diff --git a/assets/images/help/repository/audit-log-entries.png b/assets/images/help/repository/audit-log-entries.png new file mode 100644 index 0000000000..1fda1196bb Binary files /dev/null and b/assets/images/help/repository/audit-log-entries.png differ diff --git a/content/README.md b/content/README.md index 3479fcd11a..2fea939f42 100644 --- a/content/README.md +++ b/content/README.md @@ -237,4 +237,4 @@ Sometimes you want to link to a Dotcom-only article in Enterprise content and yo GitHub's Terms of Service ``` -Sometimes the canonical home of content moves outside the docs site. None of the links included in [`lib/redirects/external-redirects.json`](lib/redirects/external-redirects.json) get rewritten. See [`contributing/redirects.md`](contributing/redirects.md) for more info about this type of redirect. +Sometimes the canonical home of content moves outside the docs site. None of the links included in [`lib/redirects/external-sites.json`](/lib/redirects/external-sites.json) get rewritten. See [`contributing/redirects.md`](/contributing/redirects.md) for more info about this type of redirect. diff --git a/content/actions/learn-github-actions/security-hardening-for-github-actions.md b/content/actions/learn-github-actions/security-hardening-for-github-actions.md index b186b0853f..57cef7eb3e 100644 --- a/content/actions/learn-github-actions/security-hardening-for-github-actions.md +++ b/content/actions/learn-github-actions/security-hardening-for-github-actions.md @@ -95,3 +95,42 @@ As a result, self-hosted runners should almost [never be used for public reposit You should also consider the environment of the self-hosted runner machines: - What sensitive information resides on the machine configured as a self-hosted runner? For example, private SSH keys, API access tokens, among others. - Does the machine have network access to sensitive services? For example, Azure or AWS metadata services. The amount of sensitive information in this environment should be kept to a minimum, and you should always be mindful that any user capable of invoking workflows has access to this environment. + +### Auditing {% data variables.product.prodname_actions %} events + +You can use the audit log to monitor administrative tasks in an organization. The audit log records the type of action, when it was run, and which user account perfomed the action. + +For example, you can use the audit log to track the `action:org.update_actions_secret` event, which tracks changes to organization secrets: +  + +The following tables describe the {% data variables.product.prodname_actions %} events that you can find in the audit log. For more information on using the audit log, see +"[Reviewing the audit log for your organization](/github/setting-up-and-managing-organizations-and-teams/reviewing-the-audit-log-for-your-organization#searching-the-audit-log)." + +#### Events for secret management +| Action | Description +|------------------|------------------- +| `action:org.create_actions_secret` | Triggered when a organization admin [creates a {% data variables.product.prodname_actions %} secret](/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-an-organization). +| `action:org.remove_actions_secret` | Triggered when a organization admin removes a {% data variables.product.prodname_actions %} secret. +| `action:org.update_actions_secret` | Triggered when a organization admin updates a {% data variables.product.prodname_actions %} secret. +| `action:repo.create_actions_secret ` | Triggered when a repository admin [creates a {% data variables.product.prodname_actions %} secret](/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository). +| `action:repo.remove_actions_secret` | Triggered when a repository admin removes a {% data variables.product.prodname_actions %} secret. +| `action:repo.update_actions_secret` | Triggered when a repository admin updates a {% data variables.product.prodname_actions %} secret. + +#### Events for self-hosted runners +| Action | Description +|------------------|------------------- +| `action:org.register_self_hosted_runner` | Triggered when an organization owner [registers a new self-hosted runner](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization). +| `action:org.remove_self_hosted_runner` | Triggered when an organization owner [removes a self-hosted runner](/actions/hosting-your-own-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization). +| `action:repo.register_self_hosted_runner` | Triggered when a repository admin [registers a new self-hosted runner](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository). +| `action:repo.remove_self_hosted_runner` | Triggered when a repository admin [removes a self-hosted runner](/actions/hosting-your-own-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository). + +#### Events for self-hosted runner groups +| Action | Description +|------------------|------------------- +| `action:org.runner_group_created` | Triggered when an organization admin [creates a self-hosted runner group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization). +| `action:org.runner_group_removed` | Triggered when an organization admin removes a self-hosted runner group. +| `action:org.runner_group_renamed` | Triggered when an organization admin renames a self-hosted runner group. +| `action:org.runner_group_runners_added` | Triggered when an organization admin [adds a self-hosted runner to a group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group). +| `action:org.runner_group_runners_removed` | Triggered when an organization admin removes a self-hosted runner from a group. + + diff --git a/content/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server.md b/content/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server.md index e073e896dd..30b49af880 100644 --- a/content/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server.md +++ b/content/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server.md @@ -18,10 +18,13 @@ You can connect {% data variables.product.product_location_enterprise %} to {% d After connecting {% data variables.product.product_location_enterprise %} to {% data variables.product.prodname_dotcom_the_website %} and enabling {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts for vulnerable dependencies, vulnerability data is synced from {% data variables.product.prodname_dotcom_the_website %} to your instance once every hour. You can also choose to manually sync vulnerability data at any time. No code or information about code from {% data variables.product.product_location_enterprise %} is uploaded to {% data variables.product.prodname_dotcom_the_website %}. -{% if currentVersion ver_gt "enterprise-server@2.21" %}When {% data variables.product.product_location_enterprise %} receives information about a vulnerability, it will identify repositories in your instance that use the affected version of the dependency and send {% data variables.product.prodname_dependabot_short %} alerts to owners and people with admin access in those repositories. They can customize how they receive {% data variables.product.prodname_dependabot_short %} alerts. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/#configuring-notifications-for-github-dependabot-alerts)." +{% if currentVersion ver_gt "enterprise-server@2.21" %}When {% data variables.product.product_location_enterprise %} receives information about a vulnerability, it will identify repositories in your instance that use the affected version of the dependency and send {% data variables.product.prodname_dependabot_short %} alerts. You can customize how you receive {% data variables.product.prodname_dependabot_short %} alerts. For more information, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies/#configuring-notifications-for-github-dependabot-alerts)." {% endif %} -{% if currentVersion ver_lt "enterprise-server@2.21" or currentVersion == "enterprise-server@2.21" %}When {% data variables.product.product_location_enterprise %} receives information about a vulnerability, it will identify repositories in your instance that use the affected version of the dependency and send security alerts to owners and people with admin access in those repositories. They can customize how they receive security alerts. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/#configuring-notifications-for-security-alerts)." +{% if currentVersion == "enterprise-server@2.21" %}When {% data variables.product.product_location_enterprise %} receives information about a vulnerability, it will identify repositories in your instance that use the affected version of the dependency and send security alerts. You can customize how you receive security alerts. For more information, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies/#configuring-notifications-for-security-alerts)." +{% endif %} + +{% if currentVersion ver_lt "enterprise-server@2.21" %}When {% data variables.product.product_location_enterprise %} receives information about a vulnerability, it will identify repositories in your instance that use the affected version of the dependency and send security alerts. You can customize how you receive security alerts. For more information, see "[Choosing the delivery method for your notifications](/github/receiving-notifications-about-activity-on-github/choosing-the-delivery-method-for-your-notifications#choosing-the-delivery-method-for-security-alerts-for-vulnerable-dependencies)." {% endif %} {% if currentVersion ver_gt "enterprise-server@2.21" %} diff --git a/content/admin/enterprise-management/initiating-a-failover-to-your-replica-appliance.md b/content/admin/enterprise-management/initiating-a-failover-to-your-replica-appliance.md index 5205e49617..de93a1dba3 100644 --- a/content/admin/enterprise-management/initiating-a-failover-to-your-replica-appliance.md +++ b/content/admin/enterprise-management/initiating-a-failover-to-your-replica-appliance.md @@ -30,6 +30,15 @@ The time required to failover depends on how long it takes to manually promote t 5. Update the DNS record to point to the IP address of the replica. Traffic is directed to the replica after the TTL period elapses. If you are using a load balancer, ensure it is configured to send traffic to the replica. 6. Notify users that they can resume normal operations. 7. If desired, set up replication from the new primary to existing appliances and the previous primary. For more information, see "[About high availability configuration](/enterprise/{{ currentVersion }}/admin/guides/installation/about-high-availability-configuration/#utilities-for-replication-management)." +8. Appliances you do not intend to setup replication to that were part of the high availability configuration prior the failover, need to be removed from the high availability configuration by UUID. + - On the former appliances, get their UUID via `cat /data/user/common/uuid`. + ```shell + $ cat /data/user/common/uuid + ``` + - On the new primary, remove the UUIDs using `ghe-repl-teardown`. Please replace *`UUID`* with a UUID you retrieved in the previous step. + ```shell + $ ghe-repl-teardown -u UUNID + ``` ### Further reading diff --git a/content/admin/github-actions/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access.md b/content/admin/github-actions/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access.md index c51ee1e492..2fce2abf54 100644 --- a/content/admin/github-actions/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access.md +++ b/content/admin/github-actions/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access.md @@ -34,7 +34,7 @@ You can populate the runner tool cache by running a {% data variables.product.pr ### Populating the tool cache for a self-hosted runner -1. On {% data variables.product.prodname_dotcom_the_website %}, navigate to a repostory that you can use to run a {% data variables.product.prodname_actions %} workflow. +1. On {% data variables.product.prodname_dotcom_the_website %}, navigate to a repository that you can use to run a {% data variables.product.prodname_actions %} workflow. 1. Create a new workflow file in the repository's `.github/workflows` folder that uploads an artifact containing the {% data variables.product.prodname_dotcom %}-hosted runner's tool cache. The following example demonstrates a workflow that uploads the tool cache for an Ubuntu 18.04 environment, using the `setup-node` action with Node.js versions 10 and 12. diff --git a/content/developers/webhooks-and-events/github-event-types.md b/content/developers/webhooks-and-events/github-event-types.md index 4d0dd43258..68d368da53 100644 --- a/content/developers/webhooks-and-events/github-event-types.md +++ b/content/developers/webhooks-and-events/github-event-types.md @@ -28,13 +28,13 @@ The event objects returned from the Events API endpoints have the same structure | `actor.id` | The unique identifier for the actor. | | `actor.login` | The username of the actor. | | `actor.display_login` | The specific display format of the username. | -| `actor.gravatar_id` | The unique indentifier of the Gravatar profile for the actor. | +| `actor.gravatar_id` | The unique identifier of the Gravatar profile for the actor. | | `actor.url` | The REST API URL used to retrieve the user object, which includes additional user information. | | `actor.avatar_url` | The URL of the actor's profile image. | | `repo` | The repository object where the event occurred. | | `repo.id` | The unique identifier of the repository. | | `repo.name` | The name of the repository, which includes the owner and repository name. For example, `octocat/hello-world` is the name of the `hello-world` repository owned by the `octocat` user account. | -| `repo.url` | The REST API URL used to retrive the repository object, which includes additional repository information. | +| `repo.url` | The REST API URL used to retrieve the repository object, which includes additional repository information. | | `payload` | The event payload object is unique to the event type. See the event type below for the event API `payload` object. | #### Example WatchEvent event object diff --git a/content/developers/webhooks-and-events/issue-event-types.md b/content/developers/webhooks-and-events/issue-event-types.md index 82ed7166f0..c453b70cb0 100644 --- a/content/developers/webhooks-and-events/issue-event-types.md +++ b/content/developers/webhooks-and-events/issue-event-types.md @@ -229,7 +229,7 @@ Name | Type | Description -----|------|-------------- `actor` | `object` | The person who generated the event. `created_at` | `string` | The timestamp indicating when the cross-reference was added. -`updated_at` | `string` | The timestamp indicating when the cross-refererence was updated or created, if the cross-reference is never updated. +`updated_at` | `string` | The timestamp indicating when the cross-reference was updated or created, if the cross-reference is never updated. `source` | `object` | The issue or pull request that added a cross-reference. `source[type]` | `string` | This value will always be `"issue"` because pull requests are of type issue. Only cross-reference events triggered by issues or pull requests are returned in the Timeline Events API. To determine if the issue that triggered the event is a pull request, you can check if the `source[issue][pull_request` object exists. `source[issue]` | `object` | The `issue` object that added the cross-reference. diff --git a/content/developers/webhooks-and-events/webhook-events-and-payloads.md b/content/developers/webhooks-and-events/webhook-events-and-payloads.md index 137524fbae..55d899fed5 100644 --- a/content/developers/webhooks-and-events/webhook-events-and-payloads.md +++ b/content/developers/webhooks-and-events/webhook-events-and-payloads.md @@ -617,7 +617,7 @@ For a detailed description of this payload and the payload for each type of `act ### meta -The webhook this event is configured on was deleted. This event will only listen for changes to the particular hook the event is installed on. Therefore, it must be selected for each hook that you'd like to recieve meta events for. +The webhook this event is configured on was deleted. This event will only listen for changes to the particular hook the event is installed on. Therefore, it must be selected for each hook that you'd like to receive meta events for. #### Availability diff --git a/content/github/administering-a-repository/about-required-commit-signing.md b/content/github/administering-a-repository/about-required-commit-signing.md index f357238441..71ed73f2ab 100644 --- a/content/github/administering-a-repository/about-required-commit-signing.md +++ b/content/github/administering-a-repository/about-required-commit-signing.md @@ -11,7 +11,7 @@ versions: If you've enforced branch protections in your repository, you can set up required commit signing. For more information, see "[Configuring protected branches](/articles/configuring-protected-branches/)." -When you enable required commit signing on a branch, contibutors {% if currentVersion == "free-pro-team@latest" %}and bots{% endif %} can only push commits that have been signed and verified to the branch. For more information, see "[About commit signature verification](/articles/about-commit-signature-verification)." +When you enable required commit signing on a branch, contributors {% if currentVersion == "free-pro-team@latest" %}and bots{% endif %} can only push commits that have been signed and verified to the branch. For more information, see "[About commit signature verification](/articles/about-commit-signature-verification)." You can always push local commits to the branch if the commits are signed and verified. {% if currentVersion == "free-pro-team@latest" %}You can also merge signed and verified commits into the branch using a pull request on {% data variables.product.product_name %}. However, you cannot squash and merge a pull request into the branch on {% data variables.product.product_name %} unless you are the author of the pull request.{% else %} However, you cannot merge pull requests into the branch on {% data variables.product.product_name %}.{% endif %} You can {% if currentVersion == "free-pro-team@latest" %}squash and {% endif %}merge pull requests locally. For more information, see "[Checking out pull requests locally](/github/collaborating-with-issues-and-pull-requests/checking-out-pull-requests-locally)."{% if currentVersion == "free-pro-team@latest" %} For more information about merge methods, see "[About merge methods on {% data variables.product.prodname_dotcom %}](/github/administering-a-repository/about-merge-methods-on-github)."{% endif %} diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/index.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/index.md index 381f829b52..f5742510b7 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/index.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/index.md @@ -1,5 +1,6 @@ --- title: Finding security vulnerabilities and errors in your code +shortTitle: Finding vulnerabilities and coding errors product: '{% data reusables.gated-features.code-scanning %}' redirect_from: - /github/managing-security-vulnerabilities/finding-security-vulnerabilities-in-your-projects-code diff --git a/content/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies.md b/content/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies.md index 5dae79a3e0..734552725a 100644 --- a/content/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies.md +++ b/content/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies.md @@ -74,34 +74,7 @@ We send {% data variables.product.prodname_dependabot_short %} alerts to people We send security alerts to people with admin permissions in the affected repositories by default. {% data variables.product.product_name %} never publicly discloses identified vulnerabilities for any repository. {% endif %} -### Configuring notifications for {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %} - -{% if currentVersion == "free-pro-team@latest" %} -By default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email, grouped by the specific vulnerability. You can also choose to receive {% data variables.product.prodname_dependabot_alerts %} in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#github-dependabot-alerts-notification-options)." -{% endif %} - -{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21" %} -By default, if your site administrator has configured email for notifications on your instance, you will receive {% data variables.product.prodname_dependabot_alerts %} by email. You can also choose to receive {% data variables.product.prodname_dependabot_alerts %} in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#github-dependabot-alerts-notification-options)." -{% endif %} - -{% if enterpriseServerVersions contains currentVersion and currentVersion == "enterprise-server@2.21" %} -By default, if your site administrator has configured email for notifications on your instance, you will receive security alerts by email. You can also choose to receive security alerts in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#security-alert-notification-options)." -{% endif %} - -{% if enterpriseServerVersions contains currentVersion and currentVersion ver_lt "enterprise-server@2.21" %} -By default, if your site administrator has configured email for notifications on your instance, you will receive security alerts by email. You can also choose to receive security alerts in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Choosing the delivery method for your notifications -](/github/receiving-notifications-about-activity-on-github/choosing-the-delivery-method-for-your-notifications)." -{% endif %} - -{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.20" % %} - -{% if currentVersion ver_gt "enterprise-server@2.21" %}Site administrators can also enable {% data variables.product.prodname_dependabot_alerts %} without notifications. For more information, see "[Enabling {% data variables.product.prodname_dependabot_short %} alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %} - -{% if currentVersion ver_lt "enterprise-server@2.22" %}Site administrators can also enable security alerts without notifications. For more information, see "[Enabling security alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %} - -{% endif %} - -{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.19" % %}{% data reusables.repositories.security-alerts-x-github-severity %} For more information, see {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.20" %}"[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#filtering-email-notifications){% else %}"[About email notifications](/github/receiving-notifications-about-activity-on-github/about-email-notifications){% endif %}."{% endif %} +{% data reusables.notifications.vulnerable-dependency-notification-delivery-method-customization %}{% if enterpriseServerVersions contains currentVersion and currentVersion ver_lt "enterprise-server@2.21" %} For more information, see "[Choosing the delivery method for your notifications](/github/receiving-notifications-about-activity-on-github/choosing-the-delivery-method-for-your-notifications)."{% endif %}{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.20" %} For more information, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies)."{% endif %} {% if currentVersion == "free-pro-team@latest" %} ### Further reading diff --git a/content/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies.md b/content/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies.md new file mode 100644 index 0000000000..dbf47ece95 --- /dev/null +++ b/content/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies.md @@ -0,0 +1,56 @@ +--- +title: Configuring notifications for vulnerable dependencies +shortTitle: Configuring notifications +intro: 'Optimize how you receive notifications about {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts.' +versions: + free-pro-team: '*' + enterprise-server: '>=2.21' +--- + +### About notifications for vulnerable dependencies + +{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}When {% data variables.product.prodname_dependabot %} detects vulnerable dependencies in your repositories, we send you {% data variables.product.prodname_dependabot_short %} alerts.{% else %}When {% data variables.product.product_name %} detects vulnerable dependencies in your repositories, it sends security alerts.{% endif %}{% if currentVersion == "free-pro-team@latest" %} {% data variables.product.prodname_dependabot_short %} is enabled by default on all public repositories. For {% data variables.product.prodname_dependabot_alerts %}, by default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email, grouped by the specific vulnerability. +{% endif %} + +{% if currentVersion == "free-pro-team@latest" %}If you're an organization owner, you can enable or disable {% data variables.product.prodname_dependabot_short %} alerts for all repositories in your organization with one click. You can also set whether the detection of vulnerable dependencies will be enabled or disabled for newly-created repositories. For more information, see "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-features-for-new-repositories)." +{% endif %} + +{% if enterpriseServerVersions contains currentVersion and currentVersion == "enterprise-server@2.21" %} +Your site administrator needs to enable security alerts for vulnerable dependencies for {% data variables.product.product_location_enterprise %} before you can use the feature. For more information, see "[Enabling alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %} + +{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.20" %} +By default, if your site administrator has configured email for notifications on your instance, you will receive {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %} by email.{% endif %} + +{% if currentVersion ver_gt "enterprise-server@2.21" %}Site administrators can also enable {% data variables.product.prodname_dependabot_alerts %} without notifications. For more information, see "[Enabling {% data variables.product.prodname_dependabot_short %} alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %} + +{% if currentVersion ver_lt "enterprise-server@2.22" %}Site administrators can also enable security alerts without notifications. For more information, see "[Enabling security alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %} + +### Configuring notifications for {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %} + +You can configure notification settings for yourself or your organization from the Manage notifications drop-down {% octicon "bell" aria-label="The notifications bell" %} shown at the top of each page. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#choosing-your-notification-settings)." + +{% data reusables.notifications.vulnerable-dependency-notification-delivery-method-customization %} +{% data reusables.notifications.vulnerable-dependency-notification-options %} + +{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %} +  +{% else %} +  +{% endif %} + +{% note %} + +**Note:** You can filter your {% data variables.product.company_short %} inbox notifications to show {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %} security{% endif %} alerts. For more information, see "[Managing notifications from your inbox](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#supported-queries-for-custom-filters)." + +{% endnote %} + +{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.19" % %}{% data reusables.repositories.security-alerts-x-github-severity %} For more information, see {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.20" %}"[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#filtering-email-notifications){% else %}"[About email notifications](/github/receiving-notifications-about-activity-on-github/about-email-notifications){% endif %}."{% endif %} + +### How to reduce the noise from notifications for vulnerable dependencies + +If you are concerned about receiving too many notifications for {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %}, we recommend you opt into the weekly email digest, or turn off notifications while keeping {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %} enabled. You can still navigate to see your {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %} in your repository's Security tab.{% if currentVersion == "free-pro-team@latest" %} For more information, see "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)."{% endif %} + +### Further reading + +- "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications)" +- "[Managing notifications from your inbox](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#supported-is-queries)" diff --git a/content/github/managing-security-vulnerabilities/index.md b/content/github/managing-security-vulnerabilities/index.md index a4285a6d86..33684e122b 100644 --- a/content/github/managing-security-vulnerabilities/index.md +++ b/content/github/managing-security-vulnerabilities/index.md @@ -28,6 +28,7 @@ versions: {% link_in_list /browsing-security-vulnerabilities-in-the-github-advisory-database %} {% link_in_list /about-alerts-for-vulnerable-dependencies %} + {% link_in_list /configuring-notifications-for-vulnerable-dependencies %} {% link_in_list /configuring-github-dependabot-security-updates %} {% link_in_list /viewing-and-updating-vulnerable-dependencies-in-your-repository %} diff --git a/content/github/managing-subscriptions-and-notifications-on-github/configuring-notifications.md b/content/github/managing-subscriptions-and-notifications-on-github/configuring-notifications.md index 5c2b46dcb5..223c3f828e 100644 --- a/content/github/managing-subscriptions-and-notifications-on-github/configuring-notifications.md +++ b/content/github/managing-subscriptions-and-notifications-on-github/configuring-notifications.md @@ -163,25 +163,10 @@ If you are a member of more than one organization, you can configure each one to ### Security alert notification options {% endif %} -{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}Choose how you want to receive {% data variables.product.prodname_dependabot_alerts %} for repositories that you are watching. You can receive {% data variables.product.prodname_dependabot_alerts %} in your inbox, as a banner on {% data variables.product.product_name %}, on the command line, through email, or some combination of these options. +{% data reusables.notifications.vulnerable-dependency-notification-delivery-method-customization %} +{% data reusables.notifications.vulnerable-dependency-notification-options %} -If you want to receive {% data variables.product.prodname_dependabot_alerts %} by email, choose whether you want a weekly email summary of vulnerabilities for up 10 repositories or a new email each time a vulnerability is detected. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."{% endif %} - -{% if currentVersion == "enterprise-server@2.21" %}Choose how you want to receive security alerts for repositories that you are watching. You can receive security alerts in your inbox, as a banner on {% data variables.product.product_name %}, on the command line, through email, or some combination of these options. - -If you want to receive security alerts by email, choose whether you want a weekly email summary of vulnerabilities for up 10 repositories or a new email each time a vulnerability is detected. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."{% endif %} - -{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %} -  -{% else %} -  -{% endif %} - -{% note %} - -**Note:** You can filter your {% data variables.product.company_short %} inbox notifications by {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %} security{% endif %} alerts. For more information, see "[Managing notifications from your inbox](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#supported-queries-for-custom-filters)." - -{% endnote %} +For more information about the notification delivery methods available to you, and advice on optimizing your notifications for {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %}, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies)." {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %} diff --git a/content/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox.md b/content/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox.md index 940fb73c59..fad89fc130 100644 --- a/content/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox.md +++ b/content/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox.md @@ -124,6 +124,8 @@ To filter notifications for specific activity on {% data variables.product.produ - `is:repository-advisory` - `is:team-discussion` +For information about reducing noise from notifications for {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %}, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies)." + You can also use the `is:` query to describe how the notification was triaged. - `is:saved` diff --git a/content/github/managing-subscriptions-and-notifications-on-github/managing-your-subscriptions.md b/content/github/managing-subscriptions-and-notifications-on-github/managing-your-subscriptions.md index e9253f1908..c76a24f0c7 100644 --- a/content/github/managing-subscriptions-and-notifications-on-github/managing-your-subscriptions.md +++ b/content/github/managing-subscriptions-and-notifications-on-github/managing-your-subscriptions.md @@ -38,7 +38,7 @@ When you unsubscribe from notifications in your inbox, they will automatically d {% data reusables.notifications.access_notifications %} 1. From the notifications inbox, select the notifications you want to unsubscribe to. -2. Use the the **selected** {% octicon "triangle-down" aria-label="The down triangle icon" %} drop-down to click **Unsubscribe.** +2. Use the **selected** {% octicon "triangle-down" aria-label="The down triangle icon" %} drop-down to click **Unsubscribe.**  ### Unsubscribing from notifications on the subscriptions page diff --git a/content/github/managing-your-work-on-github/about-automation-for-project-boards.md b/content/github/managing-your-work-on-github/about-automation-for-project-boards.md index a98102fe88..c947ec9fd6 100644 --- a/content/github/managing-your-work-on-github/about-automation-for-project-boards.md +++ b/content/github/managing-your-work-on-github/about-automation-for-project-boards.md @@ -29,7 +29,10 @@ Project board automation can also help teams develop a shared understanding of a | Done |