Repo sync

Dockerfile

@@ -10,7 +10,7 @@
 # ---------------------------------------------------------------
 # To update the sha:
 # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble
-FROM ghcr.io/github/gh-base-image/gh-base-noble:20260720-202540-g0ac3959ef@sha256:48e1461c14c217a7dbaa9d08ccfe726772d356f40a070f8c6a34e37a8fcf2f18 AS base
+FROM ghcr.io/github/gh-base-image/gh-base-noble:20260722-151519-g000ce495e@sha256:f722b1fb6d02a18f85d45ab2e064a0736e64992f20371a063c4076bac57832c9 AS base
 
 # Install curl for Node install and determining the early access branch
 # Install git for cloning docs-early-access & translations repos

content/code-security/concepts/code-scanning/ai-powered-security-detections.md

@@ -50,7 +50,7 @@ Each finding includes a description of the security issue and an explanation of
 
 AI-powered security detections are designed to cover languages and frameworks that are not currently supported by {% data variables.product.prodname_codeql %}. This includes, but is not limited to, languages such as PHP, Shell/Bash, Terraform configuration (HCL), and Dockerfiles, as well as framework coverage gaps such as JSP for Java and Blazor for C#.
 
-For a full list of languages supported by {% data variables.product.prodname_codeql %}, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/about-code-scanning-with-codeql#supported-languages-and-frameworks).
+For a full list of languages supported by {% data variables.product.prodname_codeql %}, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/about-code-scanning-with-codeql).
 
 ## Detection categories
 

content/code-security/concepts/code-scanning/code-scanning-alerts.md

@@ -27,7 +27,7 @@ By default, {% data variables.product.prodname_code_scanning %} analyzes your co
 
 {% ifversion code-scanning-autofix %}
 
-You can use {% data variables.copilot.copilot_autofix %} to generate fixes automatically for {% data variables.product.prodname_code_scanning %} alerts, including {% data variables.product.prodname_codeql %} alerts. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#generating-suggested-fixes-for-code-scanning-alerts).
+You can use {% data variables.copilot.copilot_autofix %} to generate fixes automatically for {% data variables.product.prodname_code_scanning %} alerts, including {% data variables.product.prodname_codeql %} alerts. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#generating-a-suggested-fix).
 
 {% endif %}
 

content/code-security/concepts/code-scanning/codeql/codeql-workspaces.md

@@ -49,7 +49,7 @@ The workspace dependency model affects how packs are installed and published.
 * During installation, dependencies found in the workspace are not downloaded into the package cache and are not written to the `codeql-pack.lock.yml` file.
 * During publishing, dependencies provided by the workspace are bundled using their local source content rather than versions from the package cache.
 
-For example, running `codeql pack install` in a pack directory within a workspace uses any dependencies found in the workspace instead of downloading them into the package cache or recording them in the `codeql-pack.lock.yml` file. See [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs#adding-and-installing-dependencies).
+For example, running `codeql pack install` in a pack directory within a workspace uses any dependencies found in the workspace instead of downloading them into the package cache or recording them in the `codeql-pack.lock.yml` file. See [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs#adding-and-installing-dependencies-on-a-codeql-pack).
 
 ### Example
 
@@ -98,7 +98,7 @@ A {% data variables.product.prodname_codeql %} workspace is defined by a YAML fi
 
 * The `ignore` block contains a list of glob patterns that define {% data variables.product.prodname_codeql %} packs that are not available in the workspace.
 
-* The `registries` block contains a list of GHES URLs and package patterns that control which container registry is used for publishing {% data variables.product.prodname_codeql %} packs. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/publish-and-use-packs#working-with-codeql-packs-on-ghes).
+* The `registries` block contains a list of GHES URLs and package patterns that control which container registry is used for publishing {% data variables.product.prodname_codeql %} packs. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/publish-and-use-packs).
 
 Each entry in the `provide` or `ignore` section must map to the location of a `qlpack.yml` file. All glob patterns are defined relative to the directory that contains the workspace file. For a list of patterns accepted in this file, see [@actions/glob](https://github.com/actions/toolkit/tree/main/packages/glob#patterns).
 

content/code-security/concepts/code-scanning/codeql/query-packs.md

@@ -26,7 +26,7 @@ Each {% data variables.product.prodname_codeql %} pack requires a `qlpack.yml` f
 * Dependencies on other {% data variables.product.prodname_codeql %} packs and libraries
 * Query suite definitions
 
-For more information about `qlpack.yml` properties, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/customize-analysis#codeqlpack-yml-properties).
+For more information about `qlpack.yml` properties, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/customize-analysis).
 
 Additionally, a {% data variables.product.prodname_codeql %} pack can contain:
 

content/code-security/concepts/code-scanning/tool-status-page.md

@@ -60,7 +60,7 @@ In addition to the information listed above, the {% data variables.code-scanning
 
 ### Compiled languages
 
-The {% data variables.code-scanning.tool_status_page %} reports files present before running autobuild or manual build steps. Files generated during the build process are not shown. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#about-autobuild-for-codeql).
+The {% data variables.code-scanning.tool_status_page %} reports files present before running autobuild or manual build steps. Files generated during the build process are not shown. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#use-autobuild-for-codeql).
 
 ### Coverage calculation
 
@@ -72,7 +72,7 @@ Use file coverage percentages to debug and improve your analysis:
 
 * **High percentage**: {% data variables.product.prodname_code_scanning_caps %} is working as expected for that language
 * **Low percentage**: Investigate diagnostic output. See [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected)
-* **Zero percentage**: You may have code in languages not currently being analyzed. Update your setup to include these languages. See [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#changing-the-languages-that-are-analyzed)
+* **Zero percentage**: You may have code in languages not currently being analyzed. Update your setup to include these languages. See [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options)
 
 > [!NOTE]
 > If you set up both advanced setup and default setup, the {% data variables.code-scanning.tool_status_page %} only shows default setup.

content/code-security/concepts/secret-security/about-alerts.md

@@ -55,7 +55,7 @@ Push protection scans pushes for supported secrets. If push protection detects a
 > [!NOTE]
 > {% ifversion secret-scanning-push-protection-for-users %}You can also enable push protection for your personal account, called "push protection for users", which prevents you from accidentally pushing supported secrets to _any_ public repository. Alerts are _not_ created if you choose to bypass your user-based push protection only. Alerts are only created if the repository itself has push protection enabled. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-secrets/prevent-future-leaks/manage-user-push-protection).{% endif %}
 >
-> {% data reusables.secret-scanning.push-protection-older-tokens %} For more information about push protection limitations, see [AUTOTITLE](/code-security/reference/secret-security/secret-scanning-scope#push-protection-and-pattern-versions).
+> {% data reusables.secret-scanning.push-protection-older-tokens %} For more information about push protection limitations, see [AUTOTITLE](/code-security/reference/secret-security/secret-scanning-scope).
 
 {% ifversion fpt or ghec %}
 

content/code-security/concepts/secret-security/secret-scanning-for-partners.md

@@ -30,7 +30,7 @@ The reason partner alerts are directly sent to the secret providers whenever a l
 
 ## What are the supported secrets
 
-For information about the secrets and service providers supported by push protection, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets).
+For information about the secrets and service providers supported by push protection, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns).
 
 ## Further reading
 

content/code-security/concepts/secret-security/validity-checks.md

@@ -47,7 +47,7 @@ You can enable extended metadata checks if validity checks are enabled. Then, yo
 * **Enhance compliance**: Ensure secrets align with your organization’s governance and security policies.
 * **Reduce false positives**: Use additional context to determine if a detection requires action.
 
-The specific metadata available depends on what the service provider shares with {% data variables.product.github %}. Not all secret types support extended metadata checks. For more information, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#verifying-token-metadata).
+The specific metadata available depends on what the service provider shares with {% data variables.product.github %}. Not all secret types support extended metadata checks. For more information, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts).
 
 ## Getting started with validity and extended metadata checks
 

content/code-security/concepts/security-at-scale/security-overview.md

@@ -42,7 +42,7 @@ All organizations on {% data variables.product.prodname_enterprise %} can use:
 All organizations on {% data variables.product.prodname_enterprise %} can use {% data variables.product.prodname_dependabot %} data to evaluate the security of their supply chain in all repositories.
 {% endif %}
 
-In addition, data for **{% data variables.product.prodname_AS %}** features, such as {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, is shown for organizations and enterprises that use {% data variables.product.prodname_GHAS_cs_or_sp %}{% ifversion ghec %}, and for public repositories{% endif %}, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#dependabot-alerts-for-vulnerable-dependencies) and [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security).
+In addition, data for **{% data variables.product.prodname_AS %}** features, such as {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, is shown for organizations and enterprises that use {% data variables.product.prodname_GHAS_cs_or_sp %}{% ifversion ghec %}, and for public repositories{% endif %}, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts) and [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security).
 
 {% endif %}
 

content/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules.md

@@ -44,7 +44,7 @@ There are two types of {% data variables.dependabot.auto_triage_rules %}:
 * At worst, have limited effects like slow builds or long-running tests.
 * Are not indicative of issues in production.
 
-The rule is enabled by default for public repositories and can be opted into for private repositories. For instructions, see [Enabling the `Dismiss low impact issues for development-scoped dependencies` rule for your private repository](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/prioritize-with-preset-rules#enabling-the-dismiss-low-impact-issues-for-development-scoped-dependencies-rule-for-your-private-repository).
+The rule is enabled by default for public repositories and can be opted into for private repositories. For instructions, see [Enabling the `Dismiss low impact issues for development-scoped dependencies` rule for your private repository](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/prioritize-with-preset-rules#enabling-github-preset-rules).
 
 For more information about the criteria used by the rule, see [AUTOTITLE](/code-security/reference/supply-chain-security/criteria-for-preset-rules).
 
@@ -78,7 +78,7 @@ Additionally, auto-dismissed alerts are still available for reporting and review
 * If you change the scope of a dependency from development to production.
 * If {% data variables.product.company_short %} modifies certain metadata for the related advisory.
 
-Auto-dismissed alerts are defined by the `resolution:auto-dismiss` close reason. Automatic dismissal activity is included in alert webhooks, REST and GraphQL APIs, and the audit log. For more information, see [AUTOTITLE](/rest/dependabot/alerts), and the "`repository_vulnerability_alert`" section in [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#repository_vulnerability_alert-category-actions).
+Auto-dismissed alerts are defined by the `resolution:auto-dismiss` close reason. Automatic dismissal activity is included in alert webhooks, REST and GraphQL APIs, and the audit log. For more information, see [AUTOTITLE](/rest/dependabot/alerts), and the "`repository_vulnerability_alert`" section in [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization).
 
 ## Next steps
 

content/code-security/concepts/supply-chain-security/dependabot-security-updates.md

@@ -46,10 +46,10 @@ You can add a `dependabot.yml` configuration file to your repository to customiz
 
 {% data variables.product.prodname_dependabot %} checks whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then {% data variables.product.prodname_dependabot %} raises a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the {% data variables.product.prodname_dependabot %} alert, or reports an error on the alert. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors).
 
-The {% data variables.product.prodname_dependabot_security_updates %} feature is available for repositories where you have enabled the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. You will see a {% data variables.product.prodname_dependabot %} alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-graph#dependencies-included).
+The {% data variables.product.prodname_dependabot_security_updates %} feature is available for repositories where you have enabled the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. You will see a {% data variables.product.prodname_dependabot %} alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-graph).
 
 > [!NOTE]
-> For npm, {% data variables.product.prodname_dependabot %} will raise a pull request to update an explicitly defined dependency to a secure version, even if it means updating the parent dependency or dependencies, or even removing a sub-dependency that is no longer needed by the parent. For other ecosystems, {% data variables.product.prodname_dependabot %} is unable to update an indirect or transitive dependency if it would also require an update to the parent dependency. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors#dependabot-tries-to-update-dependencies-without-an-alert).
+> For npm, {% data variables.product.prodname_dependabot %} will raise a pull request to update an explicitly defined dependency to a secure version, even if it means updating the parent dependency or dependencies, or even removing a sub-dependency that is no longer needed by the parent. For other ecosystems, {% data variables.product.prodname_dependabot %} is unable to update an indirect or transitive dependency if it would also require an update to the parent dependency. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors#updates-dependencies-without-an-alert).
 
 You can enable a related feature, {% data variables.product.prodname_dependabot_version_updates %}, so that {% data variables.product.prodname_dependabot %} raises pull requests to update the manifest to the latest version of the dependency, whenever it detects an outdated dependency. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-version-updates).
 
@@ -70,7 +70,7 @@ For security updates, {% data variables.product.prodname_dependabot %} will only
 {% data reusables.dependabot.dependabot-grouped-security-updates-how-enable %}
 {% data reusables.dependabot.dependabot-grouped-security-updates-order %}
 
- For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates#grouping-into-a-single-pull-request).
+ For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates#grouping-dependabot-security-updates-into-a-single-pull-request).
 
 {% ifversion fpt or ghec %}
 
@@ -86,4 +86,4 @@ For security updates, {% data variables.product.prodname_dependabot %} will only
 
 ## About notifications for {% data variables.product.prodname_dependabot %} security updates
 
-You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot %} security updates. For more information, see [AUTOTITLE](/subscriptions-and-notifications/reference/inbox-filters#custom-filters).
+You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot %} security updates. For more information, see [AUTOTITLE](/subscriptions-and-notifications/reference/inbox-filters).

content/code-security/concepts/supply-chain-security/dependency-review.md

@@ -29,7 +29,7 @@ Sometimes you might just want to update the version of one dependency in a manif
 
 By checking the dependency reviews in a pull request, and changing any dependencies that are flagged as vulnerable, you can avoid vulnerabilities being added to your project. For more information about how dependency review works, see [AUTOTITLE](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request).
 
-{% data variables.product.prodname_dependabot_alerts %} will find vulnerabilities that are already in your dependencies, but it's much better to avoid introducing potential problems than to fix problems at a later date. For more information about {% data variables.product.prodname_dependabot_alerts %}, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#dependabot-alerts-for-vulnerable-dependencies).
+{% data variables.product.prodname_dependabot_alerts %} will find vulnerabilities that are already in your dependencies, but it's much better to avoid introducing potential problems than to fix problems at a later date. For more information about {% data variables.product.prodname_dependabot_alerts %}, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts).
 
 Dependency review supports the same languages and package management ecosystems as the dependency graph. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems#supported-package-ecosystems).