jprdonnelly/docs
1
0
Fork 0
mirror of synced 2025-12-19 18:10:59 -05:00
Code Issues Projects Releases Wiki Activity

Deprecate GHES 3.3 (#34328)

Browse Source 
Co-authored-by: Felicity Chapman <felicitymay@github.com>
Co-authored-by: Matt Pollard <mattpollard@users.noreply.github.com>
Co-authored-by: Sam Browning <106113886+sabrowning1@users.noreply.github.com>
This commit is contained in:
Kevin Heis
2023-02-03 09:05:11 -08:00
committed by GitHub
parent 6748ab45c9
commit ac2cd0e47d
155 changed files with 222 additions and 542213 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
content/account-and-profile/managing-subscriptions-and-notifications-on-github/managing-subscriptions-for-activity-on-github/managing-your-subscriptions.md
View File

@@ -72,7 +72,7 @@ When you unwatch a repository, you unsubscribe from future updates from that rep
- Ignore all notifications for a repository
- If enabled, customize the types of event you receive notifications for ({% data reusables.notifications-v2.custom-notification-types %})
{%- ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{%- ifversion fpt or ghec or ghes or ghae > 3.3 %}
1. Optionally, to unsubscribe from all repositories owned by a given user or organization, select the **Unwatch all** dropdown and click the organization whose repositories you'd like to unsubscribe from. The button to unwatch all repositories is only available if you are watching all activity or custom notifications on over 10 repositories.
![Screenshot of the Unwatch All button.](/assets/images/help/notifications-v2/unsubscribe-from-all-repos.png)

7
content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md
View File

@@ -89,8 +89,6 @@ For conversations you're watching or participating in, you can choose whether yo
![Screenshot of participating and watching notifications options](/assets/images/help/notifications-v2/participating-and-watching-options.png){% endif %}
For example:
- If you don't want notifications to be sent to your email, unselect **email** for participating and watching notifications.
- If you want to receive notifications by email when you've participated in a conversation, then you can select **email** under "Participating".
@@ -153,7 +151,7 @@ Email notifications from {% data variables.location.product_location %} contain
- There are updates in repositories or team discussions you're watching or in a conversation you're participating in. For more information, see "[About participating and watching notifications](#about-participating-and-watching-notifications)."
- You gain access to a new repository or you've joined a new team. For more information, see "[Automatic watching](#automatic-watching)."
- There are new {% data variables.product.prodname_dependabot_alerts %} in your repository. For more information, see "[{% data variables.product.prodname_dependabot_alerts %} notification options](#dependabot-alerts-notification-options)." {% ifversion fpt or ghec %}
- There are workflow runs updates on repositories set up with {% data variables.product.prodname_actions %}. For more information, see "[{% data variables.product.prodname_actions %} notification options](#github-actions-notification-options)."{% endif %}{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
- There are workflow runs updates on repositories set up with {% data variables.product.prodname_actions %}. For more information, see "[{% data variables.product.prodname_actions %} notification options](#github-actions-notification-options)."{% endif %}{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
- There are new deploy keys added to repositories that belong to organizations that you're an owner of. For more information, see "[Organization alerts notification options](#organization-alerts-notification-options)."{% endif %}
## Automatic watching
@@ -256,8 +254,7 @@ Choose how you want to receive workflow run updates for repositories that you ar
{% ifversion ghes %}
![Screenshot of the notification options for {% data variables.product.prodname_actions %}](/assets/images/help/notifications-v2/github-actions-notification-options.png){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
## Organization alerts notification options
If you're an organization owner, you'll receive email notifications by default when organization members add new deploy keys to repositories within the organization. You can unsubscribe from these notifications. On the notification settings page, under "Organization alerts", unselect **Email**.

2
content/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/about-your-organizations-profile.md
View File

@@ -16,7 +16,7 @@ topics:
shortTitle: Organization's profile
---
You can optionally choose to add a description, location, website, and email address for your organization, and pin important repositories.{% ifversion fpt or ghec or ghes > 3.3 %} You can customize your organization's public profile by adding a README.md file. For more information, see "[Customizing your organization's profile](/organizations/collaborating-with-groups-in-organizations/customizing-your-organizations-profile)."{% endif %}
You can optionally choose to add a description, location, website, and email address for your organization, and pin important repositories.{% ifversion fpt or ghec or ghes %} You can customize your organization's public profile by adding a README.md file. For more information, see "[Customizing your organization's profile](/organizations/collaborating-with-groups-in-organizations/customizing-your-organizations-profile)."{% endif %}
{% ifversion fpt %}
Organizations that use {% data variables.product.prodname_ghe_cloud %} can confirm their organization's identity and display a "Verified" badge on their organization's profile page by verifying the organization's domains with {% data variables.product.product_name %}. For more information, see "[Verifying or approving a domain for your organization](/organizations/managing-organization-settings/verifying-or-approving-a-domain-for-your-organization)" in the {% data variables.product.prodname_ghe_cloud %} documentation.

2
content/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-personal-account-settings/managing-your-tab-size-rendering-preference.md
View File

@@ -4,7 +4,7 @@ intro: You can manage the number of spaces a tab is equal to for your personal a
versions:
fpt: '*'
ghae: '>= 3.4'
ghes: '>=3.4'
ghes: '*'
ghec: '*'
topics:
- Accounts

6
content/actions/creating-actions/creating-a-javascript-action.md
View File

@@ -37,9 +37,9 @@ Once you complete this project, you should understand how to build your own Java
Before you begin, you'll need to download Node.js and create a public {% data variables.product.prodname_dotcom %} repository.
1. Download and install Node.js {% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}16.x{% else %}12.x{% endif %}, which includes npm.
1. Download and install Node.js {% ifversion fpt or ghes or ghae > 3.3 or ghec %}16.x{% else %}12.x{% endif %}, which includes npm.
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}https://nodejs.org/en/download/{% else %}https://nodejs.org/en/download/releases/{% endif %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}https://nodejs.org/en/download/{% else %}https://nodejs.org/en/download/releases/{% endif %}
1. Create a new public repository on {% data variables.location.product_location %} and call it "hello-world-javascript-action". For more information, see "[Create a new repository](/articles/creating-a-new-repository)."
@@ -73,7 +73,7 @@ outputs:
time: # id of output
description: 'The time we greeted you'
runs:
using: {% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}'node16'{% else %}'node12'{% endif %}
using: {% ifversion fpt or ghes or ghae > 3.3 or ghec %}'node16'{% else %}'node12'{% endif %}
main: 'index.js'
```

12
content/actions/creating-actions/metadata-syntax-for-github-actions.md
View File

@@ -149,11 +149,11 @@ For more information on how to use context syntax, see "[Contexts](/actions/lear
**Required** Configures the path to the action's code and the runtime used to execute the code.
### Example: Using Node.js {% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}v16{% else %}v12{% endif %}
### Example: Using Node.js {% ifversion fpt or ghes or ghae > 3.3 or ghec %}v16{% else %}v12{% endif %}
```yaml
runs:
using: {% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}'node16'{% else %}'node12'{% endif %}
using: {% ifversion fpt or ghes or ghae > 3.3 or ghec %}'node16'{% else %}'node12'{% endif %}
main: 'main.js'
```
@@ -161,7 +161,7 @@ runs:
**Required** The runtime used to execute the code specified in [`main`](#runsmain).
- Use `node12` for Node.js v12.{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
- Use `node12` for Node.js v12.{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
- Use `node16` for Node.js v16.{% endif %}
### `runs.main`
@@ -176,7 +176,7 @@ In this example, the `pre:` action runs a script called `setup.js`:
```yaml
runs:
using: {% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}'node16'{% else %}'node12'{% endif %}
using: {% ifversion fpt or ghes or ghae > 3.3 or ghec %}'node16'{% else %}'node12'{% endif %}
pre: 'setup.js'
main: 'index.js'
post: 'cleanup.js'
@@ -203,7 +203,7 @@ In this example, the `post:` action runs a script called `cleanup.js`:
```yaml
runs:
using: {% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}'node16'{% else %}'node12'{% endif %}
using: {% ifversion fpt or ghes or ghae > 3.3 or ghec %}'node16'{% else %}'node12'{% endif %}
main: 'index.js'
post: 'cleanup.js'
```
@@ -263,7 +263,7 @@ For more information, see "[`github context`](/actions/reference/context-and-exp
**Optional** The shell where you want to run the command. You can use any of the shells listed [here](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsshell). Required if `run` is set.
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
#### `runs.steps[*].if`
**Optional** You can use the `if` conditional to prevent a step from running unless a condition is met. You can use any supported context and expression to create a conditional.

2
content/actions/deployment/managing-your-deployments/viewing-deployment-history.md
View File

@@ -15,7 +15,7 @@ redirect_from:
---
You can deliver deployments through {% data variables.product.prodname_actions %} and environments or with the REST API and third party apps. {% ifversion fpt or ghae ghes > 3.0 or ghec %}For more information about using environments to deploy with {% data variables.product.prodname_actions %}, see "[Using environments for deployment](/actions/deployment/using-environments-for-deployment)." {% endif %}For more information about deployments with the REST API, see "[Repositories](/rest/reference/repos#deployments)."
You can deliver deployments through {% data variables.product.prodname_actions %} and environments or with the REST API and third party apps. For more information about using environments to deploy with {% data variables.product.prodname_actions %}, see "[Using environments for deployment](/actions/deployment/using-environments-for-deployment)." For more information about deployments with the REST API, see "[Repositories](/rest/reference/repos#deployments)."
To view current and past deployments, click **Environments** on the home page of your repository.
{% ifversion ghae %}

19
content/actions/hosting-your-own-runners/adding-self-hosted-runners.md
View File

@@ -46,18 +46,12 @@ You can set up automation to scale the number of self-hosted runners. For more i
You can add self-hosted runners to a single repository. To add a self-hosted runner to a user repository, you must be the repository owner. For an organization repository, you must be an organization owner or have admin access to the repository. For information about how to add a self-hosted runner with the REST API, see "[Self-hosted runners](/rest/reference/actions#self-hosted-runners)."
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
{% data reusables.repositories.navigate-to-repo %}
{% data reusables.repositories.sidebar-settings %}
{% data reusables.repositories.settings-sidebar-actions-runners %}
1. Click **New self-hosted runner**.
{% data reusables.actions.self-hosted-runner-configure %}
{% elsif ghae or ghes < 3.4 %}
{% data reusables.repositories.navigate-to-repo %}
{% data reusables.repositories.sidebar-settings %}
{% data reusables.repositories.settings-sidebar-actions-runners %}
1. Under {% ifversion ghes or ghae or ghec %}"Runners"{% else %}"Self-hosted runners"{% endif %}, click **Add runner**.
{% data reusables.actions.self-hosted-runner-configure %}
{% endif %}
{% data reusables.actions.self-hosted-runner-check-installation-success %}
@@ -67,19 +61,14 @@ For more information, see "[Monitoring and troubleshooting self-hosted runners](
You can add self-hosted runners at the organization level, where they can be used to process jobs for multiple repositories in an organization. To add a self-hosted runner to an organization, you must be an organization owner. For information about how to add a self-hosted runner with the REST API, see "[Self-hosted runners](/rest/reference/actions#self-hosted-runners)."
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
{% data reusables.organizations.navigate-to-org %}
{% data reusables.organizations.org_settings %}
{% data reusables.organizations.settings-sidebar-actions-runners %}
{% ifversion actions-hosted-runners %}1. Click **New runner**, then click **New self-hosted runner**.{% else %}1. Click **New runner**.{% endif %}
{% data reusables.actions.self-hosted-runner-configure %}
{% elsif ghae or ghes < 3.4 %}
{% data reusables.organizations.navigate-to-org %}
{% data reusables.organizations.org_settings %}
{% data reusables.organizations.settings-sidebar-actions-runners %}
1. Under {% ifversion ghes or ghae %}"Runners", click **Add new**, then click **New runner**.{% endif %}
{% data reusables.actions.self-hosted-runner-configure %}
{% endif %}
{% data reusables.actions.self-hosted-runner-configure %}
{% data reusables.actions.self-hosted-runner-check-installation-success %}
For more information, see "[Monitoring and troubleshooting self-hosted runners](/actions/hosting-your-own-runners/monitoring-and-troubleshooting-self-hosted-runners)."
@@ -93,7 +82,7 @@ For more information, see "[Monitoring and troubleshooting self-hosted runners](
{% ifversion ghec or ghes or ghae %}
New runners are assigned to the default group. You can modify the runner's group after you've registered the runner. For more information, see "[Managing access to self-hosted runners](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group)."
{% ifversion ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion ghec or ghes or ghae > 3.3 %}
To add a self-hosted runner to an enterprise, you must be an enterprise owner. For information about how to add a self-hosted runner with the REST API, see the enterprise endpoints in the [{% data variables.product.prodname_actions %} REST API](/rest/reference/actions#self-hosted-runners).

22
content/actions/hosting-your-own-runners/removing-self-hosted-runners.md
View File

@@ -29,17 +29,12 @@ shortTitle: Remove self-hosted runners
To remove a self-hosted runner from a user repository you must be the repository owner. For an organization repository, you must be an organization owner or have admin access to the repository. We recommend that you also have access to the self-hosted runner machine. For information about how to remove a self-hosted runner with the REST API, see "[Self-hosted runners](/rest/reference/actions#self-hosted-runners)."
{% data reusables.actions.self-hosted-runner-reusing %}
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
{% data reusables.repositories.navigate-to-repo %}
{% data reusables.repositories.sidebar-settings %}
{% data reusables.repositories.settings-sidebar-actions-runners %}
{% data reusables.actions.settings-sidebar-actions-runner-selection %}
{% data reusables.actions.self-hosted-runner-removing-a-runner-updated %}
{% elsif ghae or ghes < 3.4 %}
{% data reusables.repositories.navigate-to-repo %}
{% data reusables.repositories.sidebar-settings %}
{% data reusables.repositories.settings-sidebar-actions-runners %}
{% data reusables.actions.self-hosted-runner-removing-a-runner %}
{% endif %}
## Removing a runner from an organization
@@ -55,18 +50,11 @@ To remove a self-hosted runner from a user repository you must be the repository
To remove a self-hosted runner from an organization, you must be an organization owner. We recommend that you also have access to the self-hosted runner machine. For information about how to remove a self-hosted runner with the REST API, see "[Self-hosted runners](/rest/reference/actions#self-hosted-runners)."
{% data reusables.actions.self-hosted-runner-reusing %}
{% ifversion fpt or ghes > 3.3 or ghec %}
{% data reusables.organizations.navigate-to-org %}
{% data reusables.organizations.org_settings %}
{% data reusables.organizations.settings-sidebar-actions-runners %}
{% data reusables.actions.settings-sidebar-actions-runner-selection %}
{% data reusables.actions.self-hosted-runner-removing-a-runner-updated %}
{% elsif ghes < 3.4 or ghae %}
{% data reusables.organizations.navigate-to-org %}
{% data reusables.organizations.org_settings %}
{% data reusables.organizations.settings-sidebar-actions-runners %}
{% data reusables.actions.self-hosted-runner-removing-a-runner %}
{% endif %}
## Removing a runner from an enterprise
@@ -85,18 +73,12 @@ If you use {% data variables.product.prodname_ghe_cloud %}, you can also remove
To remove a self-hosted runner from an enterprise, you must be an enterprise owner. We recommend that you also have access to the self-hosted runner machine. For information about how to remove a self-hosted runner with the REST API, see the enterprise endpoints in the [{% data variables.product.prodname_actions %} REST API](/rest/reference/actions#self-hosted-runners).
{% data reusables.actions.self-hosted-runner-reusing %}
{% ifversion ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion ghec or ghes or ghae > 3.3 %}
{% data reusables.enterprise-accounts.access-enterprise %}
{% data reusables.enterprise-accounts.policies-tab %}
{% data reusables.enterprise-accounts.actions-tab %}
{% data reusables.enterprise-accounts.actions-runners-tab %}
{% data reusables.actions.settings-sidebar-actions-runner-selection %}
{% data reusables.actions.self-hosted-runner-removing-a-runner-updated %}
{% elsif ghae or ghes < 3.4 %}
{% data reusables.enterprise-accounts.access-enterprise %}
{% data reusables.enterprise-accounts.policies-tab %}
{% data reusables.enterprise-accounts.actions-tab %}
{% data reusables.enterprise-accounts.actions-runners-tab %}
{% data reusables.actions.self-hosted-runner-removing-a-runner %}
{% endif %}
{% endif %}

27
content/actions/hosting-your-own-runners/using-labels-with-self-hosted-runners.md
View File

@@ -19,51 +19,30 @@ For information on how to use labels to route jobs to specific types of self-hos
## Creating a custom label
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
{% data reusables.actions.self-hosted-runner-navigate-to-repo-org-enterprise %}
{% data reusables.actions.settings-sidebar-actions-runner-selection %}
1. In the "Labels" section, click {% octicon "gear" aria-label="The Gear icon" %}.
1. In the "Find or create a label" field, type the name of your new label and click **Create new label**.
The custom label is created and assigned to the self-hosted runner. Custom labels can be removed from self-hosted runners, but they currently can't be manually deleted. {% data reusables.actions.actions-unused-labels %}
{% elsif ghae or ghes < 3.4 %}
{% data reusables.actions.self-hosted-runner-navigate-to-repo-org-enterprise %}
{% data reusables.actions.self-hosted-runner-list %}
{% data reusables.actions.self-hosted-runner-list-group %}
{% data reusables.actions.self-hosted-runner-labels-view-assigned-labels %}
1. In the "Filter labels" field, type the name of your new label, and click **Create new label**.
![Add runner label](/assets/images/help/settings/actions-add-runner-label.png)
The custom label is created and assigned to the self-hosted runner. Custom labels can be removed from self-hosted runners, but they currently can't be manually deleted. {% data reusables.actions.actions-unused-labels %}
{% endif %}
## Assigning a label to a self-hosted runner
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
{% data reusables.actions.self-hosted-runner-navigate-to-repo-org-enterprise %}
{% data reusables.actions.settings-sidebar-actions-runner-selection %}
{% data reusables.actions.runner-label-settings %}
1. To assign a label to your self-hosted runner, in the "Find or create a label" field, click the label.
{% elsif ghae or ghes < 3.4 %}
{% data reusables.actions.self-hosted-runner-navigate-to-repo-org-enterprise %}
{% data reusables.actions.self-hosted-runner-list %}
{% data reusables.actions.self-hosted-runner-list-group %}
{% data reusables.actions.self-hosted-runner-labels-view-assigned-labels %}
1. Click on a label to assign it to your self-hosted runner.
{% endif %}
## Removing a custom label from a self-hosted runner
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
{% data reusables.actions.self-hosted-runner-navigate-to-repo-org-enterprise %}
{% data reusables.actions.settings-sidebar-actions-runner-selection %}
{% data reusables.actions.runner-label-settings %}
1. In the "Find or create a label" field, assigned labels are marked with the {% octicon "check" aria-label="The Check icon" %} icon. Click on a marked label to unassign it from your self-hosted runner.
{% elsif ghae or ghes < 3.4 %}
{% data reusables.actions.self-hosted-runner-navigate-to-repo-org-enterprise %}
{% data reusables.actions.self-hosted-runner-list %}
{% data reusables.actions.self-hosted-runner-list-group %}
{% data reusables.actions.self-hosted-runner-labels-view-assigned-labels %}
1. Click on the assigned label to remove it from your self-hosted runner. {% data reusables.actions.actions-unused-labels %}
{% endif %}
## Programmatically assign labels

15
content/actions/hosting-your-own-runners/using-self-hosted-runners-in-a-workflow.md
View File

@@ -97,22 +97,7 @@ These labels operate cumulatively, so a self-hosted runner must have all four la
When routing a job to a self-hosted runner, {% data variables.product.prodname_dotcom %} looks for a runner that matches the job's `runs-on` labels{% ifversion target-runner-groups %} and/or groups{% endif %}:
{% ifversion fpt or ghes > 3.3 or ghae or ghec %}
- If {% data variables.product.prodname_dotcom %} finds an online and idle runner that matches the job's `runs-on` labels{% ifversion target-runner-groups %} and/or groups{% endif %}, the job is then assigned and sent to the runner.
- If the runner doesn't pick up the assigned job within 60 seconds, the job is re-queued so that a new runner can accept it.
- If {% data variables.product.prodname_dotcom %} doesn't find an online and idle runner that matches the job's `runs-on` labels {% ifversion target-runner-groups %} and/or groups{% endif %}, then the job will remain queued until a runner comes online.
- If the job remains queued for more than 24 hours, the job will fail.
{% elsif ghes = 3.3 %}
- {% data variables.product.prodname_dotcom %} first searches for a runner at the repository level, then at the organization level, then at the enterprise level.
- If {% data variables.product.prodname_dotcom %} finds an online and idle runner at a certain level that matches the job's `runs-on` labels, the job is then assigned and sent to the runner.
- If the runner doesn't pick up the assigned job within 60 seconds, the job is queued at all levels and waits for a matching runner from any level to come online and pick up the job.
- If {% data variables.product.prodname_dotcom %} doesn't find an online and idle runner at any level, the job is queued to all levels and waits for a matching runner from any level to come online and pick up the job.
- If the job remains queued for more than 24 hours, the job will fail.
{% else %}
1. {% data variables.product.prodname_dotcom %} first searches for a runner at the repository level, then at the organization level, then at the enterprise level.
2. The job is then sent to the first matching runner that is online and idle.
- If all matching online runners are busy, the job will queue at the level with the highest number of matching online runners.
- If all matching runners are offline, the job will queue at the level with the highest number of matching offline runners.
- If there are no matching runners at any level, the job will fail.
- If the job remains queued for more than 24 hours, the job will fail.
{% endif %}

14
content/actions/learn-github-actions/contexts.md
View File

@@ -40,7 +40,7 @@ You can access contexts using the expression syntax. For more information, see "
{%- ifversion actions-configuration-variables %}
| `vars` | `object` | Contains variables set at the repository, organization, or environment levels. For more information, see [`vars` context](#vars-context). |{% endif %}
| `job` | `object` | Information about the currently running job. For more information, see [`job` context](#job-context). |
{%- ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{%- ifversion fpt or ghes or ghae > 3.3 or ghec %}
| `jobs` | `object` | For reusable workflows only, contains outputs of jobs from the reusable workflow. For more information, see [`jobs` context](#jobs-context). |{% endif %}
| `steps` | `object` | Information about the steps that have been run in the current job. For more information, see [`steps` context](#steps-context). |
| `runner` | `object` | Information about the runner that is running the current job. For more information, see [`runner` context](#runner-context). |
@@ -48,7 +48,7 @@ You can access contexts using the expression syntax. For more information, see "
| `strategy` | `object` | Information about the matrix execution strategy for the current job. For more information, see [`strategy` context](#strategy-context). |
| `matrix` | `object` | Contains the matrix properties defined in the workflow that apply to the current job. For more information, see [`matrix` context](#matrix-context). |
| `needs` | `object` | Contains the outputs of all jobs that are defined as a dependency of the current job. For more information, see [`needs` context](#needs-context). |
{%- ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{%- ifversion fpt or ghec or ghes or ghae > 3.3 %}
| `inputs` | `object` | Contains the inputs of a reusable {% ifversion actions-unified-inputs %}or manually triggered {% endif %}workflow. For more information, see [`inputs` context](#inputs-context). |{% endif %}
As part of an expression, you can access context information using one of two syntaxes.
@@ -72,7 +72,7 @@ In addition, some functions may only be used in certain places. For example, the
The following table indicates where each context and special function can be used within a workflow. Unless listed below, a function can be used anywhere.
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
| Workflow key | Context | Special functions |
| ---- | ------- | ----------------- |
@@ -208,7 +208,7 @@ The `github` context contains information about the workflow run and the event t
{%- endif %}
| `github.path` | `string` | Path on the runner to the file that sets system `PATH` variables from workflow commands. This file is unique to the current step and is a different file for each step in a job. For more information, see "[Workflow commands for {% data variables.product.prodname_actions %}](/actions/learn-github-actions/workflow-commands-for-github-actions#adding-a-system-path)." |
| `github.ref` | `string` | {% data reusables.actions.ref-description %} |
{%- ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{%- ifversion fpt or ghec or ghes or ghae > 3.3 %}
| `github.ref_name` | `string` | {% data reusables.actions.ref_name-description %} |
| `github.ref_protected` | `boolean` | {% data reusables.actions.ref_protected-description %} |
| `github.ref_type` | `string` | {% data reusables.actions.ref_type-description %} |
@@ -228,7 +228,7 @@ The `github` context contains information about the workflow run and the event t
{%- ifversion fpt or ghec or ghes > 3.5 or ghae > 3.4 %}
| `github.run_attempt` | `string` | A unique number for each attempt of a particular workflow run in a repository. This number begins at 1 for the workflow run's first attempt, and increments with each re-run. |
{%- endif %}
{%- ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{%- ifversion fpt or ghec or ghes or ghae > 3.3 %}
| `github.secret_source` | `string` | The source of a secret used in a workflow. Possible values are `None`, `Actions`, `Dependabot`, or `Codespaces`. |
{%- endif %}
| `github.server_url` | `string` | The URL of the GitHub server. For example: `https://github.com`. |
@@ -456,7 +456,7 @@ jobs:
- run: ./run-tests
```
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
## `jobs` context
@@ -848,7 +848,7 @@ jobs:
- run: ./debug
```
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
## `inputs` context
The `inputs` context contains input properties passed to an action{% ifversion actions-unified-inputs %},{% else %} or{% endif %} to a reusable workflow{% ifversion actions-unified-inputs %}, or to a manually triggered workflow{% endif %}. {% ifversion actions-unified-inputs %}For reusable workflows, the{% else %}The{% endif %} input names and types are defined in the [`workflow_call` event configuration](/actions/learn-github-actions/events-that-trigger-workflows#workflow-reuse-events) of a reusable workflow, and the input values are passed from [`jobs.<job_id>.with`](/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_idwith) in an external workflow that calls the reusable workflow. {% ifversion actions-unified-inputs %}For manually triggered workflows, the inputs are defined in the [`workflow_dispatch` event configuration](/actions/learn-github-actions/events-that-trigger-workflows#workflow_dispatch) of a workflow.{% endif %}

3
content/actions/learn-github-actions/expressions.md
View File

@@ -284,8 +284,7 @@ Creates a hash for any `package-lock.json` and `Gemfile.lock` files in the repos
`hashFiles('**/package-lock.json', '**/Gemfile.lock')`
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
## Status check functions
You can use the following status check functions as expressions in `if` conditionals. A default status check of `success()` is applied unless you include one of these functions. For more information about `if` conditionals, see "[Workflow syntax for GitHub Actions](/articles/workflow-syntax-for-github-actions/#jobsjob_idif)" and "[Metadata syntax for GitHub Composite Actions](/actions/creating-actions/metadata-syntax-for-github-actions/#runsstepsif)".

2
content/actions/learn-github-actions/understanding-github-actions.md
View File

@@ -53,7 +53,7 @@ You can configure a {% data variables.product.prodname_actions %} _workflow_ to
{% data reusables.actions.about-workflows-long %}
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}You can reference a workflow within another workflow, see "[Reusing workflows](/actions/learn-github-actions/reusing-workflows)."{% endif %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}You can reference a workflow within another workflow, see "[Reusing workflows](/actions/learn-github-actions/reusing-workflows)."{% endif %}
For more information about workflows, see "[Using workflows](/actions/using-workflows)."

3
content/actions/learn-github-actions/usage-limits-billing-and-administration.md
View File

@@ -26,7 +26,6 @@ shortTitle: Workflow billing & limits
GitHub Actions usage is free for {% data variables.product.prodname_ghe_server %} instances that use self-hosted runners. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners)."
{% endif %}
{% ifversion fpt or ghec %}
## Availability
@@ -85,7 +84,7 @@ Usage limits apply to self-hosted runners. For more information, see "[About sel
In addition to the usage limits, you must ensure that you use {% data variables.product.prodname_actions %} within the [GitHub Terms of Service](/free-pro-team@latest/github/site-policy/github-terms-of-service/). For more information on {% data variables.product.prodname_actions %}-specific terms, see the [GitHub Additional Product Terms](/free-pro-team@latest/github/site-policy/github-additional-product-terms#a-actions-usage).
{% endif %}
{% ifversion fpt or ghes > 3.3 or ghec %}
{% ifversion fpt or ghes or ghec %}
## Billing for reusable workflows
{% data reusables.actions.reusable-workflows-enterprise-beta %}

3
content/actions/learn-github-actions/variables.md
View File

@@ -212,7 +212,6 @@ In this modification of the earlier example, we've introduced an `if` conditiona
You will commonly use either the `env` or `github` context to access variable values in parts of the workflow that are processed before jobs are sent to runners.
| Context | Use case | Example |
| --- | --- | --- |
| `env` | Reference custom variables defined in the workflow. | <span style="white-space: nowrap;">{% raw %}`${{ env.MY_VARIABLE }}`{% endraw %}</span> |
@@ -255,7 +254,7 @@ We strongly recommend that actions use variables to access the filesystem rather
| `GITHUB_JOB` | The [job_id](/actions/reference/workflow-syntax-for-github-actions#jobsjob_id) of the current job. For example, `greeting_job`. |
| `GITHUB_PATH` | The path on the runner to the file that sets system `PATH` variables from workflow commands. This file is unique to the current step and changes for each step in a job. For example, `/home/runner/work/_temp/_runner_file_commands/add_path_899b9445-ad4a-400c-aa89-249f18632cf5`. For more information, see "[Workflow commands for {% data variables.product.prodname_actions %}](/actions/using-workflows/workflow-commands-for-github-actions#adding-a-system-path)." |
| `GITHUB_REF` | {% data reusables.actions.ref-description %} |
{%- ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{%- ifversion fpt or ghec or ghes or ghae > 3.3 %}
| `GITHUB_REF_NAME` | {% data reusables.actions.ref_name-description %} |
| `GITHUB_REF_PROTECTED` | {% data reusables.actions.ref_protected-description %} |
| `GITHUB_REF_TYPE` | {% data reusables.actions.ref_type-description %} |

2
content/actions/security-guides/encrypted-secrets.md
View File

@@ -224,7 +224,7 @@ You can check which access policies are being applied to a secret in your organi
* {% data reusables.actions.forked-secrets %}
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
* Secrets are not automatically passed to reusable workflows. For more information, see "[Reusing workflows](/actions/using-workflows/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow)."

2
content/actions/security-guides/security-hardening-for-github-actions.md
View File

@@ -187,7 +187,7 @@ You can help mitigate this risk by following these good practices:
Although pinning to a commit SHA is the most secure option, specifying a tag is more convenient and is widely used. If you’d like to specify a tag, then be sure that you trust the action's creators. The ‘Verified creator’ badge on {% data variables.product.prodname_marketplace %} is a useful signal, as it indicates that the action was written by a team whose identity has been verified by {% data variables.product.prodname_dotcom %}. Note that there is risk to this approach even if you trust the author, because a tag can be moved or deleted if a bad actor gains access to the repository storing the action.
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
## Reusing third-party workflows
The same principles described above for using third-party actions also apply to using third-party workflows. You can help mitigate the risks associated with reusing workflows by following the same good practices outlined above. For more information, see "[Reusing workflows](/actions/learn-github-actions/reusing-workflows)."

3
content/actions/using-workflows/about-workflows.md
View File

@@ -42,7 +42,6 @@ For more information, see "[Triggering a workflow](/actions/using-workflows/trig
Workflow are defined using YAML. For the full reference of the YAML syntax for authoring workflows, see "[Workflow syntax for GitHub Actions](/actions/using-workflows/workflow-syntax-for-github-actions#about-yaml-syntax-for-workflows)."
{% data reusables.actions.workflow-basic-example-and-explanation %}
For more on managing workflow runs, such as re-running, cancelling, or deleting a workflow run, see "[Managing workflow runs](/actions/managing-workflow-runs)."
@@ -195,7 +194,7 @@ To learn more about self-hosted runner labels, see "[Using labels with self-host
To learn more about {% data variables.product.prodname_dotcom %}-hosted runner labels, see "[Supported runners and hardware resources](/actions/using-github-hosted-runners/about-github-hosted-runners#supported-runners-and-hardware-resources)."
{% endif %}
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
### Reusing workflows
{% data reusables.actions.reusable-workflows %}
{% endif %}

2
content/actions/using-workflows/creating-starter-workflows-for-your-organization.md
View File

@@ -34,7 +34,7 @@ Starter workflows can be created by users with write access to the organization'
Starter workflows created by users can only be used to create workflows in public repositories. Organizations using {% data variables.product.prodname_ghe_cloud %} can also use starter workflows to create workflows in private repositories. For more information, see the [{% data variables.product.prodname_ghe_cloud %} documentation](/enterprise-cloud@latest/actions/learn-github-actions/creating-starter-workflows-for-your-organization).
{% endif %}
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
{% note %}
**Note:** To avoid duplication among starter workflows you can call reusable workflows from within a workflow. This can help make your workflows easier to maintain. For more information, see "[Reusing workflows](/actions/learn-github-actions/reusing-workflows)."

7
content/actions/using-workflows/events-that-trigger-workflows.md
View File

@@ -24,7 +24,6 @@ Workflow triggers are events that cause a workflow to run. For more information
Some events have multiple activity types. For these events, you can specify which activity types will trigger a workflow run. For more information about what each activity type means, see "[Webhook events and payloads](/developers/webhooks-and-events/webhook-events-and-payloads)." Note that not all webhook events trigger workflows.
{% ifversion fpt or ghec or ghes > 3.3 or ghae %}
### `branch_protection_rule`
| Webhook event payload | Activity types | `GITHUB_SHA` | `GITHUB_REF` |
@@ -49,8 +48,6 @@ on:
types: [created, deleted]
```
{% endif %}
### `check_run`
| Webhook event payload | Activity types | `GITHUB_SHA` | `GITHUB_REF` |
@@ -1242,7 +1239,7 @@ on:
types: [started]
```
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
### `workflow_call`
@@ -1278,7 +1275,7 @@ You can configure custom-defined input properties, default input values, and req
{% data reusables.actions.inputs-vs-github-event-inputs %}
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
This example defines inputs called `logLevel`, `tags`, and `environment`. You pass values for these inputs to the workflow when you run it. This workflow then prints the values to the log, using the {% ifversion actions-unified-inputs %}`inputs.logLevel`, `inputs.tags`, and `inputs.environment`{% else %}`github.event.inputs.logLevel`, `github.event.inputs.tags`, and `github.event.inputs.environment`{% endif %} context properties.
```yaml

2
content/actions/using-workflows/reusing-workflows.md
View File

@@ -8,7 +8,7 @@ miniTocMaxHeadingLevel: 3
versions:
fpt: '*'
ghec: '*'
ghes: '>=3.4'
ghes: '*'
ghae: '>= 3.4'
type: how_to
topics:

3
content/actions/using-workflows/sharing-workflows-secrets-and-runners-with-your-organization.md
View File

@@ -34,7 +34,7 @@ Your organization can share workflows by reusing the workflows exactly or by cre
{% data reusables.actions.internal-actions-summary %}
{% endif %}
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
### Reusing workflows
{% data reusables.actions.reusable-workflows %}
@@ -73,7 +73,6 @@ Organization admins can add their self-hosted runners to groups, and then create
For more information, see "[Managing access to self-hosted runners using groups](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups)."
## Next steps
To continue learning about {% data variables.product.prodname_actions %}, see "[Creating starter workflows for your organization](/actions/using-workflows/creating-starter-workflows-for-your-organization)."

2
content/actions/using-workflows/triggering-a-workflow.md
View File

@@ -120,7 +120,7 @@ You can use activity types and filters to further control when your workflow wil
{% data reusables.actions.workflow-dispatch-inputs %}
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
## Defining inputs, outputs, and secrets for reusable workflows
{% data reusables.actions.reusable-workflows-enterprise-beta %}

4
content/actions/using-workflows/workflow-syntax-for-github-actions.md
View File

@@ -69,7 +69,7 @@ run-name: Deploy to ${{ inputs.deploy_target }} by @${{ github.actor }}
{% data reusables.actions.workflows.section-triggering-a-workflow-schedule %}
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
## `on.workflow_call`
{% data reusables.actions.reusable-workflows-enterprise-beta %}
@@ -955,7 +955,7 @@ Additional Docker container resource options. For a list of options, see "[`dock
{% endwarning %}
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
## `jobs.<job_id>.uses`
{% data reusables.actions.reusable-workflows-enterprise-beta %}

10
content/admin/code-security/managing-github-advanced-security-for-your-enterprise/configuring-code-scanning-for-your-appliance.md
View File

@@ -87,14 +87,4 @@ If you don't want to use {% data variables.product.prodname_actions %}, you shou
The {% data variables.product.prodname_codeql_cli %} is a command-line tool that you use to analyze codebases on any machine, including a third-party CI/CD system. For more information, see "[Installing CodeQL CLI in your CI system](/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system)."
{% ifversion codeql-runner-supported %}
## Running {% data variables.product.prodname_code_scanning %} using the {% data variables.code-scanning.codeql_runner %}
{% data reusables.code-scanning.deprecation-codeql-runner %}
If you don't want to use {% data variables.product.prodname_actions %}, you can run {% data variables.product.prodname_code_scanning %} using the {% data variables.code-scanning.codeql_runner %}.
The {% data variables.code-scanning.codeql_runner %} is a command-line tool that you can add to your third-party CI/CD system. The tool runs {% data variables.product.prodname_codeql %} analysis on a checkout of a {% data variables.product.prodname_dotcom %} repository. For more information, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)."
{% endif %}

24
content/admin/configuration/configuring-your-enterprise/command-line-utilities.md
View File

@@ -44,11 +44,8 @@ $ ghe-announce -u
```
{% endif %}
{% ifversion ghes %}
You can also set an announcement banner using the enterprise settings on {% data variables.product.product_name %}. For more information, see "[Customizing user messages on your instance](/enterprise/admin/user-management/customizing-user-messages-on-your-instance#creating-a-global-announcement-banner)."
{% endif %}
{% ifversion ghes %}
<!--For earlier releases of GHES, see the previous service `ghe-resque-info`-->
### ghe-aqueduct
@@ -76,7 +73,6 @@ $ ghe-aqueduct pause --queue QUEUE
$ ghe-aqueduct resume --queue QUEUE
# resumes the specified queue
```
{% endif %}
### ghe-check-disk-usage
@@ -125,14 +121,12 @@ Allows you to find the universally unique identifier (UUID) of your node in `clu
$ ghe-config HOSTNAME.uuid
```
{% ifversion ghes %}
Allows you to exempt a list of users from REST API rate limits. A hard limit of 120,000 requests will still apply to these users. For more information, see "[Resources in the REST API](/rest/overview/resources-in-the-rest-api#rate-limiting)."
``` shell
$ ghe-config app.github.rate-limiting-exempt-users "HUBOT GITHUB-ACTIONS"
# Exempts the users hubot and github-actions from rate limits
```
{% endif %}
### ghe-config-apply
@@ -288,7 +282,6 @@ Use this command to immediately unlock the {% data variables.enterprise.manageme
$ ghe-reactivate-admin-login
```
### ghe-saml-mapping-csv
This utility can help map SAML records.
@@ -554,28 +547,17 @@ ghe-webhook-logs
```
To show all failed hook deliveries in the past day:
{% ifversion ghes %}
```shell
ghe-webhook-logs -f -a YYYY-MM-DD
```
The date format should be `YYYY-MM-DD`, `YYYY-MM-DD HH:MM:SS`, or `YYYY-MM-DD HH:MM:SS (+/-) HH:M`.
{% else %}
```shell
ghe-webhook-logs -f -a YYYYMMDD
```
{% endif %}
To show the full hook payload, result, and any exceptions for the delivery:
{% ifversion ghes %}
```shell
ghe-webhook-logs -g DELIVERY_GUID
```
{% else %}
```shell
ghe-webhook-logs -g DELIVERY_GUID -v
```
{% endif %}
## Clustering
@@ -793,7 +775,7 @@ This utility rewrites the imported repository. This gives you a chance to rename
git-import-rewrite
```
{% ifversion ghes > 3.3 %}
## Security
@@ -805,7 +787,7 @@ This utility searches your instance's logs and identifies Git operations over SS
ghe-find-insecure-git-operations
```
{% endif %}
## Support

2
content/admin/configuration/configuring-your-enterprise/configuring-custom-footers.md
View File

@@ -3,7 +3,7 @@ title: Configuring custom footers
intro: 'You can give users easy access to enterprise-specific links by adding custom footers to {% data variables.product.product_name %}.'
versions:
ghec: '*'
ghes: '>=3.4'
ghes: '*'
ghae: '>= 3.4'
type: how_to
topics:

2
content/admin/configuration/configuring-your-enterprise/managing-github-mobile-for-your-enterprise.md
View File

@@ -18,7 +18,7 @@ shortTitle: Manage GitHub Mobile
{% data variables.product.prodname_mobile %} allows people to triage, collaborate, and manage work on {% data variables.location.product_location %} from a mobile device after successful authentication. {% data reusables.mobile.about-mobile %} For more information, see "[{% data variables.product.prodname_mobile %}](/get-started/using-github/github-mobile)."
You can allow or disallow people from using {% data variables.product.prodname_mobile %} to authenticate to {% data variables.location.product_location %} and access your instance's data. By default, {% data variables.product.prodname_mobile %} is{% ifversion ghes > 3.3 %} enabled for people who use {% data variables.location.product_location %}.{% else %} not enabled for people who use {% data variables.location.product_location %}. To allow connection to your instance with {% data variables.product.prodname_mobile %}, you must enable the feature for your instance.{% endif %}
You can allow or disallow people from using {% data variables.product.prodname_mobile %} to authenticate to {% data variables.location.product_location %} and access your instance's data. By default, {% data variables.product.prodname_mobile %} is enabled for people who use {% data variables.location.product_location %}.
{% ifversion ghes < 3.6 %}
{% note %}

2
content/admin/enterprise-management/caching-repositories/about-repository-caching.md
View File

@@ -14,7 +14,7 @@ If you have teams and CI farms located around the world, you may experience redu
A repository cache eliminates the need for {% data variables.product.product_name %} to transmit the same Git data over a long-haul network link multiple times to serve multiple clients, by serving your repository data close to CI farms and distributed teams. For instance, if your primary instance is in North America and you also have a large presence in Asia, you will benefit from setting up the repository cache in Asia for use by CI runners there.
The repository cache listens to the primary instance, whether that's a single instance or a geo-replicated set of instances, for changes to Git data. CI farms and other read-heavy consumers clone and fetch from the repository cache instead of the primary instance. Changes are propagated across the network, at periodic intervals, once per cache instance rather than once per client. Git data will typically be visible on the repository cache within several minutes after the data is pushed to the primary instance. {% ifversion ghes > 3.3 %}The [`cache_sync` webhook](/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#cache_sync) can be used by CI systems to react to data being available in the cache.{% endif %}
The repository cache listens to the primary instance, whether that's a single instance or a geo-replicated set of instances, for changes to Git data. CI farms and other read-heavy consumers clone and fetch from the repository cache instead of the primary instance. Changes are propagated across the network, at periodic intervals, once per cache instance rather than once per client. Git data will typically be visible on the repository cache within several minutes after the data is pushed to the primary instance. {% ifversion ghes %}The [`cache_sync` webhook](/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#cache_sync) can be used by CI systems to react to data being available in the cache.{% endif %}
You have fine-grained control over which repositories are allowed to sync to the repository cache. Git data will only be replicated to the locations you specify.

14
content/admin/enterprise-management/caching-repositories/configuring-a-repository-cache.md
View File

@@ -33,14 +33,6 @@ Then, when told to fetch `https://github.example.com/myorg/myrepo`, Git will ins
## Configuring a repository cache
{% ifversion ghes = 3.3 %}
{% data reusables.enterprise_installation.ssh-into-instance %}
1. To enable repository caching, run the following command.
```
$ ghe-config cluster.cache-enabled true
```
{%- endif %}
1. Set up a new {% data variables.product.prodname_ghe_server %} instance on your desired platform. This instance will be your repository cache. For more information, see "[Setting up a {% data variables.product.prodname_ghe_server %} instance](/admin/guides/installation/setting-up-a-github-enterprise-server-instance)."
{% data reusables.enterprise_installation.replica-steps %}
1. Connect to the repository cache's IP address using SSH.
@@ -48,13 +40,7 @@ Then, when told to fetch `https://github.example.com/myorg/myrepo`, Git will ins
```shell
$ ssh -p 122 admin@REPLICA-IP
```
{%- ifversion ghes = 3.3 %}
1. On your cache replica, enable the feature flag for repository caching.
```
$ ghe-config cluster.cache-enabled true
```
{%- endif %}
{% data reusables.enterprise_installation.generate-replication-key-pair %}
{% data reusables.enterprise_installation.add-ssh-key-to-primary %}
1. To verify the connection to the primary and enable replica mode for the repository cache, run `ghe-repl-setup` again.

4
content/admin/github-actions/advanced-configuration-and-troubleshooting/troubleshooting-github-actions-for-your-enterprise.md
View File

@@ -186,8 +186,6 @@ There are three ways to resolve this problem:
{% endif %}
{% ifversion ghes > 3.3 %}
<a name="bundled-actions"></a>
## Troubleshooting bundled actions in {% data variables.product.prodname_actions %}
@@ -223,5 +221,3 @@ To install the official bundled actions and starter workflows within a designate
```
After you've completed these steps, you can resume configuring {% data variables.product.prodname_actions %} at "[Managing access permissions for GitHub Actions in your enterprise](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server#managing-access-permissions-for-github-actions-in-your-enterprise)."
{% endif %}

8
content/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server.md
View File

@@ -47,13 +47,6 @@ The peak quantity of connected runners without performance loss depends on such
{% endif %}
{%- ifversion ghes = 3.3 %}
{% data reusables.actions.hardware-requirements-3.3 %}
Maximum concurrency was measured using multiple repositories, job duration of approximately 10 minutes, and 10 MB artifact uploads. You may experience different performance depending on the overall levels of activity on your instance.
{%- endif %}
{%- ifversion ghes = 3.4 %}
@@ -79,7 +72,6 @@ Maximum concurrency was measured using multiple repositories, job duration of ap
{%- ifversion ghes > 3.5 %}
| vCPUs | Memory | Maximum Connected Runners |
| :---| :--- | :--- |
| 8 | 64 GB | 740 runners |

4
content/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-self-hosted-runners-for-your-enterprise.md
View File

@@ -99,14 +99,14 @@ You can create a runner group to manage access to the runner that you added to y
{% endwarning %}
{%- endif %}
{% data reusables.actions.create-runner-group %}
{%- ifversion ghec or ghes > 3.3 or ghae > 3.3 %}
{%- ifversion ghec or ghes or ghae > 3.3 %}
1. Click the "Runners" tab.
1. In the list of runners, click the runner that you deployed in the previous section.
1. Click **Edit**.
1. Click **Runner groups {% octicon "gear" aria-label="The Gear icon" %}**.
1. In the list of runner groups, click the name of the group that you previously created.
1. Click **Save** to move the runner to the group.
{%- elsif ghes < 3.4 or ghae %}
{%- elsif ghae %}
1. To the right of "Default", click the number of runners in the group to show the runners.
1. Select the runner that you deployed.
1. To the right of "Runner groups", select the **Move to group** dropdown, and click the group that you previously created.

2
content/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/introducing-github-actions-to-your-enterprise.md
View File

@@ -71,7 +71,7 @@ Think about how your enterprise can use features of {% data variables.product.pr
{% data reusables.actions.internal-actions-summary %}
{% ifversion ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion ghec or ghes or ghae > 3.3 %}
{% data reusables.actions.reusable-workflows-enterprise-beta %}
With reusable workflows, your team can call one workflow from another workflow, avoiding exact duplication. Reusable workflows promote best practice by helping your team use workflows that are well designed and have already been tested. For more information, see "[Reusing workflows](/actions/learn-github-actions/reusing-workflows)."
{% endif %}

3
content/admin/identity-and-access-management/using-saml-for-enterprise-iam/about-saml-for-enterprise-iam.md
View File

@@ -42,7 +42,6 @@ After you enable SAML SSO, depending on the IdP you use, you may be able to enab
If you use Azure AD as your IdP, you can use team synchronization to manage team membership within each organization. {% data reusables.identity-and-permissions.about-team-sync %} For more information, see "[Managing team synchronization for organizations in your enterprise](/admin/identity-and-access-management/managing-iam-for-your-enterprise/managing-team-synchronization-for-organizations-in-your-enterprise)."
{% note %}
**Note:** You cannot configure SCIM for your enterprise account unless your account was created to use {% data variables.product.prodname_emus %}. For more information, see "[About {% data variables.product.prodname_emus %}](/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users)."
@@ -112,7 +111,7 @@ Shibboleth | {% octicon "check-circle-fill" aria-label="The check icon" %} | |
{% data reusables.saml.saml-supported-idps %}
{% ifversion ghes > 3.3 %}
{% ifversion ghes %}
If your IdP supports encrypted assertions, you can configure encrypted assertions on {% data variables.product.product_name %} for increased security during the authentication process.

2
content/admin/identity-and-access-management/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise.md
View File

@@ -131,7 +131,7 @@ You can enable or disable SAML authentication for {% data variables.location.pro
1. Select **Disable administrator demotion/promotion** if you **do not** want your SAML provider to determine administrator rights for users on {% data variables.location.product_location %}.
![Screenshot of option to enable option to respect the "administrator" attribute from the IdP to enable or disable administrative rights](/assets/images/enterprise/management-console/disable-admin-demotion-promotion.png)
{%- ifversion ghes > 3.3 %}
{%- ifversion ghes %}
1. Optionally, to allow {% data variables.location.product_location %} to receive encrypted assertions from your SAML IdP, select **Require encrypted assertions**. You must ensure that your IdP supports encrypted assertions and that the encryption and key transport methods in the management console match the values configured on your IdP. You must also provide {% data variables.location.product_location %}'s public certificate to your IdP. For more information, see "[Enabling encrypted assertions](/admin/identity-and-access-management/using-saml-for-enterprise-iam/enabling-encrypted-assertions)."
![Screenshot of "Enable encrypted assertions" checkbox within management console's "Authentication" section](/assets/images/help/saml/management-console-enable-encrypted-assertions.png)

4
content/admin/overview/system-overview.md
View File

@@ -106,12 +106,8 @@ You can manually collect and send troubleshooting data to {% data variables.cont
By default, the instance also offers Secure Shell (SSH) access for both repository access using Git and administrative purposes. For more information, see "[About SSH](/authentication/connecting-to-github-with-ssh/about-ssh)" and "[Accessing the administrative shell (SSH)](/admin/configuration/configuring-your-enterprise/accessing-the-administrative-shell-ssh)."
{% ifversion ghes > 3.3 %}
If you configure SAML authentication for {% data variables.location.product_location %}, you can enable encrypted assertions between the instance and your SAML IdP. For more information, see "[Using SAML](/admin/identity-and-access-management/authenticating-users-for-your-github-enterprise-server-instance/using-saml#enabling-encrypted-assertions)."
{% endif %}
### Users and access permissions
{% data variables.product.product_name %} provides three types of accounts.

3
content/billing/managing-billing-for-github-advanced-security/viewing-your-github-advanced-security-usage.md
View File

@@ -71,7 +71,6 @@ You can view the enterprise account's current {% ifversion ghas-billing-UI-updat
For more information, see "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)."
{% endif %}
{% ifversion ghec or ghes > 3.3 %}
## Downloading {% data variables.product.prodname_GH_advanced_security %} license usage information
@@ -126,5 +125,3 @@ For organization-level data, use the `/orgs/{org}/settings/billing/advanced-secu
{% endif %}
For enterprise-level data, use the `/enterprises/{enterprise}/settings/billing/advanced-security` endpoint. For more information, see "[{% data variables.product.prodname_enterprise %} administration](/rest/reference/enterprise-admin#get-github-advanced-security-active-committers-for-an-enterprise)" in the {% data variables.product.prodname_dotcom %} REST API documentation.
{% endif %}

2
content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning.md
View File

@@ -525,7 +525,7 @@ For more information about using `exclude` and `include` filters in your custom
### Specifying directories to scan
For the interpreted languages that {% data variables.product.prodname_codeql %} supports (Python{% ifversion fpt or ghes > 3.3 or ghae > 3.3 %}, Ruby{% endif %} and JavaScript/TypeScript), you can restrict {% data variables.product.prodname_code_scanning %} to files in specific directories by adding a `paths` array to the configuration file. You can exclude the files in specific directories from analysis by adding a `paths-ignore` array.
For the interpreted languages that {% data variables.product.prodname_codeql %} supports (Python{% ifversion fpt or ghes or ghae > 3.3 %}, Ruby{% endif %} and JavaScript/TypeScript), you can restrict {% data variables.product.prodname_code_scanning %} to files in specific directories by adding a `paths` array to the configuration file. You can exclude the files in specific directories from analysis by adding a `paths-ignore` array.
``` yaml
paths:

2
content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository.md
View File

@@ -85,7 +85,7 @@ If you enter multiple filters, the view will show alerts matching _all_ these fi
{% data reusables.code-scanning.filter-non-default-branches %}
{% endif %}
{% ifversion fpt or ghes > 3.3 or ghec %}
{% ifversion fpt or ghes or ghec %}
You can prefix the `tag` filter with `-` to exclude results with that tag. For example, `-tag:style` only shows alerts that do not have the `style` tag{% ifversion codeql-ml-queries %} and `-tag:experimental` will omit all experimental alerts. For more information, see "[About {% data variables.product.prodname_code_scanning %} alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts#about-experimental-alerts)."{% else %}.{% endif %}

2
content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/running-codeql-code-scanning-in-a-container.md
View File

@@ -30,7 +30,7 @@ topics:
If you're configuring {% data variables.product.prodname_code_scanning %} for a compiled language, and you're building the code in a containerized environment, the analysis may fail with the error message "No source code was seen during the build." This indicates that {% data variables.product.prodname_codeql %} was unable to monitor your code as it was compiled.
You must run {% data variables.product.prodname_codeql %} inside the container in which you build your code. This applies whether you are using the {% data variables.product.prodname_codeql_cli %}{% ifversion codeql-runner-supported %}, the {% data variables.code-scanning.codeql_runner %},{% endif %} or {% data variables.product.prodname_actions %}. For the {% data variables.product.prodname_codeql_cli %} {% ifversion codeql-runner-supported %}or the {% data variables.code-scanning.codeql_runner %}{% endif %}, see "[Installing {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system)"{% ifversion codeql-runner-supported %} or "[Running {% data variables.code-scanning.codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system)"{% endif %} for more information. If you're using {% data variables.product.prodname_actions %}, configure your workflow to run all the actions in the same container. For more information, see "[Example workflow](#example-workflow)."
You must run {% data variables.product.prodname_codeql %} inside the container in which you build your code. This applies whether you are using the {% data variables.product.prodname_codeql_cli %} or {% data variables.product.prodname_actions %}. For the {% data variables.product.prodname_codeql_cli %}, see "[Installing {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system)" for more information. If you're using {% data variables.product.prodname_actions %}, configure your workflow to run all the actions in the same container. For more information, see "[Example workflow](#example-workflow)."
{% note %}

12
content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md
View File

@@ -40,7 +40,7 @@ allowTitleToDifferFromFilename: true
To produce more detailed logging output, you can enable step debug logging. For more information, see "[Enabling debug logging](/actions/managing-workflow-runs/enabling-debug-logging#enabling-step-debug-logging)."
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
## Creating {% data variables.product.prodname_codeql %} debugging artifacts
@@ -61,7 +61,7 @@ You need to ensure that you select **Enable debug logging** . This option enable
{% endif %}
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
### Creating {% data variables.product.prodname_codeql %} debugging artifacts using a workflow flag
@@ -159,8 +159,6 @@ If your workflow fails with an error `No source code was seen during the build`
For more information about specifying build steps, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/code-security/secure-coding/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
## Lines of code scanned are lower than expected
For compiled languages like C/C++, C#, Go, and Java, {% data variables.product.prodname_codeql %} only scans files that are built during the analysis. Therefore the number of lines of code scanned will be lower than expected if some of the source code isn't compiled correctly. This can happen for several reasons:
@@ -201,12 +199,6 @@ The extraction diagnostics information gives an indication of overall database h
However, if you see extractor errors in the overwhelming majority of files that were compiled during database creation, you should look into the errors in more detail to try to understand why some source files weren't extracted properly.
{% else %}
## Portions of my repository were not analyzed using `autobuild`
The {% data variables.product.prodname_codeql %} `autobuild` feature uses heuristics to build the code in a repository, however, sometimes this approach results in incomplete analysis of a repository. For example, when multiple `build.sh` commands exist in a single repository, the analysis may not complete since the `autobuild` step will only execute one of the commands. The solution is to replace the `autobuild` step with build steps which build all of the source code which you wish to analyze. For more information, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/code-security/secure-coding/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
{% endif %}
## The build takes too long

4
content/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning.md
View File

@@ -31,7 +31,7 @@ SARIF (Static Analysis Results Interchange Format) is an [OASIS Standard](https:
To upload a SARIF file from a third-party static code analysis engine, you'll need to ensure that uploaded files use the SARIF 2.1.0 version. {% data variables.product.prodname_dotcom %} will parse the SARIF file and show alerts using the results in your repository as a part of the {% data variables.product.prodname_code_scanning %} experience. For more information, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github)." For more information about the SARIF 2.1.0 JSON schema, see [`sarif-schema-2.1.0.json`](https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/CommitteeSpecifications/2.1.0/sarif-schema-2.1.0.json).
If you're using {% data variables.product.prodname_actions %} with the {% data variables.code-scanning.codeql_workflow %}{% ifversion codeql-runner-supported %}, using the {% data variables.code-scanning.codeql_runner %},{% endif %} or using the {% data variables.product.prodname_codeql_cli %}, then the {% data variables.product.prodname_code_scanning %} results will automatically use the supported subset of SARIF 2.1.0. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} for a repository](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-for-a-repository)"{% ifversion codeql-runner-supported %}, "[Running {% data variables.code-scanning.codeql_runner %} in your CI system](/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/running-codeql-runner-in-your-ci-system)",{% endif %} or "[Installing CodeQL CLI in your CI system](/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system)."
If you're using {% data variables.product.prodname_actions %} with the {% data variables.code-scanning.codeql_workflow %} or using the {% data variables.product.prodname_codeql_cli %}, then the {% data variables.product.prodname_code_scanning %} results will automatically use the supported subset of SARIF 2.1.0. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} for a repository](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-for-a-repository)" or "[Installing CodeQL CLI in your CI system](/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system)."
You can upload multiple SARIF files for the same commit, and display the data from each file as {% data variables.product.prodname_code_scanning %} results. When you upload multiple SARIF files for a commit, you must indicate a "category" for each analysis. The way to specify a category varies according to the analysis method:
- Using the {% data variables.product.prodname_codeql_cli %} directly, pass the `--sarif-category` argument to the `codeql database analyze` command when you generate SARIF files. For more information, see "[Configuring CodeQL CLI in your CI system](/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-cli-in-your-ci-system#about-generating-code-scanning-results-with-codeql-cli)."
@@ -57,7 +57,7 @@ The filepath has to be consistent across the runs to enable a computation of a s
{% data variables.product.prodname_dotcom %} uses the `partialFingerprints` property in the OASIS standard to detect when two results are logically identical. For more information, see the "[partialFingerprints property](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012611)" entry in the OASIS documentation.
SARIF files created by the {% data variables.code-scanning.codeql_workflow %}, {% ifversion codeql-runner-supported %}using the {% data variables.code-scanning.codeql_runner %}, {% endif %}or using the {% data variables.product.prodname_codeql_cli %} include fingerprint data. If you upload a SARIF file using the `upload-sarif` action and this data is missing, {% data variables.product.prodname_dotcom %} attempts to populate the `partialFingerprints` field from the source files. For more information about uploading results, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github)."
SARIF files created by the {% data variables.code-scanning.codeql_workflow %}, or using the {% data variables.product.prodname_codeql_cli %} include fingerprint data. If you upload a SARIF file using the `upload-sarif` action and this data is missing, {% data variables.product.prodname_dotcom %} attempts to populate the `partialFingerprints` field from the source files. For more information about uploading results, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github)."
If you upload a SARIF file without fingerprint data using the `/code-scanning/sarifs` API endpoint, the {% data variables.product.prodname_code_scanning %} alerts will be processed and displayed, but users may see duplicate alerts. To avoid seeing duplicate alerts, you should calculate fingerprint data and populate the `partialFingerprints` property before you upload the SARIF file. You may find the script that the `upload-sarif` action uses a helpful starting point: https://github.com/github/codeql-action/blob/main/src/fingerprints.ts. For more information about the API, see "[Upload an analysis as SARIF data](/rest/reference/code-scanning#upload-an-analysis-as-sarif-data)."

5
content/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github.md
View File

@@ -35,12 +35,11 @@ topics:
You can generate SARIF files using many static analysis security testing tools, including {% data variables.product.prodname_codeql %}. The results must use SARIF version 2.1.0. For more information, see "[SARIF support for {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/sarif-support-for-code-scanning)."
You can upload the results using {% data variables.product.prodname_actions %}, the {% data variables.product.prodname_code_scanning %} API,{% ifversion codeql-runner-supported %} the {% data variables.code-scanning.codeql_runner %},{% endif %} or the {% data variables.product.prodname_codeql_cli %}. The best upload method will depend on how you generate the SARIF file, for example, if you use:
You can upload the results using {% data variables.product.prodname_actions %}, the {% data variables.product.prodname_code_scanning %} API, or the {% data variables.product.prodname_codeql_cli %}. The best upload method will depend on how you generate the SARIF file, for example, if you use:
- {% data variables.product.prodname_actions %} to run the {% data variables.product.prodname_codeql %} action, there is no further action required. The {% data variables.product.prodname_codeql %} action uploads the SARIF file automatically when it completes analysis.
- {% data variables.product.prodname_actions %} to run a SARIF-compatible analysis tool, you could update the workflow to include a final step that uploads the results (see below).
- The {% data variables.product.prodname_codeql_cli %} to run {% data variables.product.prodname_code_scanning %} in your CI system, you can use the CLI to upload results to {% data variables.product.prodname_dotcom %} (for more information, see "[Installing {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system)").{% ifversion codeql-runner-supported %}
- The {% data variables.code-scanning.codeql_runner %}, to run {% data variables.product.prodname_code_scanning %} in your CI system, by default the runner automatically uploads results to {% data variables.product.prodname_dotcom %} on completion. If you block the automatic upload, when you are ready to upload results you can use the `upload` command (for more information, see "[Running {% data variables.code-scanning.codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system)").{% endif %}
- The {% data variables.product.prodname_codeql_cli %} to run {% data variables.product.prodname_code_scanning %} in your CI system, you can use the CLI to upload results to {% data variables.product.prodname_dotcom %} (for more information, see "[Installing {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system)").
- A tool that generates results as an artifact outside of your repository, you can use the {% data variables.product.prodname_code_scanning %} API to upload the file (for more information, see "[Upload an analysis as SARIF data](/rest/reference/code-scanning#upload-an-analysis-as-sarif-data)").
{% data reusables.code-scanning.not-available %}

4
content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-cli-in-your-ci-system.md
View File

@@ -152,8 +152,8 @@ codeql database analyze &lt;database&gt; --format=&lt;format&gt; \
| `<packs,queries>` | | Specify {% data variables.product.prodname_codeql %} packs or queries to run. To run the standard queries used for {% data variables.product.prodname_code_scanning %}, omit this parameter. To see the other query suites included in the {% data variables.product.prodname_codeql_cli %} bundle, look in `/<extraction-root>/qlpacks/codeql/<language>-queries/codeql-suites`. For information about creating your own query suite, see [Creating CodeQL query suites](/code-security/codeql-cli/using-the-codeql-cli/creating-codeql-query-suites/) in the documentation for the {% data variables.product.prodname_codeql_cli %}.
| <nobr>`--format`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the format for the results file generated by the command. For upload to {% data variables.product.company_short %} this should be: {% ifversion fpt or ghae or ghec %}`sarif-latest`{% else %}`sarifv2.1.0`{% endif %}. For more information, see "[SARIF support for {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/sarif-support-for-code-scanning)."
| <nobr>`--output`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify where to save the SARIF results file.
| <nobr>`--sarif-category`<nobr> | {% octicon "question" aria-label="Required with multiple results sets" %} | Optional for single database analysis. Required to define the language when you analyze multiple databases for a single commit in a repository. Specify a category to include in the SARIF results file for this analysis. A category is used to distinguish multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.|{% ifversion fpt or ghes > 3.3 or ghae or ghec %}
| <nobr>`--sarif-add-query-help`</nobr> | | Optional. Use if you want to include any available markdown-rendered query help for custom queries used in your analysis. Any query help for custom queries included in the SARIF output will be displayed in the code scanning UI if the relevant query generates an alert. For more information, see "[Analyzing databases with the {% data variables.product.prodname_codeql_cli %}](/code-security/codeql-cli/using-the-codeql-cli/analyzing-databases-with-the-codeql-cli/#including-query-help-for-custom-codeql-queries-in-sarif-files)."{% endif %}{% ifversion codeql-packs %}
| <nobr>`--sarif-category`<nobr> | {% octicon "question" aria-label="Required with multiple results sets" %} | Optional for single database analysis. Required to define the language when you analyze multiple databases for a single commit in a repository. Specify a category to include in the SARIF results file for this analysis. A category is used to distinguish multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.|
| <nobr>`--sarif-add-query-help`</nobr> | | Optional. Use if you want to include any available markdown-rendered query help for custom queries used in your analysis. Any query help for custom queries included in the SARIF output will be displayed in the code scanning UI if the relevant query generates an alert. For more information, see "[Analyzing databases with the {% data variables.product.prodname_codeql_cli %}](/code-security/codeql-cli/using-the-codeql-cli/analyzing-databases-with-the-codeql-cli/#including-query-help-for-custom-codeql-queries-in-sarif-files)."{% ifversion codeql-packs %}
| `<packs>` | | Optional. Use if you want to include CodeQL query packs in your analysis. For more information, see "[Downloading and using {% data variables.product.prodname_codeql %} packs](#downloading-and-using-codeql-query-packs)."
| <nobr>`--download`</nobr> | | Optional. Use if some of your CodeQL query packs are not yet on disk and need to be downloaded before running queries.{% endif %}
| <nobr>`--threads`</nobr> | | Optional. Use if you want to use more than one thread to run queries. The default value is `1`. You can specify more threads to speed up query execution. To set the number of threads to the number of logical processors, specify `0`.

216
content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-runner-in-your-ci-system.md
View File

@@ -1,216 +0,0 @@
---
title: Configuring CodeQL runner in your CI system
shortTitle: Configure CodeQL runner
intro: 'You can configure how the {% data variables.code-scanning.codeql_runner %} scans the code in your project and uploads the results to {% data variables.product.prodname_dotcom %}.'
product: '{% data reusables.gated-features.code-scanning %}'
miniTocMaxHeadingLevel: 3
redirect_from:
- /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system
- /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system
- /code-security/secure-coding/configuring-codeql-code-scanning-in-your-ci-system
- /code-security/secure-coding/configuring-codeql-runner-in-your-ci-system
- /code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-runner-in-your-ci-system
versions:
feature: codeql-runner-supported
type: how_to
topics:
- Advanced Security
- Code scanning
- CodeQL
- Integration
- CI
- Repositories
- Pull requests
- C/C++
- C#
- Java
---
{% data reusables.code-scanning.deprecation-codeql-runner %}
{% data reusables.code-scanning.beta %}
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
## About configuring {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system
To integrate {% data variables.product.prodname_code_scanning %} into your CI system, you can use the {% data variables.code-scanning.codeql_runner %}. For more information, see "[Running {% data variables.code-scanning.codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system)."
In general, you invoke the {% data variables.code-scanning.codeql_runner %} as follows.
```shell
$ /path/to-runner/codeql-runner-OS <COMMAND> <FLAGS>
```
`/path/to-runner/` depends on where you've downloaded the {% data variables.code-scanning.codeql_runner %} on your CI system. `codeql-runner-OS` depends on the operating system you use.
There are three versions of the {% data variables.code-scanning.codeql_runner %}, `codeql-runner-linux`, `codeql-runner-macos`, and `codeql-runner-win`, for Linux, macOS, and Windows systems respectively.
To customize the way the {% data variables.code-scanning.codeql_runner %} scans your code, you can use flags, such as `--languages` and `--queries`, or you can specify custom settings in a separate configuration file.
## Scanning pull requests
Scanning code whenever a pull request is created prevents developers from introducing new vulnerabilities and errors into the code.
To scan a pull request, run the `analyze` command and use the `--ref` flag to specify the pull request. The reference is `refs/pull/<PR-number>/head` or `refs/pull/<PR-number>/merge`, depending on whether you have checked out the HEAD commit of the pull request branch or a merge commit with the base branch.
```shell
$ /path/to-runner/codeql-runner-linux analyze --ref refs/pull/42/merge
```
{% note %}
**Note**: If you analyze code with a third-party tool and want the results to appear as pull request checks, you must run the `upload` command and use the `--ref` flag to specify the pull request instead of the branch. The reference is `refs/pull/<PR-number>/head` or `refs/pull/<PR-number>/merge`.
{% endnote %}
## Overriding automatic language detection
The {% data variables.code-scanning.codeql_runner %} automatically detects and scans code written in the supported languages.
{% data reusables.code-scanning.codeql-languages-bullets %}
{% data reusables.code-scanning.specify-language-to-analyze %}
To override automatic language detection, run the `init` command with the `--languages` flag, followed by a comma-separated list of language keywords. The keywords for the supported languages are {% data reusables.code-scanning.codeql-languages-keywords %}.
```shell
$ /path/to-runner/codeql-runner-linux init --languages cpp,java
```
## Running additional queries
{% data reusables.code-scanning.run-additional-queries %}
{% data reusables.code-scanning.codeql-query-suites-explanation %}
To add one or more queries, pass a comma-separated list of paths to the `--queries` flag of the `init` command. You can also specify additional queries in a configuration file.
If you also are using a configuration file for custom settings, and you are also specifying additional queries with the `--queries` flag, the {% data variables.code-scanning.codeql_runner %} uses the additional queries specified with the <nobr>`--queries`</nobr> flag instead of any in the configuration file.
If you want to run the combined set of additional queries specified with the flag and in the configuration file, prefix the value passed to <nobr>`--queries`</nobr> with the `+` symbol.
For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)."
In the following example, the `+` symbol ensures that the {% data variables.code-scanning.codeql_runner %} uses the additional queries together with any queries specified in the referenced configuration file.
```shell
$ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-config.yml
--queries +security-and-quality,octo-org/python-qlpack/show_ifs.ql@main
```
## Using a custom configuration file
Instead of passing additional information to the {% data variables.code-scanning.codeql_runner %} commands, you can specify custom settings in a separate configuration file.
The configuration file is a YAML file. It uses syntax similar to the workflow syntax for {% data variables.product.prodname_actions %}, as illustrated in the examples below. For more information, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions)."
Use the `--config-file` flag of the `init` command to specify the configuration file. The value of <nobr>`--config-file`</nobr> is the path to the configuration file that you want to use. This example loads the configuration file _.github/codeql/codeql-config.yml_.
```shell
$ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-config.yml
```
{% data reusables.code-scanning.custom-configuration-file %}
### Example configuration files
{% data reusables.code-scanning.example-configuration-files %}
## Configuring {% data variables.product.prodname_code_scanning %} for compiled languages
For the compiled languages C/C++, C#,{% ifversion codeql-go-autobuild %} Go,{% endif %} and Java, {% data variables.product.prodname_codeql %} builds the code before analyzing it. {% data reusables.code-scanning.analyze-go %}
For many common build systems, the {% data variables.code-scanning.codeql_runner %} can build the code automatically. To attempt to build the code automatically, run `autobuild` between the `init` and `analyze` steps. Note that if your repository requires a specific version of a build tool, you may need to install the build tool manually first.
The `autobuild` process only ever attempts to build _one_ compiled language for a repository. The language automatically selected for analysis is the language with the most files. If you want to choose a language explicitly, use the `--language` flag of the `autobuild` command.
```shell
$ /path/to-runner/codeql-runner-linux autobuild --language csharp
```
If the `autobuild` command can't build your code, you can run the build steps yourself, between the `init` and `analyze` steps. For more information, see "[Running {% data variables.code-scanning.codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system#compiled-language-example)."
## Uploading {% data variables.product.prodname_code_scanning %} data to {% data variables.product.prodname_dotcom %}
By default, the {% data variables.code-scanning.codeql_runner %} uploads results from {% data variables.product.prodname_code_scanning %} when you run the `analyze` command. You can also upload SARIF files separately, by using the `upload` command.
Once you've uploaded the data, {% data variables.product.prodname_dotcom %} displays the alerts in your repository.
- If you uploaded to a pull request, for example `--ref refs/pull/42/merge` or `--ref refs/pull/42/head`, then the results appear as alerts in a pull request check. For more information, see "[Triaging code scanning alerts in pull requests](/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests)."
- If you uploaded to a branch, for example `--ref refs/heads/my-branch`, then the results appear in the **Security** tab for your repository. For more information, see "[Managing code scanning alerts for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository)."
## {% data variables.code-scanning.codeql_runner %} command reference
The {% data variables.code-scanning.codeql_runner %} supports the following commands and flags.
### `init`
Initializes the {% data variables.code-scanning.codeql_runner %} and creates a {% data variables.product.prodname_codeql %} database for each language to be analyzed.
| Flag | Required | Input value |
| ---- |:--------:| ----------- |
| `--repository` | ✓ | Name of the repository to initialize. |
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or {% data variables.product.pat_generic %} from standard input. |
| `--languages` | | Comma-separated list of languages to analyze. By default, the {% data variables.code-scanning.codeql_runner %} detects and analyzes all supported languages in the repository. |
| `--queries` | | Comma-separated list of additional queries to run, in addition to the default suite of security queries. This overrides the `queries` setting in the custom configuration file. |
| `--config-file` | | Path to custom configuration file. |
| `--codeql-path` | | Path to a copy of the {% data variables.product.prodname_codeql %} CLI executable to use. By default, the {% data variables.code-scanning.codeql_runner %} downloads a copy. |
| `--temp-dir` | | Directory where temporary files are stored. The default is `./codeql-runner`. |
| `--tools-dir` | | Directory where {% data variables.product.prodname_codeql %} tools and other files are stored between runs. The default is a subdirectory of the home directory. |
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
| `--debug` | | None. Prints more verbose output. |
| <nobr>`--trace-process-name`</nobr> | | Advanced, Windows only. Name of the process where a Windows tracer of this process is injected. |
| <nobr>`--trace-process-level`</nobr> | | Advanced, Windows only. Number of levels up of the parent process where a Windows tracer of this process is injected. |
| `-h`, `--help` | | None. Displays help for the command. |
### `autobuild`
Attempts to build the code for the compiled languages C/C++, C#, and Java. For those languages, {% data variables.product.prodname_codeql %} builds the code before analyzing it. Run `autobuild` between the `init` and `analyze` steps.
| Flag | Required | Input value |
| ---- |:--------:| ----------- |
| `--language` | | The language to build. By default, the {% data variables.code-scanning.codeql_runner %} builds the compiled language with the most files. |
| <nobr>`--temp-dir`</nobr> | | Directory where temporary files are stored. The default is `./codeql-runner`. |
| `--debug` | | None. Prints more verbose output. |
| <nobr> `-h`, `--help`</nobr> | | None. Displays help for the command. |
### `analyze`
Analyzes the code in the {% data variables.product.prodname_codeql %} databases and uploads results to {% data variables.product.product_name %}.
| Flag | Required | Input value |
| ---- |:--------:| ----------- |
| `--repository` | ✓ | Name of the repository to analyze. |
| `--commit` | ✓ | SHA of the commit to analyze. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. |
| `--ref` | ✓ | Name of the reference to analyze, for example `refs/heads/main` or `refs/pull/42/merge`. In Git or in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. |
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or {% data variables.product.pat_generic %} from standard input. |
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
| `--no-upload` | | None. Stops the {% data variables.code-scanning.codeql_runner %} from uploading the results to {% data variables.product.product_name %}. |
| `--output-dir` | | Directory where the output SARIF files are stored. The default is in the directory of temporary files. |
| `--ram` | | Amount of memory to use when running queries. The default is to use all available memory. |
| <nobr>`--no-add-snippets`</nobr> | | None. Excludes code snippets from the SARIF output. |
| <nobr>`--category`<nobr> | | Category to include in the SARIF results file for this analysis. A category can be used to distinguish multiple analyses for the same tool and commit, but performed on different languages or different parts of the code. This value will appear in the `<run>.automationDetails.id` property in SARIF v2.1.0. |
| `--threads` | | Number of threads to use when running queries. The default is to use all available cores. |
| `--temp-dir` | | Directory where temporary files are stored. The default is `./codeql-runner`. |
| `--debug` | | None. Prints more verbose output. |
| `-h`, `--help` | | None. Displays help for the command. |
### `upload`
Uploads SARIF files to {% data variables.product.product_name %}.
{% note %}
**Note**: If you analyze code with the CodeQL runner, the `analyze` command uploads SARIF results by default. You can use the `upload` command to upload SARIF results that were generated by other tools.
{% endnote %}
| Flag | Required | Input value |
| ---- |:--------:| ----------- |
| `--sarif-file` | ✓ | SARIF file to upload, or a directory containing multiple SARIF files. |
| `--repository` | ✓ | Name of the repository that was analyzed. |
| `--commit` | ✓ | SHA of the commit that was analyzed. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. |
| `--ref` | ✓ | Name of the reference that was analyzed, for example `refs/heads/main` or `refs/pull/42/merge`. In Git or in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. |
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or {% data variables.product.pat_generic %} from standard input. |
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
| `--debug` | | None. Prints more verbose output. |
| `-h`, `--help` | | None. Displays help for the command. |

2
content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/index.md
View File

@@ -23,8 +23,6 @@ children:
- /installing-codeql-cli-in-your-ci-system
- /configuring-codeql-cli-in-your-ci-system
- /running-codeql-runner-in-your-ci-system
- /configuring-codeql-runner-in-your-ci-system
- /troubleshooting-codeql-runner-in-your-ci-system
- /migrating-from-the-codeql-runner-to-codeql-cli
---

147
content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/running-codeql-runner-in-your-ci-system.md
View File

@@ -26,151 +26,6 @@ topics:
- SARIF
---
<!--UI-LINK: When GitHub Enterprise Server <=3.0 doesn't have GitHub Actions set up, the Security > Code scanning alerts view links to this article.-->
{% ifversion codeql-runner-supported %}
{% data reusables.code-scanning.deprecation-codeql-runner %}
{% data reusables.code-scanning.beta %}
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
## About the {% data variables.code-scanning.codeql_runner %}
The {% data variables.code-scanning.codeql_runner %} is a tool you can use to run {% data variables.product.prodname_code_scanning %} on code that you're processing in a third-party continuous integration (CI) system. {% data reusables.code-scanning.about-code-scanning %} For information, see "[About {% data variables.product.prodname_code_scanning %} with {% data variables.product.prodname_codeql %}](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql)."
In many cases it is easier to set up {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} using the {% data variables.product.prodname_codeql_cli %} directly in your CI system.
Alternatively, you can use {% data variables.product.prodname_actions %} to run {% data variables.product.prodname_code_scanning %} within {% data variables.product.product_name %}. For information, see "[Configuring {% data variables.product.prodname_code_scanning %} for a repository](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-for-a-repository)."
The {% data variables.code-scanning.codeql_runner %} is a command-line tool that runs {% data variables.product.prodname_codeql %} analysis on a checkout of a {% data variables.product.prodname_dotcom %} repository. You add the runner to your third-party system, then call the runner to analyze code and upload the results to {% data variables.product.product_name %}. These results are displayed as {% data variables.product.prodname_code_scanning %} alerts in the repository.
{% note %}
**Note:**
{% ifversion fpt or ghec %}
* The {% data variables.code-scanning.codeql_runner %} uses the {% data variables.product.prodname_codeql %} CLI to analyze code and therefore has the same license conditions. It's free to use on public repositories that are maintained on {% data variables.product.prodname_dotcom_the_website %}, and available to use on private repositories that are owned by customers with an {% data variables.product.prodname_advanced_security %} license. For information, see "[{% data variables.product.product_name %} {% data variables.product.prodname_codeql %} Terms and Conditions](https://securitylab.github.com/tools/codeql/license)" and "[{% data variables.product.prodname_codeql %} CLI](/code-security/codeql-cli/using-the-codeql-cli/)."
{% else %}
* The {% data variables.code-scanning.codeql_runner %} is available to customers with an {% data variables.product.prodname_advanced_security %} license.
{% endif %}
{% ifversion ghae %}
* The {% data variables.code-scanning.codeql_runner %} shouldn't be confused with the {% data variables.product.prodname_codeql %} CLI. The {% data variables.product.prodname_codeql %} CLI is a command-line interface that lets you create {% data variables.product.prodname_codeql %} databases for security research and run {% data variables.product.prodname_codeql %} queries.
For more information, see "[{% data variables.product.prodname_codeql_cli %}](/code-security/codeql-cli/using-the-codeql-cli/)."
{% endif %}
{% endnote %}
## Downloading the {% data variables.code-scanning.codeql_runner %}
You can download the {% data variables.code-scanning.codeql_runner %} from https://{% ifversion fpt or ghec %}github.com{% else %}HOSTNAME{% endif %}/github/codeql-action/releases. On some operating systems, you may need to change permissions for the downloaded file before you can run it.
On Linux:
```shell
chmod +x codeql-runner-linux
```
On macOS:
```shell
chmod +x codeql-runner-macos
sudo xattr -d com.apple.quarantine codeql-runner-macos
```
On Windows, the `codeql-runner-win.exe` file usually requires no change to permissions.
## Adding the {% data variables.code-scanning.codeql_runner %} to your CI system
Once you download the {% data variables.code-scanning.codeql_runner %} and verify that it can be executed, you should make the runner available to each CI server that you intend to use for {% data variables.product.prodname_code_scanning %}. For example, you might configure each server to copy the runner from a central, internal location. Alternatively, you could use the REST API to get the runner directly from {% data variables.product.prodname_dotcom %}, for example:
```shell
wget https://{% ifversion fpt or ghec %}github.com{% else %}HOSTNAME{% endif %}/github/codeql-action/releases/latest/download/codeql-runner-linux
chmod +x codeql-runner-linux
```
In addition to this, each CI server also needs:
- A {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} for the {% data variables.code-scanning.codeql_runner %} to use. You must use an access token with the `repo` scope, or a {% data variables.product.prodname_github_app %} with the `security_events` write permission, and `metadata` and `contents` read permissions. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a {% data variables.product.pat_generic %}](/github/authenticating-to-github/creating-a-personal-access-token)."
- Access to the {% data variables.product.prodname_codeql %} bundle associated with this release of the {% data variables.code-scanning.codeql_runner %}. This package contains queries and libraries needed for {% data variables.product.prodname_codeql %} analysis, plus the {% data variables.product.prodname_codeql %} CLI, which is used internally by the runner. For information, see "[{% data variables.product.prodname_codeql %} CLI](/code-security/codeql-cli/using-the-codeql-cli/)."
The options for providing access to the {% data variables.product.prodname_codeql %} bundle are:
1. Allow the CI servers access to https://{% ifversion fpt or ghec %}github.com{% else %}HOSTNAME{% endif %}/github/codeql-action so that the {% data variables.code-scanning.codeql_runner %} can download the bundle automatically.
1. Manually download/extract the bundle, store it with other central resources, and use the <nobr>`--codeql-path`</nobr> flag to specify the location of the bundle in calls to initialize the {% data variables.code-scanning.codeql_runner %}.
## Calling the {% data variables.code-scanning.codeql_runner %}
You should call the {% data variables.code-scanning.codeql_runner %} from the checkout location of the repository you want to analyze. The two main commands are:
1. `init` required to initialize the runner and create a {% data variables.product.prodname_codeql %} database for each language to be analyzed. These databases are populated and analyzed by subsequent commands.
1. `analyze` required to populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload results to {% data variables.product.product_name %}.
For both commands, you must specify the URL of {% data variables.product.product_name %}, the repository *OWNER/NAME*, and the {% data variables.product.prodname_github_apps %} or {% data variables.product.pat_generic %} to use for authentication. You also need to specify the location of the CodeQL bundle, unless the CI server has access to download it directly from the `github/codeql-action` repository.
You can configure where the {% data variables.code-scanning.codeql_runner %} stores the CodeQL bundle for future analysis on a server using the <nobr>`--tools-dir`</nobr> flag and where it stores temporary files during analysis using <nobr>`--temp-dir`</nobr>.
To view the command-line reference for the runner, use the `-h` flag. For example, to list all commands run: `codeql-runner-OS -h`, or to list all the flags available for the `init` command run: `codeql-runner-OS init -h` (where `OS` varies according to the executable that you are using). For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/code-security/secure-coding/configuring-codeql-runner-in-your-ci-system#codeql-runner-command-reference)."
{% data reusables.code-scanning.upload-sarif-alert-limit %}
### Basic example
This example runs {% data variables.product.prodname_codeql %} analysis on a Linux CI server for the `octo-org/example-repo` repository hosted on `{% data variables.command_line.git_url_example %}`. The process is very simple because the repository contains only languages that can be analyzed by {% data variables.product.prodname_codeql %} directly, without being built (that is, Go, JavaScript, Python, and TypeScript).
In this example, the server has access to download the {% data variables.product.prodname_codeql %} bundle directly from the `github/codeql-action` repository, so there is no need to use the `--codeql-path` flag.
1. Check out the repository to analyze.
1. Move into the directory where the repository is checked out.
1. Initialize the {% data variables.code-scanning.codeql_runner %} and create {% data variables.product.prodname_codeql %} databases for the languages detected.
```shell
$ echo "$TOKEN" | /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo
--github-url {% data variables.command_line.git_url_example %} --github-auth-stdin
> Cleaning temp directory /srv/checkout/example-repo/codeql-runner
> ...
> Created CodeQL database at /srv/checkout/example-repo/codeql-runner/codeql_databases/javascript.
```
{% data reusables.code-scanning.codeql-runner-analyze-example %}
### Compiled language example
This example is similar to the previous example, however this time the repository has code in C/C++, C#, or Java. To create a {% data variables.product.prodname_codeql %} database for these languages, the CLI needs to monitor the build. At the end of the initialization process, the runner reports the command you need to set up the environment before building the code. You need to run this command, before calling the normal CI build process, and then running the `analyze` command.
1. Check out the repository to analyze.
1. Move into the directory where the repository is checked out.
1. Initialize the {% data variables.code-scanning.codeql_runner %} and create {% data variables.product.prodname_codeql %} databases for the languages detected.
```shell
$ echo "$TOKEN" | /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo-2
--github-url {% data variables.command_line.git_url_example %} --github-auth-stdin
> Cleaning temp directory /srv/checkout/example-repo-2/codeql-runner
> ...
> CodeQL environment output to "/srv/checkout/example-repo-2/codeql-runner/codeql-env.json"
and "/srv/checkout/example-repo-2/codeql-runner/codeql-env.sh".
Please export these variables to future processes so that CodeQL can monitor the build, for example by running
". /srv/checkout/example-repo-2/codeql-runner/codeql-env.sh".
```
1. Source the script generated by the `init` action to set up the environment to monitor the build. Note the leading dot and space in the following code snippet.
```shell
$ . /srv/checkout/example-repo-2/codeql-runner/codeql-env.sh
```
1. Build the code. On macOS, you need to prefix the build command with the environment variable `$CODEQL_RUNNER`. For more information, see "[Troubleshooting {% data variables.code-scanning.codeql_runner %} in your CI system](/code-security/secure-coding/troubleshooting-codeql-runner-in-your-ci-system#no-code-found-during-the-build)."
{% data reusables.code-scanning.codeql-runner-analyze-example %}
{% note %}
**Note:** If you use a containerized build, you need to run the {% data variables.code-scanning.codeql_runner %} in the container where your build task takes place.
{% endnote %}
## Further reading
- "[Configuring {% data variables.code-scanning.codeql_runner %} in your CI system](/code-security/secure-coding/configuring-codeql-runner-in-your-ci-system)"
- "[Troubleshooting {% data variables.code-scanning.codeql_runner %} in your CI system](/code-security/secure-coding/troubleshooting-codeql-runner-in-your-ci-system)"
{% else %}
## About the {% data variables.code-scanning.codeql_runner %}
The {% data variables.code-scanning.codeql_runner %} has been deprecated. [{% data variables.product.prodname_codeql_cli %}](https://github.com/github/codeql-cli-binaries/releases) version 2.7.6 has complete feature parity.
@@ -180,5 +35,3 @@ For information on migrating to {% data variables.product.prodname_codeql_cli %}
## Further reading
- [CodeQL runner deprecation](https://github.blog/changelog/2021-09-21-codeql-runner-deprecation/) in the GitHub Blog
{% endif %}

69
content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/troubleshooting-codeql-runner-in-your-ci-system.md
View File

@@ -1,69 +0,0 @@
---
title: Troubleshooting CodeQL runner in your CI system
shortTitle: Troubleshoot CodeQL runner
intro: 'If you''re having problems with the {% data variables.code-scanning.codeql_runner %}, you can troubleshoot by using these tips.'
product: '{% data reusables.gated-features.code-scanning %}'
redirect_from:
- /github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system
- /github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-codeql-code-scanning-in-your-ci-system
- /code-security/secure-coding/troubleshooting-codeql-code-scanning-in-your-ci-system
- /code-security/secure-coding/troubleshooting-codeql-runner-in-your-ci-system
- /code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/troubleshooting-codeql-runner-in-your-ci-system
versions:
feature: codeql-runner-supported
type: how_to
topics:
- Advanced Security
- Code scanning
- CodeQL
- Troubleshooting
- Integration
- CI
---
{% data reusables.code-scanning.deprecation-codeql-runner %}
{% data reusables.code-scanning.beta %}
{% data reusables.code-scanning.not-available %}
## The `init` command takes too long
Before the {% data variables.code-scanning.codeql_runner %} can build and analyze code, it needs access to the {% data variables.product.prodname_codeql %} bundle, which contains the {% data variables.product.prodname_codeql %} CLI and the {% data variables.product.prodname_codeql %} libraries.
When you use the {% data variables.code-scanning.codeql_runner %} for the first time on your machine, the `init` command downloads the {% data variables.product.prodname_codeql %} bundle to your machine. This download can take a few minutes.
The {% data variables.product.prodname_codeql %} bundle is cached between runs, so if you use the {% data variables.code-scanning.codeql_runner %} again on the same machine, it won't download the {% data variables.product.prodname_codeql %} bundle again.
To avoid this automatic download, you can manually download the {% data variables.product.prodname_codeql %} bundle to your machine and specify the path using the `--codeql-path` flag of the `init` command.
## No code found during the build
If the `analyze` command for the {% data variables.code-scanning.codeql_runner %} fails with an error `No source code was seen during the build`, this indicates that {% data variables.product.prodname_codeql %} was unable to monitor your code. Several reasons can explain such a failure.
1. Automatic language detection identified a supported language, but there is no analyzable code of that language in the repository. A typical example is when our language detection service finds a file associated with a particular programming language like a `.h`, or `.gyp` file, but no corresponding executable code is present in the repository. To solve the problem, you can manually define the languages you want to analyze by using the `--languages` flag of the `init` command. For more information, see "[Configuring {% data variables.code-scanning.codeql_runner %} in your CI system](/code-security/secure-coding/configuring-codeql-runner-in-your-ci-system)."
1. You're analyzing a compiled language without using the `autobuild` command and you run the build steps yourself after the `init` step. For the build to work, you must set up the environment such that the {% data variables.code-scanning.codeql_runner %} can monitor the build process. The `init` command generates instructions for how to export the required environment variables, so you can copy and run the script after you've run the `init` command.
- On macOS and Linux:
```shell
$ . codeql-runner/codeql-env.sh
```
- On Windows, using the Command shell (`cmd`) or a batch file (`.bat`):
```shell
> call codeql-runner\codeql-env.bat
```
- On Windows, using PowerShell:
```shell
> cat codeql-runner\codeql-env.sh | Invoke-Expression
```
The environment variables are also stored in the file `codeql-runner/codeql-env.json`. This file contains a single JSON object which maps environment variable keys to values. If you can't run the script generated by the `init` command, then you can use the data in JSON format instead.
{% note %}
**Note:** If you used the `--temp-dir` flag of the `init` command to specify a custom directory for temporary files, the path to the `codeql-env` files might be different.
{% endnote %}
1. You're analyzing a compiled language on macOS without using the `autobuild` command and you run the build steps yourself after the `init` step. If SIP (System Integrity Protection) is enabled, which is the default on recent versions of OSX, analysis might fail. To fix this, prefix the build command with the `$CODEQL_RUNNER` environment variable.
For example, if your build command is `cmd arg1 arg2`, you should run `$CODEQL_RUNNER cmd arg1 arg2`.
1. The code is built in a container or on a separate machine. If you use a containerized build or if you outsource the build to another machine, make sure to run the {% data variables.code-scanning.codeql_runner %} in the container or on the machine where your build task takes place. For more information, see "[Running CodeQL code scanning in a container](/code-security/secure-coding/running-codeql-code-scanning-in-a-container)."

288
content/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions.md
View File

@@ -33,14 +33,14 @@ redirect_from:
{% data variables.product.prodname_dependabot %} is able to trigger {% data variables.product.prodname_actions %} workflows on its pull requests and comments; however, certain events are treated differently.
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
For workflows initiated by {% data variables.product.prodname_dependabot %} (`github.actor == 'dependabot[bot]'`) using the `pull_request`, `pull_request_review`, `pull_request_review_comment`, `push`, `create`, `deployment`, and `deployment_status` events, the following restrictions apply:
{% endif %}
- {% ifversion ghes = 3.3 %}`GITHUB_TOKEN` has read-only permissions, unless your administrator has removed restrictions.{% else %}`GITHUB_TOKEN` has read-only permissions by default.{% endif %}
- {% ifversion ghes = 3.3 %}Secrets are inaccessible, unless your administrator has removed restrictions.{% else %}Secrets are populated from {% data variables.product.prodname_dependabot %} secrets. {% data variables.product.prodname_actions %} secrets are not available.{% endif %}
- `GITHUB_TOKEN` has read-only permissions by default.
- Secrets are populated from {% data variables.product.prodname_dependabot %} secrets. {% data variables.product.prodname_actions %} secrets are not available.
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
For workflows initiated by {% data variables.product.prodname_dependabot %} (`github.actor == 'dependabot[bot]'`) using the `pull_request_target` event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %} (`github.actor == 'dependabot[bot]'`), the `GITHUB_TOKEN` will be read-only and secrets are not available.
{% endif %}
@@ -48,7 +48,7 @@ For workflows initiated by {% data variables.product.prodname_dependabot %} (`gi
For more information, see ["Keeping your GitHub Actions and workflows secure: Preventing pwn requests"](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/).
{% ifversion fpt or ghec or ghes > 3.3 %}
{% ifversion fpt or ghec or ghes %}
### Changing `GITHUB_TOKEN` permissions
@@ -111,120 +111,6 @@ jobs:
{% endif %}
{% ifversion ghes = 3.3 %}
{% note %}
**Note:** Your site administrator can override these restrictions for {% data variables.location.product_location %}. For more information, see "[Troubleshooting {% data variables.product.prodname_actions %} for your enterprise](/admin/github-actions/advanced-configuration-and-troubleshooting/troubleshooting-github-actions-for-your-enterprise#troubleshooting-failures-when-dependabot-triggers-existing-workflows)."
If the restrictions are removed, when a workflow is triggered by {% data variables.product.prodname_dependabot %} it will have access to {% data variables.product.prodname_actions %} secrets and can use the `permissions` term to increase the default scope of the `GITHUB_TOKEN` from read-only access. You can ignore the specific steps in the "Handling `pull_request` events" and "Handling `push` events" sections, as it no longer applies.
{% endnote %}
### Handling `pull_request` events
If your workflow needs access to secrets or a `GITHUB_TOKEN` with write permissions, you have two options: using `pull_request_target`, or using two separate workflows. We will detail using `pull_request_target` in this section, and using two workflows below in "[Handling `push` events](#handling-push-events)."
Below is a simple example of a `pull_request` workflow that might now be failing:
```yaml
### This workflow now has no secrets and a read-only token
name: Dependabot Workflow
on:
pull_request
jobs:
dependabot:
runs-on: ubuntu-latest
# Always check the actor is Dependabot to prevent your workflow from failing on non-Dependabot PRs
if: {% raw %}${{ github.actor == 'dependabot[bot]' }}{% endraw %}
steps:
- uses: {% data reusables.actions.action-checkout %}
```
You can replace `pull_request` with `pull_request_target`, which is used for pull requests from forks, and explicitly check out the pull request `HEAD`.
{% warning %}
**Warning:** Using `pull_request_target` as a substitute for `pull_request` exposes you to insecure behavior. We recommend you use the two workflow method, as described below in "[Handling `push` events](#handling-push-events)."
{% endwarning %}
```yaml
### This workflow has access to secrets and a read-write token
name: Dependabot Workflow
on:
pull_request_target
permissions:
# Downscope as necessary, since you now have a read-write token
jobs:
dependabot:
runs-on: ubuntu-latest
if: {% raw %}${{ github.actor == 'dependabot[bot]' }}{% endraw %}
steps:
- uses: {% data reusables.actions.action-checkout %}
with:
# Check out the pull request HEAD
ref: {% raw %}${{ github.event.pull_request.head.sha }}{% endraw %}
github-token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
```
It is also strongly recommended that you downscope the permissions granted to the `GITHUB_TOKEN` in order to avoid leaking a token with more privilege than necessary. For more information, see "[Permissions for the `GITHUB_TOKEN`](/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token)."
### Handling `push` events
As there is no `pull_request_target` equivalent for `push` events, you will have to use two workflows: one untrusted workflow that ends by uploading artifacts, which triggers a second trusted workflow that downloads artifacts and continues processing.
The first workflow performs any untrusted work:
{% raw %}
```yaml
### This workflow doesn't have access to secrets and has a read-only token
name: Dependabot Untrusted Workflow
on:
push
jobs:
check-dependabot:
runs-on: ubuntu-latest
if: ${{ github.actor == 'dependabot[bot]' }}
steps:
- uses: ...
```
{% endraw %}
The second workflow performs trusted work after the first workflow completes successfully:
{% raw %}
```yaml
### This workflow has access to secrets and a read-write token
name: Dependabot Trusted Workflow
on:
workflow_run:
workflows: ["Dependabot Untrusted Workflow"]
types:
- completed
permissions:
# Downscope as necessary, since you now have a read-write token
jobs:
dependabot:
runs-on: ubuntu-latest
if: ${{ github.event.workflow_run.conclusion == 'success' }}
steps:
- uses: ...
```
{% endraw %}
{% endif %}
### Manually re-running a workflow
{% ifversion actions-stable-actor-ids %}
@@ -241,55 +127,12 @@ You can also manually re-run a failed Dependabot workflow, and it will run with
Here are several common scenarios that can be automated using {% data variables.product.prodname_actions %}.
{% ifversion ghes = 3.3 %}
{% note %}
**Note:** If your site administrator has overridden restrictions for {% data variables.product.prodname_dependabot %} on {% data variables.location.product_location %}, you can use `pull_request` instead of `pull_request_target` in the following workflows.
{% endnote %}
{% endif %}
### Fetch metadata about a pull request
A large amount of automation requires knowing information about the contents of the pull request: what the dependency name was, if it's a production dependency, and if it's a major, minor, or patch update.
The `dependabot/fetch-metadata` action provides all that information for you:
{% ifversion ghes = 3.3 %}
{% raw %}
```yaml
name: Dependabot fetch metadata
on: pull_request_target
permissions:
pull-requests: write
issues: write
repository-projects: write
jobs:
dependabot:
runs-on: ubuntu-latest
if: ${{ github.actor == 'dependabot[bot]' }}
steps:
- name: Dependabot metadata
id: dependabot-metadata
uses: dependabot/fetch-metadata@v1
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
# The following properties are now available:
# - steps.dependabot-metadata.outputs.dependency-names
# - steps.dependabot-metadata.outputs.dependency-type
# - steps.dependabot-metadata.outputs.update-type
```
{% endraw %}
{% else %}
{% raw %}
```yaml
@@ -319,8 +162,6 @@ jobs:
{% endraw %}
{% endif %}
For more information, see the [`dependabot/fetch-metadata`](https://github.com/dependabot/fetch-metadata) repository.
### Label a pull request
@@ -329,41 +170,6 @@ If you have other automation or triage workflows based on {% data variables.prod
For example, if you want to flag all production dependency updates with a label:
{% ifversion ghes = 3.3 %}
{% raw %}
```yaml
name: Dependabot auto-label
on: pull_request_target
permissions:
pull-requests: write
issues: write
repository-projects: write
jobs:
dependabot:
runs-on: ubuntu-latest
if: ${{ github.actor == 'dependabot[bot]' }}
steps:
- name: Dependabot metadata
id: dependabot-metadata
uses: dependabot/fetch-metadata@v1
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
- name: Add a label for all production dependencies
if: ${{ steps.dependabot-metadata.outputs.dependency-type == 'direct:production' }}
run: gh pr edit "$PR_URL" --add-label "production"
env:
PR_URL: ${{github.event.pull_request.html_url}}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```
{% endraw %}
{% else %}
{% raw %}
```yaml
@@ -390,49 +196,14 @@ jobs:
run: gh pr edit "$PR_URL" --add-label "production"
env:
PR_URL: ${{github.event.pull_request.html_url}}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```
{% endraw %}
{% endif %}
### Approve a pull request
If you want to automatically approve Dependabot pull requests, you can use the {% data variables.product.prodname_cli %} in a workflow:
{% ifversion ghes = 3.3 %}
{% raw %}
```yaml
name: Dependabot auto-approve
on: pull_request_target
permissions:
pull-requests: write
jobs:
dependabot:
runs-on: ubuntu-latest
if: ${{ github.actor == 'dependabot[bot]' }}
steps:
- name: Dependabot metadata
id: dependabot-metadata
uses: dependabot/fetch-metadata@v1
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
- name: Approve a PR
run: gh pr review --approve "$PR_URL"
env:
PR_URL: ${{github.event.pull_request.html_url}}
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
```
{% endraw %}
{% else %}
{% raw %}
```yaml
@@ -461,8 +232,6 @@ jobs:
{% endraw %}
{% endif %}
### Enable auto-merge on a pull request
If you want to allow maintainers to mark certain pull requests for auto-merge, you can use {% data variables.product.prodname_dotcom %}'s auto-merge functionality. This enables the pull request to be merged when any tests and approvals required by the branch protection rules are successfully met. For more information, see "[Automatically merging a pull request](/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request)" and "[Managing a branch protection rule](/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule)."
@@ -475,40 +244,6 @@ If you want to allow maintainers to mark certain pull requests for auto-merge, y
You can instead use {% data variables.product.prodname_actions %} and the {% data variables.product.prodname_cli %}. Here is an example that auto merges all patch updates to `my-dependency`:
{% ifversion ghes = 3.3 %}
{% raw %}
```yaml
name: Dependabot auto-merge
on: pull_request_target
permissions:
contents: write
pull-requests: write
jobs:
dependabot:
runs-on: ubuntu-latest
if: ${{ github.actor == 'dependabot[bot]' }}
steps:
- name: Dependabot metadata
id: dependabot-metadata
uses: dependabot/fetch-metadata@v1
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
- name: Enable auto-merge for Dependabot PRs
if: ${{contains(steps.dependabot-metadata.outputs.dependency-names, 'my-dependency') && steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch'}}
run: gh pr merge --auto --merge "$PR_URL"
env:
PR_URL: ${{github.event.pull_request.html_url}}
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
```
{% endraw %}
{% else %}
{% raw %}
```yaml
@@ -539,26 +274,13 @@ jobs:
{% endraw %}
{% endif %}
## Troubleshooting failed workflow runs
If your workflow run fails, check the following:
{% ifversion ghes = 3.3 %}
- You are running the workflow only when the correct actor triggers it.
- You are checking out the correct `ref` for your `pull_request`.
- You aren't trying to access secrets from within a Dependabot-triggered `pull_request`, `pull_request_review`, `pull_request_review_comment`, or `push` event.
- You aren't trying to perform any `write` actions from within a Dependabot-triggered `pull_request`, `pull_request_review`, `pull_request_review_comment`, or `push` event.
{% else %}
- You are running the workflow only when the correct actor triggers it.
- You are checking out the correct `ref` for your `pull_request`.
- Your secrets are available in {% data variables.product.prodname_dependabot %} secrets rather than as {% data variables.product.prodname_actions %} secrets.
- You have a `GITHUB_TOKEN` with the correct permissions.
{% endif %}
For information on writing and debugging {% data variables.product.prodname_actions %}, see "[Learning GitHub Actions](/actions/learn-github-actions)."

3
content/code-security/getting-started/securing-your-repository.md
View File

@@ -32,10 +32,9 @@ The first step to securing a repository is to establish who can see and modify y
From the main page of your repository, click **{% octicon "gear" aria-label="The Settings gear" %} Settings**, then scroll down to the "Danger Zone."
- To change who can view your repository, click **Change visibility**. For more information, see "[Setting repository visibility](/github/administering-a-repository/setting-repository-visibility)."{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
- To change who can view your repository, click **Change visibility**. For more information, see "[Setting repository visibility](/github/administering-a-repository/setting-repository-visibility)."{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
- To change who can access your repository and adjust permissions, click **Manage access**. For more information, see"[Managing teams and people with access to your repository](/github/administering-a-repository/managing-teams-and-people-with-access-to-your-repository)."{% endif %}
## Managing the dependency graph
{% ifversion fpt or ghec %}

6
content/code-security/index.md
View File

@@ -11,9 +11,9 @@ featuredLinks:
- '{% ifversion fpt or ghec %}/code-security/security-advisories/repository-security-advisories/creating-a-repository-security-advisory{% endif %}'
- '{% ifversion ghes or ghae %}/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-for-a-repository{% endif%}'
guideCards:
- '{% ifversion fpt or ghec or ghes > 3.2 %}/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates{% endif %}'
- '{% ifversion fpt or ghec or ghes > 3.2 %}/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates{% endif %}'
- '{% ifversion fpt or ghec or ghes > 3.2 %}/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-for-a-repository{% endif %}'
- '{% ifversion fpt or ghec or ghes %}/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates{% endif %}'
- '{% ifversion fpt or ghec or ghes %}/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates{% endif %}'
- '{% ifversion fpt or ghec or ghes %}/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-for-a-repository{% endif %}'
- '{% ifversion ghes < 3.3 %}/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository{% endif %}'
- '{% ifversion ghes < 3.3 %}/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies{% endif %}'
- '{% ifversion ghes < 3.3 or ghae %}/code-security/secret-scanning/configuring-secret-scanning-for-your-repositories{% endif %}'

3
content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md
View File

@@ -47,7 +47,6 @@ Repository administrators can also set up the dependency graph for private repos
{% ifversion ghes %}
For more information about configuration of the dependency graph, see "[Configuring the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-the-dependency-graph)."{% endif %}
## Dependencies included
The dependency graph includes all the dependencies of a repository that are detailed in the manifest and lock files, or their equivalent, for supported ecosystems{% ifversion dependency-submission-api %}, as well as any dependencies that are submitted using the Dependency submission API (beta){% endif %}. This includes:
@@ -95,7 +94,7 @@ The recommended formats explicitly define which versions are used for all direct
{%- ifversion dependency-graph-dart-support %}
| pub | Dart | `pubspec.lock` | `pubspec.yaml`, `pubspec.lock` |
{%- endif %}
{%- ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{%- ifversion fpt or ghec or ghes or ghae > 3.3 %}
| Python Poetry | Python | `poetry.lock` | `poetry.lock`, `pyproject.toml` |
{%- endif %}
| RubyGems | Ruby | `Gemfile.lock` | `Gemfile.lock`, `Gemfile`, `*.gemspec` |

1
content/codespaces/troubleshooting/index.md
View File

@@ -23,3 +23,4 @@ children:
- /troubleshooting-gpg-verification-for-github-codespaces
- /working-with-support-for-github-codespaces
---

2
content/codespaces/troubleshooting/troubleshooting-included-usage.md
View File

@@ -2,7 +2,7 @@
title: Getting the most out of your included usage
shortTitle: Included usage
allowTitleToDifferFromFilename: true
intro: Find out about the free use of {% data variables.product.prodname_github_codespaces %} that's included with personal accounts.
intro: 'Find out about the free use of {% data variables.product.prodname_github_codespaces %} that''s included with personal accounts.'
versions:
fpt: '*'
ghec: '*'

9
content/developers/apps/building-github-apps/creating-a-github-app-using-url-parameters.md
View File

@@ -47,8 +47,7 @@ The complete list of available query parameters, permissions, and events is list
`webhook_active` | `boolean` | Set to `false` to disable webhook. Webhook is enabled by default.
`webhook_url` | `string` | The full URL that you would like to send webhook event payloads to.
{% ifversion ghae %}`webhook_secret` | `string` | You can specify a secret to secure your webhooks. See "[Securing your webhooks](/webhooks/securing/)" for more details.
{% endif %}`events` | `array of strings` | Webhook events. Some webhook events require `read` or `write` permissions for a resource before you can select the event when registering a new {% data variables.product.prodname_github_app %}. See the "[{% data variables.product.prodname_github_app %} webhook events](#github-app-webhook-events)" section for available events and their required permissions. You can select multiple events in a query string. For example, `events[]=public&events[]=label`.{% ifversion ghes < 3.4 %}
`domain` | `string` | The URL of a content reference.{% endif %}
{% endif %}`events` | `array of strings` | Webhook events. Some webhook events require `read` or `write` permissions for a resource before you can select the event when registering a new {% data variables.product.prodname_github_app %}. See the "[{% data variables.product.prodname_github_app %} webhook events](#github-app-webhook-events)" section for available events and their required permissions. You can select multiple events in a query string. For example, `events[]=public&events[]=label`.
`single_file_name` | `string` | This is a narrowly-scoped permission that allows the app to access a single file in any repository. When you set the `single_file` permission to `read` or `write`, this field provides the path to the single file your {% data variables.product.prodname_github_app %} will manage. {% ifversion fpt or ghes or ghec %} If you need to manage multiple files, see `single_file_paths` below. {% endif %}{% ifversion fpt or ghes or ghec %}
`single_file_paths` | `array of strings` | This allows the app to access up ten specified files in a repository. When you set the `single_file` permission to `read` or `write`, this array can store the paths for up to ten files that your {% data variables.product.prodname_github_app %} will manage. These files all receive the same permission set by `single_file`, and do not have separate individual permissions. When two or more files are configured, the API returns `multiple_single_files=true`, otherwise it returns `multiple_single_files=false`.{% endif %}
@@ -60,8 +59,7 @@ Permission | Description
---------- | -----------
[`administration`](/rest/reference/permissions-required-for-github-apps#administration) | Grants access to various endpoints for organization and repository administration. Can be one of: `none`, `read`, or `write`.{% ifversion fpt or ghec %}
[`blocking`](/rest/reference/permissions-required-for-github-apps#blocking-users) | Grants access to the [Blocking Users API](/rest/reference/users#blocking). Can be one of: `none`, `read`, or `write`.{% endif %}
[`checks`](/rest/reference/permissions-required-for-github-apps#checks) | Grants access to the [Checks API](/rest/reference/checks). Can be one of: `none`, `read`, or `write`.{% ifversion ghes < 3.4 %}
`content_references` | Grants access to the "[Create a content attachment](/rest/reference/apps#create-a-content-attachment)" endpoint. Can be one of: `none`, `read`, or `write`.{% endif %}
[`checks`](/rest/reference/permissions-required-for-github-apps#checks) | Grants access to the [Checks API](/rest/reference/checks). Can be one of: `none`, `read`, or `write`.
[`contents`](/rest/reference/permissions-required-for-github-apps#contents) | Grants access to various endpoints that allow you to modify repository contents. Can be one of: `none`, `read`, or `write`.
[`deployments`](/rest/reference/permissions-required-for-github-apps#deployments) | Grants access to the [Deployments API](/rest/reference/repos#deployments). Can be one of: `none`, `read`, or `write`.{% ifversion fpt or ghes or ghec %}
[`emails`](/rest/reference/permissions-required-for-github-apps#email-addresses) | Grants access to the [Emails API](/rest/reference/users#emails). Can be one of: `none`, `read`, or `write`.{% endif %}
@@ -96,8 +94,7 @@ Webhook event name | Required permission | Description
------------------ | ------------------- | -----------
[`check_run`](/webhooks/event-payloads/#check_run) |`checks` | {% data reusables.webhooks.check_run_short_desc %}
[`check_suite`](/webhooks/event-payloads/#check_suite) |`checks` | {% data reusables.webhooks.check_suite_short_desc %}
[`commit_comment`](/webhooks/event-payloads/#commit_comment) | `contents` | {% data reusables.webhooks.commit_comment_short_desc %}{% ifversion ghes < 3.4 %}
[`content_reference`](/webhooks/event-payloads/#content_reference) |`content_references` | {% data reusables.webhooks.content_reference_short_desc %}{% endif %}
[`commit_comment`](/webhooks/event-payloads/#commit_comment) | `contents` | {% data reusables.webhooks.commit_comment_short_desc %}
[`create`](/webhooks/event-payloads/#create) | `contents` | {% data reusables.webhooks.create_short_desc %}
[`delete`](/webhooks/event-payloads/#delete) | `contents` | {% data reusables.webhooks.delete_short_desc %}
[`deployment`](/webhooks/event-payloads/#deployment) | `deployments` | {% data reusables.webhooks.deployment_short_desc %}

4
content/developers/apps/building-oauth-apps/scopes-for-oauth-apps.md
View File

@@ -77,8 +77,8 @@ Name | Description
&emsp;`read:gpg_key`| List and view details for GPG keys.{% ifversion fpt or ghec %}
**`codespace`** | Grants the ability to create and manage codespaces. Codespaces can expose a GITHUB_TOKEN which may have a different set of scopes. For more information, see "[Security in {% data variables.product.prodname_github_codespaces %}](/codespaces/codespaces-reference/security-in-github-codespaces#authentication)."{% endif %}
**`workflow`** | Grants the ability to add and update {% data variables.product.prodname_actions %} workflow files. Workflow files can be committed without this scope if the same file (with both the same path and contents) exists on another branch in the same repository. Workflow files can expose `GITHUB_TOKEN` which may have a different set of scopes. For more information, see "[Authentication in a workflow](/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token)."{% ifversion not fpt %}
**`admin:enterprise`** | Gives full control of enterprise functionality. For more information, see "[Managing enterprise accounts](/graphql/guides/managing-enterprise-accounts)" in the GraphQL API documentation.<br><br>Includes `manage_runners:enterprise`{% ifversion ghec or ghes > 3.3 %}, `manage_billing:enterprise`,{% endif %} and `read:enterprise`.
&emsp;`manage_runners:enterprise` | Gives full control over self-hosted runners within the enterprise. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners)." {% ifversion ghec or ghes > 3.3 %}
**`admin:enterprise`** | Gives full control of enterprise functionality. For more information, see "[Managing enterprise accounts](/graphql/guides/managing-enterprise-accounts)" in the GraphQL API documentation.<br><br>Includes `manage_runners:enterprise`{% ifversion ghec or ghes %}, `manage_billing:enterprise`,{% endif %} and `read:enterprise`.
&emsp;`manage_runners:enterprise` | Gives full control over self-hosted runners within the enterprise. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners)." {% ifversion ghec or ghes %}
&emsp;`manage_billing:enterprise` | Read and write enterprise billing data. For more information, see "[Billing](/rest/billing)" in the REST API documentation. {% endif %}
&emsp;`read:enterprise` | Read all data on an enterprise profile. Does not include profile data of enterprise members or organizations.{% endif %}{% ifversion read-audit-scope %}
**`read:audit_log`** | Read audit log data.{% endif %}

1
content/developers/apps/guides/index.md
View File

@@ -12,7 +12,6 @@ topics:
- GitHub Apps
children:
- /using-the-github-api-in-your-app
- /using-content-attachments
- /creating-ci-tests-with-the-checks-api
---

179
content/developers/apps/guides/using-content-attachments.md
View File

@@ -1,179 +0,0 @@
---
title: Using content attachments
intro: Content attachments allow a GitHub App to provide more information in GitHub for URLs that link to registered domains. GitHub renders the information provided by the app under the URL in the body or comment of an issue or pull request.
redirect_from:
- /apps/using-content-attachments
- /developers/apps/using-content-attachments
versions:
ghes: <3.4
topics:
- GitHub Apps
---
{% data reusables.pre-release-program.content-attachments-public-beta %}
## About content attachments
A GitHub App can register domains that will trigger `content_reference` events. When someone includes a URL that links to a registered domain in the body or comment of an issue or pull request, the app receives the [`content_reference` webhook](/webhooks/event-payloads/#content_reference). You can use content attachments to visually provide more context or data for the URL added to an issue or pull request. The URL must be a fully-qualified URL, starting with either `http://` or `https://`. URLs that are part of a markdown link are ignored and don't trigger the `content_reference` event.
Before you can use the {% data variables.product.prodname_unfurls %} API, you'll need to configure content references for your GitHub App:
* Give your app `Read & write` permissions for "Content references."
* Register up to 5 valid, publicly accessible domains when configuring the "Content references" permission. Do not use IP addresses when configuring content reference domains. You can register a domain name (example.com) or a subdomain (subdomain.example.com).
* Subscribe your app to the "Content reference" event.
Once your app is installed on a repository, issue or pull request comments in the repository that contain URLs for your registered domains will generate a content reference event. The app must create a content attachment within six hours of the content reference URL being posted.
Content attachments will not retroactively update URLs. It only works for URLs added to issues or pull requests after you configure the app using the requirements outlined above and then someone installs the app on their repository.
See "[Creating a GitHub App](/apps/building-github-apps/creating-a-github-app/)" or "[Editing a GitHub App's permissions](/apps/managing-github-apps/editing-a-github-app-s-permissions/)" for the steps needed to configure GitHub App permissions and event subscriptions.
## Implementing the content attachment flow
The content attachment flow shows you the relationship between the URL in the issue or pull request, the `content_reference` webhook event, and the REST API endpoint you need to call to update the issue or pull request with additional information:
**Step 1.** Set up your app using the guidelines outlined in [About content attachments](#about-content-attachments). You can also use the [Probot App example](#example-using-probot-and-github-app-manifests) to get started with content attachments.
**Step 2.** Add the URL for the domain you registered to an issue or pull request. You must use a fully qualified URL that starts with `http://` or `https://`.
![URL added to an issue](/assets/images/github-apps/github_apps_content_reference.png)
**Step 3.** Your app will receive the [`content_reference` webhook](/webhooks/event-payloads/#content_reference) with the action `created`.
``` json
{
"action": "created",
"content_reference": {
"id": 17,
"node_id": "MDE2OkNvbnRlbnRSZWZlcmVuY2UxNjA5",
"reference": "errors.ai"
},
"repository": {
"full_name": "Codertocat/Hello-World",
},
"sender": {...},
"installation": {
"id": 371641,
"node_id": "MDIzOkludGVncmF0aW9uSW5zdGFsbGF0aW9uMzcxNjQx"
}
}
```
**Step 4.** The app uses the `content_reference` `id` and `repository` `full_name` fields to [Create a content attachment](/rest/reference/apps#create-a-content-attachment) using the REST API. You'll also need the `installation` `id` to authenticate as a [GitHub App installation](/apps/building-github-apps/authenticating-with-github-apps/#authenticating-as-an-installation).
{% data reusables.pre-release-program.corsair-preview %}
{% data reusables.pre-release-program.api-preview-warning %}
The `body` parameter can contain markdown:
```shell
curl -X POST \
{% data variables.product.api_url_code %}/repos/Codertocat/Hello-World/content_references/17/attachments \
-H 'Accept: application/vnd.github.corsair-preview+json' \
-H 'Authorization: Bearer $INSTALLATION_TOKEN' \
-d '{
"title": "[A-1234] Error found in core/models.py file",
"body": "You have used an email that already exists for the user_email_uniq field.\n ## DETAILS:\n\nThe (email)=(Octocat@github.com) already exists.\n\n The error was found in core/models.py in get_or_create_user at line 62.\n\n self.save()"
}'
```
For more information about creating an installation token, see "[Authenticating as a GitHub App](/apps/building-github-apps/authenticating-with-github-apps/#authenticating-as-an-installation)."
**Step 5.** You'll see the new content attachment appear under the link in a pull request or issue comment:
![Content attached to a reference in an issue](/assets/images/github-apps/content_reference_attachment.png)
## Using content attachments in GraphQL
We provide the `node_id` in the [`content_reference` webhook](/webhooks/event-payloads/#content_reference) event so you can refer to the `createContentAttachment` mutation in the GraphQL API.
{% data reusables.pre-release-program.corsair-preview %}
{% data reusables.pre-release-program.api-preview-warning %}
For example:
``` graphql
mutation {
createContentAttachment(input: {
contentReferenceId: "MDE2OkNvbnRlbnRSZWZlcmVuY2UxNjA1",
title: "[A-1234] Error found in core/models.py file",
body:"You have used an email that already exists for the user_email_uniq field.\n ## DETAILS:\n\nThe (email)=(Octocat@github.com) already exists.\n\n The error was found in core/models.py in get_or_create_user at line 62.\n\n self.save()"
}) {
contentAttachment {
... on ContentAttachment {
id
title
body
}
}
}
}
```
Example `curl` command:
```shell
curl -X "POST" "{% data variables.product.api_url_code %}/graphql" \
-H 'Authorization: Bearer $INSTALLATION_TOKEN' \
-H 'Accept: application/vnd.github.corsair-preview+json' \
-H 'Content-Type: application/json; charset=utf-8' \
-d $'{
"query": "mutation {\\n createContentAttachment(input:{contentReferenceId: \\"MDE2OkNvbnRlbnRSZWZlcmVuY2UxNjA1\\", title:\\"[A-1234] Error found in core/models.py file\\", body:\\"You have used an email that already exists for the user_email_uniq field.\n ## DETAILS:\n\nThe (email)=(Octocat@github.com) already exists.\n\n The error was found in core/models.py in get_or_create_user at line 62.\n\n\self.save()\\"}) {\\n contentAttachment {\\n id,\\n title,\\n body\\n }\\n }\\n}"
}'
```
For more information on `node_id`, see "[Using Global Node IDs](/graphql/guides/using-global-node-ids)."
## Example using Probot and GitHub App Manifests
To quickly setup a GitHub App that can use the {% data variables.product.prodname_unfurls %} API, you can use [Probot](https://probot.github.io/). See "[Creating GitHub Apps from a manifest](/apps/building-github-apps/creating-github-apps-from-a-manifest/)" to learn how Probot uses GitHub App Manifests.
To create a Probot App, follow these steps:
1. [Generate a new GitHub App](https://probot.github.io/docs/development/#generating-a-new-app).
2. Open the project you created, and customize the settings in the `app.yml` file. Subscribe to the `content_reference` event and enable `content_references` write permissions:
``` yml
default_events:
- content_reference
# The set of permissions needed by the GitHub App. The format of the object uses
# the permission name for the key (for example, issues) and the access type for
# the value (for example, write).
# Valid values are `read`, `write`, and `none`
default_permissions:
content_references: write
content_references:
- type: domain
value: errors.ai
- type: domain
value: example.org
```
3. Add this code to the `index.js` file to handle `content_reference` events and call the REST API:
``` javascript
module.exports = app => {
// Your code here
app.log('Yay, the app was loaded!')
app.on('content_reference.created', async context => {
console.log('Content reference created!', context.payload)
// Call the "Create a content reference" REST endpoint
await context.github.request({
method: 'POST',
headers: { accept: 'application/vnd.github.corsair-preview+json' },
url: `/repos/${context.payload.repository.full_name}/content_references/${context.payload.content_reference.id}/attachments`,
// Parameters
title: '[A-1234] Error found in core/models.py file',
body: 'You have used an email that already exists for the user_email_uniq field.\n ## DETAILS:\n\nThe (email)=(Octocat@github.com) already exists.\n\n The error was found in core/models.py in get_or_create_user at line 62.\n\nself.save()'
})
})
}
```
4. [Run the GitHub App locally](https://probot.github.io/docs/development/#running-the-app-locally). Navigate to `http://localhost:3000`, and click the **Register GitHub App** button:
![Register a Probot GitHub App](/assets/images/github-apps/github_apps_probot-registration.png)
5. Install the app on a test repository.
6. Create an issue in your test repository.
7. Add a comment to the issue you opened that includes the URL you configured in the `app.yml` file.
8. Take a look at the issue comment and you'll see an update that looks like this:
![Content attached to a reference in an issue](/assets/images/github-apps/content_reference_attachment.png)

8
content/get-started/using-github/keyboard-shortcuts.md
View File

@@ -55,10 +55,10 @@ The following sections list some of the available keyboard shortcuts, organized
|<kbd>></kbd> | Opens a repository or pull request in the {% data variables.codespaces.serverless %} editor, in a new browser tab. You must be signed in to use the editor. For more information, see "[The {% data variables.codespaces.serverless %} web-based editor](/codespaces/the-githubdev-web-based-editor)."{% endif %}
|<kbd>Command</kbd>+<kbd>B</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>B</kbd> (Windows/Linux) | Inserts Markdown formatting for bolding text
|<kbd>Command</kbd>+<kbd>I</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>I</kbd> (Windows/Linux) | Inserts Markdown formatting for italicizing text
|<kbd>Command</kbd>+<kbd>K</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>K</kbd> (Windows/Linux) | Inserts Markdown formatting for creating a link{% ifversion fpt or ghec or ghae or ghes > 3.3 %}
|<kbd>Command</kbd>+<kbd>K</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>K</kbd> (Windows/Linux) | Inserts Markdown formatting for creating a link
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>7</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>7</kbd> (Windows/Linux) | Inserts Markdown formatting for an ordered list
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>8</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>8</kbd> (Windows/Linux) | Inserts Markdown formatting for an unordered list
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>.</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>.</kbd> (Windows/Linux) | Inserts Markdown formatting for a quote{% endif %}
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>.</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>.</kbd> (Windows/Linux) | Inserts Markdown formatting for a quote
|<kbd>E</kbd> | Open source code file in the **Edit file** tab
|<kbd>Command</kbd>+<kbd>F</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>F</kbd> (Windows/Linux) | Start searching in file editor
|<kbd>Command</kbd>+<kbd>G</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>G</kbd> (Windows/Linux) | Find next
@@ -94,8 +94,8 @@ For more keyboard shortcuts, see the [CodeMirror documentation](https://codemirr
|<kbd>Command</kbd>+<kbd>E</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>E</kbd> (Windows/Linux) | Inserts Markdown formatting for code or a command within a line{% ifversion fpt or ghae > 3.3 or ghes or ghec %}
|<kbd>Command</kbd>+<kbd>K</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>K</kbd> (Windows/Linux) | Inserts Markdown formatting for creating a link{% endif %}{% ifversion fpt or ghae > 3.5 or ghes > 3.5 or ghec %}
|<kbd>Command</kbd>+<kbd>V</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>V</kbd> (Windows/Linux) | Creates a Markdown link when applied over highlighted text{% endif %}
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>P</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>P</kbd> (Windows/Linux) | Toggles between the **Write** and **Preview** comment tabs{% ifversion fpt or ghae or ghes > 3.4 or ghec %}
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>V</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>V</kbd> (Windows/Linux) | Pastes HTML link as plain text{% endif %}
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>P</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>P</kbd> (Windows/Linux) | Toggles between the **Write** and **Preview** comment tabs
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>V</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>V</kbd> (Windows/Linux) | Pastes HTML link as plain text
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>Option</kbd>+<kbd>V</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>Alt</kbd>+<kbd>V</kbd> (Windows/Linux) | Pastes HTML link as plain text
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>7</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>7</kbd> (Windows/Linux) | Inserts Markdown formatting for an ordered list
|<kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>8</kbd> (Mac) or </br> <kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>8</kbd> (Windows/Linux) | Inserts Markdown formatting for an unordered list

16
content/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax.md
View File

@@ -116,7 +116,7 @@ Here are the currently supported color models.
## Links
You can create an inline link by wrapping link text in brackets `[ ]`, and then wrapping the URL in parentheses `( )`. You can also use the keyboard shortcut <kbd>Command</kbd>+<kbd>K</kbd> to create a link.{% ifversion fpt or ghae > 3.3 or ghes > 3.3 or ghec %} When you have text selected, you can paste a URL from your clipboard to automatically create a link from the selection.{% endif %}
You can create an inline link by wrapping link text in brackets `[ ]`, and then wrapping the URL in parentheses `( )`. You can also use the keyboard shortcut <kbd>Command</kbd>+<kbd>K</kbd> to create a link.{% ifversion fpt or ghae > 3.3 or ghes or ghec %} When you have text selected, you can paste a URL from your clipboard to automatically create a link from the selection.{% endif %}
{% ifversion fpt or ghae > 3.5 or ghes > 3.5 or ghec %} You can also create a Markdown hyperlink by highlighting the text and using the keyboard shortcut <kbd>Command</kbd>+<kbd>V</kbd>. If you'd like to replace the text with the link, use the keyboard shortcut <kbd>Command</kbd>+<kbd>Shift</kbd>+<kbd>V</kbd>.{% endif %}
@@ -172,7 +172,7 @@ Here are some examples for using relative links to display an image.
For more information, see "[Relative Links](#relative-links)."
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
### Specifying the theme an image is shown to
You can specify the theme an image is displayed for in Markdown by using the HTML `<picture>` element in combination with the `prefers-color-scheme` media feature. We distinguish between light and dark color modes, so there are two options available. You can use these options to display images optimized for dark or light backgrounds. This is particularly helpful for transparent PNG images.
@@ -291,18 +291,6 @@ For more information, see "[Autolinked references and URLs](/get-started/writing
{% data reusables.repositories.autolink-references %}
{% ifversion ghes < 3.4 %}
## Content attachments
Some {% data variables.product.prodname_github_apps %} provide information in {% data variables.product.product_name %} for URLs that link to their registered domains. {% data variables.product.product_name %} renders the information provided by the app under the URL in the body or comment of an issue or pull request.
![Content attachment](/assets/images/github-apps/content_reference_attachment.png)
To see content attachments, you must have a {% data variables.product.prodname_github_app %} that uses the Content Attachments API installed on the repository.{% ifversion fpt or ghec %} For more information, see "[Installing an app in your personal account](/get-started/customizing-your-github-workflow/purchasing-and-installing-apps-in-github-marketplace/installing-an-app-in-your-personal-account)" and "[Installing an app in your organization](/get-started/customizing-your-github-workflow/purchasing-and-installing-apps-in-github-marketplace/installing-an-app-in-your-organization)."{% endif %}
Content attachments will not be displayed for URLs that are part of a markdown link.
For more information about building a {% data variables.product.prodname_github_app %} that uses content attachments, see "[Using Content Attachments](/developers/apps/guides/using-content-attachments)."{% endif %}
## Uploading assets

2
content/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/filtering-projects.md
View File

@@ -1,6 +1,6 @@
---
title: 'Filtering {% data variables.projects.projects_v2 %}'
intro: "Use filters to choose which items appear in your project's views."
intro: Use filters to choose which items appear in your project's views.
miniTocMaxHeadingLevel: 3
versions:
feature: projects-v2

2
content/organizations/collaborating-with-groups-in-organizations/customizing-your-organizations-profile.md
View File

@@ -4,7 +4,7 @@ intro: You can share information about your organization by customizing your org
versions:
fpt: '*'
ghec: '*'
ghes: '>3.3'
ghes: '*'
topics:
- Organizations
shortTitle: Customize organization profile

3
content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md
View File

@@ -773,7 +773,6 @@ For more information, see "[Managing the publication of {% data variables.produc
| `update` | Triggered when changes to a custom pattern are saved for {% data variables.product.prodname_secret_scanning %} in a repository. For more information, see "[Defining custom patterns for {% data variables.product.prodname_secret_scanning %}](/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#editing-a-custom-pattern)."
| `delete` | Triggered when a custom pattern is removed from {% data variables.product.prodname_secret_scanning %} in a repository. For more information, see "[Defining custom patterns for {% data variables.product.prodname_secret_scanning %}](/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning#removing-a-custom-pattern)."
{% endif %}{% ifversion secret-scanning-custom-pattern-push-protection-audit %}
### `repository_secret_scanning_custom_pattern_push_protection` category actions
@@ -905,7 +904,7 @@ For more information, see "[Managing the publication of {% data variables.produc
{% data reusables.actions.actions-audit-events-workflow %}
## Further reading
- "[Keeping your organization secure](/articles/keeping-your-organization-secure)"{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
- "[Keeping your organization secure](/articles/keeping-your-organization-secure)"{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
{%- ifversion fpt or ghec %}
- "[Exporting member information for your organization](/organizations/managing-membership-in-your-organization/exporting-member-information-for-your-organization)"{% endif %}
{%- endif %}

2
content/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization.md
View File

@@ -28,7 +28,7 @@ Members of a team with the security manager role have only the permissions requi
Additional functionality, including a security overview for the organization, is available in organizations that use {% data variables.product.prodname_ghe_cloud %} with {% data variables.product.prodname_advanced_security %}. For more information, see the [{% data variables.product.prodname_ghe_cloud %} documentation](/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization).
{% endif %}
If a team has the security manager role, people with admin access to the team and a specific repository can change the team's level of access to that repository but cannot remove the access. For more information, see "[Managing team access to an organization repository](/organizations/managing-access-to-your-organizations-repositories/managing-team-access-to-an-organization-repository){% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}" and "[Managing teams and people with access to your repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository)."{% else %}."{% endif %}
If a team has the security manager role, people with admin access to the team and a specific repository can change the team's level of access to that repository but cannot remove the access. For more information, see "[Managing team access to an organization repository](/organizations/managing-access-to-your-organizations-repositories/managing-team-access-to-an-organization-repository){% ifversion fpt or ghec or ghes or ghae > 3.3 %}" and "[Managing teams and people with access to your repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository)."{% else %}."{% endif %}
![Manage repository access UI with security managers](/assets/images/help/organizations/repo-access-security-managers.png)

2
content/organizations/managing-user-access-to-your-organizations-repositories/adding-outside-collaborators-to-repositories-in-your-organization.md
View File

@@ -39,7 +39,7 @@ If your organization requires two-factor authentication, all outside collaborato
## Adding outside collaborators to a repository
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
You can give outside collaborators access to a repository in your repository settings. For more information, see "[Managing teams and people with access to your repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository#inviting-a-team-or-person)."
{% else %}
{% data reusables.repositories.navigate-to-repo %}

2
content/organizations/managing-user-access-to-your-organizations-repositories/managing-an-individuals-access-to-an-organization-repository.md
View File

@@ -25,7 +25,7 @@ When you remove a collaborator from a repository in your organization, the colla
{% data reusables.repositories.deleted_forks_from_private_repositories_warning %}
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
## Managing an individual's access to an organization repository
You can give a person access to a repository or change a person's level of access to a repository in your repository settings. For more information, see "[Managing teams and people with access to your repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository)."
{% else %}

4
content/organizations/managing-user-access-to-your-organizations-repositories/managing-team-access-to-an-organization-repository.md
View File

@@ -29,7 +29,7 @@ People with admin access to a repository can manage team access to the repositor
## Giving a team access to a repository
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
You can give a team access to a repository or change a team's level of access to a repository in your repository settings. For more information, see "[Managing teams and people with access to your repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository#inviting-a-team-or-person)."
{% else %}
{% data reusables.profile.access_org %}
@@ -45,7 +45,7 @@ You can give a team access to a repository or change a team's level of access to
{% endif %}
## Removing a team's access to a repository
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
You can remove a team's access to an organization repository in your repository settings. For more information, see "[Managing teams and people with access to your repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository#removing-access-for-a-team-or-person)."
If a team has direct access to a repository, you can remove that team's access to the repository. If a team's access to the repository is inherited from a parent team, you must remove the repository from the parent team in order to remove the repository from child teams.

2
content/organizations/managing-user-access-to-your-organizations-repositories/removing-an-outside-collaborator-from-an-organization-repository.md
View File

@@ -61,7 +61,7 @@ If you only want to remove an outside collaborator from certain repositories in
8. To confirm, click **Remove access**.
![Confirm outside collaborator who will be removed from the repository](/assets/images/help/teams/confirm-remove-outside-collaborator-from-a-repository.png)
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
You can also remove an outside collaborator from a repository in the access overview in your repository settings. For more information, see "[Managing teams and people with access to your repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository#removing-access-for-a-team-or-person)."
{% endif %}
## Further reading

4
content/organizations/managing-user-access-to-your-organizations-repositories/viewing-people-with-access-to-your-repository.md
View File

@@ -25,14 +25,14 @@ You can use this information to help off-board people, gather data for complianc
Organizations that use {% data variables.product.prodname_ghe_cloud %} can also export a CSV list of people who have access to a repository. For more information, see [the {% data variables.product.prodname_ghe_cloud %} documentation](/enterprise-cloud@latest/organizations/managing-access-to-your-organizations-repositories/viewing-people-with-access-to-your-repository).
{% endif %}
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
![Access management overview](/assets/images/help/repository/manage-access-overview.png)
{% else %}
![Repository people permissions list](/assets/images/help/repository/repository-permissions-list.png)
{% endif %}
## Viewing people with access to your repository
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
You can see a combined overview of teams and people with access to your repository in your repository settings. For more information, see "[Managing teams and people with access to your repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository#about-access-management-for-repositories)."
{% else %}
{% data reusables.repositories.navigate-to-repo %}

4
content/organizations/organizing-members-into-teams/managing-code-review-settings-for-your-team.md
View File

@@ -83,9 +83,7 @@ Any team members that have set their status to "Busy" will not be selected for r
![Routing algorithm dropdown](/assets/images/help/teams/review-assignment-algorithm.png)
1. Optionally, to always skip certain members of the team, select **Never assign certain team members**. Then, select one or more team members you'd like to always skip.
![Never assign certain team members checkbox and dropdown](/assets/images/help/teams/review-assignment-skip-members.png)
{% ifversion ghes < 3.4 %}
1. Optionally, to only notify the team members chosen by code review assignment for each pull review request, under "Notifications" select **If assigning team members, don't notify the entire team.**
{%- endif %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
1. Optionally, to include members of child teams as potential reviewers when assigning requests, select **Child team members**.
1. Optionally, to count any members whose review has already been requested against the total number of members to assign, select **Count existing requests**.

3
content/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request.md
View File

@@ -28,14 +28,11 @@ You can review changes in a pull request one file at a time. While reviewing the
{% data reusables.repositories.sidebar-pr %}
{% data reusables.repositories.choose-pr-review %}
{% data reusables.repositories.changed-files %}
{% ifversion fpt or ghec or ghes > 3.3 or ghae %}
You can change the format of the diff view in this tab by clicking {% octicon "gear" aria-label="The Settings gear" %} and choosing the unified or split view. The choice you make will apply when you view the diff for other pull requests.
![Diff view settings](/assets/images/help/pull_requests/diff-view-settings.png)
You can also choose to hide whitespace differences. The choice you make only applies to this pull request and will be remembered the next time you visit this page.
{% endif %}
1. Optionally, filter the files to show only the files you want to review{% ifversion pr-tree-view %} or use the file tree to navigate to a specific file{% endif %}. For more information, see "[Filtering files in a pull request](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/filtering-files-in-a-pull-request)."
{% data reusables.repositories.start-line-comment %}
{% data reusables.repositories.type-line-comment %}

4
content/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches.md
View File

@@ -99,7 +99,7 @@ Before you can enable required status checks, you must configure the repository
After enabling required status checks, all required status checks must pass before collaborators can merge changes into the protected branch. After all required status checks pass, any commits must either be pushed to another branch and then merged or pushed directly to the protected branch.
Any person or integration with write permissions to a repository can set the state of any status check in the repository{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}, but in some cases you may only want to accept a status check from a specific {% data variables.product.prodname_github_app %}. When you add a required status check, you can select an app that has recently set this check as the expected source of status updates.{% endif %} If the status is set by any other person or integration, merging won't be allowed. If you select "any source", you can still manually verify the author of each status, listed in the merge box.
Any person or integration with write permissions to a repository can set the state of any status check in the repository{% ifversion fpt or ghes or ghae > 3.3 or ghec %}, but in some cases you may only want to accept a status check from a specific {% data variables.product.prodname_github_app %}. When you add a required status check, you can select an app that has recently set this check as the expected source of status updates.{% endif %} If the status is set by any other person or integration, merging won't be allowed. If you select "any source", you can still manually verify the author of each status, listed in the merge box.
You can set up required status checks to either be "loose" or "strict." The type of required status check you choose determines whether your branch is required to be up to date with the base branch before merging.
@@ -191,7 +191,7 @@ You can only give push access to a protected branch, or give permission to creat
### Allow force pushes
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
By default, {% data variables.product.product_name %} blocks force pushes on all protected branches. When you enable force pushes to a protected branch, you can choose one of two groups who can force push:
1. Allow everyone with at least write permissions to the repository to force push to the branch, including those with admin permissions.

6
content/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule.md
View File

@@ -50,7 +50,7 @@ When you create a branch rule, the branch you specify doesn't have to exist yet
{% data reusables.repositories.sidebar-settings %}
{% data reusables.repositories.repository-branches %}
{% data reusables.repositories.add-branch-protection-rules %}
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
1. Optionally, enable required pull requests.
- Under "Protect matching branches", select **Require a pull request before merging**.
![Pull request review restriction checkbox](/assets/images/help/repository/PR-reviews-required-updated.png)
@@ -67,7 +67,7 @@ When you create a branch rule, the branch you specify doesn't have to exist yet
![Dismiss stale pull request approvals when new commits are pushed checkbox](/assets/images/help/repository/PR-reviews-required-dismiss-stale.png)
- Optionally, to require review from a code owner when the pull request affects code that has a designated owner, select **Require review from Code Owners**. For more information, see "[About code owners](/github/creating-cloning-and-archiving-repositories/about-code-owners)."
![Require review from code owners](/assets/images/help/repository/PR-review-required-code-owner.png)
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
- Optionally, to allow specific actors to push code to the branch without creating pull requests when they're required, select **Allow specified actors to bypass required pull requests**. Then, search for and select the actors who should be allowed to skip creating a pull request.
![Allow specific actors to bypass pull request requirements checkbox]{% ifversion integration-branch-protection-exceptions %}(/assets/images/help/repository/PR-bypass-requirements-with-apps.png){% else %}(/assets/images/help/repository/PR-bypass-requirements.png){% endif %}
{% endif %}
@@ -121,7 +121,7 @@ When you create a branch rule, the branch you specify doesn't have to exist yet
![Branch restriction search]{% ifversion restrict-pushes-create-branch %}(/assets/images/help/repository/restrict-branch-search-with-create.png){% else %}(/assets/images/help/repository/restrict-branch-search.png){% endif %}
1. Optionally, under "Rules applied to everyone including administrators", select **Allow force pushes**.
![Allow force pushes option](/assets/images/help/repository/allow-force-pushes.png)
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
Then, choose who can force push to the branch.
- Select **Everyone** to allow everyone with at least write permissions to the repository to force push to the branch, including those with admin permissions.
- Select **Specify who can force push** to allow only specific actors to force push to the branch. Then, search for and select those actors.

2
content/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks.md
View File

@@ -111,7 +111,7 @@ Now the checks will always pass whenever someone sends a pull request that doesn
{% endnote %}
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
## Required status checks from unexpected sources
It's also possible for a protected branch to require a status check from a specific {% data variables.product.prodname_github_app %}. If you see a message similar to the following, then you should verify that the check listed in the merge box was set by the expected app.

2
content/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch.md
View File

@@ -1,7 +1,7 @@
---
title: Renaming a branch
intro: You can change the name of a branch in a repository.
permissions: 'People with write permissions to a repository can rename a branch in the repository unless it is the [default branch](/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-branches#about-the-default-branch){% ifversion fpt or ghec or ghes > 3.3 %} or a [protected branch](/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches){% endif %}. People with admin permissions can rename the default branch{% ifversion fpt or ghec or ghes > 3.3 %} and protected branches{% endif %}.'
permissions: 'People with write permissions to a repository can rename a branch in the repository unless it is the [default branch](/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-branches#about-the-default-branch){% ifversion fpt or ghec or ghes %} or a [protected branch](/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches){% endif %}. People with admin permissions can rename the default branch{% ifversion fpt or ghec or ghes %} and protected branches{% endif %}.'
versions:
fpt: '*'
ghes: '*'

3
content/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository.md
View File

@@ -146,7 +146,7 @@ By default, when you create a new repository in your personal account, workflows
1. Click **Save** to apply the settings.
{% endif %}
{% ifversion ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion ghes or ghae > 3.3 or ghec %}
## Allowing access to components in an internal repository
{% ifversion internal-actions %}Actions and reusable workflows in your internal repositories can be shared with internal and private repositories in the same organization or enterprise.{% else %}Members of your enterprise can use internal repositories to work on projects without sharing information publicly.{% endif %} For information about internal repositories, see "[About repositories](/repositories/creating-and-managing-repositories/about-repositories#about-internal-repositories)."
@@ -171,7 +171,6 @@ Actions and reusable workflows in your private repositories can be shared with o
You can use the steps below to configure whether actions and reusable workflows in a private repository can be accessed from outside the repository. For more information, see {% ifversion fpt %}"[Sharing actions and workflows from your private repository](/actions/creating-actions/sharing-actions-and-workflows-from-your-private-repository)" and "[Sharing actions and workflows with your organization](/actions/creating-actions/sharing-actions-and-workflows-with-your-organization)."{% else %}"[Sharing actions and workflows with your enterprise](/actions/creating-actions/sharing-actions-and-workflows-with-your-enterprise)."{% endif %} Alternatively, you can use the REST API to set, or get details of the level of access. For more information, see "[Get the level of access for workflows outside of the repository](/rest/actions/permissions#get-the-level-of-access-for-workflows-outside-of-the-repository)" and "[Set the level of access for workflows outside of the repository](/rest/actions/permissions#set-the-level-of-access-for-workflows-outside-of-the-repository)."
{% ifversion fpt %}
### Managing access for a private repository

2
content/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-teams-and-people-with-access-to-your-repository.md
View File

@@ -9,7 +9,7 @@ redirect_from:
versions:
fpt: '*'
ghec: '*'
ghes: '>3.3'
ghes: '*'
ghae: '>= 3.4'
topics:
- Repositories

4
content/repositories/releasing-projects-on-github/about-releases.md
View File

@@ -19,7 +19,7 @@ topics:
---
## About releases
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
![An overview of releases](/assets/images/help/releases/refreshed-releases-overview-with-contributors.png)
{% else %}
![An overview of releases](/assets/images/help/releases/releases-overview.png)
@@ -33,7 +33,7 @@ You can receive notifications when new releases are published in a repository wi
Anyone with read access to a repository can view and compare releases, but only people with write permissions to a repository can manage releases. For more information, see "[Managing releases in a repository](/github/administering-a-repository/managing-releases-in-a-repository)."
{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{% ifversion fpt or ghec or ghes or ghae > 3.3 %}
You can manually create release notes while managing a release. Alternatively, you can automatically generate release notes from a default template, or customize your own release notes template. For more information, see "[Automatically generated release notes](/repositories/releasing-projects-on-github/automatically-generated-release-notes)."
{% endif %}

2
content/repositories/releasing-projects-on-github/automatically-generated-release-notes.md
View File

@@ -5,7 +5,7 @@ permissions: Repository collaborators and people with write access to a reposito
versions:
fpt: '*'
ghec: '*'
ghes: '>3.3'
ghes: '*'
ghae: '>= 3.4'
topics:
- Repositories

8
content/repositories/releasing-projects-on-github/managing-releases-in-a-repository.md
View File

@@ -55,10 +55,10 @@ You can choose whether {% data variables.large_files.product_name_long %} ({% da
{%- data reusables.releases.previous-release-tag %}
1. Type a title and description for your release.
{%- ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %}
{%- ifversion fpt or ghec or ghes or ghae > 3.3 %}
If you @mention anyone in the description, the published release will include a **Contributors** section with an avatar list of all the mentioned users.
{%- endif %}
{% ifversion fpt or ghec or ghes > 3.3 %} Alternatively, you can automatically generate your release notes by clicking {% ifversion previous-release-tag %}**Generate release notes**{% else %}**Auto-generate release notes**{% endif %}.{% endif %}{% ifversion previous-release-tag %}
{% ifversion fpt or ghec or ghes %} Alternatively, you can automatically generate your release notes by clicking {% ifversion previous-release-tag %}**Generate release notes**{% else %}**Auto-generate release notes**{% endif %}.{% endif %}{% ifversion previous-release-tag %}
![Screenshot of the releases description](/assets/images/help/releases/releases_description_auto.png){% else %}
@@ -114,7 +114,7 @@ You can choose whether {% data variables.large_files.product_name_long %} ({% da
```shell
gh release create v1.3.2 --title "v1.3.2 (beta)" --notes "this is a beta release" --prerelease
```
{% ifversion fpt or ghes > 3.3 or ghae > 3.3 or ghec %}
{% ifversion fpt or ghes or ghae > 3.3 or ghec %}
If you @mention any {% data variables.product.product_name %} users in the notes, the published release on {% data variables.product.prodname_dotcom_the_website %} will include a **Contributors** section with an avatar list of all the mentioned users.
{% endif %}
@@ -133,7 +133,7 @@ If you @mention any {% data variables.product.product_name %} users in the notes
3. On the right side of the page, next to the release you want to edit, click **Edit release**.
![Edit a release](/assets/images/help/releases/edit-release.png)
{% endif %}
4. Edit the details for the release in the form, then click **Update release**.{% ifversion fpt or ghec or ghes > 3.3 or ghae > 3.3 %} If you add or remove any @mentions of GitHub users in the description, those users will be added or removed from the avatar list in the **Contributors** section of the release.{% endif %}
4. Edit the details for the release in the form, then click **Update release**.{% ifversion fpt or ghec or ghes or ghae > 3.3 %} If you add or remove any @mentions of GitHub users in the description, those users will be added or removed from the avatar list in the **Contributors** section of the release.{% endif %}
![Update a release](/assets/images/help/releases/update-release.png)
{% endwebui %}

2
content/rest/billing.md
View File

@@ -7,7 +7,7 @@ miniTocMaxHeadingLevel: 3
versions:
fpt: '*'
ghec: '*'
ghes: '>=3.4'
ghes: '*'
redirect_from:
- /rest/reference/billing
---

2
content/rest/dependabot/index.md
View File

@@ -4,7 +4,7 @@ intro: 'Use the REST API to interact with {% data variables.product.prodname_dep
allowTitleToDifferFromFilename: true
versions:
fpt: '*'
ghes: '>=3.4'
ghes: '*'
ghec: '*'
topics:
- API

2
content/rest/dependabot/secrets.md
View File

@@ -6,7 +6,7 @@ topics:
- API
versions:
fpt: '*'
ghes: '>=3.4'
ghes: '*'
ghec: '*'
allowTitleToDifferFromFilename: true
---

2
content/rest/enterprise-admin/billing.md
View File

@@ -2,7 +2,7 @@
title: Billing
intro: Use the REST API to retrieve the GitHub Advanced Security active committers for an enterprise per repository.
versions:
ghes: '>=3.4'
ghes: '*'
ghec: '*'
topics:
- API

2
content/rest/migrations/index.md
View File

@@ -9,7 +9,7 @@ redirect_from:
versions:
fpt: '*'
ghec: '*'
ghes: '>3.3'
ghes: '*'
ghae: '*'
topics:
- API

2
content/rest/migrations/orgs.md
View File

@@ -6,7 +6,7 @@ intro: 'Use the REST API to move a repository from {% data variables.product.pro
versions:
fpt: '*'
ghec: '*'
ghes: '>3.3'
ghes: '*'
ghae: '*'
topics:
- API

2
content/rest/migrations/users.md
View File

@@ -6,7 +6,7 @@ intro: 'Use the REST API to review, backup, or migrate your user data stored on
versions:
fpt: '*'
ghec: '*'
ghes: '>3.3'
ghes: '*'
ghae: '*'
topics:
- API

2
content/rest/orgs/custom-roles.md
View File

@@ -2,7 +2,7 @@
title: Custom Repository Roles
intro: Use the REST API to interact with custom repository roles.
versions:
ghes: '>=3.4'
ghes: '*'
ghec: '*'
topics:
- API

29
content/rest/overview/api-previews.md
View File

@@ -1,29 +0,0 @@
---
title: API previews
intro: You can use API previews to try out new features and provide feedback before these features become official.
redirect_from:
- /v3/previews
versions:
ghes: <3.4
topics:
- API
---
API previews let you try out new endpoints and changes to existing endpoints before they become part of the official {% data variables.product.prodname_dotcom %} API.
During the preview period, we may change some features based on developer feedback. If we do make changes, we'll announce them on the [developer blog](https://developer.github.com/changes/) without advance notice.
To access an API preview, you'll need to provide a custom [media type](/rest/overview/media-types) in the `Accept` header for your requests. Feature documentation for each preview specifies which custom media type to provide.
{% ifversion ghes < 3.4 %}
## Content attachments
You can now provide more information in {% data variables.product.prodname_dotcom %} for URLs that link to registered domains by using the API to manage {% data variables.product.prodname_unfurls %}. For more information, see "[Using content attachments](/apps/using-content-attachments/)."
**Custom media types:** `corsair-preview`
**Announced:** [2018-12-10](https://developer.github.com/changes/2018-12-10-content-attachments-api/)
{% endif %}

1
content/rest/overview/index.md
View File

@@ -15,7 +15,6 @@ children:
- /media-types
- /other-authentication-methods
- /troubleshooting
- /api-previews
- /libraries
- /openapi-description
- /endpoints-available-for-github-apps

50
content/rest/overview/permissions-required-for-github-apps.md
View File

@@ -52,9 +52,9 @@ shortTitle: GitHub App permissions
{% ifversion fpt or ghec or ghes > 3.4 %}- [`GET /repos/{owner}/{repo}/actions/cache/usage`](/rest/actions#get-github-actions-cache-usage-for-a-repository) (read){% endif %}
{% ifversion ghes > 3.4 %}- [`GET /repos/{owner}/{repo}/actions/cache/usage-policy`](/rest/actions#get-github-actions-cache-usage-policy-for-a-repository) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.4 %}- [`POST /repos/{owner}/{repo}/actions/jobs/{job_id}/rerun`](/rest/actions#re-run-job-for-workflow-run) (write){% endif %}
{% ifversion fpt or ghec or ghae or ghes > 3.4 %}- [`GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}`](/rest/actions#get-a-workflow-run-attempt) (read){% endif %}
{% ifversion fpt or ghec or ghae or ghes > 3.4 %}- [`GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}/jobs`](/rest/actions#list-jobs-for-a-workflow-run-attempt) (read){% endif %}
{% ifversion fpt or ghec or ghae or ghes > 3.4 %}- [`GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}/logs`](/rest/actions#download-workflow-run-attempt-logs) (read){% endif %}
- [`GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}`](/rest/actions#get-a-workflow-run-attempt) (read)
- [`GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}/jobs`](/rest/actions#list-jobs-for-a-workflow-run-attempt) (read)
- [`GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}/logs`](/rest/actions#download-workflow-run-attempt-logs) (read)
{% ifversion fpt or ghec or ghes > 3.4 %}- [`POST /repos/{owner}/{repo}/actions/runs/{run_id}/rerun-failed-jobs`](/rest/actions#re-run-workflow-failed-jobs) (write){% endif %}
{% ifversion fpt or ghec or ghes > 3.6 %}- [`GET /repos/{owner}/{repo}/actions/caches`](/rest/actions/cache#list-github-actions-caches-for-a-repository) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.6 %}- [`DELETE /repos/{owner}/{repo}/actions/caches`](/rest/actions/cache#delete-github-actions-caches-for-a-repository-using-a-cache-key) (write){% endif %}
@@ -158,12 +158,12 @@ shortTitle: GitHub App permissions
- [`POST /repos/{owner}/{repo}/autolinks`](/v3/repos#create-an-autolink) (write)
- [`GET /repos/{owner}/{repo}/autolinks/{autolink_id}`](/v3/repos#get-autolink) (read)
- [`DELETE /repos/{owner}/{repo}/autolinks/{autolink_id}`](/v3/repos#delete-autolink) (write)
{% ifversion fpt or ghec or ghes > 3.3 %}- [`GET /repos/{owner}/{repo}/actions/runners/{runner_id}/labels`](/rest/actions#list-labels-for-a-self-hosted-runner-for-a-repository) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}- [`POST /repos/{owner}/{repo}/actions/runners/{runner_id}/labels`](/rest/actions#add-custom-labels-to-a-self-hosted-runner-for-a-repository) (write){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}- [`PUT /repos/{owner}/{repo}/actions/runners/{runner_id}/labels`](/rest/actions#set-custom-labels-for-a-self-hosted-runner-for-a-repository) (write){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}- [`DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}/labels`](/rest/actions#remove-all-custom-labels-from-a-self-hosted-runner-for-a-repository) (write){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}- [`DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}/labels/{name}`](/rest/actions#remove-a-custom-label-from-a-self-hosted-runner-for-a-repository) (write){% endif %}
{% ifversion ghes > 3.3 %}- [`GET /repos/{owner}/{repo}/replicas/caches`](/rest/repos#list-repository-cache-replication-status) (read){% endif %}
{% ifversion fpt or ghec or ghes %}- [`GET /repos/{owner}/{repo}/actions/runners/{runner_id}/labels`](/rest/actions#list-labels-for-a-self-hosted-runner-for-a-repository) (read){% endif %}
{% ifversion fpt or ghec or ghes %}- [`POST /repos/{owner}/{repo}/actions/runners/{runner_id}/labels`](/rest/actions#add-custom-labels-to-a-self-hosted-runner-for-a-repository) (write){% endif %}
{% ifversion fpt or ghec or ghes %}- [`PUT /repos/{owner}/{repo}/actions/runners/{runner_id}/labels`](/rest/actions#set-custom-labels-for-a-self-hosted-runner-for-a-repository) (write){% endif %}
{% ifversion fpt or ghec or ghes %}- [`DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}/labels`](/rest/actions#remove-all-custom-labels-from-a-self-hosted-runner-for-a-repository) (write){% endif %}
{% ifversion fpt or ghec or ghes %}- [`DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}/labels/{name}`](/rest/actions#remove-a-custom-label-from-a-self-hosted-runner-for-a-repository) (write){% endif %}
{% ifversion ghes %}- [`GET /repos/{owner}/{repo}/replicas/caches`](/rest/repos#list-repository-cache-replication-status) (read){% endif %}
{% ifversion ghes > 3.4 %}- [`PATCH /repos/{owner}/{repo}/actions/cache/usage-policy`](/rest/actions#set-github-actions-cache-usage-policy-for-a-repository) (write){% endif %}
{% ifversion fpt or ghec or ghes > 3.4 %}- [`GET /repos/{owner}/{repo}/actions/permissions/access`](/rest/actions#get-workflow-access-level-to-a-repository) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.4 %}- [`PUT /repos/{owner}/{repo}/actions/permissions/access`](/rest/actions#set-workflow-access-to-a-repository) (write){% endif %}
@@ -188,7 +188,6 @@ shortTitle: GitHub App permissions
{% ifversion fpt or ghec %}- [`PUT /repos/{owner}/{repo}/vulnerability-alerts`](/rest/repos#enable-vulnerability-alerts) (write){% endif %}
{% ifversion fpt or ghec %}- [`DELETE /repos/{owner}/{repo}/vulnerability-alerts`](/rest/repos#disable-vulnerability-alerts) (write){% endif %}
{% ifversion fpt or ghec %}
## Blocking
@@ -288,6 +287,7 @@ shortTitle: GitHub App permissions
## Contents
- [`GET /repos/{owner}/{repo}/codeowners/errors`](/rest/reference/repos#list-codeowners-errors) (read)
- [`GET /repos/{owner}/{repo}/branches`](/rest/branches/branches#list-branches) (read)
- [`GET /repos/{owner}/{repo}/branches/{branch}`](/rest/branches/branches#get-a-branch) (read)
{% ifversion fpt or ghec or ghes %}- [`POST /repos/{owner}/{repo}/branches/{branch}/rename`](/rest/branches/branches#rename-a-branch) (write){% endif %}
@@ -333,7 +333,7 @@ shortTitle: GitHub App permissions
- [`GET /repos/{owner}/{repo}/releases/{release_id}/assets`](/rest/repos#list-release-assets) (read)
- [`POST /repos/{owner}/{repo}/merge-upstream`](/rest/branches/branches#sync-a-fork-branch-with-the-upstream-repository) (write)
{% ifversion fpt or ghec or ghes %}- [`POST /repos/{owner}/{repo}/releases/generate-notes`](/rest/repos#generate-release-notes) (write){% endif %}
{% ifversion fpt or ghec or ghae or ghes > 3.4 %}- [`GET /repos/{owner}/{repo}/codeowners/errors`](/rest/repos#list-codeowners-errors) (read){% endif %}
- [`GET /repos/{owner}/{repo}/codeowners/errors`](/rest/repos#list-codeowners-errors) (read)
{% ifversion fpt or ghec or ghes > 3.5 %}- [`GET /repos/{owner}/{repo}/dependency-graph/compare/{basehead}`](/rest/dependency-graph#get-a-diff-of-the-dependencies-between-commits) (read){% endif %}
{% ifversion fpt or ghec %}- [`GET /repos/{owner}/{repo}/code-scanning/codeql/databases`](/rest/code-scanning#list-codeql-databases) (read){% endif %}
{% ifversion fpt or ghec %}- [`GET /repos/{owner}/{repo}/code-scanning/codeql/databases/{language}`](/rest/code-scanning#get-codeql-database) (read){% endif %}
@@ -347,7 +347,7 @@ shortTitle: GitHub App permissions
{% ifversion fpt or ghec %}- [`GET /repos/{owner}/{repo}/import/large_files`](/rest/migrations#get-large-files) (read){% endif %}
{% ifversion fpt or ghec %}- [`PATCH /repos/{owner}/{repo}/import/lfs`](/rest/migrations#update-git-lfs-preference) (write){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}
{% ifversion fpt or ghec or ghes %}
## Dependabot secrets
@@ -382,11 +382,11 @@ shortTitle: GitHub App permissions
{% endif %}
{% ifversion ghec or ghes > 3.3 %}
{% ifversion ghec or ghes %}
## Enterprise administration
{% ifversion ghec or ghes > 3.3 %}- [`GET /enterprises/{enterprise}/settings/billing/advanced-security`](/rest/billing#export-advanced-security-active-committers-data-for-enterprise) (write){% endif %}
{% ifversion ghec or ghes %}- [`GET /enterprises/{enterprise}/settings/billing/advanced-security`](/rest/billing#export-advanced-security-active-committers-data-for-enterprise) (write){% endif %}
{% ifversion ghec or ghes > 3.4 %}- [`GET /enterprises/{enterprise}/actions/cache/usage`](/rest/actions#get-github-actions-cache-usage-for-an-enterprise) (write){% endif %}
{% ifversion ghes > 3.4 %}- [`GET /enterprises/{enterprise}/actions/cache/usage-policy`](/rest/actions#get-github-actions-cache-usage-policy-for-an-enterprise) (write){% endif %}
{% ifversion ghes > 3.4 %}- [`PATCH /enterprises/{enterprise}/actions/cache/usage-policy`](/rest/actions#set-github-actions-cache-usage-policy-for-an-enterprise) (write){% endif %}
@@ -602,8 +602,8 @@ shortTitle: GitHub App permissions
- [`GET /search/labels`](/rest/search#search-labels) (read)
- [`GET /user/repos`](/rest/repos#list-repositories-for-the-authenticated-user) (read)
- [`GET /users/{username}/repos`](/rest/repos#list-repositories-for-a-user) (read)
{% ifversion fpt or ghec or ghes > 3.3 %}- [`PUT /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}`](/rest/dependabot#add-selected-repository-to-an-organization-secret) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}- [`DELETE /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}`](/rest/dependabot#remove-selected-repository-from-an-organization-secret) (read){% endif %}
{% ifversion fpt or ghec or ghes %}- [`PUT /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}`](/rest/dependabot#add-selected-repository-to-an-organization-secret) (read){% endif %}
{% ifversion fpt or ghec or ghes %}- [`DELETE /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}`](/rest/dependabot#remove-selected-repository-from-an-organization-secret) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.7 %}- [`PUT /orgs/{org}/actions/required_workflows/{required_workflow_id}/repositories/{repository_id}`](/rest/actions#add-a-repository-to-selected-repositories-list-for-a-required-workflow) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.7 %}- [`DELETE /orgs/{org}/actions/required_workflows/{required_workflow_id}/repositories/{repository_id}`](/rest/actions#remove-a-repository-from-selected-repositories-list-for-a-required-workflow) (read){% endif %}
{% ifversion fpt or ghec %}- [`PUT /orgs/{org}/codespaces/secrets/{secret_name}/repositories/{repository_id}`](/rest/codespaces#add-selected-repository-to-an-organization-secret) (read){% endif %}
@@ -645,7 +645,7 @@ shortTitle: GitHub App permissions
- [`PUT /orgs/{org}/actions/permissions/selected-actions`](/rest/actions#set-allowed-actions-for-an-organization) (write)
- [`GET /orgs/{org}/installations`](/rest/orgs#list-app-installations-for-an-organization) (read)
{% ifversion ghec or ghae or ghes %}- [`GET /orgs/{org}/audit-log`](/rest/orgs#get-audit-log) (read){% endif %}
{% ifversion ghec or ghes > 3.3 %}- [`GET /orgs/{org}/settings/billing/advanced-security`](/rest/billing#get-github-advanced-security-active-committers-for-an-organization) (read){% endif %}
{% ifversion ghec or ghes %}- [`GET /orgs/{org}/settings/billing/advanced-security`](/rest/billing#get-github-advanced-security-active-committers-for-an-organization) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.4 %}- [`GET /orgs/{org}/actions/cache/usage`](/rest/actions#get-github-actions-cache-usage-for-an-organization) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.4 %}- [`GET /orgs/{org}/actions/cache/usage-by-repository`](/rest/actions#list-repositories-with-github-actions-cache-usage-for-an-organization) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.4 %}- [`GET /orgs/{org}/actions/permissions/workflow`](/rest/actions#get-default-workflow-permissions) (read){% endif %}
@@ -706,7 +706,7 @@ shortTitle: GitHub App permissions
{% endif %}
{% ifversion ghec or ghes > 3.3 %}
{% ifversion ghec or ghes %}
## Organization custom roles
@@ -714,7 +714,7 @@ shortTitle: GitHub App permissions
{% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}
{% ifversion fpt or ghec or ghes %}
## Organization dependabot secrets
@@ -815,11 +815,11 @@ shortTitle: GitHub App permissions
- [`POST /orgs/{org}/actions/runners/remove-token`](/rest/actions#create-a-remove-token-for-an-organization) (write)
- [`GET /orgs/{org}/actions/runners/{runner_id}`](/rest/actions#get-a-self-hosted-runner-for-an-organization) (read)
- [`DELETE /orgs/{org}/actions/runners/{runner_id}`](/rest/actions#delete-a-self-hosted-runner-from-an-organization) (write)
{% ifversion fpt or ghec or ghes > 3.3 %}- [`GET /orgs/{org}/actions/runners/{runner_id}/labels`](/rest/actions#list-labels-for-a-self-hosted-runner-for-an-organization) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}- [`POST /orgs/{org}/actions/runners/{runner_id}/labels`](/rest/actions#add-custom-labels-to-a-self-hosted-runner-for-an-organization) (write){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}- [`PUT /orgs/{org}/actions/runners/{runner_id}/labels`](/rest/actions#set-custom-labels-for-a-self-hosted-runner-for-an-organization) (write){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}- [`DELETE /orgs/{org}/actions/runners/{runner_id}/labels`](/rest/actions#remove-all-custom-labels-from-a-self-hosted-runner-for-an-organization) (write){% endif %}
{% ifversion fpt or ghec or ghes > 3.3 %}- [`DELETE /orgs/{org}/actions/runners/{runner_id}/labels/{name}`](/rest/actions#remove-a-custom-label-from-a-self-hosted-runner-for-an-organization) (write){% endif %}
{% ifversion fpt or ghec or ghes %}- [`GET /orgs/{org}/actions/runners/{runner_id}/labels`](/rest/actions#list-labels-for-a-self-hosted-runner-for-an-organization) (read){% endif %}
{% ifversion fpt or ghec or ghes %}- [`POST /orgs/{org}/actions/runners/{runner_id}/labels`](/rest/actions#add-custom-labels-to-a-self-hosted-runner-for-an-organization) (write){% endif %}
{% ifversion fpt or ghec or ghes %}- [`PUT /orgs/{org}/actions/runners/{runner_id}/labels`](/rest/actions#set-custom-labels-for-a-self-hosted-runner-for-an-organization) (write){% endif %}
{% ifversion fpt or ghec or ghes %}- [`DELETE /orgs/{org}/actions/runners/{runner_id}/labels`](/rest/actions#remove-all-custom-labels-from-a-self-hosted-runner-for-an-organization) (write){% endif %}
{% ifversion fpt or ghec or ghes %}- [`DELETE /orgs/{org}/actions/runners/{runner_id}/labels/{name}`](/rest/actions#remove-a-custom-label-from-a-self-hosted-runner-for-an-organization) (write){% endif %}
{% ifversion fpt or ghec %}
@@ -1007,7 +1007,7 @@ shortTitle: GitHub App permissions
- [`DELETE /repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}`](/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository) (write)
- [`POST /repos/{owner}/{repo}/code-scanning/sarifs`](/rest/code-scanning#upload-a-sarif-file) (write)
- [`GET /repos/{owner}/{repo}/code-scanning/sarifs/{sarif_id}`](/rest/code-scanning#list-recent-code-scanning-analyses-for-a-repository) (read)
{% ifversion fpt or ghec or ghae or ghes > 3.4 %}- [`GET /orgs/{org}/code-scanning/alerts`](/rest/code-scanning#list-code-scanning-alerts-by-organization) (read){% endif %}
- [`GET /orgs/{org}/code-scanning/alerts`](/rest/code-scanning#list-code-scanning-alerts-by-organization) (read)
{% ifversion fpt or ghec or ghes > 3.7 %}- [`GET /repos/{owner}/{repo}/dependabot/alerts`](/rest/dependabot#list-dependabot-alerts-for-a-repository) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.7 %}- [`GET /repos/{owner}/{repo}/dependabot/alerts/{alert_number}`](/rest/dependabot#get-a-dependabot-alert) (read){% endif %}
{% ifversion fpt or ghec or ghes > 3.7 %}- [`PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number}`](/rest/dependabot#update-a-dependabot-alert) (write){% endif %}

2
contributing/content-style-guide.md
View File

@@ -189,7 +189,7 @@ When using a screenshot of a command-line interface to show user interface eleme
Be descriptive when naming image files: include the name, action, and UI element in the filename. Mirror product language. Use kebab case. Do not use Liquid conditionals in filenames. If replacing an image, use the exact filename.
- **Use:** `data-pack-purchase-button.png`
- **Avoid:** `purchase_button.png`
- **Avoid:** `purchase-button{% ifversion ghes > 3.2 %}-for-admins{% endif %}.png`
- **Avoid:** `purchase-button{% ifversion ghes %}-for-admins{% endif %}.png`
### Screenshots

5
data/features/codeql-runner-supported.yml
View File

@@ -1,5 +0,0 @@
# Tracking deprecation of CodeQL runner
# https://github.blog/changelog/2022-04-05-codeql-runner-is-now-deprecated/
versions:
ghes: '<=3.3'

2
data/glossaries/external.yml
View File

@@ -177,7 +177,7 @@
Your personal dashboard is the main hub of your activity on GitHub. From your personal dashboard, you can keep track of issues and pull requests you're following or working on, navigate to your top repositories and team pages, and learn about recent activity in repositories you're watching or participating in. You can also discover new repositories, which are recommended based on users you're following and repositories you have starred. To only view activity for a specific organization, visit your organization's dashboard. For more information, see "[About your personal dashboard](/articles/about-your-personal-dashboard)" or "[About your organization dashboard](/articles/about-your-organization-dashboard)."
- term: default branch
description: >-
The base branch for new pull requests and code commits in a repository. Each repository has at least one branch, which Git creates when you initialize the repository. The first branch is usually called {% ifversion ghes < 3.2 %}`master`{% else %}`main`{% endif %}, and is often the default branch.
The base branch for new pull requests and code commits in a repository. Each repository has at least one branch, which Git creates when you initialize the repository. The first branch is usually called `main`, and is often the default branch.
- term: dependents graph
description: >-
A repository graph that shows the packages, projects, and repositories that depend on a

131
data/graphql/ghes-3.3/graphql_previews.enterprise.yml
View File

@@ -1,131 +0,0 @@
- title: Access to package version deletion
description: >-
This preview adds support for the DeletePackageVersion mutation which
enables deletion of private package versions.
toggled_by: ':package-deletes-preview'
announcement: null
updates: null
toggled_on:
- Mutation.deletePackageVersion
owning_teams:
- '@github/pe-package-registry'
- title: Deployments
description: >-
This preview adds support for deployments mutations and new deployments
features.
toggled_by: ':flash-preview'
announcement: null
updates: null
toggled_on:
- DeploymentStatus.environment
- Mutation.createDeploymentStatus
- CreateDeploymentStatusInput
- CreateDeploymentStatusPayload
- Mutation.createDeployment
- CreateDeploymentInput
- CreateDeploymentPayload
owning_teams:
- '@github/c2c-actions-service'
- title: >-
MergeInfoPreview - More detailed information about a pull request's merge
state.
description: >-
This preview adds support for accessing fields that provide more detailed
information about a pull request's merge state.
toggled_by: ':merge-info-preview'
announcement: null
updates: null
toggled_on:
- PullRequest.canBeRebased
- PullRequest.mergeStateStatus
owning_teams:
- '@github/pe-pull-requests'
- title: UpdateRefsPreview - Update multiple refs in a single operation.
description: This preview adds support for updating multiple refs in a single operation.
toggled_by: ':update-refs-preview'
announcement: null
updates: null
toggled_on:
- Mutation.updateRefs
- GitRefname
- RefUpdate
- UpdateRefsInput
- UpdateRefsPayload
owning_teams:
- '@github/reponauts'
- title: Project Event Details
description: >-
This preview adds project, project card, and project column details to
project-related issue events.
toggled_by: ':starfox-preview'
announcement: null
updates: null
toggled_on:
- AddedToProjectEvent.project
- AddedToProjectEvent.projectCard
- AddedToProjectEvent.projectColumnName
- ConvertedNoteToIssueEvent.project
- ConvertedNoteToIssueEvent.projectCard
- ConvertedNoteToIssueEvent.projectColumnName
- MovedColumnsInProjectEvent.project
- MovedColumnsInProjectEvent.projectCard
- MovedColumnsInProjectEvent.projectColumnName
- MovedColumnsInProjectEvent.previousProjectColumnName
- RemovedFromProjectEvent.project
- RemovedFromProjectEvent.projectColumnName
owning_teams:
- '@github/github-projects'
- title: Create content attachments
description: This preview adds support for creating content attachments.
toggled_by: ':corsair-preview'
announcement: null
updates: null
toggled_on:
- Mutation.createContentAttachment
owning_teams:
- '@github/feature-lifecycle'
- title: Labels Preview
description: >-
This preview adds support for adding, updating, creating and deleting
labels.
toggled_by: ':bane-preview'
announcement: null
updates: null
toggled_on:
- Mutation.createLabel
- CreateLabelPayload
- CreateLabelInput
- Mutation.deleteLabel
- DeleteLabelPayload
- DeleteLabelInput
- Mutation.updateLabel
- UpdateLabelPayload
- UpdateLabelInput
owning_teams:
- '@github/pe-pull-requests'
- title: Import Project
description: This preview adds support for importing projects.
toggled_by: ':slothette-preview'
announcement: null
updates: null
toggled_on:
- Mutation.importProject
owning_teams:
- '@github/pe-issues-projects'
- title: Team Review Assignments Preview
description: >-
This preview adds support for updating the settings for team review
assignment.
toggled_by: ':stone-crop-preview'
announcement: null
updates: null
toggled_on:
- Mutation.updateTeamReviewAssignment
- UpdateTeamReviewAssignmentInput
- TeamReviewAssignmentAlgorithm
- Team.reviewRequestDelegationEnabled
- Team.reviewRequestDelegationAlgorithm
- Team.reviewRequestDelegationMemberCount
- Team.reviewRequestDelegationNotifyTeam
owning_teams:
- '@github/pe-pull-requests'

116
data/graphql/ghes-3.3/graphql_upcoming_changes.public-enterprise.yml
View File

@@ -1,116 +0,0 @@
---
upcoming_changes:
- location: LegacyMigration.uploadUrlTemplate
description: '`uploadUrlTemplate` will be removed. Use `uploadUrl` instead.'
reason:
'`uploadUrlTemplate` is being removed because it is not a standard URL and
adds an extra user step.'
date: '2019-04-01T00:00:00+00:00'
criticality: breaking
owner: tambling
- location: AssignedEvent.user
description: '`user` will be removed. Use the `assignee` field instead.'
reason: Assignees can now be mannequins.
date: '2020-01-01T00:00:00+00:00'
criticality: breaking
owner: tambling
- location: EnterpriseBillingInfo.availableSeats
description:
'`availableSeats` will be removed. Use EnterpriseBillingInfo.totalAvailableLicenses
instead.'
reason:
'`availableSeats` will be replaced with `totalAvailableLicenses` to provide
more clarity on the value being returned'
date: '2020-01-01T00:00:00+00:00'
criticality: breaking
owner: BlakeWilliams
- location: EnterpriseBillingInfo.seats
description: '`seats` will be removed. Use EnterpriseBillingInfo.totalLicenses instead.'
reason:
'`seats` will be replaced with `totalLicenses` to provide more clarity on
the value being returned'
date: '2020-01-01T00:00:00+00:00'
criticality: breaking
owner: BlakeWilliams
- location: UnassignedEvent.user
description: '`user` will be removed. Use the `assignee` field instead.'
reason: Assignees can now be mannequins.
date: '2020-01-01T00:00:00+00:00'
criticality: breaking
owner: tambling
- location: EnterprisePendingMemberInvitationEdge.isUnlicensed
description: '`isUnlicensed` will be removed.'
reason: All pending members consume a license
date: '2020-07-01T00:00:00+00:00'
criticality: breaking
owner: BrentWheeldon
- location: EnterpriseOwnerInfo.pendingCollaborators
description:
'`pendingCollaborators` will be removed. Use the `pendingCollaboratorInvitations`
field instead.'
reason:
Repository invitations can now be associated with an email, not only an
invitee.
date: '2020-10-01T00:00:00+00:00'
criticality: breaking
owner: jdennes
- location: Issue.timeline
description: '`timeline` will be removed. Use Issue.timelineItems instead.'
reason: '`timeline` will be removed'
date: '2020-10-01T00:00:00+00:00'
criticality: breaking
owner: mikesea
- location: PullRequest.timeline
description: '`timeline` will be removed. Use PullRequest.timelineItems instead.'
reason: '`timeline` will be removed'
date: '2020-10-01T00:00:00+00:00'
criticality: breaking
owner: mikesea
- location: RepositoryInvitationOrderField.INVITEE_LOGIN
description: '`INVITEE_LOGIN` will be removed.'
reason:
'`INVITEE_LOGIN` is no longer a valid field value. Repository invitations
can now be associated with an email, not only an invitee.'
date: '2020-10-01T00:00:00+00:00'
criticality: breaking
owner: jdennes
- location: EnterpriseMemberEdge.isUnlicensed
description: '`isUnlicensed` will be removed.'
reason: All members consume a license
date: '2021-01-01T00:00:00+00:00'
criticality: breaking
owner: BrentWheeldon
- location: EnterpriseOutsideCollaboratorEdge.isUnlicensed
description: '`isUnlicensed` will be removed.'
reason: All outside collaborators consume a license
date: '2021-01-01T00:00:00+00:00'
criticality: breaking
owner: BrentWheeldon
- location: EnterprisePendingCollaboratorEdge.isUnlicensed
description: '`isUnlicensed` will be removed.'
reason: All pending collaborators consume a license
date: '2021-01-01T00:00:00+00:00'
criticality: breaking
owner: BrentWheeldon
- location: MergeStateStatus.DRAFT
description: '`DRAFT` will be removed. Use PullRequest.isDraft instead.'
reason:
DRAFT state will be removed from this enum and `isDraft` should be used
instead
date: '2021-01-01T00:00:00+00:00'
criticality: breaking
owner: nplasterer
- location: PackageType.DOCKER
description: '`DOCKER` will be removed.'
reason:
DOCKER will be removed from this enum as this type will be migrated to only
be used by the Packages REST API.
date: '2021-06-21'
criticality: breaking
owner: reybard
- location: ReactionGroup.users
description: '`users` will be removed. Use the `reactors` field instead.'
reason: Reactors can now be mannequins, bots, and organizations.
date: '2021-10-01T00:00:00+00:00'
criticality: breaking
owner: synthead

42441
data/graphql/ghes-3.3/schema.docs-enterprise.graphql
View File

File diff suppressed because it is too large Load Diff

299
data/release-notes/enterprise-server/3-3/0-rc1.yml
View File

@@ -1,299 +0,0 @@
date: '2021-11-09'
release_candidate: true
deprecated: true
intro: |
{% note %}
**Note:** If {% data variables.location.product_location %} is running a release candidate build, you can't upgrade with a hotpatch. We recommend only running release candidates on test environments.
{% endnote %}
For upgrade instructions, see "[Upgrading {% data variables.product.prodname_ghe_server %}](/admin/enterprise-management/updating-the-virtual-machine-and-physical-resources/upgrading-github-enterprise-server)."
sections:
features:
- heading: Security Manager role
notes:
# https://github.com/github/releases/issues/1610
- |
Organization owners can now grant teams the access to manage security alerts and settings on their repositories. The "security manager" role can be applied to any team and grants the team's members the following access:
- Read access on all repositories in the organization.
- Write access on all security alerts in the organization.
- Access to the organization-level security tab.
- Write access on security settings at the organization level.
- Write access on security settings at the repository level.
For more information, see "[Managing security managers in your organization](/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization)."
- heading: 'Ephemeral self-hosted runners for GitHub Actions & new webhooks for auto-scaling'
notes:
# https://github.com/github/releases/issues/1378
- |
{% data variables.product.prodname_actions %} now supports ephemeral (single job) self-hosted runners and a new [`workflow_job`](/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#workflow_job) webhook to make autoscaling runners easier.
Ephemeral runners are good for self-managed environments where each job is required to run on a clean image. After a job is run, ephemeral runners are automatically unregistered from {% data variables.location.product_location %}, allowing you to perform any post-job management.
You can combine ephemeral runners with the new `workflow_job` webhook to automatically scale self-hosted runners in response to {% data variables.product.prodname_actions %} job requests.
For more information, see "[Autoscaling with self-hosted runners](/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners)" and "[Webhook events and payloads](/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#workflow_job)."
- heading: 'Dark high contrast theme'
notes:
# https://github.com/github/releases/issues/1539
- |
A dark high contrast theme, with greater contrast between foreground and background elements, is now available on {% data variables.product.prodname_ghe_server %} 3.3. This release also includes improvements to the color system across all {% data variables.product.company_short %} themes.
![Animated image of switching between dark default theme and dark high contrast on the appearance settings page](https://user-images.githubusercontent.com/334891/123645834-ad096c00-d7f4-11eb-85c9-b2c92b00d70a.gif)
For more information about changing your theme, see "[Managing your theme settings](/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-your-theme-settings)."
changes:
- heading: Administration Changes
notes:
# https://github.com/github/releases/issues/1666
- '{% data variables.product.prodname_ghe_server %} 3.3 includes improvements to the maintenance of repositories, especially for repositories that contain many unreachable objects. Note that the first maintenance cycle after upgrading to {% data variables.product.prodname_ghe_server %} 3.3 may take longer than usual to complete.'
# https://github.com/github/releases/issues/1533
- '{% data variables.product.prodname_ghe_server %} 3.3 includes the public beta of a repository cache for geographically-distributed teams and CI infrastructure. The repository cache keeps a read-only copy of your repositories available in additional geographies, which prevents clients from downloading duplicate Git content from your primary instance. For more information, see "[About repository caching](/admin/enterprise-management/caching-repositories/about-repository-caching)."'
# https://github.com/github/releases/issues/1616
- '{% data variables.product.prodname_ghe_server %} 3.3 includes improvements to the user impersonation process. An impersonation session now requires a justification for the impersonation, actions are recorded in the audit log as being performed as an impersonated user, and the user who is impersonated will receive an email notification that they have been impersonated by an enterprise administrator. For more information, see "[Impersonating a user](/enterprise-server@3.3/admin/user-management/managing-users-in-your-enterprise/impersonating-a-user)."'
# https://github.com/github/releases/issues/1609
- A new stream processing service has been added to facilitate the growing set of events that are published to the audit log, including events associated with Git and {% data variables.product.prodname_actions %} activity.
- heading: Token Changes
notes:
# https://github.com/github/releases/issues/1390
- |
An expiration date can now be set for new and existing personal access tokens. Setting an expiration date on personal access tokens is highly recommended to prevent older tokens from leaking and compromising security. Token owners will receive an email when it's time to renew a token that's about to expire. Tokens that have expired can be regenerated, giving users a duplicate token with the same properties as the original.
When using a personal access token with the {% data variables.product.company_short %} API, a new `GitHub-Authentication-Token-Expiration` header is included in the response, which indicates the token's expiration date. For more information, see "[Creating a personal access token](/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token)."
- heading: 'Notifications changes'
notes:
# https://github.com/github/releases/issues/1625
- 'Notification emails from discussions now include `(Discussion #xx)` in the subject, so you can recognize and filter emails that reference discussions.'
- heading: 'Repositories changes'
notes:
# https://github.com/github/releases/issues/1735
- Public repositories now have a `Public` label next to their names like private and internal repositories. This change makes it easier to identify public repositories and avoid accidentally committing private code.
# https://github.com/github/releases/issues/1733
- If you specify the exact name of a branch when using the branch selector menu, the result now appears at the top of the list of matching branches. Previously, exact branch name matches could appear at the bottom of the list.
# https://github.com/github/releases/issues/1673
- When viewing a branch that has a corresponding open pull request, {% data variables.product.prodname_ghe_server %} now links directly to the pull request. Previously, there would be a prompt to contribute using branch comparison or to open a new pull request.
# https://github.com/github/releases/issues/1670
- You can now click a button to copy the full raw contents of a file to the clipboard. Previously, you would need to open the raw file, select all, and then copy. To copy the contents of a file, navigate to the file and click {% octicon "copy" aria-label="The copy icon" %} in the toolbar. Note that this feature is currently only available in some browsers.
# https://github.com/github/releases/issues/1571
- When creating a new release, you can now select or create the tag using a dropdown selector, rather than specifying the tag in a text field. For more information, see "[Managing releases in a repository](/repositories/releasing-projects-on-github/managing-releases-in-a-repository)."
# https://github.com/github/releases/issues/1752
- A warning is now displayed when viewing a file that contains bidirectional Unicode text. Bidirectional Unicode text can be interpreted or compiled differently than it appears in a user interface. For example, hidden bidirectional Unicode characters can be used to swap segments of text in a file. For more information about replacing these characters, see the [{% data variables.product.prodname_dotcom %} changelog](https://github.blog/changelog/2021-10-31-warning-about-bidirectional-unicode-text/).
# https://github.com/github/releases/issues/1416
- You can now use `CITATION.cff` files to let others know how you would like them to cite your work. `CITATION.cff` files are plain text files with human- and machine-readable citation information. {% data variables.product.prodname_ghe_server %} parses this information into common citation formats such as [APA](https://apastyle.apa.org) and [BibTeX](https://en.wikipedia.org/wiki/BibTeX). For more information, see "[About CITATION files](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-citation-files)."
- heading: 'Markdown changes'
notes:
# https://github.com/github/releases/issues/1645
- |
You can use new keyboard shortcuts for quotes and lists in Markdown files, issues, pull requests, and comments.
* To add quotes, use <kbd>cmd shift .</kbd> on Mac, or <kbd>ctrl shift .</kbd> on Windows and Linux.
* To add an ordered list, use <kbd>cmd shift 7</kbd> on Mac, or <kbd>ctrl shift 7</kbd> on Windows and Linux.
* To add an unordered list, use <kbd>cmd shift 8</kbd> on Mac, or <kbd>ctrl shift 8</kbd> on Windows and Linux.
See "[Keyboard shortcuts](/get-started/using-github/keyboard-shortcuts)" for a full list of available shortcuts.
# https://github.com/github/releases/issues/1684
- You can now use footnote syntax in any Markdown field. Footnotes are displayed as superscript links that you can click to jump to the referenced information, which is displayed in a new section at the bottom of the document. For more information about the syntax, see "[Basic writing and formatting syntax](/github/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#footnotes)."
# https://github.com/github/releases/issues/1647
- When viewing Markdown files, you can now click {% octicon "code" aria-label="The code icon" %} in the toolbar to view the source of a Markdown file. Previously, you needed to use the blame view to link to specific line numbers in the source of a Markdown file.
# https://github.com/github/releases/issues/1600
- You can now add images and videos to Markdown files in gists by pasting them into the Markdown body or selecting them from the dialog at the bottom of the Markdown file. For information about supported file types, see "[Attaching files](https://docs.github.com/en/github/writing-on-github/working-with-advanced-formatting/attaching-files)."
# https://github.com/github/releases/issues/1523
- '{% data variables.product.prodname_ghe_server %} now automatically generates a table of contents for Wikis, based on headings.'
# https://github.com/github/releases/issues/1626
- When dragging and dropping files into a Markdown editor, such as images and videos, {% data variables.product.prodname_ghe_server %} now uses the mouse pointer location instead of the cursor location when placing the file.
- heading: 'Issues and pull requests changes'
notes:
# https://github.com/github/releases/issues/1504
- You can now search issues by label using a logical OR operator. To filter issues using logical OR, use the comma syntax. For example, `label:"good first issue","bug"` will list all issues with a label of `good first issue` or `bug`. For more information, see "[Filtering and searching issues and pull requests](/issues/tracking-your-work-with-issues/filtering-and-searching-issues-and-pull-requests#about-search-terms)."
# https://github.com/github/releases/issues/1685
- |
Improvements have been made to help teams manage code review assignments. You can now:
- Limit assignment to only direct members of the team.
- Continue with automatic assignment even if one or more members of the team are already requested.
- Keep a team assigned to review even if one or more members is newly assigned.
The timeline and reviewers sidebar on the pull request page now indicate if a review request was automatically assigned to one or more team members.
For more information, see the [{% data variables.product.prodname_dotcom %} changelog](https://github.blog/changelog/2021-09-29-new-code-review-assignment-settings-and-team-filtering-improvements/).
- You can now filter pull request searches to only include pull requests you are directly requested to review.
# https://github.com/github/releases/issues/1683
- Filtered files in pull requests are now completely hidden from view, and are no longer shown as collapsed in the "Files Changed" tab. The "File Filter" menu has also been simplified. For more information, see "[Filtering files in a pull request](/github/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/filtering-files-in-a-pull-request)."
- heading: 'GitHub Actions changes'
notes:
# https://github.com/github/releases/issues/1593
- You can now create "composite actions" which combine multiple workflow steps into one action, and includes the ability to reference other actions. This makes it easier to reduce duplication in workflows. Previously, an action could only use scripts in its YAML definition. For more information, see "[Creating a composite action](/actions/creating-actions/creating-a-composite-action)."
# https://github.com/github/releases/issues/1694
- Managing self-hosted runners at the enterprise level no longer requires using personal access tokens with the `admin:enterprise` scope. You can instead use the new `manage_runners:enterprise` scope to restrict the permissions on your tokens. Tokens with this scope can authenticate to [many REST API endpoints](/rest/reference/enterprise-admin#list-self-hosted-runner-groups-for-an-enterprise) to manage your enterprise's self-hosted runners.
# https://github.com/github/releases/issues/1157
- |
The audit log now includes additional events for {% data variables.product.prodname_actions %}. Audit log entries are now recorded for the following events:
* A self-hosted runner is registered or removed.
* A self-hosted runner is added to a runner group, or removed from a runner group.
* A runner group is created or removed.
* A workflow run is created or completed.
* A workflow job is prepared. Importantly, this log includes the list of secrets that were provided to the runner.
For more information, see "[Security hardening for {% data variables.product.prodname_actions %}](/actions/security-guides/security-hardening-for-github-actions#auditing-github-actions-events)."
# https://github.com/github/releases/issues/1588
- Performance improvements have been made to {% data variables.product.prodname_actions %}, which may result in higher maximum job concurrency.
- heading: 'GitHub Packages changes'
notes:
# https://github.com/github/docs-content/issues/5554
- When a repository is deleted, any associated package files are now immediately deleted from your {% data variables.product.prodname_registry %} external storage.
- heading: 'Dependabot and Dependency graph changes'
notes:
# https://github.com/github/releases/issues/1141
- Dependency review is out of beta and is now generally available for {% data variables.product.prodname_GH_advanced_security %} customers. Dependency review provides an easy-to-understand view of dependency changes and their security impact in the "Files changed" tab of pull requests. It informs you of which dependencies were added, removed, or updated, along with vulnerability information. For more information, see "[Reviewing dependency changes in a pull request](/github/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request)."
# https://github.com/github/releases/issues/1630
- '{% data variables.product.prodname_dependabot %} is now available as a private beta, offering both version updates and security updates for several popular ecosystems. {% data variables.product.prodname_dependabot %} on {% data variables.product.prodname_ghe_server %} requires {% data variables.product.prodname_actions %} and a pool of self-hosted runners configured for {% data variables.product.prodname_dependabot %} use. {% data variables.product.prodname_dependabot %} on {% data variables.product.prodname_ghe_server %} also requires {% data variables.product.prodname_github_connect %} to be enabled. To learn more and sign up for the beta, contact the GitHub Sales team.'
- heading: 'Code scanning and secret scanning changes'
notes:
# https://github.com/github/releases/issues/1724
- The depth of {% data variables.product.prodname_codeql %}'s analysis has been improved by adding support for more [libraries and frameworks](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/) and increasing the coverage of our existing library and framework models. [JavaScript](https://github.com/github/codeql/tree/main/javascript) analysis now supports most common templating languages, and [Java](https://github.com/github/codeql/tree/main/java) now covers more than three times the endpoints of previous {% data variables.product.prodname_codeql %} versions. As a result, {% data variables.product.prodname_codeql %} can now detect even more potential sources of untrusted user data, steps through which that data flows, and potentially dangerous sinks where the data could end up. This results in an overall improvement of the quality of {% data variables.product.prodname_code_scanning %} alerts.
# https://github.com/github/releases/issues/1639
- '{% data variables.product.prodname_codeql %} now supports scanning standard language features in Java 16, such as records and pattern matching. {% data variables.product.prodname_codeql %} is able to analyze code written in Java version 7 through 16. For more information about supported languages and frameworks, see the [{% data variables.product.prodname_codeql %} documentation](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/#id5).'
# https://github.com/github/releases/issues/1655
- |
Improvements have been made to the {% data variables.product.prodname_code_scanning %} `on:push` trigger when code is pushed to a pull request. If an `on:push` scan returns results that are associated with a pull request, {% data variables.product.prodname_code_scanning %} will now show these alerts on the pull request.
Some other CI/CD systems can be exclusively configured to trigger a pipeline when code is pushed to a branch, or even exclusively for every commit. Whenever such an analysis pipeline is triggered and results are uploaded to the SARIF API, {% data variables.product.prodname_code_scanning %} will also try to match the analysis results to an open pull request. If an open pull request is found, the results will be published as described above. For more information, see the [{% data variables.product.prodname_dotcom %} changelog](https://github.blog/changelog/2021-09-27-showing-code-scanning-alerts-on-pull-requests/).
# https://github.com/github/releases/issues/1546
- You can now use the new pull request filter on the {% data variables.product.prodname_code_scanning %} alerts page to find all the {% data variables.product.prodname_code_scanning %} alerts associated with a pull request. A new "View all branch alerts" link on the pull request "Checks" tab allows you to directly view {% data variables.product.prodname_code_scanning %} alerts with the specific pull request filter already applied. For more information, see the [{% data variables.product.prodname_dotcom %} changelog](https://github.blog/changelog/2021-08-23-pull-request-filter-for-code-scanning-alerts/).
# https://github.com/github/releases/issues/1562
- User defined patterns for {% data variables.product.prodname_secret_scanning %} is out of beta and is now generally available for {% data variables.product.prodname_GH_advanced_security %} customers. Also new in this release is the ability to edit custom patterns defined at the repository, organization, and enterprise levels. After editing and saving a pattern, {% data variables.product.prodname_secret_scanning %} searches for matches both in a repository's entire Git history and in any new commits. Editing a pattern will close alerts previously associated with the pattern if they no longer match the updated version. Other improvements, such as dry-runs, are planned in future releases. For more information, see "[Defining custom patterns for secret scanning](/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning)."
- heading: API and webhook changes
notes:
# https://github.com/github/releases/issues/1744
- Most REST API previews have graduated and are now an official part of the API. Preview headers are no longer required for most REST API endpoints, but will still function as expected if you specify a graduated preview in the `Accept` header of a request. For previews that still require specifying the preview in the `Accept` header of a request, see "[API previews](/rest/overview/api-previews)."
# https://github.com/github/releases/issues/1513
- You can now use the REST API to configure custom autolinks to external resources. The REST API now provides beta `GET`/`POST`/`DELETE` endpoints which you can use to view, add, or delete custom autolinks associated with a repository. For more information, see "[Autolinks](/rest/reference/repos#autolinks)."
# https://github.com/github/releases/issues/1578
- You can now use the REST API to sync a forked repository with its upstream repository. For more information, see "[Branches](/rest/reference/branches#sync-a-fork-branch-with-the-upstream-repository)" in the REST API documentation.
# https://github.com/github/releases/issues/1527
- Enterprise administrators on GitHub Enterprise Server can now use the REST API to enable or disable Git LFS for a repository. For more information, see "[Repositories](/rest/reference/repos#git-lfs)."
# https://github.com/github/releases/issues/1476
- You can now use the REST API to query the audit log for an enterprise. While audit log forwarding provides the ability to retain and analyze data with your own toolkit and determine patterns over time, the new endpoint can help you perform limited analysis on recent events. For more information, see "[{% data variables.product.prodname_enterprise %} administration](/rest/reference/enterprise-admin#get-the-audit-log-for-an-enterprise)" in the REST API documentation.
# https://github.com/github/releases/issues/1485
- GitHub App user-to-server API requests can now read public resources using the REST API. This includes, for example, the ability to list a public repository's issues and pull requests, and to access a public repository's comments and content.
# https://github.com/github/releases/issues/1734
- When creating or updating a repository, you can now configure whether forking is allowed using the REST and GraphQL APIs. Previously, APIs for creating and updating repositories didn't include the fields `allow_forking` (REST) or `forkingAllowed` (GraphQL). For more information, see "[Repositories](/rest/reference/repos)" in the REST API documentation and "[Repositories](/graphql/reference/objects#repository)" in the GraphQL API documentation.
# https://github.com/github/releases/issues/1637
- |
A new GraphQL mutation [`createCommitOnBranch`](/graphql/reference/mutations#createcommitonbranch) makes it easier to add, update, and delete files in a branch of a repository. Compared to the REST API, you do not need to manually create blobs and trees before creating the commit. This allows you to add, update, or delete multiple files in a single API call.
Commits authored using the new API are automatically GPG signed and are [marked as verified](/github/authenticating-to-github/managing-commit-signature-verification/about-commit-signature-verification) in the {% data variables.product.prodname_ghe_server %} UI. GitHub Apps can use the mutation to author commits directly or [on behalf of users](/developers/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps#user-to-server-requests).
# https://github.com/github/releases/issues/1665
- When a new tag is created, the [push](/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#push) webhook payload now always includes a `head_commit` object that contains the data of the commit that the new tag points to. As a result, the `head_commit` object will always contain the commit data of the payload's `after` commit.
- heading: 'Performance Changes'
notes:
# https://github.com/github/releases/issues/1823
- Page loads and jobs are now significantly faster for repositories with many Git refs.
# No security/bug fixes for the RC release
# security_fixes:
# - PLACEHOLDER
# bugs:
# - PLACEHOLDER
known_issues:
- On a freshly set up {% data variables.product.prodname_ghe_server %} instance without any users, an attacker could create the first admin user.
- Custom firewall rules are removed during the upgrade process.
- Git LFS tracked files [uploaded through the web interface](https://github.com/blog/2105-upload-files-to-your-repositories) are incorrectly added directly to the repository.
- Issues cannot be closed if they contain a permalink to a blob in the same repository, where the blob's file path is longer than 255 characters.
- When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.
- The {% data variables.product.prodname_registry %} npm registry no longer returns a time value in metadata responses. This was done to allow for substantial performance improvements. We continue to have all the data necessary to return a time value as part of the metadata response and will resume returning this value in the future once we have solved the existing performance issues.
- Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
deprecations:
- heading: Deprecation of GitHub Enterprise Server 2.22
notes:
- '**{% data variables.product.prodname_ghe_server %} 2.22 was discontinued on September 23, 2021**. This means that no patch releases will be made, even for critical security issues, after this date. For better performance, improved security, and new features, [upgrade to the newest version of {% data variables.product.prodname_ghe_server %}](/enterprise-server@3.3/admin/enterprise-management/upgrading-github-enterprise-server) as soon as possible.'
- heading: Deprecation of GitHub Enterprise Server 3.0
notes:
- '**{% data variables.product.prodname_ghe_server %} 3.0 will be discontinued on February 16, 2022**. This means that no patch releases will be made, even for critical security issues, after this date. For better performance, improved security, and new features, [upgrade to the newest version of {% data variables.product.prodname_ghe_server %}](/enterprise-server@3.3/admin/enterprise-management/upgrading-github-enterprise-server) as soon as possible.'
- heading: Deprecation of XenServer Hypervisor support
notes:
# https://github.com/github/docs-content/issues/4439
- Starting with {% data variables.product.prodname_ghe_server %} 3.3, {% data variables.product.prodname_ghe_server %} on XenServer is deprecated and is no longer supported. Please contact [GitHub Support](https://support.github.com) with questions or concerns.
- heading: Deprecation of OAuth Application API endpoints and API authentication using query parameters
notes:
# https://github.com/github/releases/issues/1316
- |
To prevent accidental logging or exposure of `access_tokens`, we discourage the use of OAuth Application API endpoints and the use of API authentication using query parameters. View the following posts to see the proposed replacements:
* [Replacement OAuth Application API endpoints](https://developer.github.com/changes/2020-02-14-deprecating-oauth-app-endpoint/#changes-to-make)
* [Replacement authentication using headers instead of query param](https://developer.github.com/changes/2020-02-10-deprecating-auth-through-query-param/#changes-to-make)
These endpoints and authentication route are planned to be removed from {% data variables.product.prodname_ghe_server %} in {% data variables.product.prodname_ghe_server %} 3.4.
- heading: Deprecation of the CodeQL runner
notes:
# https://github.com/github/releases/issues/1632
- The {% data variables.product.prodname_codeql %} runner is being deprecated. {% data variables.product.prodname_ghe_server %} 3.3 will be the final release series that supports the {% data variables.product.prodname_codeql %} runner. Starting with {% data variables.product.prodname_ghe_server %} 3.4, the {% data variables.product.prodname_codeql %} runner will be removed and no longer supported. The {% data variables.product.prodname_codeql %} CLI version 2.6.2 or greater is a feature-complete replacement for the {% data variables.product.prodname_codeql %} runner. For more information, see the [{% data variables.product.prodname_dotcom %} changelog](https://github.blog/changelog/2021-09-21-codeql-runner-deprecation/).
- heading: Deprecation of custom bit-cache extensions
notes:
# https://github.com/github/releases/issues/1415
- |
Starting in {% data variables.product.prodname_ghe_server %} 3.1, support for {% data variables.product.company_short %}'s proprietary bit-cache extensions began to be phased out. These extensions are now deprecated in {% data variables.product.prodname_ghe_server %} 3.3.
Any repositories that were already present and active on {% data variables.location.product_location %} running version 3.1 or 3.2 will have been automatically updated.
Repositories which were not present and active before upgrading to {% data variables.product.prodname_ghe_server %} 3.3 may not perform optimally until a repository maintenance task is run and has successfully completed.
To start a repository maintenance task manually, browse to `https://<hostname>/stafftools/repositories/<owner>/<repository>/network` for each affected repository and click the **Schedule** button.
backups:
- '{% data variables.product.prodname_ghe_server %} 3.3 requires at least [GitHub Enterprise Backup Utilities 3.3.0](https://github.com/github/backup-utils) for [Backups and Disaster Recovery](/admin/configuration/configuring-your-enterprise/configuring-backups-on-your-appliance).'

Some files were not shown because too many files have changed in this diff Show More