow job to a runner. If your instance cannot immediately assign a job to an available runner, the job will wait in a queue until a runner is available. If {% data variables.product.prodname_actions %} experiences sustained high load, the queue can back up, and the performance of {% data variables.location.product_location %} may degrade.
To avoid this performance degradation, you can configure a rate limit for {% data variables.product.prodname_actions %}. This rate limit is expressed in job runs per minute. {% data variables.product.product_name %} calculates and applies the rate limit for the sum total of all job runs on the instance. If runs exceed the rate limit, additional runs will fail instead of entering the queue. The following error will appear in the run's annotations. To avoid this performance degradation, you can configure a rate limit for {% data variables.product.prodname_actions %}. This rate limit is expressed in job runs per minute. {% data variables.product.prodname_ghe_server %} calculates and applies the rate limit for the sum total of all job runs on the instance. If runs exceed the rate limit, additional runs will fail instead of entering the queue. The following error will appear in the run's annotations.
> You've exceeded the rate limit for workflow run requests. Please wait before retrying the run. > You've exceeded the rate limit for workflow run requests. Please wait before retrying the run.
An appropriate rate limit protects {% data variables.location.product_location %} from abnormal usage of {% data variables.product.prodname_actions %} without interfering with day-to-day operations. The exact threshold depends on your instance's available resources and overall load profile. For more information about the hardware requirements for {% data variables.product.prodname_actions %}, see [AUTOTITLE](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server#review-hardware-requirements). An appropriate rate limit protects {% data variables.location.product_location %} from abnormal usage of {% data variables.product.prodname_actions %} without interfering with day-to-day operations. The exact threshold depends on your instance's available resources and overall load profile. For more information about the hardware requirements for {% data variables.product.prodname_actions %}, see [AUTOTITLE](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server#review-hardware-requirements).
By default, the rate limit for {% data variables.product.prodname_actions %} is disabled. Because {% data variables.product.product_name %} can handle temporary spikes in usage without performance degradation, this rate limit is intended to protect against sustained high load. We recommend leaving the rate limit disabled unless you are experiencing performance problems. In some cases, {% data variables.contact.github_support %} may recommend that you enable a rate limit for {% data variables.product.prodname_actions %}. By default, the rate limit for {% data variables.product.prodname_actions %} is disabled. Because {% data variables.product.prodname_ghe_server %} can handle temporary spikes in usage without performance degradation, this rate limit is intended to protect against sustained high load. We recommend leaving the rate limit disabled unless you are experiencing performance problems. In some cases, {% data variables.contact.github_support %} may recommend that you enable a rate limit for {% data variables.product.prodname_actions %}.
### Enabling or disabling rate limits for {% data variables.product.prodname_actions %} ### Enabling or disabling rate limits for {% data variables.product.prodname_actions %}

View File

@@ -1,7 +1,7 @@
--- ---
title: Configuring web commit signing title: Configuring web commit signing
shortTitle: Configure web commit signing shortTitle: Configure web commit signing
intro: 'You can enable auto-signing of commits made in the web interface of {% data variables.product.product_name %}.' intro: 'You can enable auto-signing of commits made in the web interface of {% data variables.product.prodname_ghe_server %}.'
versions: versions:
ghes: '*' ghes: '*'
type: how_to type: how_to
@@ -11,7 +11,7 @@ topics:
- Fundamentals - Fundamentals
- Identity - Identity
- Security - Security
permissions: 'Site administrators can configure web commit signing for {% data variables.location.product_location %}.' permissions: 'Site administrators'
redirect_from: redirect_from:
- /admin/configuration/configuring-your-enterprise/configuring-web-commit-signing - /admin/configuration/configuring-your-enterprise/configuring-web-commit-signing
- /admin/configuration/configuring-user-applications-for-your-enterprise/configuring-web-commit-signing - /admin/configuration/configuring-user-applications-for-your-enterprise/configuring-web-commit-signing
@@ -19,7 +19,7 @@ redirect_from:
## About web commit signing ## About web commit signing
If you enable web commit signing, {% data variables.product.product_name %} will automatically use GPG to sign commits users make on the web interface of {% data variables.location.product_location %}. Commits signed by {% data variables.product.product_name %} will have a verified status. For more information, see [AUTOTITLE](/authentication/managing-commit-signature-verification/about-commit-signature-verification). If you enable web commit signing, {% data variables.product.prodname_ghe_server %} will automatically use GPG to sign commits users make on the web interface of {% data variables.location.product_location %}. Commits signed by {% data variables.product.prodname_ghe_server %} will have a verified status. For more information, see [AUTOTITLE](/authentication/managing-commit-signature-verification/about-commit-signature-verification).
You can enable web commit signing, rotate the private key used for web commit signing, and disable web commit signing. You can enable web commit signing, rotate the private key used for web commit signing, and disable web commit signing.

View File

@@ -1,7 +1,7 @@
--- ---
title: Managing GitHub Mobile for your enterprise title: Managing GitHub Mobile for your enterprise
intro: 'You can decide whether people can use {% data variables.product.prodname_mobile %} to connect to {% data variables.location.product_location %}.' intro: 'You can decide whether people can use {% data variables.product.prodname_mobile %} to connect to {% data variables.location.product_location %}.'
permissions: 'Enterprise owners can manage {% data variables.product.prodname_mobile %} for a {% data variables.product.product_name %} instance.' permissions: 'Enterprise owners'
versions: versions:
ghes: '*' ghes: '*'
type: how_to type: how_to

View File

@@ -48,7 +48,7 @@ Organization owners can also verify additional domains for their organizations.
After you approve domains for your enterprise account, you can restrict email notifications for activity within your enterprise account to users with verified email addresses within verified or approved domains. See [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise). After you approve domains for your enterprise account, you can restrict email notifications for activity within your enterprise account to users with verified email addresses within verified or approved domains. See [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise).
{% ifversion ghec %}To receive email notifications, the owner of the user account must verify the email address on {% data variables.product.product_name %}. See [AUTOTITLE](/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/verifying-your-email-address).{% endif %} {% ifversion ghec %}To receive email notifications, the owner of the user account must verify the email address. See [AUTOTITLE](/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/verifying-your-email-address).{% endif %}
Organization owners can also approve additional domains for their organizations. See [AUTOTITLE](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization). Organization owners can also approve additional domains for their organizations. See [AUTOTITLE](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization).

View File

@@ -2,7 +2,7 @@
title: Configuring host keys for your instance title: Configuring host keys for your instance
shortTitle: Configure host keys shortTitle: Configure host keys
intro: 'You can increase the security of {% data variables.location.product_location %} by configuring the algorithms that your instance uses to generate and advertise host keys for incoming SSH connections.' intro: 'You can increase the security of {% data variables.location.product_location %} by configuring the algorithms that your instance uses to generate and advertise host keys for incoming SSH connections.'
permissions: 'Site administrators can configure the host keys for a {% data variables.product.product_name %} instance.' permissions: 'Site administrators'
redirect_from: redirect_from:
- /admin/configuration/configuring-your-enterprise/configuring-host-keys-for-your-instance - /admin/configuration/configuring-your-enterprise/configuring-host-keys-for-your-instance
- /admin/configuration/hardening-security-for-your-enterprise/configuring-host-keys-for-your-instance - /admin/configuration/hardening-security-for-your-enterprise/configuring-host-keys-for-your-instance
@@ -31,7 +31,7 @@ By default, {% data variables.location.product_location %} generates and adverti
## Managing an Ed25519 host key ## Managing an Ed25519 host key
To improve security for clients that connect to {% data variables.location.product_location %}, you can enable the generation and advertisement of an Ed25519 host key. Ed25519 is immune to some attacks that target older signature algorithms, without sacrificing speed. Older SSH clients may not support Ed25519. By default, {% data variables.product.product_name %} instances do not generate or advertise an Ed25519 host key. For more information, see [the Ed25519 website](https://ed25519.cr.yp.to). To improve security for clients that connect to {% data variables.location.product_location %}, you can enable the generation and advertisement of an Ed25519 host key. Ed25519 is immune to some attacks that target older signature algorithms, without sacrificing speed. Older SSH clients may not support Ed25519. By default, {% data variables.product.prodname_ghe_server %} instances do not generate or advertise an Ed25519 host key. For more information, see [the Ed25519 website](https://ed25519.cr.yp.to).
{% data reusables.enterprise_installation.ssh-into-instance %} {% data reusables.enterprise_installation.ssh-into-instance %}
1. To enable generation and advertisement of the Ed25519 host key, enter the following command. 1. To enable generation and advertisement of the Ed25519 host key, enter the following command.

View File

@@ -2,7 +2,7 @@
title: Configuring SSH connections to your instance title: Configuring SSH connections to your instance
shortTitle: Configure SSH connections shortTitle: Configure SSH connections
intro: 'You can increase the security of {% data variables.location.product_location %} by configuring the SSH algorithms that clients can use to establish a connection.' intro: 'You can increase the security of {% data variables.location.product_location %} by configuring the SSH algorithms that clients can use to establish a connection.'
permissions: 'Site administrators can configure SSH connections to a {% data variables.product.product_name %} instance.' permissions: 'Site administrators'
redirect_from: redirect_from:
- /admin/configuration/configuring-your-enterprise/configuring-ssh-connections-to-your-instance - /admin/configuration/configuring-your-enterprise/configuring-ssh-connections-to-your-instance
- /admin/configuration/hardening-security-for-your-enterprise/configuring-ssh-connections-to-your-instance - /admin/configuration/hardening-security-for-your-enterprise/configuring-ssh-connections-to-your-instance

View File

@@ -17,15 +17,15 @@ topics:
## About the referrer policy for your enterprise ## About the referrer policy for your enterprise
The referrer policy controls the information that {% data variables.product.product_name %} transmits in HTTP headers when someone visits a link from {% data variables.location.product_location %} to an external site. The referrer policy controls the information that {% data variables.product.prodname_ghe_server %} transmits in HTTP headers when someone visits a link from {% data variables.location.product_location %} to an external site.
By default, when a user on {% data variables.location.product_location %} visits a link to another site from a file or comment on your instance, the request includes the hostname for your instance in plain text within the `Referer` header. If the link leads to an external website, the owner of the website could read the hostname for your instance in requests or log files. By default, when a user on {% data variables.location.product_location %} visits a link to another site from a file or comment on your instance, the request includes the hostname for your instance in plain text within the `Referer` header. If the link leads to an external website, the owner of the website could read the hostname for your instance in requests or log files.
You can control the information that {% data variables.product.product_name %} sends when a user visits a link from your instance. You can control the information that {% data variables.product.prodname_ghe_server %} sends when a user visits a link from your instance.
## Enabling the `same-origin` referrer policy ## Enabling the `same-origin` referrer policy
You can enable the `same-origin` referrer policy to instruct modern browsers to exclude the hostname for {% data variables.location.product_location %} from requests to external websites. The setting applies to all links from the web interface on your instance. By default, {% data variables.product.product_name %} uses the `origin-when-cross-origin` and `strict-origin-when-cross-origin` referrer policies, which means your instance's hostname will appear in HTTP and HTTPS requests to external websites. You can enable the `same-origin` referrer policy to instruct modern browsers to exclude the hostname for {% data variables.location.product_location %} from requests to external websites. The setting applies to all links from the web interface on your instance. By default, {% data variables.product.prodname_ghe_server %} uses the `origin-when-cross-origin` and `strict-origin-when-cross-origin` referrer policies, which means your instance's hostname will appear in HTTP and HTTPS requests to external websites.
> [!NOTE] > [!NOTE]
> Changing the referrer policy to `same-origin` can affect external sites that expect a hostname in the HTTP headers for a request. > Changing the referrer policy to `same-origin` can affect external sites that expect a hostname in the HTTP headers for a request.

View File

@@ -16,9 +16,9 @@ By default, {% data variables.product.company_short %} stores data for {% data v
To get {% data variables.enterprise.data_residency_short %} for your enterprise, **contact {% data variables.contact.contact_sales_data_residency %}**. To get {% data variables.enterprise.data_residency_short %} for your enterprise, **contact {% data variables.contact.contact_sales_data_residency %}**.
## What is {% data variables.product.product_name %}? ## What is {% data variables.product.prodname_ghe_cloud %}?
{% data variables.product.github %} is a complete developer platform for building, scaling, and delivering secure software. In addition to these capabilities, {% data variables.product.product_name %} offers several key features designed to further optimize and secure your use of the platform: {% data variables.product.github %} is a complete developer platform for building, scaling, and delivering secure software. In addition to these capabilities, {% data variables.product.prodname_ghe_cloud %} offers several key features designed to further optimize and secure your use of the platform:
* Includes an **enterprise account:** a dedicated, shared space for your company to store code, collaborate, and access {% data variables.product.company_short %} features * Includes an **enterprise account:** a dedicated, shared space for your company to store code, collaborate, and access {% data variables.product.company_short %} features
* Centralizes billing, administration, governance, and audit of your companys resources and activity * Centralizes billing, administration, governance, and audit of your companys resources and activity
@@ -97,7 +97,7 @@ Your developers can access {% data variables.product.prodname_copilot %} if you
### Documentation ### Documentation
In general, the content on [{% data variables.product.prodname_docs %}](/enterprise-cloud@latest) reflects the user experience on {% data variables.enterprise.data_residency_site %}. Readers should use the "{% data variables.product.product_name %}" version of the site. See [AUTOTITLE](/get-started/using-github-docs/about-versions-of-github-docs#about-versions-of-github-docs). In general, the content on [{% data variables.product.prodname_docs %}](/enterprise-cloud@latest) reflects the user experience on {% data variables.enterprise.data_residency_site %}. Readers should use the "{% data variables.product.prodname_ghe_cloud %}" version of the site. See [AUTOTITLE](/get-started/using-github-docs/about-versions-of-github-docs#about-versions-of-github-docs).
When reading the documentation, readers may need to substitute references to {% data variables.product.prodname_dotcom_the_website %} with your enterprise's dedicated URL on {% data variables.enterprise.data_residency_site %}. When reading the documentation, readers may need to substitute references to {% data variables.product.prodname_dotcom_the_website %} with your enterprise's dedicated URL on {% data variables.enterprise.data_residency_site %}.

View File

@@ -24,7 +24,7 @@ shortTitle: Policies for security settings
## About policies for security settings in your enterprise ## About policies for security settings in your enterprise
You can enforce policies to control the security settings for organizations owned by your enterprise on {% data variables.product.product_name %}. By default, organization owners can manage security settings. You can enforce policies to control the security settings for organizations owned by your enterprise. By default, organization owners can manage security settings.
{% ifversion ghec or ghes %} {% ifversion ghec or ghes %}

View File

@@ -48,7 +48,7 @@ shortTitle: Repository management policies
## About policies for repository management in your enterprise ## About policies for repository management in your enterprise
You can enforce policies to control how members of your enterprise on {% data variables.product.product_name %} manage repositories. You can also allow organization owners to manage policies for repository management. You can enforce policies to control how members of your enterprise manage repositories. You can also allow organization owners to manage policies for repository management.
{% ifversion repo-policy-rules %} {% ifversion repo-policy-rules %}
>[!NOTE] This page describes the policies you can set on the "Member privileges" page in your enterprise settings. Certain restrictions, such as who can create, delete, or transfer repositories, are also available in a **repository policy**. Repository policies give you more flexibility over which users are affected and which organizations and repositories are targeted. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-repositories-in-your-enterprise/governing-how-people-use-repositories-in-your-enterprise). >[!NOTE] This page describes the policies you can set on the "Member privileges" page in your enterprise settings. Certain restrictions, such as who can create, delete, or transfer repositories, are also available in a **repository policy**. Repository policies give you more flexibility over which users are affected and which organizations and repositories are targeted. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-repositories-in-your-enterprise/governing-how-people-use-repositories-in-your-enterprise).
@@ -294,7 +294,7 @@ You can override the default inherited settings by configuring the settings for
If you have [enabled private mode](/admin/configuration/configuring-your-enterprise/enabling-private-mode) for {% data variables.location.product_location %}, you can allow repository administrators to enable anonymous Git read access to public repositories. If you have [enabled private mode](/admin/configuration/configuring-your-enterprise/enabling-private-mode) for {% data variables.location.product_location %}, you can allow repository administrators to enable anonymous Git read access to public repositories.
Enabling anonymous Git read access allows users to bypass authentication for custom tools on your enterprise. When you or a repository administrator enable this access setting for a repository, unauthenticated Git operations (and anyone with network access to {% data variables.product.product_name %}) will have read access to the repository without authentication. Enabling anonymous Git read access allows users to bypass authentication for custom tools on your enterprise. When you or a repository administrator enable this access setting for a repository, unauthenticated Git operations (and anyone with network access to {% data variables.location.product_location_enterprise %}) will have read access to the repository without authentication.
Anonymous Git read access is disabled by default. Anonymous Git read access is disabled by default.

View File

@@ -22,7 +22,7 @@ shortTitle: Team policies
## About policies for teams in your enterprise ## About policies for teams in your enterprise
You can enforce policies to control how members of your enterprise on {% data variables.product.product_name %} manage teams. You can also allow organization owners to manage policies for teams. For more information, see [AUTOTITLE](/organizations/organizing-members-into-teams/about-teams). You can enforce policies to control how members of your enterprise manage teams. You can also allow organization owners to manage policies for teams. For more information, see [AUTOTITLE](/organizations/organizing-members-into-teams/about-teams).
{% ifversion team-discussions %} {% ifversion team-discussions %}

View File

@@ -1,7 +1,7 @@
--- ---
title: Setting policies for your enterprise title: Setting policies for your enterprise
allowTitleToDifferFromFilename: true allowTitleToDifferFromFilename: true
intro: 'You can set policies in {% data variables.product.product_name %} to reduce risk and increase quality.' intro: 'You can set policies to reduce risk and increase quality.'
redirect_from: redirect_from:
- /enterprise/admin/developer-workflow - /enterprise/admin/developer-workflow
- /enterprise/admin/policies - /enterprise/admin/policies

View File

@@ -1,7 +1,7 @@
--- ---
title: Guides for GitHub Enterprise title: Guides for GitHub Enterprise
shortTitle: Guides shortTitle: Guides
intro: 'Learn how to increase developer productivity and code quality with {% data variables.product.product_name %}.' intro: 'Learn how to increase developer productivity and code quality with {% data variables.product.prodname_enterprise %}.'
allowTitleToDifferFromFilename: true allowTitleToDifferFromFilename: true
layout: product-guides layout: product-guides
versions: versions:

View File

@@ -1,7 +1,7 @@
--- ---
title: Enterprise administrator documentation title: Enterprise administrator documentation
shortTitle: Enterprise administrators shortTitle: Enterprise administrators
intro: 'Documentation and guides for enterprise administrators{% ifversion ghes %}, system administrators,{% endif %} and security specialists who {% ifversion ghes %}deploy, {% endif %}configure{% ifversion ghes %},{% endif %} and manage {% data variables.product.product_name %}.' intro: 'Documentation and guides for enterprise administrators{% ifversion ghes %}, system administrators,{% endif %} and security specialists who {% ifversion ghes %}deploy, {% endif %}configure{% ifversion ghes %},{% endif %} and manage {% data variables.product.prodname_enterprise %}.'
redirect_from: redirect_from:
- /github/setting-up-and-managing-your-enterprise/managing-your-enterprise-account - /github/setting-up-and-managing-your-enterprise/managing-your-enterprise-account
- /github/setting-up-and-managing-your-enterprise - /github/setting-up-and-managing-your-enterprise

View File

@@ -1,6 +1,6 @@
--- ---
title: Configuring custom footers title: Configuring custom footers
intro: 'You can give users easy access to enterprise-specific links by adding custom footers to {% data variables.product.product_name %}.' intro: 'You can give users easy access to enterprise-specific links by adding custom footers.'
permissions: Enterprise owners can configure a custom footer. permissions: Enterprise owners can configure a custom footer.
versions: versions:
ghec: '*' ghec: '*'
@@ -14,9 +14,9 @@ redirect_from:
- /admin/configuration/configuring-your-enterprise/configuring-custom-footers - /admin/configuration/configuring-your-enterprise/configuring-custom-footers
--- ---
## About custom footers for {% ifversion ghec %}your enterprise{% elsif ghes %}{% data variables.product.product_name %}{% endif %} ## About custom footers for your enterprise
You can configure the web UI for {% data variables.product.product_name %} to display a custom footer with up to five additional links. The custom footer appears above the default {% data variables.product.prodname_dotcom %} footer{% ifversion ghes %}, to all users and on all pages{% elsif ghec %} to all enterprise members and collaborators, on all repository and organization pages for repositories and organizations that belong to the enterprise{% endif %}. You can configure the web UI for your enterprise to display a custom footer with up to five additional links. The custom footer appears above the default {% data variables.product.prodname_dotcom %} footer{% ifversion ghes %}, to all users and on all pages of {% data variables.location.product_location_enterprise %}{% elsif ghec %} to all enterprise members and collaborators, on all repository and organization pages for repositories and organizations that belong to the enterprise{% endif %}.
## Configuring custom footers ## Configuring custom footers

View File

@@ -72,7 +72,7 @@ There are several types of user messages.
## Creating a mandatory message ## Creating a mandatory message
You can create a mandatory message that {% data variables.product.product_name %} will show to all users the first time they sign in after you save the message. The message appears in a pop-up window that the user must dismiss before using {% data variables.location.product_location %}. On {% data variables.product.prodname_ghe_server %}, you can create a mandatory message that is displayed to all users the first time they sign in after you save the message. The message appears in a pop-up window that the user must dismiss before continuing.
Mandatory messages have a variety of uses. Mandatory messages have a variety of uses.

View File

@@ -1,6 +1,6 @@
--- ---
title: Managing projects using Jira title: Managing projects using Jira
intro: 'You can integrate Jira with {% data variables.product.product_name %} for project management.' intro: 'You can integrate Jira with {% data variables.product.prodname_ghe_server %} for project management.'
redirect_from: redirect_from:
- /enterprise/admin/guides/installation/project-management-using-jira - /enterprise/admin/guides/installation/project-management-using-jira
- /enterprise/admin/articles/project-management-using-jira - /enterprise/admin/articles/project-management-using-jira

View File

@@ -9,7 +9,7 @@ topics:
- Enterprise - Enterprise
- Organizations - Organizations
shortTitle: Restore organization shortTitle: Restore organization
permissions: 'Site administers can restore an organization on {% data variables.product.product_name %}.' permissions: 'Site administrators'
redirect_from: redirect_from:
- /admin/user-management/managing-organizations-in-your-enterprise/restoring-a-deleted-organization - /admin/user-management/managing-organizations-in-your-enterprise/restoring-a-deleted-organization
--- ---

View File

@@ -2,7 +2,7 @@
title: About reserved usernames for GitHub Enterprise Server title: About reserved usernames for GitHub Enterprise Server
shortTitle: Reserved usernames shortTitle: Reserved usernames
intro: Certain words are reserved for internal use and cannot be used as usernames. intro: Certain words are reserved for internal use and cannot be used as usernames.
permissions: Enterprise owners can view usernames reserved by {% data variables.product.product_name %}. permissions: Enterprise owners
versions: versions:
ghes: '*' ghes: '*'
type: reference type: reference
@@ -13,7 +13,7 @@ topics:
## About reserved usernames ## About reserved usernames
{% data variables.product.product_name %} reserves certain usernames for internal use. You cannot assign reserved usernames to users or organizations on your instance. For example, the following words are reserved: {% data variables.product.prodname_ghe_server %} reserves certain usernames for internal use. You cannot assign reserved usernames to users or organizations on your instance. For example, the following words are reserved:
* `admin` * `admin`
* `enterprise` * `enterprise`

View File

@@ -41,7 +41,7 @@ When they follow the link, they're asked to approve the keys on their account. A
{% ifversion ghes %} {% ifversion ghes %}
When a new user adds an SSH key to an account, to confirm the user's access, {% data variables.product.product_name %} will prompt for authentication. For more information, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/sudo-mode). When a new user adds an SSH key to an account, to confirm the user's access, {% data variables.product.prodname_ghe_server %} will prompt for authentication. For more information, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/sudo-mode).
{% endif %} {% endif %}

View File

@@ -40,7 +40,7 @@ The audit log lists the following information about actions made within your ent
* [The date and time](#search-based-on-the-time-of-action) the action occurred * [The date and time](#search-based-on-the-time-of-action) the action occurred
> [!NOTE] > [!NOTE]
> * While you can't use text to search for audit entries, you can construct search queries using a variety of filters. {% data variables.product.product_name %} supports many operators for searching across {% data variables.product.product_name %}. For more information, see [AUTOTITLE](/search-github/getting-started-with-searching-on-github/about-searching-on-github). > * While you can't use text to search for audit entries, you can construct search queries using a variety of filters. {% data variables.product.prodname_ghe_server %} supports many operators for searching across your instance. For more information, see [AUTOTITLE](/search-github/getting-started-with-searching-on-github/about-searching-on-github).
> * Audit records are available for the last 180 days. > * Audit records are available for the last 180 days.
### Search based on the repository ### Search based on the repository
@@ -61,7 +61,7 @@ The `actor` qualifier scopes events based on the member of your organization tha
* `actor:octocat actor:hubot` finds all events performed by both `octocat` and `hubot`. * `actor:octocat actor:hubot` finds all events performed by both `octocat` and `hubot`.
* `-actor:hubot` excludes all events performed by `hubot`. * `-actor:hubot` excludes all events performed by `hubot`.
You can only use a {% data variables.product.product_name %} username, not an individual's real name. You can only use a {% data variables.product.github %} username, not an individual's real name.
### Search based on the organization ### Search based on the organization

View File

@@ -34,7 +34,7 @@ If you have enabled SCIM provisioning on your instance, you cannot delete **user
## Should I delete or suspend a user account? ## Should I delete or suspend a user account?
{% data variables.product.prodname_dotcom %} recommends suspending users where possible, rather than deleting their accounts. Suspending user accounts on {% data variables.product.product_name %} preserves the history of resources owned by the user account, such as repositories and pull requests, and releases the {% ifversion enterprise-licensing-language %}license{% else %}licensed seat{% endif %} previously consumed by the user. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/suspending-and-unsuspending-users). {% data variables.product.company_short %} recommends suspending users where possible, rather than deleting their accounts. Suspending user accounts on {% data variables.product.prodname_ghe_server %} preserves the history of resources owned by the user account, such as repositories and pull requests, and releases the {% ifversion enterprise-licensing-language %}license{% else %}licensed seat{% endif %} previously consumed by the user. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/suspending-and-unsuspending-users).
As an alternative to deleting or suspending a user account, to stop a user's repositories being permanently removed from your enterprise you can place a legal hold on the user account. See [Placing a legal hold on a user or organization](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/placing-a-legal-hold-on-a-user-or-organization). As an alternative to deleting or suspending a user account, to stop a user's repositories being permanently removed from your enterprise you can place a legal hold on the user account. See [Placing a legal hold on a user or organization](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/placing-a-legal-hold-on-a-user-or-organization).

View File

@@ -22,7 +22,7 @@ shortTitle: Invite people to manage
## About administrator management ## About administrator management
{% ifversion ghec %}If you do not use {% data variables.product.prodname_emus %}, you{% else %}You{% endif %} can add or remove enterprise owners{% ifversion ghec %} and billing managers{% endif %} on {% data variables.product.product_name %}. For more information about the privileges that come with each enterprise role, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/roles-in-an-enterprise). {% ifversion ghec %}If you do not use {% data variables.product.prodname_emus %}, you{% else %}You{% endif %} can add or remove enterprise owners{% ifversion ghec %} and billing managers{% endif %} in your enterprise. For more information about the privileges that come with each enterprise role, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/roles-in-an-enterprise).
{% ifversion ghes %} {% ifversion ghes %}

View File

@@ -8,7 +8,7 @@ redirect_from:
- /admin/user-management/managing-dormant-users - /admin/user-management/managing-dormant-users
- /admin/user-management/managing-users-in-your-enterprise/managing-dormant-users - /admin/user-management/managing-users-in-your-enterprise/managing-dormant-users
intro: '{% data reusables.enterprise-accounts.dormant-user-activity-threshold %}' intro: '{% data reusables.enterprise-accounts.dormant-user-activity-threshold %}'
permissions: "{% ifversion ghec %}Enterprise owners can manage dormant users for an enterprise.{% elsif ghes %}Site administrators can manage dormant users on a {% data variables.product.product_name %} instance.{% endif %}" permissions: "{% ifversion ghec %}Enterprise owners{% elsif ghes %}Site administrators{% endif %}"
versions: versions:
ghec: '*' ghec: '*'
ghes: '*' ghes: '*'

View File

@@ -23,7 +23,7 @@ When you enable SAML single sign-on for your enterprise account, each enterprise
{% ifversion ghec %} {% ifversion ghec %}
If your enterprise is uses {% data variables.product.prodname_emus %}, your members will use accounts provisioned through your IdP. {% data variables.enterprise.prodname_managed_users_caps %} will not use their existing user account on {% data variables.product.product_name %}. For more information, see [AUTOTITLE](/enterprise-cloud@latest/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users). If your enterprise is uses {% data variables.product.prodname_emus %}, your members will use accounts provisioned through your IdP. {% data variables.enterprise.prodname_managed_users_caps %} will not use their existing user account on {% data variables.product.github %}. For more information, see [AUTOTITLE](/enterprise-cloud@latest/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users).
{% endif %} {% endif %}
@@ -33,7 +33,7 @@ If your enterprise is uses {% data variables.product.prodname_emus %}, your memb
{% data reusables.saml.about-linked-identities %} {% data reusables.saml.about-linked-identities %}
If your enterprise uses {% data variables.product.prodname_emus %}, you will not be able to deprovision or remove user accounts from the enterprise on {% data variables.product.product_name %}. Any changes you need to make to your enterprise's {% data variables.enterprise.prodname_managed_users %} should be made through your IdP. If your enterprise uses {% data variables.product.prodname_emus %}, you will not be able to deprovision or remove user accounts from the enterprise via {% data variables.product.github %}. Any changes you need to make to your enterprise's {% data variables.enterprise.prodname_managed_users %} should be made through your IdP.
{% data reusables.identity-and-permissions.revoking-identity-team-sync %} {% data reusables.identity-and-permissions.revoking-identity-team-sync %}

View File

@@ -115,7 +115,7 @@ You may be able to view the email addresses for members of your enterprise on ei
If you use {% data variables.product.prodname_emus %}, verify a domain, or configure SAML SSO for your enterprise, you may be able to view the email addresses in one or more of the following ways. If you use {% data variables.product.prodname_emus %}, verify a domain, or configure SAML SSO for your enterprise, you may be able to view the email addresses in one or more of the following ways.
1. On your SAML Identity Provider (IdP), review the email addresses of users with access to {% data variables.product.product_name %}. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/about-saml-for-enterprise-iam). 1. On your SAML Identity Provider (IdP), review the email addresses of users with access to your enterprise. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/about-saml-for-enterprise-iam).
1. Export the membership report for your enterprise on {% data variables.product.prodname_dotcom %}. The report may contain the user's email address, stored as the following values. 1. Export the membership report for your enterprise on {% data variables.product.prodname_dotcom %}. The report may contain the user's email address, stored as the following values.
* `GitHub com saml name`: The `NameID` from the user's linked SAML identity, which is typically the user's email address (for more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/saml-configuration-reference)) * `GitHub com saml name`: The `NameID` from the user's linked SAML identity, which is typically the user's email address (for more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/saml-configuration-reference))

View File

@@ -1,7 +1,7 @@
--- ---
title: '{% ifversion ghes %}Configuring code scanning for your appliance{% elsif default-setup-self-hosted-runners-GHEC %}Configuring self-hosted runners for code scanning in your enterprise{% endif %}' title: '{% ifversion ghes %}Configuring code scanning for your appliance{% elsif default-setup-self-hosted-runners-GHEC %}Configuring self-hosted runners for code scanning in your enterprise{% endif %}'
shortTitle: Configuring code scanning shortTitle: Configuring code scanning
intro: 'You can enable, configure, and disable {% data variables.product.prodname_code_scanning %} for {% data variables.product.product_name %}{% ifversion default-setup-self-hosted-runners-GHEC %} without {% data variables.product.prodname_dotcom %}-hosted runners{% endif %}. {% data variables.product.prodname_code_scanning_caps %} allows users to scan code for vulnerabilities and errors.' intro: 'You can enable, configure, and disable {% data variables.product.prodname_code_scanning %} for your enterprise{% ifversion default-setup-self-hosted-runners-GHEC %} without {% data variables.product.prodname_dotcom %}-hosted runners{% endif %}. {% data variables.product.prodname_code_scanning_caps %} allows users to scan code for vulnerabilities and errors.'
allowTitleToDifferFromFilename: true allowTitleToDifferFromFilename: true
product: '{% data reusables.gated-features.code-scanning %}' product: '{% data reusables.gated-features.code-scanning %}'
redirect_from: redirect_from:
@@ -62,7 +62,7 @@ You can configure {% data variables.product.prodname_code_scanning %} to run {%
{% endif %} {% endif %}
{% data variables.product.product_name %} can run {% data variables.product.prodname_code_scanning %} using a {% data variables.product.prodname_actions %} workflow. First, you need to provision one or more self-hosted {% data variables.product.prodname_actions %} runners in your environment. You can provision self-hosted runners at the repository, organization, or enterprise account level. See [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners) and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners). {% data variables.product.github %} can run {% data variables.product.prodname_code_scanning %} using a {% data variables.product.prodname_actions %} workflow. First, you need to provision one or more self-hosted {% data variables.product.prodname_actions %} runners in your environment. You can provision self-hosted runners at the repository, organization, or enterprise account level. See [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners) and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners).
{% ifversion default-setup-self-hosted-runners-GHEC %} {% ifversion default-setup-self-hosted-runners-GHEC %}
If you are provisioning a self-hosted runner for {% data variables.product.prodname_codeql %} analysis, your runner must use a {% data variables.product.prodname_codeql %}-supported operating system version and CPU architecture. See the [{% data variables.product.prodname_codeql %} system requirements](https://codeql.github.com/docs/codeql-overview/system-requirements/). If you are provisioning a self-hosted runner for {% data variables.product.prodname_codeql %} analysis, your runner must use a {% data variables.product.prodname_codeql %}-supported operating system version and CPU architecture. See the [{% data variables.product.prodname_codeql %} system requirements](https://codeql.github.com/docs/codeql-overview/system-requirements/).

View File

@@ -1,7 +1,7 @@
--- ---
title: Enabling GitHub Advanced Security for your enterprise title: Enabling GitHub Advanced Security for your enterprise
shortTitle: Enabling GitHub Advanced Security shortTitle: Enabling GitHub Advanced Security
intro: 'You can configure {% data variables.product.product_name %} to include {% data variables.product.prodname_GH_advanced_security %}. This provides extra features that help users find and fix security problems in their code.' intro: 'You can configure {% data variables.product.prodname_ghe_server %} to include {% data variables.product.prodname_GH_advanced_security %}. This provides extra features that help users find and fix security problems in their code.'
product: '{% data reusables.gated-features.ghas %}' product: '{% data reusables.gated-features.ghas %}'
redirect_from: redirect_from:
- /admin/advanced-security/enabling-github-advanced-security-for-your-enterprise - /admin/advanced-security/enabling-github-advanced-security-for-your-enterprise
@@ -36,7 +36,7 @@ For guidance on a phased deployment of GitHub Advanced Security, see [AUTOTITLE]
## Prerequisites for enabling {% data variables.product.prodname_GH_advanced_security %} ## Prerequisites for enabling {% data variables.product.prodname_GH_advanced_security %}
1. Upgrade your license for {% data variables.product.product_name %} to include {% data variables.product.prodname_GH_advanced_security %}. For information about licensing, see [AUTOTITLE](/billing/managing-billing-for-your-products/managing-billing-for-github-advanced-security/about-billing-for-github-advanced-security). 1. Upgrade your {% data variables.product.prodname_enterprise %} license to include {% data variables.product.prodname_GH_advanced_security %}. For information about licensing, see [AUTOTITLE](/billing/managing-billing-for-your-products/managing-billing-for-github-advanced-security/about-billing-for-github-advanced-security).
1. Download the new license file. See [AUTOTITLE](/billing/managing-your-license-for-github-enterprise/downloading-your-license-for-github-enterprise). 1. Download the new license file. See [AUTOTITLE](/billing/managing-your-license-for-github-enterprise/downloading-your-license-for-github-enterprise).
1. Upload the new license file to {% data variables.product.prodname_ghe_server %}. See [AUTOTITLE](/billing/managing-your-license-for-github-enterprise/uploading-a-new-license-to-github-enterprise-server). 1. Upload the new license file to {% data variables.product.prodname_ghe_server %}. See [AUTOTITLE](/billing/managing-your-license-for-github-enterprise/uploading-a-new-license-to-github-enterprise-server).
1. Review the prerequisites for the features you plan to enable. 1. Review the prerequisites for the features you plan to enable.
@@ -55,7 +55,7 @@ For guidance on a phased deployment of GitHub Advanced Security, see [AUTOTITLE]
1. Under "Security," select the features that you want to enable and deselect any features you want to disable. 1. Under "Security," select the features that you want to enable and deselect any features you want to disable.
{% data reusables.enterprise_management_console.save-settings %} {% data reusables.enterprise_management_console.save-settings %}
When {% data variables.product.product_name %} has finished restarting, you're ready to set up any additional resources required for newly enabled features. See [AUTOTITLE](/admin/code-security/managing-github-advanced-security-for-your-enterprise/configuring-code-scanning-for-your-appliance). When {% data variables.product.prodname_ghe_server %} has finished restarting, you're ready to set up any additional resources required for newly enabled features. See [AUTOTITLE](/admin/code-security/managing-github-advanced-security-for-your-enterprise/configuring-code-scanning-for-your-appliance).
## Enabling or disabling {% data variables.product.prodname_GH_advanced_security %} features via the administrative shell (SSH) ## Enabling or disabling {% data variables.product.prodname_GH_advanced_security %} features via the administrative shell (SSH)

View File

@@ -31,7 +31,7 @@ Before configuring {% data variables.product.prodname_dependabot %}, install Doc
1. On {% data variables.product.prodname_ghe_server %}, navigate to the `github/dependabot-action` repository and retrieve information about the `dependabot-updater` and `dependabot-proxy` container images from the `containers.json` file. 1. On {% data variables.product.prodname_ghe_server %}, navigate to the `github/dependabot-action` repository and retrieve information about the `dependabot-updater` and `dependabot-proxy` container images from the `containers.json` file.
Each release of {% data variables.product.product_name %} includes an updated `containers.json` file at: `https://HOSTNAME/github/dependabot-action/blob/ghes-VERSION/docker/containers.json`. You can see the {% data variables.product.prodname_dotcom_the_website %} version of the file at: [containers.json](https://github.com/github/dependabot-action/blob/main/docker/containers.json). Each release of {% data variables.product.prodname_ghe_server %} includes an updated `containers.json` file at: `https://HOSTNAME/github/dependabot-action/blob/ghes-VERSION/docker/containers.json`. You can see the {% data variables.product.prodname_dotcom_the_website %} version of the file at: [containers.json](https://github.com/github/dependabot-action/blob/main/docker/containers.json).
1. Preload all the container images from the {% data variables.product.prodname_dotcom %} {% data variables.product.prodname_container_registry %} onto the {% data variables.product.prodname_dependabot %} runner using the `docker pull` command. {% ifversion ghes %}Alternatively, preload the `dependabot-proxy` image and then preload only the container images for the ecosystems you require. 1. Preload all the container images from the {% data variables.product.prodname_dotcom %} {% data variables.product.prodname_container_registry %} onto the {% data variables.product.prodname_dependabot %} runner using the `docker pull` command. {% ifversion ghes %}Alternatively, preload the `dependabot-proxy` image and then preload only the container images for the ecosystems you require.
@@ -46,7 +46,7 @@ Before configuring {% data variables.product.prodname_dependabot %}, install Doc
{%- endif %} {%- endif %}
> [!NOTE] > [!NOTE]
> You will need to repeat this step when you upgrade to a new minor version of {% data variables.product.product_name %}, or if you manually update the {% data variables.product.prodname_dependabot %} action from {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/manually-syncing-actions-from-githubcom). > You will need to repeat this step when you upgrade to a new minor version of {% data variables.product.prodname_ghe_server %}, or if you manually update the {% data variables.product.prodname_dependabot %} action from {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/manually-syncing-actions-from-githubcom).
1. When you have finished adding these images to the runner, you are ready to restrict internet access to the {% data variables.product.prodname_dependabot %} runner, ensuring that it can still access your private registries for the required ecosystems and for {% data variables.product.prodname_ghe_server %}. 1. When you have finished adding these images to the runner, you are ready to restrict internet access to the {% data variables.product.prodname_dependabot %} runner, ensuring that it can still access your private registries for the required ecosystems and for {% data variables.product.prodname_ghe_server %}.

View File

@@ -15,13 +15,13 @@ redirect_from:
- /admin/github-actions/advanced-configuration-and-troubleshooting/backing-up-and-restoring-github-enterprise-server-with-github-actions-enabled - /admin/github-actions/advanced-configuration-and-troubleshooting/backing-up-and-restoring-github-enterprise-server-with-github-actions-enabled
--- ---
## About backups of {% data variables.product.product_name %} when using {% data variables.product.prodname_actions %} ## About backups of {% data variables.product.prodname_ghe_server %} when using {% data variables.product.prodname_actions %}
You can use {% data variables.product.prodname_enterprise_backup_utilities %} to back up and restore the data and configuration for {% data variables.location.product_location %} to a new instance. For more information, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/configuring-backups-on-your-appliance). You can use {% data variables.product.prodname_enterprise_backup_utilities %} to back up and restore the data and configuration for {% data variables.location.product_location %} to a new instance. For more information, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/configuring-backups-on-your-appliance).
However, not all the data for {% data variables.product.prodname_actions %} is included in these backups. {% data reusables.actions.enterprise-storage-ha-backups %} However, not all the data for {% data variables.product.prodname_actions %} is included in these backups. {% data reusables.actions.enterprise-storage-ha-backups %}
## Restoring a backup of {% data variables.product.product_name %} when {% data variables.product.prodname_actions %} is enabled ## Restoring a backup of {% data variables.product.prodname_ghe_server %} when {% data variables.product.prodname_actions %} is enabled
To restore a backup of {% data variables.location.product_location %} with {% data variables.product.prodname_actions %}, you must manually configure network settings and external storage on the destination instance before you restore your backup from {% data variables.product.prodname_enterprise_backup_utilities %}. To restore a backup of {% data variables.location.product_location %} with {% data variables.product.prodname_actions %}, you must manually configure network settings and external storage on the destination instance before you restore your backup from {% data variables.product.prodname_enterprise_backup_utilities %}.

View File

@@ -15,19 +15,19 @@ redirect_from:
shortTitle: Use staging environment shortTitle: Use staging environment
--- ---
## About staging environments for {% data variables.product.product_name %} ## About staging environments for {% data variables.product.prodname_ghe_server %}
It can be useful to have a staging or testing environment for {% data variables.location.product_location %}, so that you can test updates or new features before implementing them in your production environment. For more information, see [AUTOTITLE](/admin/installation/setting-up-a-github-enterprise-server-instance/setting-up-a-staging-instance). It can be useful to have a staging or testing environment for {% data variables.location.product_location %}, so that you can test updates or new features before implementing them in your production environment. For more information, see [AUTOTITLE](/admin/installation/setting-up-a-github-enterprise-server-instance/setting-up-a-staging-instance).
## Using a staging environment with {% data variables.product.prodname_actions %} ## Using a staging environment with {% data variables.product.prodname_actions %}
A common way to create the staging environment is to restore a backup of your production {% data variables.product.product_name %} instance to a new virtual machine in the staging environment. If you use a staging instance and plan to test {% data variables.product.prodname_actions %} functionality, you should review your storage configuration in the staging environment. A common way to create the staging environment is to restore a backup of your production {% data variables.product.prodname_ghe_server %} instance to a new virtual machine in the staging environment. If you use a staging instance and plan to test {% data variables.product.prodname_actions %} functionality, you should review your storage configuration in the staging environment.
After you restore a {% data variables.product.prodname_ghe_server %} backup to the staging instance, if you try to view logs or artifacts from existing {% data variables.product.prodname_actions %} workflow runs on your staging instance, you will see `404` errors, because this data will be missing from your staging storage location. To work around the `404` errors, you can copy data from production to use in your staging environment. After you restore a {% data variables.product.prodname_ghe_server %} backup to the staging instance, if you try to view logs or artifacts from existing {% data variables.product.prodname_actions %} workflow runs on your staging instance, you will see `404` errors, because this data will be missing from your staging storage location. To work around the `404` errors, you can copy data from production to use in your staging environment.
### Configuring storage ### Configuring storage
When you set up a staging environment that includes a {% data variables.product.product_name %} instance with {% data variables.product.prodname_actions %} enabled, you must use a different external storage configuration for {% data variables.product.prodname_actions %} storage than your production environment. When you set up a staging environment that includes a {% data variables.product.prodname_ghe_server %} instance with {% data variables.product.prodname_actions %} enabled, you must use a different external storage configuration for {% data variables.product.prodname_actions %} storage than your production environment.
> [!WARNING] > [!WARNING]
> If you don't change the storage configuration, your staging instance may be able to write to the same external storage that you use for production, which could result in loss of data. > If you don't change the storage configuration, your staging instance may be able to write to the same external storage that you use for production, which could result in loss of data.

View File

@@ -29,7 +29,7 @@ redirect_from:
You can create your own unique automations, or you can use and adapt workflows from our ecosystem of over 10,000 actions built by industry leaders and the open source community. {% ifversion ghec %}For more information, see [AUTOTITLE](/actions/learn-github-actions/finding-and-customizing-actions).{% else %}You can restrict your developers to using actions that exist on {% data variables.location.product_location %}, or you can allow your developers to access actions on {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/about-using-actions-in-your-enterprise).{% endif %} You can create your own unique automations, or you can use and adapt workflows from our ecosystem of over 10,000 actions built by industry leaders and the open source community. {% ifversion ghec %}For more information, see [AUTOTITLE](/actions/learn-github-actions/finding-and-customizing-actions).{% else %}You can restrict your developers to using actions that exist on {% data variables.location.product_location %}, or you can allow your developers to access actions on {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/about-using-actions-in-your-enterprise).{% endif %}
{% data variables.product.prodname_actions %} is developer friendly, because it's integrated directly into the familiar {% data variables.product.product_name %} experience. {% data variables.product.prodname_actions %} is developer friendly, because it's integrated directly into the familiar {% data variables.product.github %} experience.
{% ifversion ghec %}You can enjoy the convenience of {% data variables.product.company_short %}-hosted runners, which are maintained and upgraded by {% data variables.product.company_short %}, or you{% else %}You{% endif %} can control your own private CI/CD infrastructure by using self-hosted runners. Self-hosted runners allow you to determine the exact environment and resources that complete your builds, testing, and deployments, without exposing your software development cycle to the internet. For more information, see {% ifversion ghec %}[AUTOTITLE](/actions/using-github-hosted-runners/about-github-hosted-runners) and{% endif %} [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners). {% ifversion ghec %}You can enjoy the convenience of {% data variables.product.company_short %}-hosted runners, which are maintained and upgraded by {% data variables.product.company_short %}, or you{% else %}You{% endif %} can control your own private CI/CD infrastructure by using self-hosted runners. Self-hosted runners allow you to determine the exact environment and resources that complete your builds, testing, and deployments, without exposing your software development cycle to the internet. For more information, see {% ifversion ghec %}[AUTOTITLE](/actions/using-github-hosted-runners/about-github-hosted-runners) and{% endif %} [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners).

View File

@@ -27,7 +27,7 @@ You can use policies to control how enterprise members use {% data variables.pro
## Adding runners ## Adding runners
To run {% data variables.product.prodname_actions %} workflows, you need to use runners. {% data reusables.actions.about-runners %} If you use {% data variables.product.company_short %}-hosted runners, you will be billed based on consumption after exhausting the minutes included in {% data variables.product.product_name %}, while self-hosted runners are free. For more information, see [AUTOTITLE](/billing/managing-billing-for-github-actions/about-billing-for-github-actions). To run {% data variables.product.prodname_actions %} workflows, you need to use runners. {% data reusables.actions.about-runners %} If you use {% data variables.product.company_short %}-hosted runners, you will be billed based on consumption after exhausting the minutes included in your plan, whereas self-hosted runners are free. For more information, see [AUTOTITLE](/billing/managing-billing-for-github-actions/about-billing-for-github-actions).
For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners). For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners).

View File

@@ -47,7 +47,7 @@ After you finish the guide, {% ifversion ghec %}members of your enterprise{% els
## 1. Configure policies for {% data variables.product.prodname_actions %} ## 1. Configure policies for {% data variables.product.prodname_actions %}
First, enable {% data variables.product.prodname_actions %} for all organizations, and configure a policy to restrict the actions{% ifversion actions-workflow-policy %} and reusable workflows{% endif %} that can run {% ifversion ghec %}within your enterprise on {% data variables.product.product_name %}{% elsif ghes %}on {% data variables.location.product_location %}{% endif %}. Optionally, organization owners can further restrict these policies for each organization. First, enable {% data variables.product.prodname_actions %} for all organizations, and configure a policy to restrict the actions{% ifversion actions-workflow-policy %} and reusable workflows{% endif %} that can run {% ifversion ghec %}within your enterprise{% elsif ghes %}on {% data variables.location.product_location %}{% endif %}. Optionally, organization owners can further restrict these policies for each organization.
{% data reusables.enterprise-accounts.access-enterprise %} {% data reusables.enterprise-accounts.access-enterprise %}
{% data reusables.enterprise-accounts.policies-tab %} {% data reusables.enterprise-accounts.policies-tab %}
@@ -60,7 +60,7 @@ You can configure additional policies to restrict the actions available to {% if
## 2. Deploy the self-hosted runner for your enterprise ## 2. Deploy the self-hosted runner for your enterprise
Next, add a self-hosted runner to your enterprise. {% data variables.product.product_name %} will guide you through installation of the necessary software on the runner machine. After you deploy the runner, you can verify connectivity between the runner machine and {% ifversion ghec %}your enterprise{% elsif ghes %}{% data variables.location.product_location %}{% endif %}. Next, add a self-hosted runner to your enterprise. {% data variables.product.github %} will guide you through installation of the necessary software on the runner machine. After you deploy the runner, you can verify connectivity between the runner machine and {% ifversion ghec %}your enterprise{% elsif ghes %}{% data variables.location.product_location %}{% endif %}.
### Adding the self-hosted runner ### Adding the self-hosted runner
@@ -72,7 +72,7 @@ Next, add a self-hosted runner to your enterprise. {% data variables.product.pro
You can create a runner group to manage access to the runner that you added to your enterprise. You'll use the group to choose which organizations can execute jobs from {% data variables.product.prodname_actions %} on the runner. You can create a runner group to manage access to the runner that you added to your enterprise. You'll use the group to choose which organizations can execute jobs from {% data variables.product.prodname_actions %} on the runner.
{% data variables.product.product_name %} adds all new runners to a group. Runners can be in one group at a time. By default, {% data variables.product.product_name %} adds new runners to the "Default" group. {% data variables.product.github %} adds all new runners to a group. Runners can be in one group at a time. By default, {% data variables.product.github %} adds new runners to the "Default" group.
{% data reusables.actions.runner-groups-add-to-enterprise-first-steps %} {% data reusables.actions.runner-groups-add-to-enterprise-first-steps %}
1. To choose a policy for organization access, under "Organization access", select the **Organization access** drop-down, and click **Selected organizations**. 1. To choose a policy for organization access, under "Organization access", select the **Organization access** drop-down, and click **Selected organizations**.
@@ -115,7 +115,7 @@ Optionally, you can use {% data variables.product.prodname_actions_runner_contro
* {% data variables.product.company_short %} recommends that you review security considerations for self-hosted runner machines. For more information, see [AUTOTITLE](/actions/security-guides/security-hardening-for-github-actions#hardening-for-self-hosted-runners). * {% data variables.product.company_short %} recommends that you review security considerations for self-hosted runner machines. For more information, see [AUTOTITLE](/actions/security-guides/security-hardening-for-github-actions#hardening-for-self-hosted-runners).
* {% ifversion ghec %}If you use {% data variables.product.prodname_ghe_server %}, you{% elsif ghes %}You{% endif %} can manually sync repositories on {% data variables.product.prodname_dotcom_the_website %} containing actions to your enterprise on {% ifversion ghes %}{% data variables.product.product_name %}{% elsif ghec %}{% data variables.product.prodname_ghe_server %}{% endif %}. Alternatively, you can allow members of your enterprise to automatically access actions from {% data variables.product.prodname_dotcom_the_website %} by using {% data variables.product.prodname_github_connect %}. For more information, see the following. * {% ifversion ghec %}If you use {% data variables.product.prodname_ghe_server %}, you{% elsif ghes %}You{% endif %} can manually sync repositories on {% data variables.product.prodname_dotcom_the_website %} containing actions to your enterprise on {% data variables.product.prodname_ghe_server %}. Alternatively, you can allow members of your enterprise to automatically access actions from {% data variables.product.prodname_dotcom_the_website %} by using {% data variables.product.prodname_github_connect %}. For more information, see the following.
* [AUTOTITLE]({% ifversion ghec %}/enterprise-server@latest{% endif %}/admin/github-actions/managing-access-to-actions-from-githubcom/manually-syncing-actions-from-githubcom){% ifversion ghec %} in the {% data variables.product.prodname_ghe_server %} documentation{% endif %} * [AUTOTITLE]({% ifversion ghec %}/enterprise-server@latest{% endif %}/admin/github-actions/managing-access-to-actions-from-githubcom/manually-syncing-actions-from-githubcom){% ifversion ghec %} in the {% data variables.product.prodname_ghe_server %} documentation{% endif %}
* [AUTOTITLE]({% ifversion ghec %}/enterprise-server@latest{% endif %}/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect){% ifversion ghec %} in the {% data variables.product.prodname_ghe_server %} documentation{% endif %} * [AUTOTITLE]({% ifversion ghec %}/enterprise-server@latest{% endif %}/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect){% ifversion ghec %} in the {% data variables.product.prodname_ghe_server %} documentation{% endif %}

View File

@@ -1,7 +1,7 @@
--- ---
title: Managing GitHub Actions for your enterprise title: Managing GitHub Actions for your enterprise
allowTitleToDifferFromFilename: true allowTitleToDifferFromFilename: true
intro: 'Enable {% data variables.product.prodname_actions %} on {% data variables.product.product_name %}, and manage {% data variables.product.prodname_actions %} policies and settings.' intro: 'Enable {% data variables.product.prodname_actions %} on {% data variables.product.prodname_ghe_server %}, and manage {% data variables.product.prodname_actions %} policies and settings.'
redirect_from: redirect_from:
- /enterprise/admin/github-actions - /enterprise/admin/github-actions
- /admin/github-actions - /admin/github-actions

View File

@@ -1,6 +1,6 @@
--- ---
title: About using actions in your enterprise title: About using actions in your enterprise
intro: '{% data variables.product.product_name %} includes most {% data variables.product.prodname_dotcom %}-authored actions, and has options for enabling access to other actions from {% data variables.product.prodname_dotcom_the_website %} and {% data variables.product.prodname_marketplace %}.' intro: '{% data variables.product.prodname_ghe_server %} includes most {% data variables.product.prodname_dotcom %}-authored actions, and has options for enabling access to other actions from {% data variables.product.prodname_dotcom_the_website %} and {% data variables.product.prodname_marketplace %}.'
redirect_from: redirect_from:
- /enterprise/admin/github-actions/about-using-githubcom-actions-on-github-enterprise-server - /enterprise/admin/github-actions/about-using-githubcom-actions-on-github-enterprise-server
- /admin/github-actions/about-using-githubcom-actions-on-github-enterprise-server - /admin/github-actions/about-using-githubcom-actions-on-github-enterprise-server
@@ -18,13 +18,13 @@ shortTitle: About actions in your enterprise
{% data reusables.actions.enterprise-github-hosted-runners %} {% data reusables.actions.enterprise-github-hosted-runners %}
## About actions on {% data variables.product.product_name %} ## About actions on {% data variables.product.prodname_ghe_server %}
{% data variables.product.prodname_actions %} workflows can use _actions_, which are individual tasks that you can combine to create jobs and customize your workflow. You can create your own actions, or use and customize actions shared by the {% data variables.product.prodname_dotcom %} community. {% data variables.product.prodname_actions %} workflows can use _actions_, which are individual tasks that you can combine to create jobs and customize your workflow. You can create your own actions, or use and customize actions shared by the {% data variables.product.prodname_dotcom %} community.
{% data reusables.actions.enterprise-no-internet-actions %} You can restrict your developers to using actions that are stored on {% data variables.location.product_location %}, which includes most official {% data variables.product.company_short %}-authored actions, as well as any actions your developers create. Alternatively, to allow your developers to benefit from the full ecosystem of actions built by industry leaders and the open source community, you can configure access to other actions from {% data variables.product.prodname_dotcom_the_website %}. {% data reusables.actions.enterprise-no-internet-actions %} You can restrict your developers to using actions that are stored on {% data variables.location.product_location %}, which includes most official {% data variables.product.company_short %}-authored actions, as well as any actions your developers create. Alternatively, to allow your developers to benefit from the full ecosystem of actions built by industry leaders and the open source community, you can configure access to other actions from {% data variables.product.prodname_dotcom_the_website %}.
We recommend allowing automatic access to all actions from {% data variables.product.prodname_dotcom_the_website %}. {% ifversion ghes %}However, this does require {% data variables.product.product_name %} to make outbound connections to {% data variables.product.prodname_dotcom_the_website %}. If you don't want to allow these connections, or{% else %}If{% endif %} you want to have greater control over which actions are used on your enterprise, you can manually sync specific actions from {% data variables.product.prodname_dotcom_the_website %}. We recommend allowing automatic access to all actions from {% data variables.product.prodname_dotcom_the_website %}. {% ifversion ghes %}However, this does require {% data variables.product.prodname_ghe_server %} to make outbound connections to {% data variables.product.prodname_dotcom_the_website %}. If you don't want to allow these connections, or{% else %}If{% endif %} you want to have greater control over which actions are used on your enterprise, you can manually sync specific actions from {% data variables.product.prodname_dotcom_the_website %}.
## Official actions bundled with your enterprise instance ## Official actions bundled with your enterprise instance
@@ -44,16 +44,16 @@ There is no connection required between {% data variables.location.product_locat
Each action is a repository in the `actions` organization, and each action repository includes the necessary tags, branches, and commit SHAs that your workflows can use to reference the action. For information on how to update the bundled official actions, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/using-the-latest-version-of-the-official-bundled-actions). Each action is a repository in the `actions` organization, and each action repository includes the necessary tags, branches, and commit SHAs that your workflows can use to reference the action. For information on how to update the bundled official actions, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/using-the-latest-version-of-the-official-bundled-actions).
> [!NOTE] > [!NOTE]
> * When using setup actions (such as `actions/setup-LANGUAGE`) on {% data variables.product.product_name %} with self-hosted runners, you might need to set up the tools cache on runners that do not have internet access. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access). > * When using setup actions (such as `actions/setup-LANGUAGE`) on {% data variables.product.prodname_ghe_server %} with self-hosted runners, you might need to set up the tools cache on runners that do not have internet access. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access).
> * All `actions/setup-LANGUAGE` action repositories currently support three platforms: macOS, Windows, and Ubuntu. > * All `actions/setup-LANGUAGE` action repositories currently support three platforms: macOS, Windows, and Ubuntu.
> * When {% data variables.product.product_name %} is updated, bundled actions are automatically replaced with default versions in the upgrade package. > * When {% data variables.product.prodname_ghe_server %} is updated, bundled actions are automatically replaced with default versions in the upgrade package.
> * Being bundled with {% data variables.product.prodname_ghe_server %} means the action is available within that environment, but it doesnt automatically guarantee compatibility with all platforms or self-hosted runners. > * Being bundled with {% data variables.product.prodname_ghe_server %} means the action is available within that environment, but it doesnt automatically guarantee compatibility with all platforms or self-hosted runners.
## Configuring access to actions on {% data variables.product.prodname_dotcom_the_website %} ## Configuring access to actions on {% data variables.product.prodname_dotcom_the_website %}
{% data reusables.actions.access-actions-on-dotcom %} {% data reusables.actions.access-actions-on-dotcom %}
The recommended approach is to enable automatic access to all actions from {% data variables.product.prodname_dotcom_the_website %}. You can do this by using {% data variables.product.prodname_github_connect %} to integrate {% data variables.product.product_name %} with {% data variables.product.prodname_ghe_cloud %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect). The recommended approach is to enable automatic access to all actions from {% data variables.product.prodname_dotcom_the_website %}. You can do this by using {% data variables.product.prodname_github_connect %} to integrate {% data variables.product.prodname_ghe_server %} with {% data variables.product.prodname_ghe_cloud %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect).
> [!NOTE] > [!NOTE]
> Before you can configure access to actions on {% data variables.product.prodname_dotcom_the_website %}, you must configure {% data variables.location.product_location %} to use {% data variables.product.prodname_actions %}. For more information, see [AUTOTITLE](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server). > Before you can configure access to actions on {% data variables.product.prodname_dotcom_the_website %}, you must configure {% data variables.location.product_location %} to use {% data variables.product.prodname_actions %}. For more information, see [AUTOTITLE](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server).

View File

@@ -20,7 +20,7 @@ shortTitle: Use GitHub Connect for actions
## About automatic access to {% data variables.product.prodname_dotcom_the_website %} actions ## About automatic access to {% data variables.product.prodname_dotcom_the_website %} actions
By default, {% data variables.product.prodname_actions %} workflows on {% data variables.product.product_name %} cannot use actions directly from {% data variables.product.prodname_dotcom_the_website %} or [{% data variables.product.prodname_marketplace %}](https://github.com/marketplace?type=actions). To make all actions from {% data variables.product.prodname_dotcom_the_website %} available on your enterprise instance, you can use {% data variables.product.prodname_github_connect %} to integrate {% data variables.product.product_name %} with {% data variables.product.prodname_ghe_cloud %}. By default, {% data variables.product.prodname_actions %} workflows on {% data variables.product.prodname_ghe_server %} cannot use actions directly from {% data variables.product.prodname_dotcom_the_website %} or [{% data variables.product.prodname_marketplace %}](https://github.com/marketplace?type=actions). To make all actions from {% data variables.product.prodname_dotcom_the_website %} available on your enterprise instance, you can use {% data variables.product.prodname_github_connect %} to integrate {% data variables.product.prodname_ghe_server %} with {% data variables.product.prodname_ghe_cloud %}.
{% data reusables.actions.self-hosted-runner-networking-to-dotcom %} {% data reusables.actions.self-hosted-runner-networking-to-dotcom %}

View File

@@ -20,15 +20,15 @@ shortTitle: Manually sync actions
{% ifversion ghes %} {% ifversion ghes %}
We recommend enabling automatic access to all actions by using {% data variables.product.prodname_github_connect %} to integrate {% data variables.product.product_name %} with {% data variables.product.prodname_ghe_cloud %}. See [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect). We recommend enabling automatic access to all actions by using {% data variables.product.prodname_github_connect %} to integrate {% data variables.product.prodname_ghe_server %} with {% data variables.product.prodname_ghe_cloud %}. See [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect).
If you want stricter control over which actions are allowed in your enterprise, you{% else %}You{% endif %} can follow this guide to use our open source [`actions-sync`](https://github.com/actions/actions-sync) tool to sync individual action repositories from {% data variables.product.prodname_dotcom_the_website %} to your enterprise. If you want stricter control over which actions are allowed in your enterprise, you{% else %}You{% endif %} can follow this guide to use our open source [`actions-sync`](https://github.com/actions/actions-sync) tool to sync individual action repositories from {% data variables.product.prodname_dotcom_the_website %} to your enterprise.
When you upgrade {% data variables.product.product_name %}, bundled actions are automatically replaced with the default versions in the upgrade package. These may not be the latest available version. As a best practice, if you use `actions-sync` to update actions, you should always rerun `actions-sync` after any {% data variables.product.product_name %} upgrade (major or minor) to ensure that the actions remain up to date. When you upgrade {% data variables.product.prodname_ghe_server %}, bundled actions are automatically replaced with the default versions in the upgrade package. These may not be the latest available version. As a best practice, if you use `actions-sync` to update actions, you should always rerun `actions-sync` after any {% data variables.product.prodname_ghe_server %} upgrade (major or minor) to ensure that the actions remain up to date.
## About the `actions-sync` tool ## About the `actions-sync` tool
The `actions-sync` tool must be run on a machine that can access the {% data variables.product.prodname_dotcom_the_website %} API and your {% data variables.product.product_name %} instance's API. The machine doesn't need to be connected to both at the same time. The `actions-sync` tool must be run on a machine that can access the {% data variables.product.prodname_dotcom_the_website %} API and your {% data variables.product.prodname_ghe_server %} instance's API. The machine doesn't need to be connected to both at the same time.
If your machine has access to both systems at the same time, you can do the sync with a single `actions-sync sync` command. If you can only access one system at a time, you can use the `actions-sync pull` and `push` commands. If your machine has access to both systems at the same time, you can do the sync with a single `actions-sync sync` command. If you can only access one system at a time, you can use the `actions-sync pull` and `push` commands.

View File

@@ -21,7 +21,7 @@ shortTitle: Tool cache for offline runners
{% data reusables.actions.enterprise-no-internet-actions %} {% data reusables.actions.enterprise-no-internet-actions %}
Most official {% data variables.product.prodname_dotcom %}-authored actions are automatically bundled with {% data variables.product.product_name %}. However, self-hosted runners without internet access require some configuration before they can use the included `actions/setup-LANGUAGE` actions, such as `setup-node`. Most official {% data variables.product.prodname_dotcom %}-authored actions are automatically bundled with {% data variables.product.prodname_ghe_server %}. However, self-hosted runners without internet access require some configuration before they can use the included `actions/setup-LANGUAGE` actions, such as `setup-node`.
The `actions/setup-LANGUAGE` actions normally need internet access to download the required environment binaries into the runner's tool cache. Self-hosted runners without internet access can't download the binaries, so you must manually populate the tool cache on the runner. The `actions/setup-LANGUAGE` actions normally need internet access to download the required environment binaries into the runner's tool cache. Self-hosted runners without internet access can't download the binaries, so you must manually populate the tool cache on the runner.

View File

@@ -25,11 +25,11 @@ To update the bundled actions, you can use the `actions-sync` tool to update the
## Using {% data variables.product.prodname_github_connect %} to access the latest actions ## Using {% data variables.product.prodname_github_connect %} to access the latest actions
You can use {% data variables.product.prodname_github_connect %} to allow {% data variables.product.product_name %} to use actions from {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect). You can use {% data variables.product.prodname_github_connect %} to allow {% data variables.product.prodname_ghe_server %} to use actions from {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect).
Once {% data variables.product.prodname_github_connect %} is configured, you can use the latest version of an action by deleting its local repository in the `actions` organization on your instance. For example, if your enterprise instance is using `v1` of the `actions/checkout` action, and you need to use `{% data reusables.actions.action-checkout %}` which isn't available on your enterprise instance, perform the following steps to be able to use the latest `checkout` action from {% data variables.product.prodname_dotcom_the_website %}: Once {% data variables.product.prodname_github_connect %} is configured, you can use the latest version of an action by deleting its local repository in the `actions` organization on your instance. For example, if your enterprise instance is using `v1` of the `actions/checkout` action, and you need to use `{% data reusables.actions.action-checkout %}` which isn't available on your enterprise instance, perform the following steps to be able to use the latest `checkout` action from {% data variables.product.prodname_dotcom_the_website %}:
1. From an enterprise owner account on {% data variables.product.product_name %}, navigate to the repository you want to delete from the _actions_ organization (in this example `checkout`). 1. From an enterprise owner account on {% data variables.product.prodname_ghe_server %}, navigate to the repository you want to delete from the _actions_ organization (in this example `checkout`).
1. By default, site administrators are not owners of the bundled _actions_ organization. To get the access required to delete the `checkout` repository, you must use the site admin tools. Click {% octicon "rocket" aria-label="Site admin" %} in the upper-right corner of any page in that repository. 1. By default, site administrators are not owners of the bundled _actions_ organization. To get the access required to delete the `checkout` repository, you must use the site admin tools. Click {% octicon "rocket" aria-label="Site admin" %} in the upper-right corner of any page in that repository.
1. Click **{% octicon "shield-lock" aria-hidden="true" %} Security** to see an overview of the security for the repository. 1. Click **{% octicon "shield-lock" aria-hidden="true" %} Security** to see an overview of the security for the repository.

View File

@@ -23,9 +23,9 @@ redirect_from:
{% data reusables.enterprise-accounts.emu-cap-public-preview %} {% data reusables.enterprise-accounts.emu-cap-public-preview %}
{% data variables.product.product_name %} supports CAP for any {% data variables.enterprise.prodname_emu_enterprise %} where OIDC SSO is enabled. Enterprise owners can choose to use this IP allow list configuration instead of {% data variables.product.product_name %}'s IP allow list, and can do so once OIDC SSO is configured. For more information about IP allow lists, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/restricting-network-traffic-to-your-enterprise-with-an-ip-allow-list#about-your-idps-allow-list) and [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization). {% data variables.product.github %} supports CAP for any {% data variables.enterprise.prodname_emu_enterprise %} where OIDC SSO is enabled. Enterprise owners can choose to use this IP allow list configuration instead of {% data variables.product.github %}'s IP allow list, and can do so once OIDC SSO is configured. For more information about IP allow lists, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/restricting-network-traffic-to-your-enterprise-with-an-ip-allow-list#about-your-idps-allow-list) and [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization).
* {% data variables.product.product_name %} enforces your IdP's IP conditions but cannot enforce your device compliance conditions. * {% data variables.product.github %} enforces your IdP's IP conditions but cannot enforce your device compliance conditions.
* Policies for multi-factor authentication are only enforced at the point of sign-in to the IdP. * Policies for multi-factor authentication are only enforced at the point of sign-in to the IdP.
For more information about using OIDC with {% data variables.product.prodname_emus %}, see [AUTOTITLE](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users) and [AUTOTITLE](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/migrating-from-saml-to-oidc). For more information about using OIDC with {% data variables.product.prodname_emus %}, see [AUTOTITLE](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/configuring-oidc-for-enterprise-managed-users) and [AUTOTITLE](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/migrating-from-saml-to-oidc).

View File

@@ -77,7 +77,7 @@ To configure SAML SSO for your {% data variables.enterprise.prodname_emu_enterpr
{% endrowheaders %} {% endrowheaders %}
Alternatively, if you don't use a partner IdP, you can use the SAML configuration reference for {% data variables.product.product_name %} to create and configure a generic SAML 2.0 application on your IdP. See [AUTOTITLE](/admin/identity-and-access-management/iam-configuration-reference/saml-configuration-reference). Alternatively, if you don't use a partner IdP, you can use the SAML configuration reference for {% data variables.product.github %} to create and configure a generic SAML 2.0 application on your IdP. See [AUTOTITLE](/admin/identity-and-access-management/iam-configuration-reference/saml-configuration-reference).
1. To test and configure your enterprise, assign yourself or the user that will configure SAML SSO for your enterprise on {% data variables.product.github %} to the application you configured for {% data variables.product.prodname_emus %} on your IdP. 1. To test and configure your enterprise, assign yourself or the user that will configure SAML SSO for your enterprise on {% data variables.product.github %} to the application you configured for {% data variables.product.prodname_emus %} on your IdP.

View File

@@ -39,7 +39,7 @@ The {% data variables.product.prodname_emu_idp_application %} application on Okt
>For example, if you sign in to `github.com/enterprises/octocorp` or `{% data variables.enterprise.data_residency_example_domain %}`, your enterprise name is `octocorp`. >For example, if you sign in to `github.com/enterprises/octocorp` or `{% data variables.enterprise.data_residency_example_domain %}`, your enterprise name is `octocorp`.
1. On the "Sign on" tab, under "SAML 2.0," click **More details**. 1. On the "Sign on" tab, under "SAML 2.0," click **More details**.
1. In order to configure your enterprise on {% data variables.product.product_name %} later, note down the following items: 1. In order to configure your enterprise on {% data variables.product.github %} later, note down the following items:
* "Sign on URL" * "Sign on URL"
* "Issuer" * "Issuer"

View File

@@ -36,7 +36,7 @@ If you want to migrate to a new identity provider (IdP) or tenant rather than di
## Disabling authentication ## Disabling authentication
> [!WARNING] > [!WARNING]
> Disabling authentication and provisioning will prevent your enterprise's {% data variables.enterprise.prodname_managed_users %} from signing in to access your enterprise on {% data variables.product.product_name %}. > Disabling authentication and provisioning will prevent your enterprise's {% data variables.enterprise.prodname_managed_users %} from signing in to access your enterprise on {% data variables.product.github %}.
{% data reusables.emus.sign-in-as-setup-user %} {% data reusables.emus.sign-in-as-setup-user %}
1. Attempt to access your enterprise account, and use a recovery code to bypass SAML SSO or OIDC. For more information, see [AUTOTITLE](/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable). 1. Attempt to access your enterprise account, and use a recovery code to bypass SAML SSO or OIDC. For more information, see [AUTOTITLE](/admin/identity-and-access-management/managing-recovery-codes-for-your-enterprise/accessing-your-enterprise-account-if-your-identity-provider-is-unavailable).

View File

@@ -1,6 +1,6 @@
--- ---
title: IAM configuration reference title: IAM configuration reference
intro: 'You can view reference information about configuration of authentication {% ifversion ghec %}and provisioning for your enterprise on {% data variables.product.product_name %}{% elsif ghes %}for {% data variables.location.product_location %}{% endif %}.' intro: 'You can view reference information about configuration of authentication {% ifversion ghec %}and provisioning for your enterprise{% elsif ghes %}for {% data variables.location.product_location %}{% endif %}.'
versions: versions:
ghec: '*' ghec: '*'
ghes: '*' ghes: '*'

View File

@@ -1,7 +1,7 @@
--- ---
title: SAML configuration reference title: SAML configuration reference
shortTitle: SAML reference shortTitle: SAML reference
intro: 'You can see SAML metadata for {% ifversion ghec %}your organization or enterprise on {% data variables.product.product_name %}{% elsif ghes %}{% data variables.location.product_location %}{% endif %}, and you can learn more about available SAML attributes and response requirements.' intro: 'You can see SAML metadata for {% ifversion ghec %}your organization or enterprise{% elsif ghes %}{% data variables.location.product_location %}{% endif %}, and you can learn more about available SAML attributes and response requirements.'
versions: versions:
ghec: '*' ghec: '*'
ghes: '*' ghes: '*'
@@ -19,23 +19,23 @@ redirect_from:
## About SAML configuration ## About SAML configuration
To use SAML single sign-on (SSO) for authentication to {% data variables.product.product_name %}, you must configure both your external SAML identity provider (IdP) and {% ifversion ghes %}{% data variables.location.product_location %}{% elsif ghec %}your enterprise or organization on {% data variables.product.github %}{% endif %}. In a SAML configuration, {% data variables.product.product_name %} functions as a SAML service provider (SP). For more information about authentication for your enterprise, see [AUTOTITLE](/admin/identity-and-access-management/understanding-iam-for-enterprises/about-identity-and-access-management#authentication-methods). To use SAML single sign-on (SSO) for authentication to {% data variables.product.github %}, you must configure both your external SAML identity provider (IdP) and {% ifversion ghes %}{% data variables.location.product_location %}{% elsif ghec %}your enterprise or organization on {% data variables.product.github %}{% endif %}. In a SAML configuration, {% data variables.product.github %} functions as a SAML service provider (SP). For more information about authentication for your enterprise, see [AUTOTITLE](/admin/identity-and-access-management/understanding-iam-for-enterprises/about-identity-and-access-management#authentication-methods).
{% data variables.product.product_name %} provides integration according to the SAML 2.0 specification. For more information, see the [SAML Wiki](https://wiki.oasis-open.org/security) on the OASIS website. {% data variables.product.github %} provides integration according to the SAML 2.0 specification. For more information, see the [SAML Wiki](https://wiki.oasis-open.org/security) on the OASIS website.
You must enter unique values from your SAML IdP when configuring SAML SSO for {% data variables.product.product_name %}, and you must also enter unique values from {% data variables.product.product_name %} on your IdP. You must enter unique values from your SAML IdP when configuring SAML SSO for {% data variables.product.github %}, and you must also enter unique values from {% data variables.product.github %} on your IdP.
## SAML metadata ## SAML metadata
{% ifversion ghec %} {% ifversion ghec %}
The SP metadata for {% data variables.product.product_name %} is available for either organizations or enterprises with SAML SSO. {% data variables.product.product_name %} uses the `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST` binding. The SP metadata for {% data variables.product.prodname_ghe_cloud %} is available for either organizations or enterprises with SAML SSO. {% data variables.product.github %} uses the `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST` binding.
If you use {% data variables.product.prodname_emus %}, you can only enable SAML SSO at the enterprise level. If you use {% data variables.product.prodname_emus %}, you can only enable SAML SSO at the enterprise level.
### Organizations ### Organizations
You can configure SAML SSO for an individual organization in your enterprise. You can also configure SAML SSO for an organization if you use an individual organization on {% data variables.product.product_name %} and do not use an enterprise account. For more information, see [AUTOTITLE](/organizations/managing-saml-single-sign-on-for-your-organization). You can configure SAML SSO for an individual organization in your enterprise. You can also configure SAML SSO for an organization if you use an individual organization on {% data variables.product.prodname_ghe_cloud %} and do not use an enterprise account. For more information, see [AUTOTITLE](/organizations/managing-saml-single-sign-on-for-your-organization).
The SP metadata for an organization on {% data variables.product.github %} is available at `https://github.com/orgs/ORGANIZATION/saml/metadata`, where **ORGANIZATION** is the name of your organization on {% data variables.product.github %}. The SP metadata for an organization on {% data variables.product.github %} is available at `https://github.com/orgs/ORGANIZATION/saml/metadata`, where **ORGANIZATION** is the name of your organization on {% data variables.product.github %}.
@@ -60,11 +60,11 @@ Depending on your environment, the SP metadata for an enterprise on {% data vari
{% elsif ghes %} {% elsif ghes %}
The SP metadata for {% data variables.location.product_location %} is available at `http(s)://HOSTNAME/saml/metadata`, where **HOSTNAME** is the hostname for your instance. {% data variables.product.product_name %} uses the `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST` binding. The SP metadata for {% data variables.location.product_location %} is available at `http(s)://HOSTNAME/saml/metadata`, where **HOSTNAME** is the hostname for your instance. {% data variables.product.prodname_ghe_server %} uses the `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST` binding.
| Value | Other names | Description | Example | | Value | Other names | Description | Example |
| :- | :- | :- | :- | | :- | :- | :- | :- |
| SP Entity ID | SP URL, audience restriction | Your top-level URL for {% data variables.product.product_name %} | `http(s)://HOSTNAME` | | SP Entity ID | SP URL, audience restriction | The top-level URL for {% data variables.location.product_location_enterprise %} | `http(s)://HOSTNAME` |
| SP Assertion Consumer Service (ACS) URL | Reply, recipient, or destination URL | URL where IdP sends SAML responses | `http(s)://HOSTNAME/saml/consume` | | SP Assertion Consumer Service (ACS) URL | Reply, recipient, or destination URL | URL where IdP sends SAML responses | `http(s)://HOSTNAME/saml/consume` |
| SP Single Sign-On (SSO) URL | | URL where IdP begins SSO | `http(s)://HOSTNAME/sso` | | SP Single Sign-On (SSO) URL | | URL where IdP begins SSO | `http(s)://HOSTNAME/sso` |
@@ -72,14 +72,14 @@ The SP metadata for {% data variables.location.product_location %} is available
## SAML attributes ## SAML attributes
The following SAML attributes are available for {% data variables.product.product_name %}.{% ifversion ghes %} You can change the attribute names in the {% data variables.enterprise.management_console %}, with the exception of the `administrator` attribute. For more information, see [AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console).{% endif %} The following SAML attributes are available for {% data variables.product.github %}.{% ifversion ghes %} You can change the attribute names in the {% data variables.enterprise.management_console %}, with the exception of the `administrator` attribute. For more information, see [AUTOTITLE](/admin/configuration/administering-your-instance-from-the-management-console).{% endif %}
| Name | Required | Description | | Name | Required | Description |
| :- | :- | :- | | :- | :- | :- |
| `NameID` | {% octicon "check" aria-label="Required" %} | A persistent user identifier. Any persistent name identifier format may be used. {% ifversion ghec %}If you use an enterprise with {% data variables.product.prodname_emus %}, {% endif %}{% data variables.product.product_name %} will normalize the `NameID` element to use as a username unless one of the alternative assertions is provided. For more information, see [AUTOTITLE](/admin/identity-and-access-management/managing-iam-for-your-enterprise/username-considerations-for-external-authentication).<br><br> > [!NOTE] It's important to use a human-readable, persistent identifier. Using a transient identifier format like `urn:oasis:names:tc:SAML:2.0:nameid-format:transient` will result in re-linking of accounts on every sign-in, which can be detrimental to authorization management. | | `NameID` | {% octicon "check" aria-label="Required" %} | A persistent user identifier. Any persistent name identifier format may be used. {% ifversion ghec %}If you use an enterprise with {% data variables.product.prodname_emus %}, {% endif %}{% data variables.product.github %} will normalize the `NameID` element to use as a username unless one of the alternative assertions is provided. For more information, see [AUTOTITLE](/admin/identity-and-access-management/managing-iam-for-your-enterprise/username-considerations-for-external-authentication).<br><br> > [!NOTE] It's important to use a human-readable, persistent identifier. Using a transient identifier format like `urn:oasis:names:tc:SAML:2.0:nameid-format:transient` will result in re-linking of accounts on every sign-in, which can be detrimental to authorization management. |
| `SessionNotOnOrAfter` | {% octicon "x" aria-label="Optional" %} | The date that {% data variables.product.product_name %} invalidates the associated session. After invalidation, the person must authenticate once again to access {% ifversion ghec %}your enterprise's resources{% elsif ghes %}{% data variables.location.product_location %}{% endif %}. For more information, see [Session duration and timeout](#session-duration-and-timeout). | | `SessionNotOnOrAfter` | {% octicon "x" aria-label="Optional" %} | The date that {% data variables.product.github %} invalidates the associated session. After invalidation, the person must authenticate once again to access {% ifversion ghec %}your enterprise's resources{% elsif ghes %}{% data variables.location.product_location %}{% endif %}. For more information, see [Session duration and timeout](#session-duration-and-timeout). |
| {% ifversion ghes %} | | {% ifversion ghes %} |
| `administrator` | {% octicon "x" aria-label="Optional" %} | When the value is `true`, {% data variables.product.product_name %} will automatically promote the user to be a {% ifversion ghes %}site administrator{% endif %}. Setting this attribute to anything but `true` will result in demotion, as long as the value is not blank. Omitting this attribute or leaving the value blank will not change the role of the user. | | `administrator` | {% octicon "x" aria-label="Optional" %} | When the value is `true`, {% data variables.product.github %} will automatically promote the user to be a {% ifversion ghes %}site administrator{% endif %}. Setting this attribute to anything but `true` will result in demotion, as long as the value is not blank. Omitting this attribute or leaving the value blank will not change the role of the user. |
| `username` | {% octicon "x" aria-label="Optional" %} | The username for {% data variables.location.product_location %}. | | `username` | {% octicon "x" aria-label="Optional" %} | The username for {% data variables.location.product_location %}. |
| {% endif %} | | {% endif %} |
| `full_name` | {% octicon "x" aria-label="Optional" %} | {% ifversion ghec %}If you configure SAML SSO for an enterprise and you use {% data variables.product.prodname_emus %}, the{% else %}The{% endif %} full name of the user to display on the user's profile page. | | `full_name` | {% octicon "x" aria-label="Optional" %} | {% ifversion ghec %}If you configure SAML SSO for an enterprise and you use {% data variables.product.prodname_emus %}, the{% else %}The{% endif %} full name of the user to display on the user's profile page. |
@@ -98,10 +98,10 @@ To specify more than one value for an attribute, use multiple `<saml2:AttributeV
## SAML response requirements ## SAML response requirements
{% data variables.product.product_name %} requires that the response message from your IdP fulfill the following requirements. {% data variables.product.github %} requires that the response message from your IdP fulfill the following requirements.
* Your IdP must provide the `<Destination>` element on the root response document and match the ACS URL only when the root response document is signed. If your IdP signs the assertion, {% data variables.product.product_name %} will ignore the assertion. * Your IdP must provide the `<Destination>` element on the root response document and match the ACS URL only when the root response document is signed. If your IdP signs the assertion, {% data variables.product.github %} will ignore the assertion.
* Your IdP must always provide the `<Audience>` element as part of the `<AudienceRestriction>` element. The value must match your `EntityId` for {% data variables.product.product_name %}.{% ifversion ghes %} This value is the URL where you access {% data variables.product.github %}, such as `http(s)://HOSTNAME`.{% endif %} * Your IdP must always provide the `<Audience>` element as part of the `<AudienceRestriction>` element. The value must match your `EntityId` for {% data variables.product.github %}.{% ifversion ghes %} This value is the URL where you access {% data variables.product.github %}, such as `http(s)://HOSTNAME`.{% endif %}
{%- ifversion ghec %} {%- ifversion ghec %}
* If you configure SAML for an organization, this value is `https://github.com/orgs/ORGANIZATION`. * If you configure SAML for an organization, this value is `https://github.com/orgs/ORGANIZATION`.
@@ -161,13 +161,13 @@ sudo nomad run -hcl1 /etc/nomad-jobs/github/unicorn.hcl
## Session duration and timeout ## Session duration and timeout
To prevent a person from authenticating with your IdP and staying authorized indefinitely, {% data variables.product.product_name %} periodically invalidates the session for each user account with access to {% ifversion ghec %}your enterprise's resources{% elsif ghes %}{% data variables.location.product_location %}{% endif %}. After invalidation, the person must authenticate with your IdP once again. To prevent a person from authenticating with your IdP and staying authorized indefinitely, {% data variables.product.github %} periodically invalidates the session for each user account with access to {% ifversion ghec %}your enterprise's resources{% elsif ghes %}{% data variables.location.product_location %}{% endif %}. After invalidation, the person must authenticate with your IdP once again.
By default, if your IdP does not assert a value for the `SessionNotOnOrAfter` attribute, {% data variables.product.product_name %} invalidates a session {% ifversion ghec %}24 hours{% elsif ghes %}one week{% endif %} after successful authentication with your IdP. By default, if your IdP does not assert a value for the `SessionNotOnOrAfter` attribute, {% data variables.product.github %} invalidates a session {% ifversion ghec %}24 hours{% elsif ghes %}one week{% endif %} after successful authentication with your IdP.
{% data variables.product.product_name %} will support a customized session duration if your IdP provides the option to configure a `SessionNotOnOrAfter` attribute and value{% ifversion ghes %}, and if this attribute is included in SAML responses. If your IdP does not allow a `SessionNotOnOrAfter` attribute, a site administrator can configure a custom SAML session timeout for all users on your instance by using the `ghe-config saml.default-session-expiration [seconds]` command in the administrative shell{% endif %}. {% data variables.product.github %} will support a customized session duration if your IdP provides the option to configure a `SessionNotOnOrAfter` attribute and value{% ifversion ghes %}, and if this attribute is included in SAML responses. If your IdP does not allow a `SessionNotOnOrAfter` attribute, a site administrator can configure a custom SAML session timeout for all users on your instance by using the `ghe-config saml.default-session-expiration [seconds]` command in the administrative shell{% endif %}.
If you define a customized session duration value less than 24 hours, {% data variables.product.product_name %} may prompt people to authenticate every time {% data variables.product.product_name %} initiates a redirect. If you define a customized session duration value less than 24 hours, {% data variables.product.github %} may prompt people to authenticate every time {% data variables.product.github %} initiates a redirect.
{% data reusables.enterprise.ghes-user-inactivity-timeout %} {% data reusables.enterprise.ghes-user-inactivity-timeout %}
@@ -175,4 +175,4 @@ If you define a customized session duration value less than 24 hours, {% data va
To prevent authentication errors, we recommend a minimum session duration of 4 hours. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/troubleshooting-saml-authentication#users-are-repeatedly-redirected-to-authenticate). To prevent authentication errors, we recommend a minimum session duration of 4 hours. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/troubleshooting-saml-authentication#users-are-repeatedly-redirected-to-authenticate).
{% endif %} {% endif %}
>[!NOTE] For Microsoft Entra ID (previously known as Azure AD), the configurable lifetime policy for SAML tokens does not control session timeout for {% data variables.product.product_name %}. >[!NOTE] For Microsoft Entra ID (previously known as Azure AD), the configurable lifetime policy for SAML tokens does not control session timeout for {% data variables.product.github %}.

View File

@@ -1,7 +1,7 @@
--- ---
title: Username considerations for external authentication title: Username considerations for external authentication
shortTitle: Username considerations shortTitle: Username considerations
intro: '{% ifversion ghes or ghec %}When you use {% ifversion ghes %}CAS, LDAP, or SAML for authentication{% elsif ghec %}{% data variables.product.prodname_emus %}{% endif %}, {% endif %}{% data variables.product.product_name %} follows certain rules to determine the username for each user account {% ifversion ghec %}in your enterprise{% elsif ghes %}on your instance{% endif %}.' intro: '{% ifversion ghes or ghec %}When you use {% ifversion ghes %}CAS, LDAP, or SAML for authentication{% elsif ghec %}{% data variables.product.prodname_emus %}{% endif %}, {% endif %}{% data variables.product.github %} follows certain rules to determine the username for each user account {% ifversion ghec %}in your enterprise{% elsif ghes %}on your instance{% endif %}.'
versions: versions:
ghec: '*' ghec: '*'
ghes: '*' ghes: '*'
@@ -29,7 +29,7 @@ redirect_from:
{% ifversion ghes %} {% ifversion ghes %}
You can configure external authentication for {% data variables.product.product_name %} using CAS, LDAP, or SAML. For more information, see [AUTOTITLE](/admin/identity-and-access-management/managing-iam-for-your-enterprise/about-authentication-for-your-enterprise#authentication-methods-for-github-enterprise-server). You can configure external authentication for {% data variables.product.prodname_ghe_server %} using CAS, LDAP, or SAML. For more information, see [AUTOTITLE](/admin/identity-and-access-management/managing-iam-for-your-enterprise/about-authentication-for-your-enterprise#authentication-methods-for-github-enterprise-server).
When you use external authentication, {% data variables.location.product_location %} automatically creates a username for each person when the person signs into {% data variables.location.product_location %} through your external authentication system for the first time. When you use external authentication, {% data variables.location.product_location %} automatically creates a username for each person when the person signs into {% data variables.location.product_location %} through your external authentication system for the first time.
@@ -99,18 +99,18 @@ Usernames{% ifversion ghec %}, including underscore and short code,{% endif %} m
Usernames for user accounts on {% data variables.product.prodname_dotcom %} can only contain alphanumeric characters and dashes (`-`). Usernames for user accounts on {% data variables.product.prodname_dotcom %} can only contain alphanumeric characters and dashes (`-`).
{% ifversion ghec %} {% ifversion ghec %}
When you configure SAML authentication, {% data variables.product.product_name %} uses the SCIM `userName` attribute value sent from the IdP to determine the username for the corresponding user account on {% data variables.product.prodname_dotcom %}. If this value includes unsupported characters, {% data variables.product.product_name %} will normalize the username per the following rules. When you configure SAML authentication, {% data variables.product.github %} uses the SCIM `userName` attribute value sent from the IdP to determine the username for the corresponding user account on {% data variables.product.prodname_dotcom %}. If this value includes unsupported characters, {% data variables.product.github %} will normalize the username per the following rules.
{% elsif ghes %} {% elsif ghes %}
When you configure CAS, LDAP, or SAML authentication, {% data variables.product.product_name %} uses an identifier from the user account on your external authentication provider to determine the username for the corresponding user account on {% data variables.product.product_name %}. If the identifier includes unsupported characters, {% data variables.product.product_name %} will normalize the username per the following rules. When you configure CAS, LDAP, or SAML authentication, {% data variables.product.prodname_ghe_server %} uses an identifier from the user account on your external authentication provider to determine the username for the corresponding user account on your {% data variables.product.prodname_ghe_server %} instance. If the identifier includes unsupported characters, {% data variables.product.github %} will normalize the username per the following rules.
{% endif %} {% endif %}
1. {% data variables.product.product_name %} will normalize any non-alphanumeric character in your account's username into a dash. For example, a username of `mona.the.octocat` will be normalized to `mona-the-octocat`. Note that normalized usernames also can't start or end with a dash. They also can't contain two consecutive dashes. 1. {% data variables.product.github %} will normalize any non-alphanumeric character in your account's username into a dash. For example, a username of `mona.the.octocat` will be normalized to `mona-the-octocat`. Note that normalized usernames also can't start or end with a dash. They also can't contain two consecutive dashes.
1. Usernames created from email addresses are created from the normalized characters that precede the `@` character. 1. Usernames created from email addresses are created from the normalized characters that precede the `@` character.
1. Usernames created from domain accounts are created from the normalized characters after the `\\` separator. 1. Usernames created from domain accounts are created from the normalized characters after the `\\` separator.
1. If multiple accounts are normalized into the same {% data variables.product.product_name %} username, only the first user account is created. Subsequent users with the same username won't be able to sign in. {% ifversion ghec %}For more information, see [Resolving username problems](#resolving-username-problems).{% endif %} 1. If multiple accounts are normalized into the same username, only the first user account is created. Subsequent users with the same username won't be able to sign in. {% ifversion ghec %}For more information, see [Resolving username problems](#resolving-username-problems).{% endif %}
### Examples of username normalization ### Examples of username normalization
@@ -128,16 +128,16 @@ When you configure CAS, LDAP, or SAML authentication, {% data variables.product.
### About username normalization with SAML ### About username normalization with SAML
{% ifversion ghes %}If you configure SAML authentication for {% data variables.location.product_location %}, {% endif %}{% data variables.product.product_name %} determines each person's username by one of the following assertions in the SAML response, ordered by descending priority. {% ifversion ghes %}If you configure SAML authentication for {% data variables.location.product_location %}, {% endif %}{% data variables.product.github %} determines each person's username by one of the following assertions in the SAML response, ordered by descending priority.
1. The custom `username` attribute, if defined and present 1. The custom `username` attribute, if defined and present
1. An `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` assertion, if present 1. An `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` assertion, if present
1. An `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` assertion, if present 1. An `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` assertion, if present
1. The `NameID` element 1. The `NameID` element
{% data variables.product.product_name %} requires the `NameID` element even if other attributes are present. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/saml-configuration-reference#saml-attributes). {% data variables.product.github %} requires the `NameID` element even if other attributes are present. For more information, see [AUTOTITLE](/admin/identity-and-access-management/using-saml-for-enterprise-iam/saml-configuration-reference#saml-attributes).
{% data variables.product.product_name %} creates a mapping between the `NameID` from the IdP and the username on {% data variables.location.product_location %}, so the `NameID` should be persistent, unique, and not subject to change for the lifecycle of the user. {% data variables.product.github %} creates a mapping between the `NameID` from the IdP and the username on {% data variables.location.product_location %}, so the `NameID` should be persistent, unique, and not subject to change for the lifecycle of the user.
{% ifversion ghes %} {% ifversion ghes %}

View File

@@ -1,6 +1,6 @@
--- ---
title: Identity and access management title: Identity and access management
intro: 'You can configure how people access {% ifversion ghec %}your enterprise on {% data variables.product.product_name %}{% elsif ghes %}{% data variables.location.product_location %}{% endif %}.' intro: 'Configure how people access your enterprise.'
redirect_from: redirect_from:
- /enterprise/admin/authentication - /enterprise/admin/authentication
- /admin/authentication - /admin/authentication

View File

@@ -1,7 +1,7 @@
--- ---
title: Accessing your enterprise account if your identity provider is unavailable title: Accessing your enterprise account if your identity provider is unavailable
shortTitle: Access your enterprise account shortTitle: Access your enterprise account
intro: 'You can sign into {% data variables.product.product_name %} even if your identity provider is unavailable by bypassing single sign-on (SSO) with a recovery code.' intro: 'You can sign into {% data variables.product.github %} even if your identity provider is unavailable by bypassing single sign-on (SSO) with a recovery code.'
versions: versions:
ghec: '*' ghec: '*'
type: how_to type: how_to