diff --git a/Dockerfile b/Dockerfile index b083245f573f..4c33770f81a8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,7 +10,7 @@ # --------------------------------------------------------------- # To update the sha: # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble -FROM ghcr.io/github/gh-base-image/gh-base-noble:20260720-202540-g0ac3959ef@sha256:48e1461c14c217a7dbaa9d08ccfe726772d356f40a070f8c6a34e37a8fcf2f18 AS base +FROM ghcr.io/github/gh-base-image/gh-base-noble:20260722-151519-g000ce495e@sha256:f722b1fb6d02a18f85d45ab2e064a0736e64992f20371a063c4076bac57832c9 AS base # Install curl for Node install and determining the early access branch # Install git for cloning docs-early-access & translations repos diff --git a/content/code-security/concepts/code-scanning/ai-powered-security-detections.md b/content/code-security/concepts/code-scanning/ai-powered-security-detections.md index 6015c3efbe5b..e9a925f1a96f 100644 --- a/content/code-security/concepts/code-scanning/ai-powered-security-detections.md +++ b/content/code-security/concepts/code-scanning/ai-powered-security-detections.md @@ -50,7 +50,7 @@ Each finding includes a description of the security issue and an explanation of AI-powered security detections are designed to cover languages and frameworks that are not currently supported by {% data variables.product.prodname_codeql %}. This includes, but is not limited to, languages such as PHP, Shell/Bash, Terraform configuration (HCL), and Dockerfiles, as well as framework coverage gaps such as JSP for Java and Blazor for C#. -For a full list of languages supported by {% data variables.product.prodname_codeql %}, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/about-code-scanning-with-codeql#supported-languages-and-frameworks). +For a full list of languages supported by {% data variables.product.prodname_codeql %}, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/about-code-scanning-with-codeql). ## Detection categories diff --git a/content/code-security/concepts/code-scanning/code-scanning-alerts.md b/content/code-security/concepts/code-scanning/code-scanning-alerts.md index aac071aed729..68def37a062d 100644 --- a/content/code-security/concepts/code-scanning/code-scanning-alerts.md +++ b/content/code-security/concepts/code-scanning/code-scanning-alerts.md @@ -27,7 +27,7 @@ By default, {% data variables.product.prodname_code_scanning %} analyzes your co {% ifversion code-scanning-autofix %} -You can use {% data variables.copilot.copilot_autofix %} to generate fixes automatically for {% data variables.product.prodname_code_scanning %} alerts, including {% data variables.product.prodname_codeql %} alerts. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#generating-suggested-fixes-for-code-scanning-alerts). +You can use {% data variables.copilot.copilot_autofix %} to generate fixes automatically for {% data variables.product.prodname_code_scanning %} alerts, including {% data variables.product.prodname_codeql %} alerts. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#generating-a-suggested-fix). {% endif %} diff --git a/content/code-security/concepts/code-scanning/codeql/codeql-workspaces.md b/content/code-security/concepts/code-scanning/codeql/codeql-workspaces.md index b3cd88d3c645..1e4be9d76ded 100644 --- a/content/code-security/concepts/code-scanning/codeql/codeql-workspaces.md +++ b/content/code-security/concepts/code-scanning/codeql/codeql-workspaces.md @@ -49,7 +49,7 @@ The workspace dependency model affects how packs are installed and published. * During installation, dependencies found in the workspace are not downloaded into the package cache and are not written to the `codeql-pack.lock.yml` file. * During publishing, dependencies provided by the workspace are bundled using their local source content rather than versions from the package cache. -For example, running `codeql pack install` in a pack directory within a workspace uses any dependencies found in the workspace instead of downloading them into the package cache or recording them in the `codeql-pack.lock.yml` file. See [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs#adding-and-installing-dependencies). +For example, running `codeql pack install` in a pack directory within a workspace uses any dependencies found in the workspace instead of downloading them into the package cache or recording them in the `codeql-pack.lock.yml` file. See [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs#adding-and-installing-dependencies-on-a-codeql-pack). ### Example @@ -98,7 +98,7 @@ A {% data variables.product.prodname_codeql %} workspace is defined by a YAML fi * The `ignore` block contains a list of glob patterns that define {% data variables.product.prodname_codeql %} packs that are not available in the workspace. -* The `registries` block contains a list of GHES URLs and package patterns that control which container registry is used for publishing {% data variables.product.prodname_codeql %} packs. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/publish-and-use-packs#working-with-codeql-packs-on-ghes). +* The `registries` block contains a list of GHES URLs and package patterns that control which container registry is used for publishing {% data variables.product.prodname_codeql %} packs. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/publish-and-use-packs). Each entry in the `provide` or `ignore` section must map to the location of a `qlpack.yml` file. All glob patterns are defined relative to the directory that contains the workspace file. For a list of patterns accepted in this file, see [@actions/glob](https://github.com/actions/toolkit/tree/main/packages/glob#patterns). diff --git a/content/code-security/concepts/code-scanning/codeql/query-packs.md b/content/code-security/concepts/code-scanning/codeql/query-packs.md index f90d0b1783e9..277114a85cd2 100644 --- a/content/code-security/concepts/code-scanning/codeql/query-packs.md +++ b/content/code-security/concepts/code-scanning/codeql/query-packs.md @@ -26,7 +26,7 @@ Each {% data variables.product.prodname_codeql %} pack requires a `qlpack.yml` f * Dependencies on other {% data variables.product.prodname_codeql %} packs and libraries * Query suite definitions -For more information about `qlpack.yml` properties, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/customize-analysis#codeqlpack-yml-properties). +For more information about `qlpack.yml` properties, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/customize-analysis). Additionally, a {% data variables.product.prodname_codeql %} pack can contain: diff --git a/content/code-security/concepts/code-scanning/tool-status-page.md b/content/code-security/concepts/code-scanning/tool-status-page.md index a364fa290aa2..1ecde96d5aa0 100644 --- a/content/code-security/concepts/code-scanning/tool-status-page.md +++ b/content/code-security/concepts/code-scanning/tool-status-page.md @@ -60,7 +60,7 @@ In addition to the information listed above, the {% data variables.code-scanning ### Compiled languages -The {% data variables.code-scanning.tool_status_page %} reports files present before running autobuild or manual build steps. Files generated during the build process are not shown. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#about-autobuild-for-codeql). +The {% data variables.code-scanning.tool_status_page %} reports files present before running autobuild or manual build steps. Files generated during the build process are not shown. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#use-autobuild-for-codeql). ### Coverage calculation @@ -72,7 +72,7 @@ Use file coverage percentages to debug and improve your analysis: * **High percentage**: {% data variables.product.prodname_code_scanning_caps %} is working as expected for that language * **Low percentage**: Investigate diagnostic output. See [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected) -* **Zero percentage**: You may have code in languages not currently being analyzed. Update your setup to include these languages. See [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#changing-the-languages-that-are-analyzed) +* **Zero percentage**: You may have code in languages not currently being analyzed. Update your setup to include these languages. See [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options) > [!NOTE] > If you set up both advanced setup and default setup, the {% data variables.code-scanning.tool_status_page %} only shows default setup. diff --git a/content/code-security/concepts/secret-security/about-alerts.md b/content/code-security/concepts/secret-security/about-alerts.md index e49410343606..90f7fceb86c9 100644 --- a/content/code-security/concepts/secret-security/about-alerts.md +++ b/content/code-security/concepts/secret-security/about-alerts.md @@ -55,7 +55,7 @@ Push protection scans pushes for supported secrets. If push protection detects a > [!NOTE] > {% ifversion secret-scanning-push-protection-for-users %}You can also enable push protection for your personal account, called "push protection for users", which prevents you from accidentally pushing supported secrets to _any_ public repository. Alerts are _not_ created if you choose to bypass your user-based push protection only. Alerts are only created if the repository itself has push protection enabled. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-secrets/prevent-future-leaks/manage-user-push-protection).{% endif %} > -> {% data reusables.secret-scanning.push-protection-older-tokens %} For more information about push protection limitations, see [AUTOTITLE](/code-security/reference/secret-security/secret-scanning-scope#push-protection-and-pattern-versions). +> {% data reusables.secret-scanning.push-protection-older-tokens %} For more information about push protection limitations, see [AUTOTITLE](/code-security/reference/secret-security/secret-scanning-scope). {% ifversion fpt or ghec %} diff --git a/content/code-security/concepts/secret-security/secret-scanning-for-partners.md b/content/code-security/concepts/secret-security/secret-scanning-for-partners.md index f981655adae3..c3489cc9656d 100644 --- a/content/code-security/concepts/secret-security/secret-scanning-for-partners.md +++ b/content/code-security/concepts/secret-security/secret-scanning-for-partners.md @@ -30,7 +30,7 @@ The reason partner alerts are directly sent to the secret providers whenever a l ## What are the supported secrets -For information about the secrets and service providers supported by push protection, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets). +For information about the secrets and service providers supported by push protection, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns). ## Further reading diff --git a/content/code-security/concepts/secret-security/validity-checks.md b/content/code-security/concepts/secret-security/validity-checks.md index 619086fe4f1c..52d3876dd7cb 100644 --- a/content/code-security/concepts/secret-security/validity-checks.md +++ b/content/code-security/concepts/secret-security/validity-checks.md @@ -47,7 +47,7 @@ You can enable extended metadata checks if validity checks are enabled. Then, yo * **Enhance compliance**: Ensure secrets align with your organization’s governance and security policies. * **Reduce false positives**: Use additional context to determine if a detection requires action. -The specific metadata available depends on what the service provider shares with {% data variables.product.github %}. Not all secret types support extended metadata checks. For more information, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#verifying-token-metadata). +The specific metadata available depends on what the service provider shares with {% data variables.product.github %}. Not all secret types support extended metadata checks. For more information, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts). ## Getting started with validity and extended metadata checks diff --git a/content/code-security/concepts/security-at-scale/security-overview.md b/content/code-security/concepts/security-at-scale/security-overview.md index 9f7290d5374c..a8b6b8afbc09 100644 --- a/content/code-security/concepts/security-at-scale/security-overview.md +++ b/content/code-security/concepts/security-at-scale/security-overview.md @@ -42,7 +42,7 @@ All organizations on {% data variables.product.prodname_enterprise %} can use: All organizations on {% data variables.product.prodname_enterprise %} can use {% data variables.product.prodname_dependabot %} data to evaluate the security of their supply chain in all repositories. {% endif %} -In addition, data for **{% data variables.product.prodname_AS %}** features, such as {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, is shown for organizations and enterprises that use {% data variables.product.prodname_GHAS_cs_or_sp %}{% ifversion ghec %}, and for public repositories{% endif %}, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#dependabot-alerts-for-vulnerable-dependencies) and [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security). +In addition, data for **{% data variables.product.prodname_AS %}** features, such as {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, is shown for organizations and enterprises that use {% data variables.product.prodname_GHAS_cs_or_sp %}{% ifversion ghec %}, and for public repositories{% endif %}, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts) and [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security). {% endif %} diff --git a/content/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules.md b/content/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules.md index 17bae70cf668..a55224219bed 100644 --- a/content/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules.md +++ b/content/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules.md @@ -44,7 +44,7 @@ There are two types of {% data variables.dependabot.auto_triage_rules %}: * At worst, have limited effects like slow builds or long-running tests. * Are not indicative of issues in production. -The rule is enabled by default for public repositories and can be opted into for private repositories. For instructions, see [Enabling the `Dismiss low impact issues for development-scoped dependencies` rule for your private repository](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/prioritize-with-preset-rules#enabling-the-dismiss-low-impact-issues-for-development-scoped-dependencies-rule-for-your-private-repository). +The rule is enabled by default for public repositories and can be opted into for private repositories. For instructions, see [Enabling the `Dismiss low impact issues for development-scoped dependencies` rule for your private repository](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/prioritize-with-preset-rules#enabling-github-preset-rules). For more information about the criteria used by the rule, see [AUTOTITLE](/code-security/reference/supply-chain-security/criteria-for-preset-rules). @@ -78,7 +78,7 @@ Additionally, auto-dismissed alerts are still available for reporting and review * If you change the scope of a dependency from development to production. * If {% data variables.product.company_short %} modifies certain metadata for the related advisory. -Auto-dismissed alerts are defined by the `resolution:auto-dismiss` close reason. Automatic dismissal activity is included in alert webhooks, REST and GraphQL APIs, and the audit log. For more information, see [AUTOTITLE](/rest/dependabot/alerts), and the "`repository_vulnerability_alert`" section in [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#repository_vulnerability_alert-category-actions). +Auto-dismissed alerts are defined by the `resolution:auto-dismiss` close reason. Automatic dismissal activity is included in alert webhooks, REST and GraphQL APIs, and the audit log. For more information, see [AUTOTITLE](/rest/dependabot/alerts), and the "`repository_vulnerability_alert`" section in [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization). ## Next steps diff --git a/content/code-security/concepts/supply-chain-security/dependabot-security-updates.md b/content/code-security/concepts/supply-chain-security/dependabot-security-updates.md index c048c8232556..bd474455dd51 100644 --- a/content/code-security/concepts/supply-chain-security/dependabot-security-updates.md +++ b/content/code-security/concepts/supply-chain-security/dependabot-security-updates.md @@ -46,10 +46,10 @@ You can add a `dependabot.yml` configuration file to your repository to customiz {% data variables.product.prodname_dependabot %} checks whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then {% data variables.product.prodname_dependabot %} raises a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the {% data variables.product.prodname_dependabot %} alert, or reports an error on the alert. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors). -The {% data variables.product.prodname_dependabot_security_updates %} feature is available for repositories where you have enabled the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. You will see a {% data variables.product.prodname_dependabot %} alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-graph#dependencies-included). +The {% data variables.product.prodname_dependabot_security_updates %} feature is available for repositories where you have enabled the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. You will see a {% data variables.product.prodname_dependabot %} alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-graph). > [!NOTE] -> For npm, {% data variables.product.prodname_dependabot %} will raise a pull request to update an explicitly defined dependency to a secure version, even if it means updating the parent dependency or dependencies, or even removing a sub-dependency that is no longer needed by the parent. For other ecosystems, {% data variables.product.prodname_dependabot %} is unable to update an indirect or transitive dependency if it would also require an update to the parent dependency. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors#dependabot-tries-to-update-dependencies-without-an-alert). +> For npm, {% data variables.product.prodname_dependabot %} will raise a pull request to update an explicitly defined dependency to a secure version, even if it means updating the parent dependency or dependencies, or even removing a sub-dependency that is no longer needed by the parent. For other ecosystems, {% data variables.product.prodname_dependabot %} is unable to update an indirect or transitive dependency if it would also require an update to the parent dependency. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors#updates-dependencies-without-an-alert). You can enable a related feature, {% data variables.product.prodname_dependabot_version_updates %}, so that {% data variables.product.prodname_dependabot %} raises pull requests to update the manifest to the latest version of the dependency, whenever it detects an outdated dependency. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-version-updates). @@ -70,7 +70,7 @@ For security updates, {% data variables.product.prodname_dependabot %} will only {% data reusables.dependabot.dependabot-grouped-security-updates-how-enable %} {% data reusables.dependabot.dependabot-grouped-security-updates-order %} - For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates#grouping-into-a-single-pull-request). + For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates#grouping-dependabot-security-updates-into-a-single-pull-request). {% ifversion fpt or ghec %} @@ -86,4 +86,4 @@ For security updates, {% data variables.product.prodname_dependabot %} will only ## About notifications for {% data variables.product.prodname_dependabot %} security updates -You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot %} security updates. For more information, see [AUTOTITLE](/subscriptions-and-notifications/reference/inbox-filters#custom-filters). +You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot %} security updates. For more information, see [AUTOTITLE](/subscriptions-and-notifications/reference/inbox-filters). diff --git a/content/code-security/concepts/supply-chain-security/dependency-review.md b/content/code-security/concepts/supply-chain-security/dependency-review.md index 5e864c2995c6..3e08fb9ce0e4 100644 --- a/content/code-security/concepts/supply-chain-security/dependency-review.md +++ b/content/code-security/concepts/supply-chain-security/dependency-review.md @@ -29,7 +29,7 @@ Sometimes you might just want to update the version of one dependency in a manif By checking the dependency reviews in a pull request, and changing any dependencies that are flagged as vulnerable, you can avoid vulnerabilities being added to your project. For more information about how dependency review works, see [AUTOTITLE](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request). -{% data variables.product.prodname_dependabot_alerts %} will find vulnerabilities that are already in your dependencies, but it's much better to avoid introducing potential problems than to fix problems at a later date. For more information about {% data variables.product.prodname_dependabot_alerts %}, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#dependabot-alerts-for-vulnerable-dependencies). +{% data variables.product.prodname_dependabot_alerts %} will find vulnerabilities that are already in your dependencies, but it's much better to avoid introducing potential problems than to fix problems at a later date. For more information about {% data variables.product.prodname_dependabot_alerts %}, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts). Dependency review supports the same languages and package management ecosystems as the dependency graph. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems#supported-package-ecosystems). diff --git a/content/code-security/concepts/supply-chain-security/multi-ecosystem-updates.md b/content/code-security/concepts/supply-chain-security/multi-ecosystem-updates.md index d016c73cf269..897040438958 100644 --- a/content/code-security/concepts/supply-chain-security/multi-ecosystem-updates.md +++ b/content/code-security/concepts/supply-chain-security/multi-ecosystem-updates.md @@ -71,7 +71,7 @@ For example, if you assign `@platform-team` at the group level and `@docker-admi Attempting to set these options at the ecosystem level will cause a configuration error. -For a complete reference of all available configuration options and their behavior, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependabot-options-reference#multi-ecosystem-groups). +For a complete reference of all available configuration options and their behavior, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependabot-options-reference#multi-ecosystem-groups-). ## Use cases diff --git a/content/code-security/concepts/supply-chain-security/supply-chain-security.md b/content/code-security/concepts/supply-chain-security/supply-chain-security.md index 621a0084ff34..55545062cf3d 100644 --- a/content/code-security/concepts/supply-chain-security/supply-chain-security.md +++ b/content/code-security/concepts/supply-chain-security/supply-chain-security.md @@ -181,8 +181,8 @@ Public repositories: * **Artifact attestations:** Available in all public repositories, but you must explicitly generate attestations in your build workflows. See [AUTOTITLE](/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations). Private repositories: -* **Dependency graph:** Not enabled by default. The feature can be enabled by repository administrators. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/explore-dependencies#enabling-and-disabling-the-dependency-graph). -* **Dependency review:** Available in private repositories owned by organizations that use {% data variables.product.prodname_team %} or {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GHAS_or_code_security %}. For more information, see [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security) and [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/explore-dependencies#enabling-and-disabling-the-dependency-graph). +* **Dependency graph:** Not enabled by default. The feature can be enabled by repository administrators. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/explore-dependencies). +* **Dependency review:** Available in private repositories owned by organizations that use {% data variables.product.prodname_team %} or {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GHAS_or_code_security %}. For more information, see [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security) and [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/explore-dependencies). * **{% data variables.product.prodname_dependabot_alerts %}:** Not enabled by default. Owners of private repositories, or people with admin access, can enable {% data variables.product.prodname_dependabot_alerts %} by enabling the dependency graph and {% data variables.product.prodname_dependabot_alerts %} for their repositories. You can also enable or disable Dependabot alerts for all repositories owned by your user account or organization. For more information, see [AUTOTITLE](/account-and-profile/how-tos/account-settings/managing-security-and-analysis-features) or [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization). * **Artifact attestations:** Only available in private repositories on {% data variables.product.prodname_ghe_cloud %}. diff --git a/content/code-security/concepts/vulnerability-reporting-and-management/coordinated-disclosure.md b/content/code-security/concepts/vulnerability-reporting-and-management/coordinated-disclosure.md index 1b014f26b779..e686fe215f6b 100644 --- a/content/code-security/concepts/vulnerability-reporting-and-management/coordinated-disclosure.md +++ b/content/code-security/concepts/vulnerability-reporting-and-management/coordinated-disclosure.md @@ -65,7 +65,7 @@ There are two processes available on {% data variables.product.github %}: The process for reporting and disclosing vulnerabilities for projects on {% data variables.product.github %} is as follows: - If you are a vulnerability reporter (for example, a security researcher) who would like report a vulnerability, first check if there is a security policy for the related repository. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy#about-security-policies). If there is one, follow it to understand the process before contacting the security team for that repository. + If you are a vulnerability reporter (for example, a security researcher) who would like report a vulnerability, first check if there is a security policy for the related repository. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy). If there is one, follow it to understand the process before contacting the security team for that repository. If there isn't a security policy in place, the most efficient way to establish a private means of communication with maintainers is to create an issue asking for a preferred security contact. It's worth noting that the issue will be immediately publicly visible, so it should not include any information about the bug. Once communication is established, you can suggest the maintainers define a security policy for future use. @@ -74,7 +74,7 @@ The process for reporting and disclosing vulnerabilities for projects on {% data If you've found a security vulnerability in {% data variables.product.github %}, please report the vulnerability through our coordinated disclosure process. For more information, see the [{% data variables.product.github %} Security Bug Bounty](https://bounty.github.com/) website. - If you are a maintainer, you can take ownership of the process at the very beginning of the pipeline by setting up a security policy for your repository, or otherwise making security reporting instructions clearly available, for example in your project’s README file. For information about adding a security policy, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy#about-security-policies). If there is no security policy, it's likely that a vulnerability reporter will try to email you or otherwise privately contact you. Alternatively, someone may open a (public) issue with details of a security issue. + If you are a maintainer, you can take ownership of the process at the very beginning of the pipeline by setting up a security policy for your repository, or otherwise making security reporting instructions clearly available, for example in your project’s README file. For information about adding a security policy, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy). If there is no security policy, it's likely that a vulnerability reporter will try to email you or otherwise privately contact you. Alternatively, someone may open a (public) issue with details of a security issue. As a maintainer, to disclose a vulnerability in your code, you first create a draft security advisory in the package's repository in {% data variables.product.github %}. {% data reusables.security-advisory.security-advisory-overview %} For more information, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories). diff --git a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning.md b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning.md index ae90d24ab987..20f481813b23 100644 --- a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning.md +++ b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning.md @@ -99,7 +99,7 @@ To assign a self-hosted runner for default setup, you can use the default `code- Once you've assigned custom labels to self-hosted runners, your repositories can use those runners for {% data variables.product.prodname_code_scanning %} default setup. -You can also use {% data variables.product.prodname_security_configurations %} to assign labels to self-hosted runners for {% data variables.product.prodname_code_scanning %}. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration#creating-a-custom-security-configuration). +You can also use {% data variables.product.prodname_security_configurations %} to assign labels to self-hosted runners for {% data variables.product.prodname_code_scanning %}. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration). {% ifversion fpt or ghec %} diff --git a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning.md b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning.md index 4ecba02cb90d..d11da6e106a3 100644 --- a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning.md +++ b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning.md @@ -102,7 +102,7 @@ For information on bulk enablement, see [AUTOTITLE](/code-security/how-tos/secur 1. When you have finished defining your configuration, add the new workflow to your default branch. - For more information, see [AUTOTITLE](/actions/how-tos/write-workflows/use-workflow-templates#choosing-and-using-a-starter-workflow) and [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options). + For more information, see [AUTOTITLE](/actions/how-tos/write-workflows/use-workflow-templates#choosing-and-using-a-workflow-template) and [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options). {% endif %} @@ -110,13 +110,13 @@ For information on bulk enablement, see [AUTOTITLE](/code-security/how-tos/secur After your workflow runs successfully at least once, you are ready to start examining and resolving {% data variables.product.prodname_code_scanning %} alerts. For more information on {% data variables.product.prodname_code_scanning %} alerts, see [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alerts) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts). -Learn how {% data variables.product.prodname_code_scanning %} runs behave as checks on pull requests, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests#about-code-scanning-as-a-pull-request-check). +Learn how {% data variables.product.prodname_code_scanning %} runs behave as checks on pull requests, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests). You can find detailed information about your {% data variables.product.prodname_code_scanning %} configuration, including timestamps for each scan and the percentage of files scanned, on the tool status page. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). ### Further reading * [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests). -* [AUTOTITLE](/subscriptions-and-notifications/get-started/configuring-notifications#github-actions-notification-options). +* [AUTOTITLE](/subscriptions-and-notifications/how-tos/managing-github-actions-notifications). * [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options). * [AUTOTITLE](/code-security/how-tos/view-and-interpret-data/view-code-scanning-logs). diff --git a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages.md b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages.md index b2ec9733c1ea..a43e62d43ca7 100644 --- a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages.md +++ b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages.md @@ -163,7 +163,7 @@ steps: ## Specify build steps manually -You can only specify manual build steps if you have enabled advanced setup, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning#configuring-advanced-setup-for-a-repository). +You can only specify manual build steps if you have enabled advanced setup, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning#configuring-advanced-setup-for-code-scanning-with-codeql). {% data reusables.code-scanning.autobuild-add-build-steps %} diff --git a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/edit-default-setup.md b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/edit-default-setup.md index 8aae41f16c4b..fc2fa27e9231 100644 --- a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/edit-default-setup.md +++ b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/edit-default-setup.md @@ -28,7 +28,7 @@ After running an initial analysis of your code with default setup, you can make 1. Optionally, in the "Languages" section, select or deselect languages for analysis. 1. Optionally, in the "Query suite" row of the "Scan settings" section, select a different query suite to run against your code. -1. Optionally, to use labeled runners, in the "Runner type" section of the "{% data variables.product.prodname_codeql %} default configuration" modal dialog, select **Standard {% data variables.product.company_short %} runner** {% octicon "triangle-down" aria-hidden="true" aria-label="triangle-down" %} to open a dropdown menu, then select **Labeled runner**. Then, next to "Runner label," enter the label of an existing self-hosted or {% data variables.product.company_short %}-hosted runner. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning#assigning-labels-to-runners). +1. Optionally, to use labeled runners, in the "Runner type" section of the "{% data variables.product.prodname_codeql %} default configuration" modal dialog, select **Standard {% data variables.product.company_short %} runner** {% octicon "triangle-down" aria-hidden="true" aria-label="triangle-down" %} to open a dropdown menu, then select **Labeled runner**. Then, next to "Runner label," enter the label of an existing self-hosted or {% data variables.product.company_short %}-hosted runner. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning#assigning-labels-to-self-hosted-runners). 1. ({% data variables.release-phases.public_preview_caps %}) Optionally, in the "Threat model" row of the "Scan settings" section, select **Remote and local sources**. This option is only available for repositories with code in a supported language: {% data variables.code-scanning.code_scanning_threat_model_support %}. diff --git a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/incremental-analysis.md b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/incremental-analysis.md index c93cc3c9197e..a245a80a6a93 100644 --- a/content/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/incremental-analysis.md +++ b/content/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/incremental-analysis.md @@ -178,7 +178,7 @@ Alternatively, create a query suite file (`.qls`) that excludes those queries: tags contain: exclude-from-incremental ``` -For more information, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#filtering-the-queries-in-a-codeql-pack). +For more information, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-query-suites#filtering-the-queries-in-a-query-suite). ### Step 5: Filter the SARIF output diff --git a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts.md index 5664ee312cb4..217db18a4e1a 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts.md @@ -83,7 +83,7 @@ You can also use the Autofix API for historical alerts endpoints to generate, ge * [Get the status of an autofix for a code scanning alert](/rest/code-scanning/code-scanning#get-the-status-of-an-autofix-for-a-code-scanning-alert) * [Commit an autofix for a code scanning alert](/rest/code-scanning/code-scanning#commit-an-autofix-for-a-code-scanning-alert) -{% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} alerts won't be able to generate a fix for every alert in every situation. The feature operates on a best-effort basis and is not guaranteed to succeed 100% of the time. For information about the limitations of automatically generated fixes, see [Limitations of suggestions](/code-security/code-scanning/managing-code-scanning-alerts/about-autofix-for-codeql-code-scanning#limitations-of-suggestions). +{% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} alerts won't be able to generate a fix for every alert in every situation. The feature operates on a best-effort basis and is not guaranteed to succeed 100% of the time. For information about the limitations of automatically generated fixes, see [Limitations of suggestions](/{% ifversion ghes %}enterprise-cloud@latest/{% endif %}code-security/responsible-use/security-and-quality-ai-features#7-limitations). {% endif %} diff --git a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests.md b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests.md index 28de6caa799e..c531beb585cb 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests.md @@ -26,7 +26,7 @@ Depending on your configuration, {% data variables.product.prodname_code_scannin For all configurations of {% data variables.product.prodname_code_scanning %}, the check that contains the results of {% data variables.product.prodname_code_scanning %} is: **{% data variables.product.prodname_code_scanning_caps %} results**. The results for each analysis tool used are shown separately. Any new alerts on lines of code changed in the pull request are shown as annotations. -To see the full set of alerts for the analyzed branch, click **View all branch alerts**. This opens the full alert view where you can filter all the alerts on the branch by type, severity, tag, etc. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts#filtering-and-searching-for-code-scanning-alerts). +To see the full set of alerts for the analyzed branch, click **View all branch alerts**. This opens the full alert view where you can filter all the alerts on the branch by type, severity, tag, etc. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts#filtering-code-scanning-alerts). ![Screenshot of the {% data variables.product.prodname_code_scanning_caps %} results check on a pull request. The "View all branch alerts" link is highlighted with a dark orange outline.](/assets/images/help/repository/code-scanning-results-check.png) @@ -36,7 +36,7 @@ If the {% data variables.product.prodname_code_scanning %} results check finds a ![Screenshot of the merge box for a pull request. The "Code scanning results / CodeQL" check has "1 new alert including 1 high severity security v..."](/assets/images/help/repository/code-scanning-check-failure.png) -You can override the default behavior in your repository settings, by specifying the level of severities and security severities that will cause a pull request check failure. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#defining-the-severities-causing-pull-request-check-failure). +You can override the default behavior in your repository settings, by specifying the level of severities and security severities that will cause a pull request check failure. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/edit-default-setup#defining-the-alert-severities-that-cause-a-check-failure-for-a-pull-request). ## Diagnosing issues with your {% data variables.product.prodname_code_scanning %} configuration @@ -96,7 +96,7 @@ When {% data variables.copilot.copilot_autofix_short %} is enabled for a reposit > * {% data variables.copilot.copilot_autofix_short %} supports a subset of {% data variables.product.prodname_codeql %} queries. For information about the availability of {% data variables.copilot.copilot_autofix_short %}, see the query tables linked from [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-queries). > * When analysis is complete, all relevant results are published to the pull request at once. If at least one alert in your pull request has an {% data variables.copilot.copilot_autofix_short %} suggestion, you should assume that the LLM has finished identifying potential fixes for your code. > * On alerts generated from queries that are not supported by {% data variables.copilot.copilot_autofix_short %}, you will see a note telling you that the query is not supported. If a suggestion for a supported query fails to generate, you will see a note on the alert prompting you to try pushing another commit or to contact support. -> * {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} alerts won't be able to generate a fix for every alert in every situation. The feature operates on a best-effort basis and is not guaranteed to succeed 100% of the time. For information about the limitations of automatically generated fixes, see [Limitations of suggestions](/code-security/responsible-use/security-and-quality-ai-features#limitations-of-suggestions). +> * {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} alerts won't be able to generate a fix for every alert in every situation. The feature operates on a best-effort basis and is not guaranteed to succeed 100% of the time. For information about the limitations of automatically generated fixes, see [Limitations of suggestions](/{% ifversion ghes %}enterprise-cloud@latest/{% endif %}code-security/responsible-use/security-and-quality-ai-features#7-limitations). Usually, when you suggest changes to a pull request, your comment contains changes for a single file that is changed in the pull request. The following screenshot shows an {% data variables.copilot.copilot_autofix_short %} comment that suggests changes to the `index.js` file where the alert is displayed. Since the potential fix requires a new dependency on `escape-html`, the comment also suggests adding this dependency to the `package.json` file, even though the original pull request makes no changes to this file. @@ -104,7 +104,7 @@ Usually, when you suggest changes to a pull request, your comment contains chang ### Assessing and committing an {% data variables.copilot.copilot_autofix_short %} suggestion -Each {% data variables.copilot.copilot_autofix_short %} suggestion demonstrates a potential solution for a {% data variables.product.prodname_code_scanning %} alert in your codebase. You must assess the suggested changes to determine whether they are a good solution for your codebase and to ensure that they maintain the intended behavior. For information about the limitations of {% data variables.copilot.copilot_autofix_short %} suggestions, see [Limitations of suggestions](/code-security/responsible-use/security-and-quality-ai-features#limitations-of-suggestions) and [Mitigating the limitations of suggestions](/code-security/responsible-use/security-and-quality-ai-features#mitigating-the-limitations-of-suggestions) in "Responsible use of {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %}." +Each {% data variables.copilot.copilot_autofix_short %} suggestion demonstrates a potential solution for a {% data variables.product.prodname_code_scanning %} alert in your codebase. You must assess the suggested changes to determine whether they are a good solution for your codebase and to ensure that they maintain the intended behavior. For information about the limitations of {% data variables.copilot.copilot_autofix_short %} suggestions, see [Limitations of suggestions](/{% ifversion ghes %}enterprise-cloud@latest/{% endif %}code-security/responsible-use/security-and-quality-ai-features#7-limitations) and [Mitigating the limitations of suggestions](/{% ifversion ghes %}enterprise-cloud@latest/{% endif %}code-security/responsible-use/security-and-quality-ai-features#9-safety-components-and-mitigations) in "Responsible use of {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %}." 1. Click **Edit** to display the editing options and select your preferred method. * Under **Edit with {% data variables.product.prodname_cli %}**, follow the instructions for checking out the pull request locally and applying the suggested fix. diff --git a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/enable-delegated-alert-dismissal.md b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/enable-delegated-alert-dismissal.md index 87767d17480e..06ee87f299f3 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/enable-delegated-alert-dismissal.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/enable-delegated-alert-dismissal.md @@ -27,7 +27,7 @@ category: You must configure delegated dismissal for your organization using a custom security configuration. You can then apply the security configuration to all (or selected) repositories in your organization. -1. Start creating or editing a custom security configuration. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration#creating-a-custom-security-configuration). +1. Start creating or editing a custom security configuration. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration). 1. In the "Dependency scanning" section of your security configuration, set "Prevent direct alert dismissals" to **Enabled**. 1. Click **Save configuration**. 1. Apply the security configuration to repositories in your organization. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/apply-custom-configuration). diff --git a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts.md index d597a9b826c7..ce6a6a23860d 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts.md @@ -168,4 +168,4 @@ When a member of your organization {% ifversion not fpt %}or enterprise {% endif ![Screenshot of the audit log showing Dependabot alerts.](/assets/images/help/dependabot/audit-log-ui-dependabot-alert.png) -Events in your audit log for {% data variables.product.prodname_dependabot_alerts %} include details such as who performed the action, what the action was, and when the action was performed. The event also includes a link to the alert itself. When a member of your organization dismisses an alert, the event displays the dismissal reason and comment. For information on the {% data variables.product.prodname_dependabot_alerts %} actions, see the `repository_vulnerability_alert` category in [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization#repository_vulnerability_alert){% ifversion not fpt %} and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#repository_vulnerability_alert).{% else %}.{% endif %} +Events in your audit log for {% data variables.product.prodname_dependabot_alerts %} include details such as who performed the action, what the action was, and when the action was performed. The event also includes a link to the alert itself. When a member of your organization dismisses an alert, the event displays the dismissal reason and comment. For information on the {% data variables.product.prodname_dependabot_alerts %} actions, see the `repository_vulnerability_alert` category in [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization){% ifversion not fpt %} and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#repository_vulnerability_alert).{% else %}.{% endif %} diff --git a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md index f27c236e6397..793b5e4a3568 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md @@ -43,15 +43,15 @@ You can apply various filters to the alerts list to help you find the alerts you |`bypassed`|Display alerts for secrets where push protection has been bypassed (`true`). For more information, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection).| |`is`|Display alerts that are open (`open`), closed (`closed`), found in a public repository (`publicly-leaked`), or found in more than one repository within the same organization or enterprise (`multi-repository`). | |`props`|Display alerts for repositories with a specific custom property (`CUSTOM_PROPERTY_NAME`) set. For example, `props:data_sensitivity:high` display results for repositories with the `data_sensitivity` property set to the value `high`. | -|`provider`|Display alerts for a specific provider (`PROVIDER-NAME`), for example, `provider:github`. For a list of supported partners, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets).| +|`provider`|Display alerts for a specific provider (`PROVIDER-NAME`), for example, `provider:github`. For a list of supported partners, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns).| |`repo`|Display alerts detected in a specified repository (`REPOSITORY-NAME`), for example: `repo:octo-repository`.| |`resolution`|Display alerts closed as "false positive" (`false-positive`), "hidden by config" (`hidden-by-config`), "pattern deleted" (`pattern-deleted`), "pattern edited" (`pattern-edited`), "revoked" (`revoked`), "used in tests" (`used-in-tests`), or "won't fix" (`wont-fix`).| |{% ifversion fpt or ghec %}| -|`results`|Display alerts for supported secrets and custom patterns (`default`), or for generic patterns (`generic`) such as private keys, and AI-detected generic secrets such as passwords. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns), and for more information about AI-detected generic secrets, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).| +|`results`|Display alerts for supported secrets and custom patterns (`default`), or for generic patterns (`generic`) such as private keys, and AI-detected generic secrets such as passwords. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns), and for more information about AI-detected generic secrets, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).| |{% elsif ghes %}| -|`results`|Display alerts for supported secrets and custom patterns (`default`), or generic patterns such as private keys (`generic`). See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns).| +|`results`|Display alerts for supported secrets and custom patterns (`default`), or generic patterns such as private keys (`generic`). See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns).| |{% endif %}| -|`secret-type`|Display alerts for a specific secret type (`SECRET-NAME`), for example, `secret-type:github_personal_access_token`. For a list of supported secret types, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets).| +|`secret-type`|Display alerts for a specific secret type (`SECRET-NAME`), for example, `secret-type:github_personal_access_token`. For a list of supported secret types, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns).| |`sort`|Display alerts from newest to oldest (`created-desc`), oldest to newest (`created-asc`), most recently updated (`updated-desc`), or least recently updated (`updated-asc`).| |`team`|Display alerts owned by members of the specified team, for example: `team:octocat-dependabot-team`.| |`topic`|Display alerts with the matching repository topic, for example: `topic:asdf`.| diff --git a/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns.md b/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns.md index ff678d0d03ff..4077beb44075 100644 --- a/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns.md +++ b/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns.md @@ -76,7 +76,7 @@ Additional default filters for {% data variables.product.prodname_code_scanning * `autofilter:true` includes only alerts that appear to be in application code. {% ifversion security-campaigns-autofix %} * `autofix:supported` includes only alerts that are for rules that are supported for {% data variables.copilot.copilot_autofix %}.{% endif %} -For more information about filtering alerts, see [AUTOTITLE](/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale#selecting-security-alerts-for-remediation) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview). +For more information about filtering alerts, see [AUTOTITLE](/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale#2-select-alerts-for-your-campaign) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview). {% ifversion security-campaigns-secrets %} @@ -97,7 +97,7 @@ In addition to the core filters, you will usually want to add a filter to limit In addition to the core filters, you will usually want to add a filter to limit results to a specific provider, secret type, or secrets that bypassed push protection (enterprise accounts only). * `is:open provider:azure` to show only alerts for the token provider Azure. -* `is:open secret-type:azure_ai_services_key,azure_cognitive_services_key` to show only alerts for the tokens "azure_ai_services_key" and "azure_cognitive_services_key". See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets). +* `is:open secret-type:azure_ai_services_key,azure_cognitive_services_key` to show only alerts for the tokens "azure_ai_services_key" and "azure_cognitive_services_key". See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns). * `is:open props.BusinessPriority:Urgent` to show only alerts for repositories where the custom property "BusinessPriority" has the value "Urgent". See [AUTOTITLE](/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). {% endif %} @@ -121,7 +121,7 @@ The new campaign is shown in the sidebar of the **{% data variables.product.prod {% ifversion code-secret-alert-assignees %} > [!TIP] -> You can assign a campaign alert to anyone with **write** access to the repository, see [Assigning alerts](/code-security/concepts/security-at-scale/about-security-campaigns#assigning-alerts). +> You can assign a campaign alert to anyone with **write** access to the repository, see [Assigning alerts](/code-security/concepts/security-at-scale/about-security-campaigns#about-assigning-alerts-to-users-and-copilot-cloud-agent). {% endif %} {% else %} @@ -134,7 +134,7 @@ For more information about the developer experience, see [AUTOTITLE](/code-secur ### How to increase engagement with the security campaign -The best way to increase engagement with a campaign is to publicize it to the teams you want to collaborate with to remediate alerts. For example, you might work with engineering managers to choose a quieter development period to run a series of security campaigns, each focused on a different type of alert, with associated training sessions. For more ideas, see [AUTOTITLE](/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale). +The best way to increase engagement with a campaign is to publicize it to the teams you want to collaborate with to remediate alerts. For example, you might work with engineering managers to choose a quieter development period to run a series of security campaigns, each focused on a different type of alert, with associated training sessions. For more ideas, see [AUTOTITLE](/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale#2-select-alerts-for-your-campaign). ## Editing security campaign details diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database.md index 180398d67d9c..31c6142cd255 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database.md @@ -72,11 +72,11 @@ You can search the database, and use qualifiers to narrow your search. For examp | `created:YYYY-MM-DD`| [`created:2021-01-13`](https://github.com/advisories?utf8=%E2%9C%93&query=created%3A2021-01-13) will show only advisories created on this date. | | `updated:YYYY-MM-DD`| [`updated:2021-01-13`](https://github.com/advisories?utf8=%E2%9C%93&query=updated%3A2021-01-13) will show only advisories updated on this date. | -A `GHSA-ID` qualifier is a unique ID that we at {% data variables.product.prodname_dotcom %} automatically assign to every advisory in the {% data variables.product.prodname_advisory_database %}. For more information about these identifiers, see [About the {% data variables.product.prodname_advisory_database %}](/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database#about-ghsa-ids). +A `GHSA-ID` qualifier is a unique ID that we at {% data variables.product.prodname_dotcom %} automatically assign to every advisory in the {% data variables.product.prodname_advisory_database %}. For more information about these identifiers, see [About the {% data variables.product.prodname_advisory_database %}](/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database#ghsa-ids). ## Viewing your vulnerable repositories -For any {% data variables.product.company_short %}-reviewed advisory in the {% data variables.product.prodname_advisory_database %}, you can see which of your repositories are affected by that security vulnerability or malware. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#access-to-dependabot-alerts). +For any {% data variables.product.company_short %}-reviewed advisory in the {% data variables.product.prodname_advisory_database %}, you can see which of your repositories are affected by that security vulnerability or malware. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts). 1. Navigate to [https://github.com/advisories](https://github.com/advisories?ref_product=security-advisories&ref_type=engagement&ref_style=text). 1. Click an advisory. @@ -107,7 +107,7 @@ You can also suggest improvements to any advisory directly from your local advis {% data reusables.repositories.enable-security-alerts %} -In the local advisory database, you can see which repositories are affected by each security vulnerability or malware. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#access-to-dependabot-alerts). +In the local advisory database, you can see which repositories are affected by each security vulnerability or malware. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts). 1. Navigate to `https://HOSTNAME/advisories`. 1. Click an advisory. diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory.md index cb2bfc6fe1bb..cc90d4590bb8 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory.md @@ -81,5 +81,5 @@ If someone accepts credit, the person's username appears in the "Credits" sectio * Comment on the draft security advisory to discuss the vulnerability with your team. * Add collaborators to the security advisory. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/add-collaborators). * Privately collaborate to fix the vulnerability in a temporary private fork. For more information, see [AUTOTITLE](/code-security/tutorials/fix-reported-vulnerabilities/collaborate-in-a-fork). -* Add individuals who should receive credit for contributing to the security advisory. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-repository-advisories#about-credits-for-security-advisories). +* Add individuals who should receive credit for contributing to the security advisory. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-repository-advisories). * Publish the security advisory to notify your community of the security vulnerability. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/publish-repository-advisory). diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configuring-code-scanning-for-your-appliance.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configuring-code-scanning-for-your-appliance.md index 483e0a812690..bc4c8ce1bffb 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configuring-code-scanning-for-your-appliance.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configuring-code-scanning-for-your-appliance.md @@ -65,7 +65,7 @@ You can configure {% data variables.product.prodname_code_scanning %} to run {% {% ifversion default-setup-self-hosted-runners-GHEC %} If you are provisioning a self-hosted runner for {% data variables.product.prodname_codeql %} analysis, your runner must use a {% data variables.product.prodname_codeql %}-supported operating system version and CPU architecture. See the [{% data variables.product.prodname_codeql %} system requirements](https://codeql.github.com/docs/codeql-overview/system-requirements/). -If you are using default setup for {% data variables.product.prodname_code_scanning %}, you can assign self-hosted runners with the default `code-scanning` label, or you can optionally give them custom labels so that individual repositories can use different runners. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning#assigning-labels-to-runners). +If you are using default setup for {% data variables.product.prodname_code_scanning %}, you can assign self-hosted runners with the default `code-scanning` label, or you can optionally give them custom labels so that individual repositories can use different runners. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning#assigning-labels-to-self-hosted-runners). For information about using default setup for code scanning analysis of compiled languages, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages). diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/setting-dependabot-to-run-on-github-hosted-runners-using-vnet.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/setting-dependabot-to-run-on-github-hosted-runners-using-vnet.md index 1ed048039c87..64a21189c3f4 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/setting-dependabot-to-run-on-github-hosted-runners-using-vnet.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/setting-dependabot-to-run-on-github-hosted-runners-using-vnet.md @@ -56,7 +56,7 @@ After configuring your Azure resources, you can use an Azure Virtual Network (VN ## Enabling {% data variables.product.prodname_dependabot %} for the organization -You now need to enable {% data variables.product.prodname_dependabot %} on _self-hosted runners_ for your organization in order to enable {% data variables.product.prodname_dependabot %} on large runners. See [Enabling or disabling {% data variables.product.prodname_dependabot %} on larger runners](/code-security/concepts/supply-chain-security/dependabot-on-actions#enabling-or-disabling-dependabot-on-larger-runners). +You now need to enable {% data variables.product.prodname_dependabot %} on _self-hosted runners_ for your organization in order to enable {% data variables.product.prodname_dependabot %} on large runners. See [Enabling or disabling {% data variables.product.prodname_dependabot %} on larger runners](/code-security/concepts/supply-chain-security/dependabot-on-actions). {% data reusables.profile.access_org %} {% data reusables.organizations.org_settings %} diff --git a/content/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-ai-detected-secrets.md b/content/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-ai-detected-secrets.md index 25d89e362c3e..34fd10374510 100644 --- a/content/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-ai-detected-secrets.md +++ b/content/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-ai-detected-secrets.md @@ -35,7 +35,7 @@ You can enable {% data variables.secret-scanning.generic-secret-detection %} in You must configure {% data variables.secret-scanning.generic-secret-detection %} for your organization using a {% data variables.product.prodname_custom_security_configuration %}. You can then apply the {% data variables.product.prodname_security_configuration %} to all (or selected) repositories in your organization. -1. Create a new {% data variables.product.prodname_custom_security_configuration %}, or edit an existing one. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration#creating-a-custom-security-configuration). +1. Create a new {% data variables.product.prodname_custom_security_configuration %}, or edit an existing one. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration). 1. When creating the custom security configuration, ensure that "{% data variables.product.prodname_secret_protection %}" is set to **Enabled**, and that the dropdown menu for "Scan for AI-detected secrets" is also set to **Enabled**. 1. Apply the {% data variables.product.prodname_custom_security_configuration %} to one or more repositories. For more information, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/apply-custom-configuration). diff --git a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-dependabot-notifications.md b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-dependabot-notifications.md index 7a6c48bb06f9..4c944c1eb7e7 100644 --- a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-dependabot-notifications.md +++ b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-dependabot-notifications.md @@ -17,7 +17,7 @@ category: - Secure your dependencies --- -By default, {% data variables.product.github %} sends notifications about new alerts by email to people with write, maintain, or admin permissions to a repository. See [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#notifications-for-alerts). +By default, {% data variables.product.github %} sends notifications about new alerts by email to people with write, maintain, or admin permissions to a repository. See [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#how-alert-notifications-work). ## Configuring notifications for {% data variables.product.prodname_dependabot_alerts %} @@ -30,11 +30,11 @@ You can configure notification settings for yourself or your organization from t ![Screenshot of the notification options for {% data variables.product.prodname_dependabot_alerts %}.](/assets/images/help/enterprises/dependabot-alerts-options-no-ui.png){% endif %} > [!NOTE] -> You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot_alerts %}. For more information, see [AUTOTITLE](/subscriptions-and-notifications/how-tos/viewing-and-triaging-notifications/managing-notifications-from-your-inbox#dependabot-custom-filters). +> You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot_alerts %}. For more information, see [AUTOTITLE](/subscriptions-and-notifications/reference/inbox-filters#dependabot-custom-filters). -{% data reusables.repositories.security-alerts-x-github-severity %} For more information, see [AUTOTITLE](/subscriptions-and-notifications/get-started/configuring-notifications#filtering-email-notifications). +{% data reusables.repositories.security-alerts-x-github-severity %} For more information, see [AUTOTITLE](/subscriptions-and-notifications/reference/email-notification-headers). ## Further reading * [AUTOTITLE](/subscriptions-and-notifications/get-started/configuring-notifications) -* [AUTOTITLE](/subscriptions-and-notifications/how-tos/viewing-and-triaging-notifications/managing-notifications-from-your-inbox#supported-is-queries) +* [AUTOTITLE](/subscriptions-and-notifications/reference/inbox-filters#supported-is-queries) diff --git a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-on-self-hosted-runners.md b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-on-self-hosted-runners.md index a64a9cd4055e..d54ef609fbee 100644 --- a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-on-self-hosted-runners.md +++ b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-on-self-hosted-runners.md @@ -27,7 +27,7 @@ category: 1. Configure your environment and runners to meet the requirements for {% data variables.product.prodname_dependabot %}. See [Requirements for using {% data variables.product.prodname_dependabot %} with self-hosted runners](/code-security/reference/supply-chain-security/dependabot-on-actions#requirements-for-using-dependabot-with-self-hosted-runners).{% ifversion dependabot-self-hosted-labels %} 1. If you are configuring self-hosted runners for your organization, you can create and assign a custom label for your runners. Otherwise, if you are configuring self-hosted runners for a standalone repository, you need to apply the `dependabot` label. See [AUTOTITLE](/actions/how-tos/manage-runners/self-hosted-runners/apply-labels).{% else %} 1. Assign a `dependabot` label to each runner you want {% data variables.product.prodname_dependabot %} to use. For more information, see [AUTOTITLE](/actions/how-tos/manage-runners/self-hosted-runners/apply-labels#assigning-a-label-to-a-self-hosted-runner).{% endif %} -1. Optionally, enable workflows triggered by {% data variables.product.prodname_dependabot %} to use more than read-only permissions and to have access to any secrets that are normally available. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions#restrictions-when-dependabot-triggers-events). +1. Optionally, enable workflows triggered by {% data variables.product.prodname_dependabot %} to use more than read-only permissions and to have access to any secrets that are normally available. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions). ## Enabling self-hosted runners for {% data variables.product.prodname_dependabot_updates %} diff --git a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/controlling-dependencies-updated.md b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/controlling-dependencies-updated.md index 462c599824f9..1b21be66480e 100644 --- a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/controlling-dependencies-updated.md +++ b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/controlling-dependencies-updated.md @@ -122,7 +122,7 @@ For pull requests for grouped updates, you can also use `@dependabot unignore` c * Un-ignore a specific dependency * Un-ignore all ignore conditions for all dependencies in a {% data variables.product.prodname_dependabot %} pull request -For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/manage-dependabot-prs#managing-dependabot-pull-requests-for-grouped-updates-with-comment-commands). +For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/manage-dependabot-prs#managing-dependabot-pull-requests-with-comment-commands). ## Allowing specific dependencies to be updated diff --git a/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates.md b/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates.md index 02be7a9c13b6..c5cf0db59866 100644 --- a/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates.md +++ b/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates.md @@ -44,7 +44,7 @@ In order to use grouped security updates, you must first enable the following fe * **Dependency graph**. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/enable-dependency-graph). * **{% data variables.product.prodname_dependabot_alerts %}**. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-dependabot-alerts). -* **{% data variables.product.prodname_dependabot_security_updates %}**. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates#managing-for-your-repositories). +* **{% data variables.product.prodname_dependabot_security_updates %}**. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates#managing-dependabot-security-updates-for-your-repositories). > [!NOTE] > When grouped security updates are first enabled, {% data variables.product.prodname_dependabot %} will immediately try to create grouped pull requests. You may notice {% data variables.product.prodname_dependabot %} closing old pull requests and opening new ones. diff --git a/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configuring-multi-ecosystem-updates.md b/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configuring-multi-ecosystem-updates.md index 6eafb1d99ca4..1c43712c5fc3 100644 --- a/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configuring-multi-ecosystem-updates.md +++ b/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configuring-multi-ecosystem-updates.md @@ -91,7 +91,7 @@ updates: multi-ecosystem-group: "infrastructure" ``` -For a complete list of available options, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependabot-options-reference#multi-ecosystem-groups). +For a complete list of available options, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependabot-options-reference#multi-ecosystem-groups-). ## 5. Verify your configuration diff --git a/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/use-dependency-submission-api.md b/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/use-dependency-submission-api.md index f02431f63bf0..0b1b50dc19d1 100644 --- a/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/use-dependency-submission-api.md +++ b/content/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/use-dependency-submission-api.md @@ -26,7 +26,7 @@ You can use the {% data variables.dependency-submission-api.name %} in a {% data {% data reusables.dependency-submission.premade-action-table %} -For more information about these actions, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems#package-ecosystems-supported-via-dependency-submission-actions). +For more information about these actions, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems#supported-package-ecosystems). ### Creating your own action diff --git a/content/code-security/reference/code-scanning/code-scanning-logs.md b/content/code-security/reference/code-scanning/code-scanning-logs.md index 22088a0e7c91..82a201cfb2a8 100644 --- a/content/code-security/reference/code-scanning/code-scanning-logs.md +++ b/content/code-security/reference/code-scanning/code-scanning-logs.md @@ -28,7 +28,7 @@ You can see analysis and diagnostic information for {% data variables.product.pr {% data reusables.code-scanning.extractor-diagnostics %} -You can see more detailed information about {% data variables.product.prodname_codeql %} extractor errors and warnings that occurred during database creation by enabling debug logging. See [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-by-re-running-jobs-with-debug-logging-enabled). +You can see more detailed information about {% data variables.product.prodname_codeql %} extractor errors and warnings that occurred during database creation by enabling debug logging. See [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/logs-not-detailed-enough#re-running-jobs-with-debug-logging-enabled). {% ifversion org-private-registry %} diff --git a/content/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages.md b/content/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages.md index ef13ef5e2b66..90cdd49db8d7 100644 --- a/content/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages.md +++ b/content/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages.md @@ -93,7 +93,7 @@ When you enable default setup for a repository that contains C# code, the build {% data variables.product.prodname_codeql %} restores dependencies and generates a few additional source files, to give more accurate results, before creating a database from all the source files and dependencies. -Dependencies are restored using multiple heuristics and strategies. The following files are the primary source of information: `*.csproj`, `*.sln`, `nuget.config`, `packages.config`, `global.json`, and `project.assets.json`. {% ifversion org-private-registry %}If a private NuGet feed is defined for the organization, this is also used, see [Code scanning default setup access to private registries](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#default-setup-access-to-private-registries) and [Determining whether code scanning default setup used any private registries](/code-security/reference/code-scanning/code-scanning-logs#diagnostic-information-for-private-package-registries).{% endif %} +Dependencies are restored using multiple heuristics and strategies. The following files are the primary source of information: `*.csproj`, `*.sln`, `nuget.config`, `packages.config`, `global.json`, and `project.assets.json`. {% ifversion org-private-registry %}If a private NuGet feed is defined for the organization, this is also used, see [Code scanning default setup access to private registries](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries) and [Determining whether code scanning default setup used any private registries](/code-security/reference/code-scanning/code-scanning-logs#diagnostic-information-for-private-package-registries).{% endif %} The following generated source files are optional, but significantly increase the correctness of the {% data variables.product.prodname_codeql %} database: @@ -216,7 +216,7 @@ If you later add Kotlin code to a repository that uses the `none` build mode, {% {% data variables.product.prodname_codeql %} will attempt to run Gradle or Maven to extract accurate dependency information (but not to invoke a build), before creating a database from all Java files present. Every root Maven or Gradle project file (a build script without any build script present in an ancestor directory) is queried for dependency information, and more recent dependency versions are preferred if there is a clash. For information about the runner requirements to run Maven or Gradle, see [Runner requirements for Java](#runner-requirements-for-java). - {% ifversion org-private-registry %}If a private Maven registry is defined for the organization, this is also used, see [Code scanning default setup access to private registries](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#default-setup-access-to-private-registries) and [Determining whether code scanning default setup used any private registries](/code-security/reference/code-scanning/code-scanning-logs#diagnostic-information-for-private-package-registries).{% endif %} + {% ifversion org-private-registry %}If a private Maven registry is defined for the organization, this is also used, see [Code scanning default setup access to private registries](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries) and [Determining whether code scanning default setup used any private registries](/code-security/reference/code-scanning/code-scanning-logs#diagnostic-information-for-private-package-registries).{% endif %} #### Accuracy of no build analysis for Java diff --git a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large.md b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large.md index 220793232d1e..4c5dba61a73e 100644 --- a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large.md +++ b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large.md @@ -77,7 +77,7 @@ Excluding non-production code from analysis is a simple way to reduce the size o Using a build command that compiles only one variant is a simple way to reduce the size of the results file. -* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: update the workflow file to specify your chosen build command. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#adding-build-steps-for-a-compiled-language). +* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: update the workflow file to specify your chosen build command. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#specify-build-steps-manually). * {% data variables.product.prodname_codeql_cli %} `database create`: specify your chosen build command either by calling the `database create` command with the `--command` option, or by defining the build command in a YAML configuration file for code scanning and calling the file using the `--codescanning-config` option. For more information, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis#specifying-build-commands). ### Defining the query suite to run diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/automatic-build-failed.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/automatic-build-failed.md index 4932e735a749..71af12391eb8 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/automatic-build-failed.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/automatic-build-failed.md @@ -23,4 +23,4 @@ If an automatic build of code for a compiled language within your project fails, ## Further reading * [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning). -* [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#codeql-build-modes) +* [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#compare-build-modes) diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected.md index 444ba65a92e1..1ef73533379d 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected.md @@ -29,7 +29,7 @@ If your {% data variables.product.prodname_codeql %} analysis scans fewer lines ## Change to a `manual` build process Replace the `autobuild` process with the same build commands you would use in production. This makes sure that {% data variables.product.prodname_codeql %} knows exactly how to compile all of the source files you want to scan. -For more information about defining build steps, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#using-build-mode-manual-and-specifying-build-steps). +For more information about defining build steps, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#specify-build-steps-manually). ## Inspect the copy of the source files in the {% data variables.product.prodname_codeql %} database diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build.md index 1ab7555ec9b8..90e98a08af70 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build.md @@ -46,13 +46,13 @@ If you want to update the analysis to also include Kotlin files, then {% data va 1. Wait until the Kotlin code is merged into the default branch for the repository. 1. Disable and then re-enable default setup on the "Settings" page for your repository. -This will trigger a new analysis using automatic build detection. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning) and [Building Java and Kotlin](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#building-java-and-kotlin). +This will trigger a new analysis using automatic build detection. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning) and [Building Java and Kotlin](/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages#building-java-and-kotlin). If the automatic build detection fails, you will need to use advanced setup with the correct build commands for the project to analyze both languages. ### {% data variables.product.prodname_code_scanning_caps %} advanced setup -If you already use advanced setup, you can edit the {% data variables.product.prodname_codeql %} workflow and change the build mode for `java-kotlin` from `none` to either `autobuild` to automatically build your project, or `manual` to specify your own build steps. [Building Java and Kotlin](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#building-java-and-kotlin). +If you already use advanced setup, you can edit the {% data variables.product.prodname_codeql %} workflow and change the build mode for `java-kotlin` from `none` to either `autobuild` to automatically build your project, or `manual` to specify your own build steps. [Building Java and Kotlin](/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages#building-java-and-kotlin). If you need to convert from default setup to advanced setup, you need enable advanced setup on the on the "Settings" page for your repository and create a {% data variables.product.prodname_codeql %} workflow. Then you can define a `manual` build mode for `java-kotlin` and define the build commands for the project. @@ -63,5 +63,5 @@ Update your calls to run the {% data variables.product.prodname_codeql_cli %} fo ## Further reading * [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning) -* [Building Java and Kotlin](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#building-java-and-kotlin) -* [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#codeql-build-modes) +* [Building Java and Kotlin](/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages#building-java-and-kotlin) +* [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#compare-build-modes) diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/no-source-code-seen-during-build.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/no-source-code-seen-during-build.md index bee3db8c1fb6..3e699c0e561e 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/no-source-code-seen-during-build.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/no-source-code-seen-during-build.md @@ -34,7 +34,7 @@ If your workflow fails with `Error: "No source code was seen during the build"` For more information, see the workflow extract in [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/some-languages-not-analyzed). -1. _Compilation of a compiled language failed:_ Your {% data variables.product.prodname_code_scanning %} workflow tries to compile a compiled language (C, C++, C#, Go, or Java), but the code was not compiled. When a workflow specifies `build-mode: autobuild` for a language or contains an `autobuild` step, {% data variables.product.prodname_codeql %} makes a best effort to detect a suitable build method and build your code. The `autobuild` process may not succeed in building your code, depending on your specific build environment. Compilation may also fail if you have removed the `autobuild` step and did not include build steps manually. For more information about defining build steps, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#using-build-mode-manual-and-specifying-build-steps). +1. _Compilation of a compiled language failed:_ Your {% data variables.product.prodname_code_scanning %} workflow tries to compile a compiled language (C, C++, C#, Go, or Java), but the code was not compiled. When a workflow specifies `build-mode: autobuild` for a language or contains an `autobuild` step, {% data variables.product.prodname_codeql %} makes a best effort to detect a suitable build method and build your code. The `autobuild` process may not succeed in building your code, depending on your specific build environment. Compilation may also fail if you have removed the `autobuild` step and did not include build steps manually. For more information about defining build steps, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#specify-build-steps-manually). 1. _Cached components not detected:_ Your workflow builds a compiled language (C, C++, C#, Go, or Java) to create a {% data variables.product.prodname_codeql %} database for analysis, but portions of your build are cached to improve performance (most likely to occur with build systems like Gradle or Bazel). Since {% data variables.product.prodname_codeql %} observes the activity of the compiler to understand the data flows in a repository, {% data variables.product.prodname_codeql %} requires a complete build to take place in order to perform analysis. @@ -48,4 +48,4 @@ If your workflow fails with `Error: "No source code was seen during the build"` If you encounter another problem with your specific compiler or configuration, contact {% data variables.contact.contact_support %}. -For more information about specifying build steps, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#adding-build-steps-for-a-compiled-language). +For more information about specifying build steps, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#specify-build-steps-manually). diff --git a/content/code-security/reference/code-scanning/workflow-configuration-options.md b/content/code-security/reference/code-scanning/workflow-configuration-options.md index fc0b1f081819..cf34f0666872 100644 --- a/content/code-security/reference/code-scanning/workflow-configuration-options.md +++ b/content/code-security/reference/code-scanning/workflow-configuration-options.md @@ -48,7 +48,7 @@ Additionally, when an `on:push` scan returns results that can be mapped to an op ### Scanning pull requests -The default {% data variables.code-scanning.codeql_workflow %} uses the `pull_request` event to trigger a code scan on pull requests targeted against the default branch. {% ifversion ghes %}The `pull_request` event is not triggered if the pull request was opened from a private fork.{% else %}If a pull request is from a private fork, the `pull_request` event will only be triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings. For more information, see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks).{% endif %} +The default {% data variables.code-scanning.codeql_workflow %} uses the `pull_request` event to trigger a code scan on pull requests targeted against the default branch. {% ifversion ghes %}The `pull_request` event is not triggered if the pull request was opened from a private fork.{% else %}If a pull request is from a private fork, the `pull_request` event will only be triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings. For more information, see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories).{% endif %} For more information about the `pull_request` event, see [AUTOTITLE](/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request). @@ -112,7 +112,7 @@ This workflow scans: ## Operating system > [!NOTE] -> * Code scanning of Swift code uses macOS runners by default. {% ifversion fpt or ghec %}{% data variables.product.company_short %}-hosted macOS runners are more expensive than Linux and Windows runners, so you should consider only scanning the build step. For more information about configuring code scanning for Swift, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#considerations-for-building-swift). For more information about pricing for {% data variables.product.company_short %}-hosted runners, see [AUTOTITLE](/billing/concepts/product-billing/github-actions).{% endif %} +> * Code scanning of Swift code uses macOS runners by default. {% ifversion fpt or ghec %}{% data variables.product.company_short %}-hosted macOS runners are more expensive than Linux and Windows runners, so you should consider only scanning the build step. For more information about configuring code scanning for Swift, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages). For more information about pricing for {% data variables.product.company_short %}-hosted runners, see [AUTOTITLE](/billing/concepts/product-billing/github-actions).{% endif %} > > * {% data reusables.code-scanning.default-setup-swift-self-hosted-runners %} @@ -200,7 +200,7 @@ jobs: build-mode: none ``` -For compiled languages, the matrix can also be used to configure which build mode should be used for analysis by changing the value of the `build-mode` property. For more information about build modes, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#about-build-mode-none-for-codeql). +For compiled languages, the matrix can also be used to configure which build mode should be used for analysis by changing the value of the `build-mode` property. For more information about build modes, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#use-none-build-mode-for-codeql). If your workflow does not provide an argument to the `languages` input of the `init` action, then {% data variables.product.prodname_codeql %} is configured to run analyses sequentially. In this case, {% data variables.product.prodname_codeql %} automatically detects, and attempts to analyze, any supported languages in the repository. Depending on the size of the repository and the number of languages, this may take a long time. If analysis for one language fails in this mode, then the analysis for all languages fails. Therefore, we do not recommend this configuration. @@ -241,7 +241,7 @@ Your specified category will not overwrite the details of the `runAutomationDeta ## {% data variables.product.prodname_codeql %} model packs -If your codebase depends on a library or framework that is not recognized by the standard queries in {% data variables.product.prodname_codeql %}, you can extend the {% data variables.product.prodname_codeql %} coverage in your {% data variables.product.prodname_code_scanning %} workflow by specifying published {% data variables.product.prodname_codeql %} model packs. For more information about creating your own model packs, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs#creating-a-model-pack). +If your codebase depends on a library or framework that is not recognized by the standard queries in {% data variables.product.prodname_codeql %}, you can extend the {% data variables.product.prodname_codeql %} coverage in your {% data variables.product.prodname_code_scanning %} workflow by specifying published {% data variables.product.prodname_codeql %} model packs. For more information about creating your own model packs, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs#creating-a-codeql-model-pack). {% data reusables.code-scanning.beta-model-packs %} @@ -492,7 +492,7 @@ paths-ignore: > * The filter pattern characters `?`, `+`, `[`, `]`, and `!` are not supported and will be matched literally. > * `**` characters can only be at the start or end of a line, or surrounded by slashes, and you can't mix `**` and other characters. For example, `foo/**`, `**/foo`, and `foo/**/bar` are all allowed syntax, but `**foo` isn't. However you can use single stars along with other characters, as shown in the example. You'll need to quote anything that contains a `*` character. -For analysis where code is built, if you want to limit {% data variables.product.prodname_code_scanning %} to specific directories in your project, you must specify appropriate build steps in the workflow. The commands you need to use to exclude a directory from the build will depend on your build system. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#adding-build-steps-for-a-compiled-language). +For analysis where code is built, if you want to limit {% data variables.product.prodname_code_scanning %} to specific directories in your project, you must specify appropriate build steps in the workflow. The commands you need to use to exclude a directory from the build will depend on your build system. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#specify-build-steps-manually). You can quickly analyze small portions of a monorepo when you modify code in specific directories. You'll need to both exclude directories in your build steps and use the `paths-ignore` and `paths` keywords for [`on.`](/actions/reference/workflows-and-actions/workflow-syntax#onpushpull_requestpull_request_targetpathspaths-ignore) in your workflow. diff --git a/content/code-security/reference/secret-security/risk-report-csv-contents.md b/content/code-security/reference/secret-security/risk-report-csv-contents.md index 107b3ee433e8..d2bb077c856f 100644 --- a/content/code-security/reference/secret-security/risk-report-csv-contents.md +++ b/content/code-security/reference/secret-security/risk-report-csv-contents.md @@ -19,7 +19,7 @@ The {% data variables.product.prodname_secret_risk_assessment %} report CSV file | ---------- | ---------------------- | --------------------------------------------------------- | | A | `Organization Name` | The name of the organization the secret was detected in | | B | `Name` | The token name for the type of secret | -| C | `Slug` | The normalized string for the token. This corresponds to `Token` in the table of supported secrets. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets). | +| C | `Slug` | The normalized string for the token. This corresponds to `Token` in the table of supported secrets. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns). | | D | `Push Protected` | A `boolean` to indicate whether the secret would be detected and blocked by push protection if it were enabled | | E | `Generic Pattern` | A `boolean` to indicate whether the secret matched a generic pattern and would generate an alert if {% data variables.product.prodname_secret_scanning %} with generic patterns were enabled | | F | `Secret Count` | An aggregate count of the active and inactive secrets found for the token type | @@ -27,4 +27,4 @@ The {% data variables.product.prodname_secret_risk_assessment %} report CSV file ## Next steps -To learn which secrets you should prioritize for remediation, see [AUTOTITLE](/code-security/tutorials/secure-your-organization/interpret-secret-risk-assessment#step-5-prioritizing-remediation-and-related-actions). +To learn which secrets you should prioritize for remediation, see [AUTOTITLE](/code-security/tutorials/secure-your-organization/interpret-secret-risk-assessment#step-5-prioritize-remediation-and-related-actions). diff --git a/content/code-security/reference/secret-security/secret-scanning-scope.md b/content/code-security/reference/secret-security/secret-scanning-scope.md index eddfc6cfbb01..5de2678f6dde 100644 --- a/content/code-security/reference/secret-security/secret-scanning-scope.md +++ b/content/code-security/reference/secret-security/secret-scanning-scope.md @@ -42,7 +42,7 @@ For {% data variables.product.prodname_dotcom %} tokens, we check the validity o ## Push protection limitations -If push protection did not detect a secret that you think should have been detected, then you should first check that push protection supports the secret type in the list of supported secrets. For further information, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets). +If push protection did not detect a secret that you think should have been detected, then you should first check that push protection supports the secret type in the list of supported secrets. For further information, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns). If your secret is in the supported list, there are various reasons why push protection may not detect it. diff --git a/content/code-security/reference/secret-security/secret-types.md b/content/code-security/reference/secret-security/secret-types.md index 233f88e3da9b..0db20172de75 100644 --- a/content/code-security/reference/secret-security/secret-types.md +++ b/content/code-security/reference/secret-security/secret-types.md @@ -116,7 +116,7 @@ Organization-level secrets: * Actions secrets are not available to workflows initiated by {% data variables.product.prodname_dependabot %}. * Actions secrets are not passed to workflows that are triggered by a pull request from a fork. * {% data variables.product.prodname_actions %} automatically redacts the contents of all {% data variables.product.github %} secrets that are printed to workflow logs. -* You can store up to 1,000 organization secrets, 100 repository secrets, and 100 environment secrets. Secrets are limited to 48 KB in size. For more information, see [Limits for secrets](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets#limits-for-secrets). +* You can store up to 1,000 organization secrets, 100 repository secrets, and 100 environment secrets. Secrets are limited to 48 KB in size. For more information, see [Limits for secrets](/actions/reference/security/secrets#limits-for-secrets). {% ifversion fpt or ghec %} @@ -169,6 +169,6 @@ Organization-level secrets: ## Further reading * [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#storing-credentials-for-dependabot-to-use) -* [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets){% ifversion fpt or ghec %} +* [AUTOTITLE](/actions/reference/security/secrets#limits-for-secrets){% ifversion fpt or ghec %} * [AUTOTITLE](/codespaces/managing-codespaces-for-your-organization/managing-development-environment-secrets-for-your-repository-or-organization) * [AUTOTITLE](/codespaces/managing-your-codespaces/managing-your-account-specific-secrets-for-github-codespaces){% endif %} diff --git a/content/code-security/reference/security-at-scale/configuration-statuses.md b/content/code-security/reference/security-at-scale/configuration-statuses.md index 16e3e009e335..bd9bdb55bec6 100644 --- a/content/code-security/reference/security-at-scale/configuration-statuses.md +++ b/content/code-security/reference/security-at-scale/configuration-statuses.md @@ -45,7 +45,7 @@ To prevent repositories from reaching a `removed` status, enable enforcement on ## Tracking configuration status changes with the audit log -Your organization's audit log records `repository_security_configuration` events whenever a configuration status changes. You can search for these events using the `action:repository_security_configuration` filter. For more information, see [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization#repository_security_configuration){% ifversion ghec or ghes %} and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/searching-the-audit-log-for-your-enterprise){% endif %}. +Your organization's audit log records `repository_security_configuration` events whenever a configuration status changes. You can search for these events using the `action:repository_security_configuration` filter. For more information, see [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization){% ifversion ghec or ghes %} and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/searching-the-audit-log-for-your-enterprise){% endif %}. ## Further reading diff --git a/content/code-security/reference/security-at-scale/overview-dashboard-filters.md b/content/code-security/reference/security-at-scale/overview-dashboard-filters.md index b75a43c834cb..6b448ac02ed0 100644 --- a/content/code-security/reference/security-at-scale/overview-dashboard-filters.md +++ b/content/code-security/reference/security-at-scale/overview-dashboard-filters.md @@ -192,7 +192,7 @@ For more information about production context, see [AUTOTITLE](/code-security/tu |{% endif %}| |`ecosystem`|Display {% data variables.product.prodname_dependabot_alerts %} detected in a specified ecosystem, for example: `ecosystem:Maven`.| |`epss_percentage`|Display {% data variables.product.prodname_dependabot_alerts %} whose EPSS score meets the defined criteria, for example: `epss_percentage:>=0.01`| -|`has`|Display {% data variables.product.prodname_dependabot_alerts %} for vulnerabilities where either a secure version is already available (`patch`) or where at least one call from the repository to a vulnerable function is detected (`vulnerable-calls`). For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts#about-the-detection-of-calls-to-vulnerable-functions).| +|`has`|Display {% data variables.product.prodname_dependabot_alerts %} for vulnerabilities where either a secure version is already available (`patch`) or where at least one call from the repository to a vulnerable function is detected (`vulnerable-calls`). For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts).| |`is`|Display {% data variables.product.prodname_dependabot_alerts %} that are open (`open`) or closed (`closed`).| |`package`|Display {% data variables.product.prodname_dependabot_alerts %} detected in the specified package, for example: `package:semver`.| |`props`|Display {% data variables.product.prodname_dependabot_alerts %} for repositories with a specific custom property set. For example, `props.data_sensitivity:high` displays results for repositories with the `data_sensitivity` property set to the value `high`.| diff --git a/content/code-security/reference/security-incident-response/investigation-areas.md b/content/code-security/reference/security-incident-response/investigation-areas.md index d1091ba99845..7e13c0c0d3cb 100644 --- a/content/code-security/reference/security-incident-response/investigation-areas.md +++ b/content/code-security/reference/security-incident-response/investigation-areas.md @@ -39,7 +39,7 @@ You suspect a token or key has been stolen or exploited, received a {% data vari | Tool | Purpose | | --- | --- | | [Audit log](/code-security/reference/security-incident-response/investigation-tools#audit-logs) | Trace token usage | -| [Security overview](/code-security/reference/security-incident-response/investigation-tools#security-overview) | View organization- or enterprise-level security alerts and activity, particularly {% data variables.product.prodname_secret_scanning %} alerts | +| [Security overview](/code-security/reference/security-incident-response/investigation-tools#security-overview-and-security-alerts) | View organization- or enterprise-level security alerts and activity, particularly {% data variables.product.prodname_secret_scanning %} alerts | | [{% data variables.product.github %} code search](/code-security/reference/security-incident-response/investigation-tools#github-code-search) | Search for exposed credentials in code | ### Key resources @@ -162,7 +162,7 @@ You received a malware or dependency alert, suspect a malicious package, or noti | [{% data variables.product.prodname_dependabot %} alerts](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts) | Review for alerts relating to vulnerable dependencies | | [{% data variables.product.prodname_advisory_database %}](https://github.com/advisories)| Search for `type:malware` | | [Activity view](/code-security/reference/security-incident-response/investigation-tools#activity-view) | Review recent pushes to repositories | -| [Security overview](/code-security/reference/security-incident-response/investigation-tools#security-overview) | Review recent security alerts across an organization or enterprise | +| [Security overview](/code-security/reference/security-incident-response/investigation-tools#security-overview-and-security-alerts) | Review recent security alerts across an organization or enterprise | ### Key resources diff --git a/content/code-security/reference/security-incident-response/investigation-tools.md b/content/code-security/reference/security-incident-response/investigation-tools.md index 9ccea741413f..c1848d8455b2 100644 --- a/content/code-security/reference/security-incident-response/investigation-tools.md +++ b/content/code-security/reference/security-incident-response/investigation-tools.md @@ -144,7 +144,7 @@ Read access to the repository. ### Key resources * [AUTOTITLE](/code-security/concepts/security-at-scale/security-overview) -* [AUTOTITLE](/code-security/how-tos/view-and-interpret-data/analyze-organization-data/viewing-security-insights#viewing-the-security-overview-dashboard-for-your-organization) +* [AUTOTITLE](/code-security/how-tos/view-and-interpret-data/analyze-organization-data/viewing-security-insights) ### Notes and limitations diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md index bc1b71a09303..37ae0ceac810 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md +++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md @@ -543,7 +543,9 @@ Change the limit on the maximum number of pull requests for version updates open {% data variables.product.prodname_dependabot %} default behavior: * If five pull requests with version updates are open, no further pull requests are raised until some of those open requests are merged or closed. -* Security updates have a separate, internal limit of ten open pull requests which cannot be changed. + +> [!NOTE] +> _Security update_ pull requests are not subject to this limit and do not count toward it. There is no limit on the number of open pull requests for security updates. When `open-pull-requests-limit` is defined: diff --git a/content/code-security/reference/supply-chain-security/dependabot-security-updates.md b/content/code-security/reference/supply-chain-security/dependabot-security-updates.md index 293db36a0e5e..82a0cc9eb551 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-security-updates.md +++ b/content/code-security/reference/supply-chain-security/dependabot-security-updates.md @@ -15,7 +15,7 @@ category: Settings for grouped {% data variables.product.prodname_dependabot_security_updates %} are applied in the following order, from highest to lowest priority: -1. Settings defined in a `dependabot.yml` file. See [About the `dependabot.yml` file](/code-security/reference/supply-chain-security/dependabot-options-reference#about-the-dependabotyml-file). +1. Settings defined in a `dependabot.yml` file. See [About the `dependabot.yml` file](/code-security/concepts/supply-chain-security/about-the-dependabot-yml-file). 1. Repository-level settings defined in the UI 1. Organization-level settings defined in the UI diff --git a/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions.md b/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions.md index 83d981f40df9..a00a8448d95a 100644 --- a/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions.md +++ b/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions.md @@ -27,7 +27,7 @@ Some troubleshooting advice is provided in this article. You can also see [AUTOT When a {% data variables.product.prodname_dependabot %} event triggers a workflow, the only secrets available to the workflow are {% data variables.product.prodname_dependabot %} secrets. {% data variables.product.prodname_actions %} secrets are **not available**. You must therefore store any secrets that are used by a workflow triggered by {% data variables.product.prodname_dependabot %} events as {% data variables.product.prodname_dependabot %} secrets. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#storing-credentials-for-dependabot-to-use). -{% data variables.product.prodname_dependabot %} secrets are added to the `secrets` context and referenced using exactly the same syntax as secrets for {% data variables.product.prodname_actions %}. For more information, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets#using-encrypted-secrets-in-a-workflow). +{% data variables.product.prodname_dependabot %} secrets are added to the `secrets` context and referenced using exactly the same syntax as secrets for {% data variables.product.prodname_actions %}. For more information, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets#using-secrets-in-a-workflow). If you have a workflow that will be triggered by {% data variables.product.prodname_dependabot %} and also by other actors, the simplest solution is to store the token with the permissions required in an action and in a {% data variables.product.prodname_dependabot %} secret with identical names. Then the workflow can include a single call to these secrets. If the secret for {% data variables.product.prodname_dependabot %} has a different name, use conditions to specify the correct secrets for different actors to use. diff --git a/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/vulnerability-detection.md b/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/vulnerability-detection.md index f6b381a0efa6..77a85b77e9fe 100644 --- a/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/vulnerability-detection.md +++ b/content/code-security/reference/supply-chain-security/troubleshoot-dependabot/vulnerability-detection.md @@ -27,10 +27,10 @@ category: * {% data variables.product.prodname_advisory_database %} is one of the data sources that {% data variables.product.prodname_dotcom %} uses to identify vulnerable dependencies and malware. It's a free, curated database of security advisories for common package ecosystems on {% data variables.product.prodname_dotcom %}. It includes both data reported directly to {% data variables.product.prodname_dotcom %} from {% data variables.product.prodname_security_advisories %}, as well as official feeds and community sources. This data is reviewed and curated by {% data variables.product.prodname_dotcom %} to ensure that false or unactionable information is not shared with the development community. {% data reusables.security-advisory.link-browsing-advisory-db %} * The dependency graph parses all known package manifest files in a user’s repository. For example, for npm it will parse the _package-lock.json_ file. It constructs a graph of all of the repository’s dependencies and public dependents. This happens when you enable the dependency graph and when anyone pushes to the default branch, and it includes commits that make changes to a supported manifest format. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-graph) and [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependency-graph-errors). -* {% data variables.product.prodname_dependabot %} scans any push, to the default branch, that contains a manifest file. When a new advisory is added, it scans all existing repositories and generates an alert for each repository that is affected. {% data variables.product.prodname_dependabot_alerts %} are aggregated at the repository level, rather than creating one alert per advisory. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts). +* {% data variables.product.prodname_dependabot %} scans any push, to the default branch, that contains a manifest file. When a new advisory is added, it scans all existing repositories and generates an alert for each repository that is affected. {% data variables.product.prodname_dependabot_alerts %} are aggregated at the repository level, rather than creating one alert per advisory. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#when-dependabot-sends-alerts). * {% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive an alert about a vulnerable dependency in your repository. Where possible, {% data variables.product.prodname_dependabot %} creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-security-updates) and [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors). - {% data variables.product.prodname_dependabot %} doesn't scan repositories on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new advisory is added to the database{% ifversion ghes %} and synchronized to {% data variables.product.prodname_dotcom %}{% endif %}. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#detection-of-insecure-dependencies). + {% data variables.product.prodname_dependabot %} doesn't scan repositories on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new advisory is added to the database{% ifversion ghes %} and synchronized to {% data variables.product.prodname_dotcom %}{% endif %}. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#when-dependabot-sends-alerts). ## Alert coverage scope @@ -106,7 +106,7 @@ If your repository contains multiple {% data variables.product.prodname_actions ## Further reading -* [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts) +* [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#when-dependabot-sends-alerts) * [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts) * [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository) * [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependency-graph-errors) diff --git a/content/code-security/responsible-use/security-and-quality-ai-features.md b/content/code-security/responsible-use/security-and-quality-ai-features.md index 4d35da7ba285..b317a14f492a 100644 --- a/content/code-security/responsible-use/security-and-quality-ai-features.md +++ b/content/code-security/responsible-use/security-and-quality-ai-features.md @@ -266,7 +266,7 @@ Responsible AI is a shared commitment between GitHub and its customers. While Gi * **Exercise caution when designing agentic AI in sensitive domains**: {% data reusables.rai.copilot.application-card-agentic-ai-caution %} * **Enable CI testing on pull requests**: Ensure continuous integration testing is in place before enabling Copilot Autofix, so that functional requirements are verified after developers apply fixes. * **Use dependency management solutions**: Enable dependency review on pull requests to catch potentially risky dependency changes introduced by Autofix suggestions. -* **Review security overview metrics**: Use your organization's security overview dashboard to view the total number of Copilot Autofix suggestions generated on open and closed pull requests for a given time period. For more information, see [AUTOTITLE](/code-security/reference/security-at-scale/overview-dashboard-metrics#pull-request-alerts-fixed-with-suggestions). +* **Review security overview metrics**: Use your organization's security overview dashboard to view the total number of Copilot Autofix suggestions generated on open and closed pull requests for a given time period. For more information, see [AUTOTITLE](/code-security/reference/security-at-scale/overview-dashboard-metrics#pull-request-alerts-fixed-with-copilot-autofix-suggestions). * **Evaluate false-positive volume for secret detection**: Evaluate the false-positive volume and establish triage processes for the alerts list. * **Monitor Code Quality suggestion volume and quality**: Evaluate the volume and quality of Code Quality suggestions and adjust enablement as appropriate for your organization. @@ -275,8 +275,8 @@ Responsible AI is a shared commitment between GitHub and its customers. While Gi For additional guidance on the responsible use of GitHub Security AI features, we recommend reviewing the following documentation: * [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alerts) -* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests#working-with-suggestions-for-alerts-on-a-pull-request) -* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#generating-suggested-fixes-for-code-scanning-alerts) +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests#working-with-copilot-autofix-suggestions-for-alerts-on-a-pull-request) +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#generating-a-suggested-fix) * [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/disabling-autofix-for-code-scanning) * [AUTOTITLE](/free-pro-team@latest/site-policy/github-terms/github-terms-for-additional-products-and-features#advanced-security) * [AUTOTITLE](/code-security/concepts/secret-security/secret-scanning) diff --git a/content/code-security/tutorials/adopting-github-advanced-security-at-scale/phase-2-preparing-to-enable-at-scale.md b/content/code-security/tutorials/adopting-github-advanced-security-at-scale/phase-2-preparing-to-enable-at-scale.md index fbfa5fb207e5..840f9ba10fca 100644 --- a/content/code-security/tutorials/adopting-github-advanced-security-at-scale/phase-2-preparing-to-enable-at-scale.md +++ b/content/code-security/tutorials/adopting-github-advanced-security-at-scale/phase-2-preparing-to-enable-at-scale.md @@ -48,7 +48,7 @@ Before you can proceed with pilot programs and rolling out {% data variables.pro > [!NOTE] > When a secret is detected in a repository that has enabled {% data variables.product.prodname_secret_scanning %}, {% data variables.product.github %} alerts all users with access to security alerts for the repository. {% ifversion ghec %} > -> Secrets found in public repositories using {% data variables.secret-scanning.partner_alerts %} are reported directly to the partner, without creating an alert on {% data variables.product.github %}. For details about the supported partner patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets).{% endif %} +> Secrets found in public repositories using {% data variables.secret-scanning.partner_alerts %} are reported directly to the partner, without creating an alert on {% data variables.product.github %}. For details about the supported partner patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns).{% endif %} If a project communicates with an external service, it might use a token or private key for authentication. If you check a secret into a repository, anyone who has read access to the repository can use the secret to access the external service with your privileges. {% data variables.product.prodname_secret_scanning_caps %} will scan your entire Git history on all branches present in your {% data variables.product.github %} repositories for secrets and alert you or block the push containing the secret. For more information, see [AUTOTITLE](/code-security/concepts/secret-security/secret-scanning). @@ -78,7 +78,7 @@ As you audit your repositories and speak to security and developer teams, build ### Push protection for {% data variables.product.prodname_secret_scanning %} -Push protection for organizations and repositories instructs {% data variables.product.prodname_secret_scanning %} to check pushes for supported secrets _before_ secrets are committed to the codebase. For information on which secrets are supported, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets). +Push protection for organizations and repositories instructs {% data variables.product.prodname_secret_scanning %} to check pushes for supported secrets _before_ secrets are committed to the codebase. For information on which secrets are supported, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns). If a secret is detected in a push, that push is blocked. {% data variables.product.prodname_secret_scanning_caps %} lists any secrets it detects so the author can review the secrets and remove them or, if needed, allow those secrets to be pushed. {% data reusables.secret-scanning.push-protection-custom-pattern %} diff --git a/content/code-security/tutorials/customize-code-scanning/analyze-code.md b/content/code-security/tutorials/customize-code-scanning/analyze-code.md index 6a5c814e1440..f29172821213 100644 --- a/content/code-security/tutorials/customize-code-scanning/analyze-code.md +++ b/content/code-security/tutorials/customize-code-scanning/analyze-code.md @@ -66,7 +66,7 @@ You must specify ``, `--format`, and `--output`. You can specify addit | --format | {% octicon "check" aria-label="Required" %} | Specify the format for the results file generated during analysis. A number of different formats are supported, including CSV, [SARIF](https://codeql.github.com/docs/codeql-overview/codeql-glossary/#sarif-file), and graph formats. For upload to {% data variables.product.company_short %} this should be: {% ifversion fpt or ghec %}`sarif-latest`{% else %}`sarifv2.1.0`{% endif %}. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/sarif-support). | | --output | {% octicon "check" aria-label="Required" %} | Specify the location where you want to save the SARIF results file, including the desired filename with the `.sarif` extension. | | --sarif-category | {% octicon "question" aria-label="Required with multiple results sets" %} | Optional for single database analysis. Required to define the language when you analyze multiple databases for a single commit in a repository.

Specify a category to include in the SARIF results file for this analysis. A category is used to distinguish multiple analyses for the same tool and commit, but performed on different languages or different parts of the code. | -| --sarif-add-baseline-file-info | {% octicon "x" aria-label="Optional" %} | **Recommended.** Use to submit file coverage information to the {% data variables.code-scanning.tool_status_page %}. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning#how-codeql-defines-scanned-files). | +| --sarif-add-baseline-file-info | {% octicon "x" aria-label="Optional" %} | **Recommended.** Use to submit file coverage information to the {% data variables.code-scanning.tool_status_page %}. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). | | --sarif-include-query-help | {% octicon "x" aria-label="Optional" %} | Specify whether to include query help in the SARIF output. One of: `always`: Include query help for all queries. `custom_queries_only` (default): Include query help only for custom queries, that is, queries in query packs which are not of the form `codeql/-queries`. `never`: Do not include query help for any queries. Any query help for custom queries included in the SARIF output will be displayed in any code scanning alerts for the query. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/write-custom-queries#including-query-help-for-custom-codeql-queries-in-sarif-files). | | `` | {% octicon "x" aria-label="Optional" %} | Use if you want to include {% data variables.product.prodname_codeql %} query packs in your analysis. For more information, see [Downloading and using {% data variables.product.prodname_codeql %} packs](/code-security/tutorials/customize-code-scanning/customize-analysis#downloading-and-using-codeql-query-packs). | | --download | {% octicon "x" aria-label="Optional" %} | Use if some of your {% data variables.product.prodname_codeql %} query packs are not yet on disk and need to be downloaded before running queries. | @@ -103,7 +103,7 @@ $ codeql database analyze /codeql-dbs/example-repo \ ### Adding file coverage information to your results for monitoring -You can optionally submit file coverage information to {% data variables.product.github %} for display on the {% data variables.code-scanning.tool_status_page %} for {% data variables.product.prodname_code_scanning %}. For more information about file coverage information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning#how-codeql-defines-scanned-files). +You can optionally submit file coverage information to {% data variables.product.github %} for display on the {% data variables.code-scanning.tool_status_page %} for {% data variables.product.prodname_code_scanning %}. For more information about file coverage information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). To include file coverage information with your {% data variables.product.prodname_code_scanning %} results, add the `--sarif-add-baseline-file-info` flag to the `codeql database analyze` invocation in your CI system, for example: diff --git a/content/code-security/tutorials/customize-code-scanning/create-query-suites.md b/content/code-security/tutorials/customize-code-scanning/create-query-suites.md index 02f7e7ce1d3f..48b19e0444ef 100644 --- a/content/code-security/tutorials/customize-code-scanning/create-query-suites.md +++ b/content/code-security/tutorials/customize-code-scanning/create-query-suites.md @@ -357,7 +357,7 @@ instruction: ## Saving a query suite Save your query suite in a file with a `.qls` extension and add it to a {% data variables.product.prodname_codeql %} -pack. For more information, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/customize-analysis#custom-codeql-packs). +pack. For more information, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/customize-analysis). ## Using query suites with {% data variables.product.prodname_codeql %} diff --git a/content/code-security/tutorials/customize-code-scanning/customize-analysis.md b/content/code-security/tutorials/customize-code-scanning/customize-analysis.md index ed1899b0d40b..ca7d60539626 100644 --- a/content/code-security/tutorials/customize-code-scanning/customize-analysis.md +++ b/content/code-security/tutorials/customize-code-scanning/customize-analysis.md @@ -138,7 +138,7 @@ In this example, the relevant queries in the standard query pack `codeql/java-qu You can specify multiple published model packs in an analysis. -For more information about writing your own model packs, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs#creating-a-model-pack). +For more information about writing your own model packs, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs#creating-a-codeql-model-pack). ### About published packs diff --git a/content/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis.md b/content/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis.md index 0ac56eafa328..470d9a1e1eb9 100644 --- a/content/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis.md +++ b/content/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis.md @@ -79,7 +79,7 @@ You can specify additional options depending on the location of your source file | `` | {% octicon "check" aria-label="Required" %} | Specify the name and location of a directory to create for the {% data variables.product.prodname_codeql %} database. The command will fail if you try to overwrite an existing directory. If you also specify `--db-cluster`, this is the parent directory and a subdirectory is created for each language analyzed. | | --language | {% octicon "check" aria-label="Required" %} | Specify the identifier for the language to create a database for, one of: {% data reusables.code-scanning.codeql-languages-keywords %}. When used with --db-cluster, the option accepts a comma-separated list, or can be specified more than once. | | --command | {% octicon "x" aria-label="Optional" %} | **Recommended.** Use to specify the build command or script that invokes the build process for the codebase. Commands are run from the current folder or, where it is defined, from --source-root. Not needed for Python and JavaScript/TypeScript analysis. | -| --build-mode | {% octicon "x" aria-label="Optional" %} | **Recommended.** Use for {% data variables.code-scanning.no_build_support %} when not providing a `--command` to specify whether to create a CodeQL database without a build (`none`) or by attempting to automatically detect a build command (`autobuild`). By default, autobuild detection is used. For a comparison of build modes, see [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#codeql-build-modes). | +| --build-mode | {% octicon "x" aria-label="Optional" %} | **Recommended.** Use for {% data variables.code-scanning.no_build_support %} when not providing a `--command` to specify whether to create a CodeQL database without a build (`none`) or by attempting to automatically detect a build command (`autobuild`). By default, autobuild detection is used. For a comparison of build modes, see [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#compare-build-modes). | | --db-cluster | {% octicon "x" aria-label="Optional" %} | Use in multi-language codebases to generate one database for each language specified by --language. | | --no-run-unnecessary-builds | {% octicon "x" aria-label="Optional" %} | **Recommended.** Use to suppress the build command for languages where the {% data variables.product.prodname_codeql_cli %} does not need to monitor the build (for example, Python and JavaScript/TypeScript). | | --source-root | {% octicon "x" aria-label="Optional" %} | Use if you run the CLI outside the checkout root of the repository. By default, the `database create` command assumes that the current directory is the root directory for the source files, use this option to specify a different location. | @@ -196,11 +196,11 @@ For most compiled languages, {% data variables.product.prodname_codeql %} needs * [Automatic build detection (autobuild)](#automatically-detecting-the-build-system) * [User-specified build commands](/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis#specifying-build-commands) -In addition, for {% data variables.code-scanning.no_build_support %}, there is an option to generate a database without building the code. This is particularly useful when you want to enable {% data variables.product.prodname_code_scanning %} for many repositories. For more information, see [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#codeql-build-modes). +In addition, for {% data variables.code-scanning.no_build_support %}, there is an option to generate a database without building the code. This is particularly useful when you want to enable {% data variables.product.prodname_code_scanning %} for many repositories. For more information, see [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#compare-build-modes). ### Automatically detecting the build system -The {% data variables.product.prodname_codeql_cli %} includes autobuilders for {% data variables.code-scanning.autobuild_support %} code. {% data variables.product.prodname_codeql %} autobuilders allow you to build projects for compiled languages without specifying any build commands. When an autobuilder is invoked, {% data variables.product.prodname_codeql %} examines the source for evidence of a build system and attempts to run the optimal set of commands required to extract a database. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#about-autobuild). +The {% data variables.product.prodname_codeql_cli %} includes autobuilders for {% data variables.code-scanning.autobuild_support %} code. {% data variables.product.prodname_codeql %} autobuilders allow you to build projects for compiled languages without specifying any build commands. When an autobuilder is invoked, {% data variables.product.prodname_codeql %} examines the source for evidence of a build system and attempts to run the optimal set of commands required to extract a database. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#use-autobuild-for-codeql). An autobuilder is invoked automatically when you execute `codeql database create` for a compiled language if you don’t include a `--command` option or set `--build-mode none`. For example, for a Swift codebase, you could simply run: diff --git a/content/code-security/tutorials/fix-reported-vulnerabilities/write-security-advisories.md b/content/code-security/tutorials/fix-reported-vulnerabilities/write-security-advisories.md index ba3defc384f5..1f667db6b950 100644 --- a/content/code-security/tutorials/fix-reported-vulnerabilities/write-security-advisories.md +++ b/content/code-security/tutorials/fix-reported-vulnerabilities/write-security-advisories.md @@ -35,7 +35,7 @@ You suggest an improvement to an existing global advisory using the _Improve sec ## Ecosystem -You need to assign the advisory to one of our supported ecosystems using the **Ecosystem** field. For more information about the ecosystems we support, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database#github-reviewed-advisories). +You need to assign the advisory to one of our supported ecosystems using the **Ecosystem** field. For more information about the ecosystems we support, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database). ![Screenshot of the "Affected products" area of the security advisory form. The "Ecosystem" field is highlighted with a dark orange outline.](/assets/images/help/security/security-advisory-ecosystem.png) diff --git a/content/code-security/tutorials/implement-supply-chain-best-practices/securing-builds.md b/content/code-security/tutorials/implement-supply-chain-best-practices/securing-builds.md index c24557dd6381..79e7c3199a00 100644 --- a/content/code-security/tutorials/implement-supply-chain-best-practices/securing-builds.md +++ b/content/code-security/tutorials/implement-supply-chain-best-practices/securing-builds.md @@ -69,7 +69,7 @@ If you are using release assets from other projects in your build system, or cre There are many further steps you can take to additionally secure {% data variables.product.prodname_actions %}. In particular, be careful when evaluating third-party workflows, and consider using `CODEOWNERS` to limit who can make changes to your workflows. -For more information, see [AUTOTITLE](/actions/reference/security/secure-use#writing-workflows) and [AUTOTITLE](/actions/reference/security/secure-use#s-security-features). +For more information, see [AUTOTITLE](/actions/reference/security/secure-use#writing-workflows) and [AUTOTITLE](/actions/reference/security/secure-use). ## Next steps diff --git a/content/code-security/tutorials/implement-supply-chain-best-practices/securing-code.md b/content/code-security/tutorials/implement-supply-chain-best-practices/securing-code.md index 134755cb209f..a67521282b5d 100644 --- a/content/code-security/tutorials/implement-supply-chain-best-practices/securing-code.md +++ b/content/code-security/tutorials/implement-supply-chain-best-practices/securing-code.md @@ -49,7 +49,7 @@ As a first step, you want to make a complete inventory of your dependencies. The ### Automatic detection of vulnerabilities in pull requests -The {% data variables.dependency-review.action_name %} enforces a dependency review on your pull requests, making it easy for you to see if a pull request will introduce a vulnerable version of a dependency to your repository. When a vulnerability is detected, the {% data variables.dependency-review.action_name %} can block the pull request from merging. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-review#the-dependency-review-action). +The {% data variables.dependency-review.action_name %} enforces a dependency review on your pull requests, making it easy for you to see if a pull request will introduce a vulnerable version of a dependency to your repository. When a vulnerability is detected, the {% data variables.dependency-review.action_name %} can block the pull request from merging. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-review#about-the-dependency-review-action). ### Assessment of exposure to risk from a vulnerable dependency diff --git a/content/code-security/tutorials/manage-security-alerts/prioritizing-dependabot-alerts-using-metrics.md b/content/code-security/tutorials/manage-security-alerts/prioritizing-dependabot-alerts-using-metrics.md index 7e7771b287f0..d701e89bded8 100644 --- a/content/code-security/tutorials/manage-security-alerts/prioritizing-dependabot-alerts-using-metrics.md +++ b/content/code-security/tutorials/manage-security-alerts/prioritizing-dependabot-alerts-using-metrics.md @@ -33,7 +33,7 @@ Application Security (AppSec) managers often face a flood of {% data variables.p For more information about these metrics, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alert-metrics). -Additionally, you can specify complex filters, which are combinations of the individual filters that are available. For more information about filters, see [{% data variables.product.prodname_dependabot %} dashboard view filters](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview#dependabot-dashboard-view-filters). +Additionally, you can specify complex filters, which are combinations of the individual filters that are available. For more information about filters, see [{% data variables.product.prodname_dependabot %} dashboard view filters](/code-security/reference/security-at-scale/overview-dashboard-filters#dependabot-dashboard-filters). ## Steps to prioritize alerts diff --git a/content/code-security/tutorials/remediate-leaked-secrets/remediating-a-leaked-secret.md b/content/code-security/tutorials/remediate-leaked-secrets/remediating-a-leaked-secret.md index 1916b7c457f0..cf51b98cc782 100644 --- a/content/code-security/tutorials/remediate-leaked-secrets/remediating-a-leaked-secret.md +++ b/content/code-security/tutorials/remediate-leaked-secrets/remediating-a-leaked-secret.md @@ -55,7 +55,7 @@ Review the {% data variables.product.prodname_secret_scanning %} alert associate 1. Check the secret's **validity status** to determine if the secret is still active. The alert will include a status that describes whether the secret is active, inactive, or if its validity is unknown. > [!NOTE] - > * Validity checks are only available for certain secret types. To check if your secret type is supported, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#default-patterns). + > * Validity checks are only available for certain secret types. To check if your secret type is supported, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns). > * The secret provider is always the most reliable source of truth for determining the validity of a secret. 1. Check for the `public exposure` label to determine if the secret was leaked in a public repository. 1. Check for the `multiple leaks` label to determine if the secret is exposed in multiple locations. diff --git a/content/code-security/tutorials/secure-your-dependencies/customize-dependency-review-action.md b/content/code-security/tutorials/secure-your-dependencies/customize-dependency-review-action.md index c29635b94986..e396ccc9fcb8 100644 --- a/content/code-security/tutorials/secure-your-dependencies/customize-dependency-review-action.md +++ b/content/code-security/tutorials/secure-your-dependencies/customize-dependency-review-action.md @@ -25,7 +25,7 @@ This guide shows you how to add three very common customizations: failing builds This guide assumes that: -* Dependency graph is enabled for the repository. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/enable-dependency-graph#enabling-and-disabling-the-dependency-graph). +* Dependency graph is enabled for the repository. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/enable-dependency-graph#enabling-the-dependency-graph-for-a-repository). * {% data variables.product.prodname_actions %} is enabled for the repository. For more information, see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository). ## Step 1: Adding the dependency review action diff --git a/content/code-security/tutorials/secure-your-dependencies/dependabot-quickstart.md b/content/code-security/tutorials/secure-your-dependencies/dependabot-quickstart.md index 8fe504f94d52..034d20a848b9 100644 --- a/content/code-security/tutorials/secure-your-dependencies/dependabot-quickstart.md +++ b/content/code-security/tutorials/secure-your-dependencies/dependabot-quickstart.md @@ -63,7 +63,7 @@ If {% data variables.product.prodname_dependabot_alerts %} are enabled for a rep ![Screenshot showing the list of Dependabot alerts for the demo repository.](/assets/images/help/repository/dependabot-alerts-list-demo-repo.png) - You can filter {% data variables.product.prodname_dependabot_alerts %} in the list, using a variety of filters or labels. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts#prioritizing-dependabot-alerts). You can also use {% data variables.dependabot.auto_triage_rules %} to filter out false positive alerts or alerts you're not interested in. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules). + You can filter {% data variables.product.prodname_dependabot_alerts %} in the list, using a variety of filters or labels. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts#tips-for-prioritizing-alerts). You can also use {% data variables.dependabot.auto_triage_rules %} to filter out false positive alerts or alerts you're not interested in. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules). 1. Click the "Command Injection in lodash" alert on the `javascript/package-lock.json` file. The details page for the alert will show the following information (note that some information may not apply to all alerts): * Whether {% data variables.product.prodname_dependabot %} created a pull request that will fix the vulnerability. You can review the suggested security update by clicking **Review security update**. @@ -76,11 +76,11 @@ If {% data variables.product.prodname_dependabot_alerts %} are enabled for a rep 1. Optionally, you can also explore the information on the right-side of the page. Some of the information shown in the screenshot may not apply to every alert. * Severity - * CVSS metrics: We use CVSS levels to assign severity levels. For more information, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database#about-cvss-levels). + * CVSS metrics: We use CVSS levels to assign severity levels. For more information, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database#cvss-levels). * Tags * Weaknesses: List of CWEs related to the vulnerability, if applicable * CVE ID: Unique CVE identifier for the vulnerability, if applicable - * GHSA ID: Unique identifier of the corresponding advisory on the {% data variables.product.prodname_advisory_database %}. For more information, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database#about-ghsa-ids). + * GHSA ID: Unique identifier of the corresponding advisory on the {% data variables.product.prodname_advisory_database %}. For more information, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database#ghsa-ids). * Option to navigate to the advisory on the {% data variables.product.prodname_advisory_database %} * Option to see all of your repositories that are affected by this vulnerability * Option to suggest improvements for this advisory on the {% data variables.product.prodname_advisory_database %} diff --git a/content/code-security/tutorials/secure-your-organization/prevent-data-leaks.md b/content/code-security/tutorials/secure-your-organization/prevent-data-leaks.md index 1dfb613adebe..774fca6a8d46 100644 --- a/content/code-security/tutorials/secure-your-organization/prevent-data-leaks.md +++ b/content/code-security/tutorials/secure-your-organization/prevent-data-leaks.md @@ -118,7 +118,7 @@ counter notice form and alert GitHub Support. For more information, see [DMCA co ### Revoke exposed tokens -If credentials have been exposed in a {% data variables.product.github %} repository, {% data variables.product.github %} {% data variables.product.prodname_secret_scanning %} can be used to report and revoke the credentials. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts#reporting-a-leaked-secret). +If credentials have been exposed in a {% data variables.product.github %} repository, {% data variables.product.github %} {% data variables.product.prodname_secret_scanning %} can be used to report and revoke the credentials. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts#reporting-a-leaked-secret-in-a-private-repository). You can also revoke exposed credentials that you do not own and have been exposed outside of {% data variables.product.github %} repositories. By doing this, you are contributing to the overall security of the {% data variables.product.github %} community and can quickly limit the impact of these credentials. The API supports revoking: diff --git a/content/code-security/tutorials/secure-your-organization/prioritize-alerts-in-production-code.md b/content/code-security/tutorials/secure-your-organization/prioritize-alerts-in-production-code.md index a6837f1d39f7..5c1929894f67 100644 --- a/content/code-security/tutorials/secure-your-organization/prioritize-alerts-in-production-code.md +++ b/content/code-security/tutorials/secure-your-organization/prioritize-alerts-in-production-code.md @@ -33,7 +33,7 @@ For more information on updating records, see [AUTOTITLE](/code-security/how-tos Production context filters are made available in the **{% data variables.product.prodname_security_and_quality_tab %}** tab. -* **{% data variables.product.prodname_dependabot %} view**: See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts#viewing-dependabot-alerts). +* **{% data variables.product.prodname_dependabot %} view**: See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts#viewing-and-prioritizing-dependabot-alerts). * **{% data variables.product.prodname_code_scanning_caps %} view**: See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts). * **Security campaign view**: See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns). diff --git a/content/code-security/tutorials/secure-your-organization/respond-to-a-security-incident.md b/content/code-security/tutorials/secure-your-organization/respond-to-a-security-incident.md index 7907c1024eaa..793ed636975f 100644 --- a/content/code-security/tutorials/secure-your-organization/respond-to-a-security-incident.md +++ b/content/code-security/tutorials/secure-your-organization/respond-to-a-security-incident.md @@ -244,7 +244,7 @@ Thorough documentation is essential for the remaining phases and for future refe The goal now is to learn from the incident and strengthen your security posture to prevent similar incidents. 1. Write an **incident summary**. This should include a timeline of events from first indication to resolution, as well as the root cause analysis, decisions and actions taken, and lessons learned. -1. Track any **outstanding action items** from the security incident as issues, such as remaining remediation tasks and any security improvements that need to be implemented based on lessons learned. {% ifversion copilot %}{% data variables.product.prodname_copilot_short %} can help create these, and you can assign well-scoped issues to {% data variables.product.prodname_copilot_short %} to work on independently. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/cloud-agent/start-copilot-sessions#assigning-an-issue-to-copilot).{% endif %} +1. Track any **outstanding action items** from the security incident as issues, such as remaining remediation tasks and any security improvements that need to be implemented based on lessons learned. {% ifversion copilot %}{% data variables.product.prodname_copilot_short %} can help create these, and you can assign well-scoped issues to {% data variables.product.prodname_copilot_short %} to work on independently. See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/cloud-agent/start-copilot-sessions).{% endif %} 1. If you don't already have one, ensure your company or team has an up-to-date **Security Incident Response Plan**. This should include defined roles and responsibilities, escalation paths, communication protocols, severity classification criteria, and step-by-step response procedures for common threat types. {% data variables.product.prodname_copilot_short %} can help generate and refine this plan based on your specific needs and resources. For additional guidance, see [What is incident response](https://github.com/resources/articles/what-is-incident-response#what-is-incident-response). ## Next steps diff --git a/content/copilot/concepts/agents/cloud-agent/about-automation-rationale-and-approvals.md b/content/copilot/concepts/agents/cloud-agent/about-automation-rationale-and-approvals.md new file mode 100644 index 000000000000..c8a28bfe4abd --- /dev/null +++ b/content/copilot/concepts/agents/cloud-agent/about-automation-rationale-and-approvals.md @@ -0,0 +1,61 @@ +--- +title: About rationale, confidence, and approvals for issues +shortTitle: Rationale, confidence, and approvals +allowTitleToDifferFromFilename: true +intro: 'When {% data variables.copilot.copilot_automations %} triage issues, it explains each change, rates its confidence, and holds lower-confidence changes for your review.' +product: '{% data reusables.gated-features.copilot-automations %}
Sign up for {% data variables.product.prodname_copilot_short %} {% octicon "link-external" height:16 %}' +versions: + feature: copilot +contentType: concepts +category: + - Learn about Copilot +--- + +> [!NOTE] +> Rationale, confidence, and approvals for {% data variables.copilot.copilot_automations %} are in {% data variables.release-phases.public_preview %} and subject to change. + +{% data variables.copilot.copilot_automations_cap %} run an agent to triage issues for you, applying labels, setting types and fields, assigning issues, and closing them, without a person initiating each change. Rationale, confidence, and approvals give you visibility into that automated work and control over when it applies. + +This capability is not specific to any one platform. It works the same whether the agent runs through {% data variables.copilot.copilot_cloud_agent %} {% data variables.copilot.copilot_automations %}, [{% data variables.copilot.github_agentic_workflows %}](https://gh.io/gh-aw), or the REST and GraphQL APIs. + +This capability applies only to the changes an {% data variables.copilot.copilot_automation %} makes to **issues**. It does not apply to changes people make by hand, and it does not affect other actions an {% data variables.copilot.copilot_automation %} can take, such as opening pull requests or pushing code. + +Rationale, confidence, and approvals cover changes an {% data variables.copilot.copilot_automation %} makes to the following issue attributes: **labels, fields, issue type, closing issues, and assignees**. + +## Rationale + +Every supported action records the reason behind it, whether the {% data variables.copilot.copilot_automation %} applied the change automatically or proposed it as a suggestion. This gives you an audit trail of what changed and why. When a change is waiting for review, you see the reason on the suggestion before you decide. + +You can also view the rationale on the issue for changes that took effect, whether they were applied automatically or suggested and then approved. An action with a recorded rationale will have {% octicon "info" aria-label="the info icon" %} next to it. Select the icon to reveal the {% data variables.copilot.copilot_automation %}'s reasoning for that change. + +## Confidence + +For each supported action, the {% data variables.copilot.copilot_automation %} rates its confidence as high, medium, or low. Your repository has an **automation level** that sets the confidence threshold: changes rated below it are held as suggestions, and changes at or above it apply automatically. + +* **Full control**: Every change is held for review. Nothing is applied automatically. +* **Cautious** (default): Only high-confidence changes are applied automatically. Everything else is held for your review. +* **Balanced**: Routine, clear-cut changes are applied automatically. Anything with ambiguity is held for review. +* **Full automation**: Every change is applied automatically. The agent only holds a change back if it's flagged as uncertain. + +Because lower-confidence actions are the ones held back, you spend time only on the changes most likely to need a second look. + +## Approvals + +Whether a change applies directly or waits for your review depends on two things: + +* **Your repository's automation level.** Changes rated below the threshold are always held as suggestions, no matter what you prompted the {% data variables.copilot.copilot_automation %} to do. +* **An explicit request to suggest.** You can also prompt the {% data variables.copilot.copilot_automation %} to suggest a change rather than apply it, and it waits for your review even if its confidence is high. + +Suggestions appear in a panel on the issue. From the panel you can: + +* **Accept** or **decline** each suggestion individually. +* **Accept all** or **decline all** to act on multiple suggestions at once. + +A small team moving quickly might choose **Full automation**, while a busy public repository can choose **Cautious** or **Full control** to hold more changes for review where the stakes are higher. + +> [!NOTE] +> Approvals are a workflow convenience, not a security control. They don't enforce a server-side boundary, so an agent with permission to change issues can apply changes directly instead of proposing them, including through the REST and GraphQL APIs. Use repository and agent permissions, not approvals, to control what an {% data variables.copilot.copilot_automation %} is allowed to do. + +## Next steps + +To learn how to configure your repository's automation level and manage suggestions, see [AUTOTITLE](/copilot/how-tos/use-copilot-agents/cloud-agent/manage-rationale-confidence-approvals). diff --git a/content/copilot/concepts/agents/cloud-agent/about-automations.md b/content/copilot/concepts/agents/cloud-agent/about-automations.md index 72e59ac1209b..b6ef139c1a5f 100644 --- a/content/copilot/concepts/agents/cloud-agent/about-automations.md +++ b/content/copilot/concepts/agents/cloud-agent/about-automations.md @@ -72,6 +72,8 @@ You can manually select the tools you want to enable, or you can use the **Sugge An {% data variables.copilot.copilot_automation %} can only take action in the single repository it is scoped to. +When an {% data variables.copilot.copilot_automation %} changes an issue, it can explain each change and rate its confidence, applying high-confidence changes automatically and proposing others for your review. See [AUTOTITLE](/copilot/concepts/agents/cloud-agent/about-automation-rationale-and-approvals). + ## Configuration inherited from the repository {% data variables.copilot.copilot_automations_cap %} use the {% data variables.copilot.copilot_cloud_agent %} configuration for the repository they are scoped to, including: diff --git a/content/copilot/concepts/agents/cloud-agent/index.md b/content/copilot/concepts/agents/cloud-agent/index.md index 31d462faa234..6b91b412a596 100644 --- a/content/copilot/concepts/agents/cloud-agent/index.md +++ b/content/copilot/concepts/agents/cloud-agent/index.md @@ -10,6 +10,7 @@ children: - /agent-management - /about-custom-agents - /about-automations + - /about-automation-rationale-and-approvals - /access-management - /mcp-and-cloud-agent - /risks-and-mitigations diff --git a/content/copilot/how-tos/use-copilot-agents/cloud-agent/index.md b/content/copilot/how-tos/use-copilot-agents/cloud-agent/index.md index 8109080a9283..e7cf6696d58c 100644 --- a/content/copilot/how-tos/use-copilot-agents/cloud-agent/index.md +++ b/content/copilot/how-tos/use-copilot-agents/cloud-agent/index.md @@ -8,6 +8,7 @@ versions: children: - /start-copilot-sessions - /create-automations + - /manage-rationale-confidence-approvals - /changing-the-ai-model - /configuring-agent-settings - /create-custom-agents-in-your-ide diff --git a/content/copilot/how-tos/use-copilot-agents/cloud-agent/manage-rationale-confidence-approvals.md b/content/copilot/how-tos/use-copilot-agents/cloud-agent/manage-rationale-confidence-approvals.md new file mode 100644 index 000000000000..ee5c24700f47 --- /dev/null +++ b/content/copilot/how-tos/use-copilot-agents/cloud-agent/manage-rationale-confidence-approvals.md @@ -0,0 +1,82 @@ +--- +title: Managing rationale, confidence, and approvals for issues +shortTitle: Manage rationale, confidence, and approvals +allowTitleToDifferFromFilename: true +intro: 'Set up and manage rationale, confidence, and approvals for issues handled by {% data variables.copilot.copilot_automation %}.' +product: '{% data reusables.gated-features.copilot-automations %}
Sign up for {% data variables.product.prodname_copilot_short %} {% octicon "link-external" height:16 %}' +versions: + feature: copilot +contentType: how-tos +category: + - Author and optimize with Copilot +--- + +Rationale and confidence need no extra configuration. When an {% data variables.copilot.copilot_automation %}'s agent changes a supported issue attribute, it attaches a rationale and a confidence level automatically. Whether that change applies directly or waits for review depends on your repository's automation level, or on an explicit request to suggest rather than apply the change. + +## Setting your repository's automation level + +> [!NOTE] +> Configuring an automation level is rolling out gradually and might not be available in your repository yet. + +Your repository's automation level sets the confidence threshold used to route every supported change. Changes rated below the threshold are held as suggestions; changes at or above it apply automatically. The default level is **Cautious**, so only high-confidence changes apply automatically until you change it. + +{% data reusables.repositories.navigate-to-repo %} +{% data reusables.repositories.sidebar-settings %} +1. In the "Planning" section of the sidebar, click **Agent suggestions for issues**. +1. Under "Automation level," select the level that fits your repository: + * **Full control**: Every change is held for review. Nothing is applied automatically. + * **Cautious** (default): Only high-confidence changes are applied automatically. Everything else is held for your review. + * **Balanced**: Routine, clear-cut changes are applied automatically. Anything with ambiguity is held for review. + * **Full automation**: Every change is applied automatically. The agent only holds a change back if it's flagged as uncertain. +1. Click **Save**. + +## With {% data variables.copilot.copilot_cloud_agent %} + +1. Create an {% data variables.copilot.copilot_automation %} that triages issues, following [AUTOTITLE](/copilot/how-tos/use-copilot-agents/cloud-agent/create-automations). Use the **When an issue is created** trigger, or run the {% data variables.copilot.copilot_automation %} on a schedule. +1. Grant the {% data variables.copilot.copilot_automation %} the issue tools for the attributes you want it to change, such as updating labels, setting the type, editing fields, assigning users, or closing issues. +1. In the prompt, describe the triage task, for example: `Triage this issue by setting a type, labels, and priority, and explain your reasoning for each.` You don't need to mention rationale, confidence, or suggestions explicitly. To hold specific changes for review regardless of confidence, ask the agent to suggest those changes rather than apply them. +1. Save the {% data variables.copilot.copilot_automation %}. When it runs, its changes carry a rationale and a confidence level. Changes below your repository's automation level, and any changes you asked the agent to suggest, wait in the approvals panel on the issue. + +## With {% data variables.copilot.github_agentic_workflows %} + +Issue intents, the rationale and confidence metadata attached to a workflow's issue changes, are optional and enabled by default. Existing workflows keep working without changes. + +1. Update to the latest version of the {% data variables.copilot.github_agentic_workflows %} extension by running `gh aw upgrade`. +1. Add a workflow that triages issues to your repository's `.github/workflows` directory. You can start from an issue triage sample or author your own. See the [{% data variables.copilot.github_agentic_workflows %}](https://gh.io/gh-aw) documentation. +1. Give the workflow the outputs for the attributes you want it to change by listing them under `safe-outputs` in the workflow's frontmatter. For example, `add-labels` to apply labels, `set-issue-type` to set the issue type, `set-issue-field` to edit fields, `assign-to-user` or `assign-to-agent` to assign issues, and `close-issue` to close them. Adding these outputs is enough for the workflow to make the corresponding issue changes with a rationale and confidence level. +1. Optionally, control whether a safe output requires issue intent metadata by setting `issue-intent` on it: + + ```yaml + safe-outputs: + add-labels: + issue-intent: true + ``` + + * Omit `issue-intent`, or leave it unset, to keep it optional: the agent is encouraged to provide a rationale and confidence level, but the output still works without them. + * Set `issue-intent: true` to require a rationale and confidence level for that output. The workflow fails if the agent omits them. + * Set `issue-intent: false` to opt out entirely: the output never carries rationale or confidence metadata. +1. In the workflow prompt, describe the triage task. To hold specific changes for review regardless of confidence, ask the agent to suggest those changes rather than apply them. +1. Compile the workflow by running `gh aw compile`, then commit the workflow file and its generated lock file. +1. When the workflow runs, its changes carry a rationale and a confidence level (unless you opted out). Changes below your repository's automation level, and any changes the agent suggested, wait in the approvals panel on the issue. + +## With the REST or GraphQL API + +If you build your own integration instead of using an {% data variables.copilot.copilot_automation %}, you can use the same issue-writing REST and GraphQL APIs to include a rationale and confidence level with a change, or mark a change as a suggestion to hold it for review. The change is routed the same way as a change from an {% data variables.copilot.copilot_automation %} or a {% data variables.copilot.github_agentic_workflows %} workflow: subject to your repository's automation level, or held for review if you marked it as a suggestion. + +## Finding issues with pending suggestions + +To find issues that have suggestions waiting for review, search using the `has:suggestions` qualifier, for example `is:issue is:open has:suggestions`. + +## Reviewing suggestions in the approvals panel + +When a change is held for review, it waits in an approvals panel on the issue instead of taking effect. Use the panel to inspect each suggestion and decide what to apply. + +1. Open the issue. Suggested changes appear in the approvals panel. +1. Inspect each suggestion. It shows the proposed change, such as a label, type, field, assignee, or close, along with the rationale and confidence level. +1. Act on the suggestions: + * Select **Accept** to apply a suggestion, or **Decline** to dismiss it. + * Select **Accept all** or **Decline all** to act on every pending suggestion at once. + +Accepted changes take effect on the issue immediately. Declined suggestions are dismissed without changing the issue. + +Ready to put this into practice? See [AUTOTITLE](/copilot/how-tos/use-copilot-agents/cloud-agent/create-automations) to create an {% data variables.copilot.copilot_automation %} that triages issues for you. diff --git a/content/organizations/managing-programmatic-access-to-your-organization/viewing-api-insights-in-your-organization.md b/content/organizations/managing-programmatic-access-to-your-organization/viewing-api-insights-in-your-organization.md index 234ed9bfcc49..79de87e08303 100644 --- a/content/organizations/managing-programmatic-access-to-your-organization/viewing-api-insights-in-your-organization.md +++ b/content/organizations/managing-programmatic-access-to-your-organization/viewing-api-insights-in-your-organization.md @@ -26,6 +26,8 @@ Organization owners can create custom organization roles to allow people to view The time period selection feature allows you to view API insights over predefined periods or a custom period, as detailed in the following table. By default, data is presented in Coordinated Universal Time (UTC). You can change the data displayed from UTC to your browser's time zone in the "Period" drop down menu at the top-right of the page. +Under normal conditions, you can expect API data to appear within 6 hours after making a request. During incidents or periods of unusually high volume, it may take longer. + {% rowheaders %} | Period | Description | diff --git a/data/reusables/advanced-security/purchase-ghas.md b/data/reusables/advanced-security/purchase-ghas.md index 44d93d641e35..0cc1427bc430 100644 --- a/data/reusables/advanced-security/purchase-ghas.md +++ b/data/reusables/advanced-security/purchase-ghas.md @@ -5,4 +5,4 @@ > [!TIP] > If you pay for {% data variables.product.github %} using volume/subscription billing, you will also need define how many licenses to purchase. -> * Under "How many committers do you want to include?", enter the number of committers you want to purchase licenses for. See [Active committers and unique committers](/billing/concepts/product-billing/github-advanced-security#active-committers-and-unique-committers). +> * Under "How many committers do you want to include?", enter the number of committers you want to purchase licenses for. See [Active committers and unique committers](/billing/concepts/product-billing/github-advanced-security#active-and-unique-committers). diff --git a/data/reusables/code-scanning/about-multiple-configurations-link.md b/data/reusables/code-scanning/about-multiple-configurations-link.md index 79fb867cbe8a..b6eb6b173694 100644 --- a/data/reusables/code-scanning/about-multiple-configurations-link.md +++ b/data/reusables/code-scanning/about-multiple-configurations-link.md @@ -1 +1 @@ -If you run code scanning using multiple configurations, an alert will sometimes have multiple analysis origins. If an alert has multiple analysis origins, you can view the status of the alert for each analysis origin on the alert page. For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alerts#about-analysis-origins). +If you run code scanning using multiple configurations, an alert will sometimes have multiple analysis origins. If an alert has multiple analysis origins, you can view the status of the alert for each analysis origin on the alert page. For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alerts#about-alerts-from-multiple-configurations). diff --git a/data/reusables/code-scanning/run-additional-queries.md b/data/reusables/code-scanning/run-additional-queries.md index bc1670915e2f..ff68cedf038d 100644 --- a/data/reusables/code-scanning/run-additional-queries.md +++ b/data/reusables/code-scanning/run-additional-queries.md @@ -3,7 +3,7 @@ When you use {% data variables.product.prodname_codeql %} to scan code, the {% d > [!TIP] > You can also specify the queries you want to exclude from analysis, or include in the analysis. This requires the use of a custom configuration file. For more information, see [Custom configuration files](#custom-configuration-files) and [Excluding specific queries from analysis](#excluding-specific-queries-from-analysis) below. -You can run extra queries if they are part of a {% data variables.product.prodname_codeql %} pack published to the {% data variables.product.company_short %} {% data variables.product.prodname_container_registry %} or a {% data variables.product.prodname_codeql %} pack stored in a repository. For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/codeql-code-scanning#about-codeql-queries). +You can run extra queries if they are part of a {% data variables.product.prodname_codeql %} pack published to the {% data variables.product.company_short %} {% data variables.product.prodname_container_registry %} or a {% data variables.product.prodname_codeql %} pack stored in a repository. For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/codeql-code-scanning#running-additional-queries). The options available to specify the additional queries you want to run are: diff --git a/data/reusables/dependabot/dependabot-ignore-dependencies.md b/data/reusables/dependabot/dependabot-ignore-dependencies.md index 9f9adfde0cf8..601d5d016061 100644 --- a/data/reusables/dependabot/dependabot-ignore-dependencies.md +++ b/data/reusables/dependabot/dependabot-ignore-dependencies.md @@ -1,4 +1,4 @@ If you want to ignore updates for the dependency, you must do one of the following. * Configure an `ignore` rule for the dependency in the `dependabot.yml` file. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependabot-options-reference#ignore--). -* Use the `@dependabot ignore` comment command for the dependency in the pull request for the grouped updates. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/manage-dependabot-prs#managing-dependabot-pull-requests-for-grouped-updates-with-comment-commands). +* Use the `@dependabot ignore` comment command for the dependency in the pull request for the grouped updates. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/manage-dependabot-prs#managing-dependabot-pull-requests-with-comment-commands). diff --git a/data/reusables/dependabot/dependabot-on-actions-troubleshooting-workflows.md b/data/reusables/dependabot/dependabot-on-actions-troubleshooting-workflows.md index 30d069e27b11..a7ba1347129c 100644 --- a/data/reusables/dependabot/dependabot-on-actions-troubleshooting-workflows.md +++ b/data/reusables/dependabot/dependabot-on-actions-troubleshooting-workflows.md @@ -5,5 +5,5 @@ By default, {% data variables.product.prodname_actions %} workflow runs that are There are three ways to resolve this problem: 1. You can update your workflows so that they are no longer triggered by {% data variables.product.prodname_dependabot %} using an expression like: `if: github.actor != 'dependabot[bot]'`. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/expressions). -1. You can modify your workflows to use a two-step process that includes `pull_request_target` which does not have these limitations. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions#restrictions-when-dependabot-triggers-events). +1. You can modify your workflows to use a two-step process that includes `pull_request_target` which does not have these limitations. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions). 1. You can provide workflows triggered by {% data variables.product.prodname_dependabot %} access to secrets and allow the `permissions` term to increase the default scope of the `GITHUB_TOKEN`. diff --git a/data/reusables/dependabot/ip-allow-list-dependabot.md b/data/reusables/dependabot/ip-allow-list-dependabot.md index a87d19e12e50..86460e8aafd9 100644 --- a/data/reusables/dependabot/ip-allow-list-dependabot.md +++ b/data/reusables/dependabot/ip-allow-list-dependabot.md @@ -1,6 +1,6 @@ {% data variables.product.prodname_dependabot %} is a first-party {% data variables.product.github %} App whose repository access is exempt from IP allow list restrictions. This means {% data variables.product.prodname_dependabot %} can read dependency files and create pull requests regardless of your IP allow list configuration. -If {% data variables.product.prodname_dependabot %} jobs running on {% data variables.product.prodname_actions %} runners need to reach external resources that require predictable IP addresses (for example, private package registries behind a firewall), you should set up a self-hosted runner or configure {% data variables.actions.hosted_runners %} with a static IP address range. See [AUTOTITLE](/actions/concepts/runners/self-hosted-runners) and [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-on-actions#enabling-or-disabling-dependabot-on-larger-runners). +If {% data variables.product.prodname_dependabot %} jobs running on {% data variables.product.prodname_actions %} runners need to reach external resources that require predictable IP addresses (for example, private package registries behind a firewall), you should set up a self-hosted runner or configure {% data variables.actions.hosted_runners %} with a static IP address range. See [AUTOTITLE](/actions/concepts/runners/self-hosted-runners) and [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-on-actions). Additionally, to learn more about configuring {% data variables.actions.hosted_runners %} with a static IP address range, see [AUTOTITLE](/actions/concepts/runners/larger-runners). diff --git a/data/reusables/security-overview/dependabot-filters-link.md b/data/reusables/security-overview/dependabot-filters-link.md index 54da8f73f6b5..9d27beb3aec7 100644 --- a/data/reusables/security-overview/dependabot-filters-link.md +++ b/data/reusables/security-overview/dependabot-filters-link.md @@ -1 +1 @@ -See [{% data variables.product.prodname_dependabot %} dashboard view filters](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview#dependabot-dashboard-view-filters). +See [{% data variables.product.prodname_dependabot %} dashboard view filters](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview). diff --git a/data/reusables/security/alert-assignee-mention.md b/data/reusables/security/alert-assignee-mention.md index 75ca6dfcbf55..f328cda164a2 100644 --- a/data/reusables/security/alert-assignee-mention.md +++ b/data/reusables/security/alert-assignee-mention.md @@ -1,5 +1,5 @@ {% ifversion code-secret-alert-assignees %} -In addition, you will receive a notification if someone assigns a {% data variables.product.prodname_code_scanning %} or a {% data variables.product.prodname_secret_scanning %} alert to you, see [Assigning alerts](/code-security/concepts/security-at-scale/about-security-campaigns#assigning-alerts). +In addition, you will receive a notification if someone assigns a {% data variables.product.prodname_code_scanning %} or a {% data variables.product.prodname_secret_scanning %} alert to you, see [Assigning alerts](/code-security/concepts/security-at-scale/about-security-campaigns#about-assigning-alerts-to-users-and-copilot-cloud-agent). {% endif %} diff --git a/data/reusables/security/alert-assignee-step.md b/data/reusables/security/alert-assignee-step.md index 3211ae0096c2..c9cedc2976f7 100644 --- a/data/reusables/security/alert-assignee-step.md +++ b/data/reusables/security/alert-assignee-step.md @@ -1,5 +1,5 @@ {% ifversion code-secret-alert-assignees %} -1. Optionally, assign the alert to someone to fix using the **Assignees** control shown on the right, see [Assigning alerts](/code-security/concepts/security-at-scale/about-security-campaigns#assigning-alerts). +1. Optionally, assign the alert to someone to fix using the **Assignees** control shown on the right, see [Assigning alerts](/code-security/concepts/security-at-scale/about-security-campaigns#about-assigning-alerts-to-users-and-copilot-cloud-agent). {% endif %}