diff --git a/.github/workflows/check-for-spammy-prs.yml b/.github/workflows/check-for-spammy-prs.yml index f10202bf7204..29e081ff2c61 100644 --- a/.github/workflows/check-for-spammy-prs.yml +++ b/.github/workflows/check-for-spammy-prs.yml @@ -39,9 +39,10 @@ jobs: const touchesTooMany = files.length > 10 const totalChanges = files.reduce((sum, f) => sum + f.additions + f.deletions, 0) const isOneLineAddition = files.every(f => f.status === 'added') && totalChanges <= 1 + const isBlankLineEdit = totalChanges <= 1 && files.every(f => f.status === 'modified') // Close the PR and add the invalid label - if (onlyDeletes || isEmptyCommit || touchesTooMany || isOneLineAddition) { + if (onlyDeletes || isEmptyCommit || touchesTooMany || isOneLineAddition || isBlankLineEdit) { await github.rest.issues.update({ owner: owner, repo: repo, diff --git a/.github/workflows/triage-unallowed-contributions.yml b/.github/workflows/triage-unallowed-contributions.yml index a11d3277e2e0..13a2309ae208 100644 --- a/.github/workflows/triage-unallowed-contributions.yml +++ b/.github/workflows/triage-unallowed-contributions.yml @@ -54,4 +54,4 @@ jobs: FILE_PATHS_NOT_ALLOWED: ${{ steps.filter.outputs.notAllowed_files }} CHANGED_FILE_PATHS: ${{ steps.filter.outputs.contentTypes_files }} ADDED_CONTENT_FILES: ${{ steps.filter.outputs.added_files }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }} diff --git a/content/actions/how-tos/troubleshoot-workflows.md b/content/actions/how-tos/troubleshoot-workflows.md index 3fb23545f104..09c7c72576f8 100644 --- a/content/actions/how-tos/troubleshoot-workflows.md +++ b/content/actions/how-tos/troubleshoot-workflows.md @@ -97,7 +97,7 @@ Specific events allow for filtering by branch, tag, and/or paths you can customi You can use special characters with filters. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#filter-pattern-cheat-sheet). -For path filtering, evaluating diffs is limited to the first 300 files. If there are files changed that are not matched in the first 300 files returned by the filter, the workflow will not be run. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#git-diff-comparisons). +For path filtering, evaluating diffs is limited to the first {% ifversion actions-paths-filter-limit %}3,000{% else %}300{% endif %} files. If there are files changed that are not matched in the first {% ifversion actions-paths-filter-limit %}3,000{% else %}300{% endif %} files returned by the filter, the workflow will not be run. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#git-diff-comparisons). ## Troubleshoot workflow execution diff --git a/content/billing/concepts/budgets-and-alerts.md b/content/billing/concepts/budgets-and-alerts.md index fa69bf1e789c..0f2210296cd0 100644 --- a/content/billing/concepts/budgets-and-alerts.md +++ b/content/billing/concepts/budgets-and-alerts.md @@ -28,7 +28,7 @@ Each budget has a type and a scope that define which paid use contributes to spe * **Universal**: applies to all licensed users by default * **Cost center user-level**: applies to every user in a cost center - * **Individual**: overrides the above for specific users + * **Individual**: overrides the above for specific users, and can be given an optional expiration date so a temporary override is removed automatically For {% data variables.product.prodname_copilot_short %}, cost centers can also have included usage controls, which cap how much of the shared {% data variables.product.prodname_ai_credits_short %} pool a cost center can use before metered usage begins. This is a separate control from the budgets and the included usage alerts described below. See [AUTOTITLE](/copilot/concepts/billing/budgets-for-usage-based-billing#included-usage-controls-for-cost-centers). diff --git a/content/billing/how-tos/set-up-budgets.md b/content/billing/how-tos/set-up-budgets.md index b157779e5555..114d9a6f22f7 100644 --- a/content/billing/how-tos/set-up-budgets.md +++ b/content/billing/how-tos/set-up-budgets.md @@ -120,6 +120,14 @@ As the owner of an enterprise or organization account, or as a billing manager, * Select a cost center to create a user-level budget that applies to every user in that cost center. This sets one per-user amount for all current and future members, and overrides the universal budget for them. * Select a specific user to create an individual budget that overrides both the universal budget and any cost center user-level budget for that user. +1. If you selected a specific user, optionally set an expiration date for the individual budget under "Expiration". + + * **No expiration**: The budget applies until you edit or delete it. This is the default. + * **End of current billing cycle**: {% data variables.product.github %} removes the budget when the current billing cycle ends. + * **Specific date**: {% data variables.product.github %} removes the budget on the date you choose. + + When an individual budget expires, {% data variables.product.github %} removes it and the user falls back to the next budget that applies to them: their cost center user-level budget, if they have one, or otherwise the universal user-level budget. If neither budget is configured, no user-level budget applies. See [AUTOTITLE](/copilot/concepts/billing/budgets-for-usage-based-billing#expiration-dates-for-individual-user-level-budgets). + 1. Under "Budget", set a budget amount or license count. To stop any usage and further spending once the budget limit is reached, select **Stop usage when budget limit is reached** or **Limit usage when budget limit is reached**, if available. **This option is available for metered products and for {% data variables.product.prodname_AS %} SKU-level budgets**. For {% data variables.product.prodname_AS %}, this option prevents new enablement on additional repositories. It doesn't disable {% data variables.product.prodname_AS %} on repositories where it is already active. See [AUTOTITLE](/billing/concepts/product-billing/github-advanced-security#hard-budgets-for-github-advanced-security-skus). @@ -145,6 +153,8 @@ As the owner of an enterprise or organization account, or as a billing manager, You can edit or delete a budget at any time, but you cannot change the scope of a budget after creating it. +For an individual user-level budget, you can also change or clear the expiration date at any time. + 1. Navigate to the "Budgets and alerts" view. See [Viewing budgets](#viewing-budgets). 1. In the list of budgets, click {% octicon "kebab-horizontal" aria-label="View actions" %} next to the budget you want to edit, and click **{% octicon "pencil" aria-hidden="true" aria-label="pencil" %} Edit** or **{% octicon "trash" aria-hidden="true" aria-label="trash" %} Delete**. 1. Follow the prompts. diff --git a/content/copilot/concepts/agents/code-review.md b/content/copilot/concepts/agents/code-review.md index 81388488fe0e..750dc2a4af6d 100644 --- a/content/copilot/concepts/agents/code-review.md +++ b/content/copilot/concepts/agents/code-review.md @@ -64,18 +64,6 @@ In repositories where automatic code review is enabled, {% data variables.produc {% data variables.copilot.copilot_code-review_short %} for users without a license is not available in IDEs. -## Excluded files - -Some file types are excluded from {% data variables.copilot.copilot_code-review_short %}: - -* Dependency management files, such as package.json and Gemfile.lock -* Log files -* SVG files - -If you include these file types in a pull request, {% data variables.copilot.copilot_code-review_short %} will not review the file. - -For more information, see [AUTOTITLE](/copilot/reference/review-excluded-files). - ## Agentic capabilities for {% data variables.copilot.copilot_code-review_short %} {% data variables.copilot.copilot_code-review_short %} utilizes agentic capabilities to extend its functionality. @@ -102,26 +90,13 @@ For more information on configuring runners, see [AUTOTITLE](/copilot/how-tos/co You can view the {% data variables.product.prodname_actions %} minutes associated with {% data variables.copilot.copilot_code-review_short %} runs. For more information, see [{% data variables.product.prodname_actions %} minutes for code review](/copilot/reference/copilot-billing/models-and-pricing#pricing-and-usage-cost-considerations-for-copilot-code-review). -## Review effort level - -{% data variables.copilot.copilot_code-review_short %} supports multiple review effort levels, so you can choose the level of thoroughness that matches the criticality of your code. - -* **Lite**: Standard review. Provides fast, targeted feedback on common issues such as bugs, security vulnerabilities, and style inconsistencies (default). -* **Balanced**: Routes pull requests to a higher-reasoning model for longer analysis of complex logic, security-sensitive code, and cross-service changes. Balanced reviews use more {% data variables.product.prodname_ai_credits_short %}, and may consume marginally more {% data variables.product.prodname_actions %} minutes, than Lite reviews. - -Use Balanced for security-sensitive code, multi-service pull requests, or repositories with strict quality standards. Use Lite for routine changes where fast feedback is more important than exhaustive analysis. - -You can select the review effort level when requesting a review in the pull request, under the **Reviewers** section where {% data variables.product.prodname_copilot_short %} appears as a reviewer. Organization owners can set a default review effort level for automatic code reviews in their organization. Repository administrators can override the organization default for a specific repository. - -After {% data variables.copilot.copilot_code-review_short %} reviews a pull request, the pull request overview comment shows the effort level used for each review run. - ### Estimated consumption A review typically consumes an estimated $0.05 USD to $1 USD worth of {% data variables.product.prodname_ai_credits_short %} with "Lite" effort, and $0.25 USD to $5 USD worth of {% data variables.product.prodname_ai_credits_short %} with "Balanced" effort. Consumption generally increases with pull request size and repository custom instructions, and the ranges may change as models evolve. These estimates do not include {% data variables.product.prodname_actions %} minutes. -Repository and organization administrators can set the default review effort level for automatic code reviews. For configuration steps, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review#configuring-review-effort-level-for-an-organization). +Repository and organization administrators can set the default review effort level for automatic code reviews. For configuration steps, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review#customizing-copilot-code-review-1). ## Code review usage @@ -154,6 +129,56 @@ When {% data variables.copilot.copilot_code-review_short %} is enabled for these {% data reusables.copilot.ccr-model-settings %} +## Automatic pull request reviews + +By default, {% data variables.product.prodname_copilot_short %} only reviews a pull request if you assign it to the pull request. However, you can configure automatic reviews. + +* **Individual users** on the {% data variables.copilot.copilot_pro_short %} or {% data variables.copilot.copilot_pro_plus_short %} plan can configure {% data variables.product.prodname_copilot_short %} to automatically review all pull requests they create. +* **Repository owners** can configure {% data variables.product.prodname_copilot_short %} to automatically review all pull requests in the repository that are created by people with access to {% data variables.product.prodname_copilot_short %}. +* **Organization owners** can configure {% data variables.product.prodname_copilot_short %} to automatically review all pull requests in some or all of the repositories in the organization where the pull request is created by a {% data variables.product.prodname_copilot_short %} user. + +If your organization has enabled {% data variables.copilot.copilot_code-review_short %} without a {% data variables.product.prodname_copilot_short %} license, automatic reviews also apply to pull requests created by organization members without a license. This applies to repositories covered by a policy where automatic reviews are enabled. For more information, see [{% data variables.copilot.copilot_code-review_short %} without a {% data variables.product.prodname_copilot_short %} license](#copilot-code-review-without-a-copilot-license). + + +### Triggering an automatic pull request review + +The triggers for automatic code review depend on the configuration settings. + +* Basic setting: + * When you create a pull request as an "Open" pull request. + * The first time you switch a "Draft" pull request to "Open". +* Review new pushes: + * Every time you push a new commit to the pull request. +* Review draft pull requests: + * Pull requests are automatically reviewed while they are still drafts, before you switch them to "Open". + +For full instructions, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review). + +> [!NOTE] +> Unless {% data variables.product.prodname_copilot_short %} has been configured to review each push to a pull request, it will only review a pull request once. If you make changes to the pull request after it has been automatically reviewed and you want {% data variables.product.prodname_copilot_short %} to re-review it, you can request this manually. Click the {% octicon "sync" aria-label="Re-request review" %} button next to {% data variables.product.prodname_copilot_short %}'s name in the **Reviewers** menu. + +## Review effort level + +{% data variables.copilot.copilot_code-review_short %} supports multiple review effort levels, so you can choose the level of thoroughness that matches the criticality of your code. + +* **Lite**: Standard review. Provides fast, targeted feedback on common issues such as bugs, security vulnerabilities, and style inconsistencies (default). +* **Balanced**: Routes pull requests to a higher-reasoning model for longer analysis of complex logic, security-sensitive code, and cross-service changes. Balanced reviews use more {% data variables.product.prodname_ai_credits_short %}, and may consume marginally more {% data variables.product.prodname_actions %} minutes, than Lite reviews. + +Use Balanced for security-sensitive code, multi-service pull requests, or repositories with strict quality standards. Use Lite for routine changes where fast feedback is more important than exhaustive analysis. + +You can select the review effort level when requesting a review in the pull request, under the **Reviewers** section where {% data variables.product.prodname_copilot_short %} appears as a reviewer. Organization owners can set a default review effort level for automatic code reviews in their organization. Repository administrators can override the organization default for a specific repository. + +After {% data variables.copilot.copilot_code-review_short %} reviews a pull request, the pull request overview comment shows the effort level used for each review run. + +## {% data variables.product.prodname_copilot_short %} approvals + +> [!NOTE] +> {% data reusables.copilot.automatic-approvals-public-preview %} + +Every {% data variables.copilot.copilot_code-review_short %} includes an approval assessment in the overview comment, indicating whether {% data variables.product.prodname_copilot_short %} has determined the pull request ready to approve after reviewing it. By default, {% data variables.product.prodname_copilot_short %}'s reviews do not count toward required approvals for the pull request. + +When {% data variables.product.prodname_copilot_short %} approvals are enabled in repository, organization, and enterprise settings, {% data variables.product.prodname_copilot_short %} can submit an approving review that satisfies your repository's required-approval rule the same way a teammate's approval would. If new commits are pushed after {% data variables.product.prodname_copilot_short %} approves, the approval is dismissed, and you can re-request a review. + ## MCP servers and agent skills for code review {% data variables.copilot.copilot_code-review_short %} can use repository-level agent skills and MCP servers when they are relevant to the review. @@ -178,11 +203,17 @@ You can configure MCP servers in your repository settings. Repository MCP config {% data reusables.copilot.code-review.mcp-tools-setting %} -## Validating {% data variables.product.prodname_copilot_short %} code reviews +## Excluded files -{% data variables.product.prodname_copilot_short %} is not guaranteed to spot all problems or issues in a pull request. Sometimes it will make mistakes. Always validate {% data variables.product.prodname_copilot_short %}'s feedback carefully. Supplement {% data variables.product.prodname_copilot_short %}'s feedback with a human review. +Some file types are excluded from {% data variables.copilot.copilot_code-review_short %}: -For more information, see [AUTOTITLE](/copilot/responsible-use/agents). +* Dependency management files, such as package.json and Gemfile.lock +* Log files +* SVG files + +If you include these file types in a pull request, {% data variables.copilot.copilot_code-review_short %} will not review the file. + +For more information, see [AUTOTITLE](/copilot/reference/review-excluded-files). ## Enhancing {% data variables.product.prodname_copilot_short %}'s knowledge of a repository @@ -211,34 +242,6 @@ For more information, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/customi If you have a {% data variables.copilot.copilot_pro_short %}, {% data variables.copilot.copilot_pro_plus_short %}, or {% data variables.copilot.copilot_max_short %} plan, you can enable {% data variables.copilot.copilot_memory %}. This allows {% data variables.product.prodname_copilot_short %} to store useful details it has learned about a repository. {% data variables.product.prodname_copilot_short %} can then use this information when it reviews pull requests in that repository. For more information, see [AUTOTITLE](/copilot/concepts/agents/copilot-memory). -## About automatic pull request reviews - -By default, {% data variables.product.prodname_copilot_short %} only reviews a pull request if you assign it to the pull request. However, you can configure automatic reviews. - -* **Individual users** on the {% data variables.copilot.copilot_pro_short %} or {% data variables.copilot.copilot_pro_plus_short %} plan can configure {% data variables.product.prodname_copilot_short %} to automatically review all pull requests they create. -* **Repository owners** can configure {% data variables.product.prodname_copilot_short %} to automatically review all pull requests in the repository that are created by people with access to {% data variables.product.prodname_copilot_short %}. -* **Organization owners** can configure {% data variables.product.prodname_copilot_short %} to automatically review all pull requests in some or all of the repositories in the organization where the pull request is created by a {% data variables.product.prodname_copilot_short %} user. - -If your organization has enabled {% data variables.copilot.copilot_code-review_short %} without a {% data variables.product.prodname_copilot_short %} license, automatic reviews also apply to pull requests created by organization members without a license. This applies to repositories covered by a policy where automatic reviews are enabled. For more information, see [{% data variables.copilot.copilot_code-review_short %} without a {% data variables.product.prodname_copilot_short %} license](#copilot-code-review-without-a-copilot-license). - - -### Triggering an automatic pull request review - -The triggers for automatic code review depend on the configuration settings. - -* Basic setting: - * When you create a pull request as an "Open" pull request. - * The first time you switch a "Draft" pull request to "Open". -* Review new pushes: - * Every time you push a new commit to the pull request. -* Review draft pull requests: - * Pull requests are automatically reviewed while they are still drafts, before you switch them to "Open". - -For full instructions, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review). - -> [!NOTE] -> Unless {% data variables.product.prodname_copilot_short %} has been configured to review each push to a pull request, it will only review a pull request once. If you make changes to the pull request after it has been automatically reviewed and you want {% data variables.product.prodname_copilot_short %} to re-review it, you can request this manually. Click the {% octicon "sync" aria-label="Re-request review" %} button next to {% data variables.product.prodname_copilot_short %}'s name in the **Reviewers** menu. - ## Getting detailed code quality feedback across your repository {% data variables.copilot.copilot_code-review %} reviews the changes in a pull request and suggests fixes. To add systematic feedback on the reliability and maintainability of your code, on pull requests and across your default branch, enable {% data variables.product.prodname_code_quality %}. @@ -252,6 +255,13 @@ For full instructions, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up For more information, see [AUTOTITLE](/code-security/concepts/code-quality/code-quality). -## Further reading +## Validating {% data variables.product.prodname_copilot_short %} code reviews + +{% data variables.product.prodname_copilot_short %} is not guaranteed to spot all problems or issues in a pull request. Sometimes it will make mistakes. Always validate {% data variables.product.prodname_copilot_short %}'s feedback carefully. Supplement {% data variables.product.prodname_copilot_short %}'s feedback with a human review. + +For more information, see [AUTOTITLE](/copilot/responsible-use/agents). + +## Next steps * [AUTOTITLE](/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review) +* [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review) diff --git a/content/copilot/concepts/billing/budgets-for-usage-based-billing.md b/content/copilot/concepts/billing/budgets-for-usage-based-billing.md index 010ebbb8fe20..5a36d0d304cc 100644 --- a/content/copilot/concepts/billing/budgets-for-usage-based-billing.md +++ b/content/copilot/concepts/billing/budgets-for-usage-based-billing.md @@ -29,6 +29,22 @@ There are three types, listed from the broadest scope to the most specific: When more than one type applies to a user, the most specific budget wins: an individual user-level budget takes precedence over a cost center user-level budget, which takes precedence over the universal user-level budget. +#### Expiration dates for individual user-level budgets + +You can set an optional expiration date on an individual user-level budget, so a temporary override cleans itself up instead of requiring you to remember to remove it. This is useful when you raise a user's limit for a single sprint, an incident, or a short-term project. + +You can choose one of the following: + +* **No expiration**, which is the default and means the budget applies until you edit or delete it. +* **Expiration at the end of the current billing cycle.** +* **Expiration on a specific date.** + +At the end of the expiration period, {% data variables.product.github %} removes the individual budget. The user then falls back to their cost center user-level budget, if they have one, or otherwise to the universal user-level budget. If no broader budget applies, the user has no remaining user-level budget. + +You can change or clear an expiration date at any time. Expiration is only available for individual user-level budgets, not for universal or cost center user-level budgets. + +To set an expiration date, see [AUTOTITLE](/billing/how-tos/set-up-budgets#creating-a-budget). You can also set an expiration date with the REST API by using the `expires_at` field when creating or updating a budget. See [AUTOTITLE](/rest/billing/budgets). + #### When users appear in a universal user-level budget A universal user-level budget can apply to thousands of licensed users. {% data variables.product.github %} creates each user's budget record the first time they consume {% data variables.product.prodname_ai_credits_short %} after the budget is created, or after the start of a new billing cycle. As a result, users appear in the universal budget list gradually rather than all at once, and a licensed user who does not use {% data variables.product.prodname_copilot_short %} in a given billing cycle will not appear in the list for that billing cycle. diff --git a/content/copilot/get-started/plans.md b/content/copilot/get-started/plans.md index 05d15f924def..979ea1024c86 100644 --- a/content/copilot/get-started/plans.md +++ b/content/copilot/get-started/plans.md @@ -121,7 +121,7 @@ On {% data variables.copilot.copilot_free_short %} and {% data variables.copilot | Available models | {% data variables.copilot.copilot_pro_short %} | {% data variables.copilot.copilot_pro_plus_short %} | {% data variables.copilot.copilot_max_short %} | |---------------------------------------------------------|-------------------------------------------------|-----------------------------------------------------|------------------------------------------------| | {% for model in tables.copilot.model-supported-plans %} | -| {{ model.name }}{% if model.name == 'GPT-5.4 nano' %}[^gpt54nano]{% endif %}{% if model.name == 'Claude Fable 5' %}[^claude-fable-5]{% endif %} | {% if model.pro == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.pro_plus == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.max == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | +| {{ model.name }}{% if model.name == 'GPT-5.4 nano' %}[^gpt54nano]{% endif %}{% if model.name == 'Claude Fable 5' or model.name == 'Claude Fable 5.1' %}[^claude-fable-5]{% endif %} | {% if model.pro == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.pro_plus == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.max == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | | {% endfor %} | {% endrowheaders %} @@ -216,7 +216,7 @@ For a full explanation of how {% data variables.product.prodname_ai_credits_shor | Available models | {% data variables.copilot.copilot_business_short %} | {% data variables.copilot.copilot_enterprise_short %} | |---------------------------------------------------------|-----------------------------------------------------|-------------------------------------------------------| | {% for model in tables.copilot.model-supported-plans %} | -| {{ model.name }}{% if model.name == 'GPT-5.4 nano' %}[^gpt54nano]{% endif %}{% if model.name == 'Claude Fable 5' %}[^claude-fable-5]{% endif %} | {% if model.business == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.enterprise == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | +| {{ model.name }}{% if model.name == 'GPT-5.4 nano' %}[^gpt54nano]{% endif %}{% if model.name == 'Claude Fable 5' or model.name == 'Claude Fable 5.1' %}[^claude-fable-5]{% endif %} | {% if model.business == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.enterprise == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | | {% endfor %} | {% endrowheaders %} @@ -274,4 +274,4 @@ For a full explanation of how {% data variables.product.prodname_ai_credits_shor * To compare models supported across plans, features, and IDEs, see [AUTOTITLE](/copilot/reference/ai-models/supported-models). [^1]: {% data variables.copilot.copilot_chat_short %} skills in IDEs is available in {% data variables.product.prodname_vscode %} and {% data variables.product.prodname_vs %}. -[^claude-fable-5]: When {% data variables.copilot.copilot_claude_fable_5 %} is used, Anthropic retains data, including prompts and outputs, to operate safety classifiers that detect harmful use. Other Claude models in {% data variables.product.prodname_copilot %} remain covered by {% data variables.product.github %}'s existing data retention agreements, as documented at [AUTOTITLE](/copilot/reference/ai-models/model-hosting#anthropic-models). Enterprise and business users need to enable the {% data variables.copilot.copilot_claude_fable_5 %} model to make it available for your organization. You can read more about Anthropic's data handling practices for this model under section F of their [Service Specific Terms](https://www.anthropic.com/legal/service-specific-terms). To enable {% data variables.copilot.copilot_claude_fable_5 %}, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-access-to-ai-models). +[^claude-fable-5]: When {% data variables.copilot.copilot_claude_fable_5 %} or {% data variables.copilot.copilot_claude_fable_51 %} is used, Anthropic retains data, including prompts and outputs, by default to operate safety classifiers that detect harmful use. Customers can request to use {% data variables.copilot.copilot_claude_fable_5 %} or {% data variables.copilot.copilot_claude_fable_51 %} with zero data retention (ZDR) through the end of 2026 under a time-bound exemption while Anthropic rolls out Enterprise Frontier Safeguards (EFS). After that point, continued use of these models would require EFS, which will enable eligible customers to keep their data under their own control while also enabling automated safety monitoring. For an enterprise that has been approved and configured for this type of access, {% data variables.copilot.copilot_claude_fable_5 %} and {% data variables.copilot.copilot_claude_fable_51 %} requests will use the ZDR endpoint through the end of 2026 when the models are enabled. To learn whether your enterprise is eligible and request access, contact your {% data variables.product.github %} account team. Approval for access does not automatically enable {% data variables.copilot.copilot_claude_fable_5 %} or {% data variables.copilot.copilot_claude_fable_51 %}. An enterprise or organization administrator must still enable each model before users can access it. Other Claude models, except for {% data variables.copilot.copilot_claude_fable_5 %} and {% data variables.copilot.copilot_claude_fable_51 %}, continue to operate under ZDR. Customers who enable a Fable model with ZDR agree to use this model only for internal operations, including to develop and evaluate products for their own customers. They may not make the model endpoints or outputs available externally. To enable these models, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-access-to-ai-models). diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/enable-copilot-code-review.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/enable-copilot-code-review.md index 6b98c5b28450..eb80fe054285 100644 --- a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/enable-copilot-code-review.md +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/enable-copilot-code-review.md @@ -24,6 +24,7 @@ The policy for {% data variables.copilot.copilot_code-review_short %} allows you {% data reusables.enterprise-accounts.ai-controls-tab %} 1. Scroll down to "Available Agents", then click **{% data variables.copilot.copilot_code-review_short %}**. 1. Next to "{% data variables.copilot.copilot_code-review_short %}", select a policy. +1. Then choose which {% data variables.copilot.copilot_code-review_short %} features to enable for your enterprise. {% data reusables.enterprise-accounts.policy-enablement-next-steps %} diff --git a/content/copilot/how-tos/copilot-cli/use-copilot-cli/voice-input.md b/content/copilot/how-tos/copilot-cli/use-copilot-cli/voice-input.md index 4008af1663e3..2906a434e7dd 100644 --- a/content/copilot/how-tos/copilot-cli/use-copilot-cli/voice-input.md +++ b/content/copilot/how-tos/copilot-cli/use-copilot-cli/voice-input.md @@ -59,6 +59,10 @@ There are two ways to dictate prompts. Rather than holding down the space bar, you can toggle voice recording on and off. This is more convenient for longer prompts. 1. Press Ctrl+X followed by V to start recording. + + > [!NOTE] + > In some terminals, you can use Ctrl+Space as an alternative. This shortcut only works if your terminal and OS pass it through. You may also need to free it in your terminal or OS key bindings. + 1. Speak your prompt. 1. Press any key to stop recording and insert the transcription. @@ -85,7 +89,7 @@ If you have more than one microphone available on your system, you can switch in A list of available input devices is shown. 1. Use the arrow keys on your keyboard to select the microphone you want to use, then press Enter. - + ## Switching voice models You can dictate prompts in English or Spanish, but the appropriate voice model must be downloaded and activated for the language you want to use. diff --git a/content/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review.md b/content/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review.md deleted file mode 100644 index 44423b6400e5..000000000000 --- a/content/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Configuring automatic code review by GitHub Copilot -shortTitle: Configure automatic review -allowTitleToDifferFromFilename: true -intro: 'Set up {% data variables.product.prodname_copilot_short %} to automatically review pull requests for you, a repository, or an organization.' -versions: - feature: copilot -redirect_from: - - /copilot/using-github-copilot/code-review/configuring-automatic-code-review-by-copilot - - /copilot/how-tos/agents/copilot-code-review/configuring-automatic-code-review-by-copilot - - /copilot/how-tos/agents/copilot-code-review/automatic-code-review - - /copilot/how-tos/agents/copilot-code-review/configure-automatic-review - - /copilot/how-tos/agents/request-a-code-review/configure-automatic-review - - /copilot/how-tos/use-copilot-agents/request-a-code-review/configure-automatic-review -contentType: how-tos -category: - - Configure Copilot ---- - -## Introduction - -You can configure {% data variables.copilot.copilot_code-review_short %} to review pull requests automatically. For an overview of automatic pull request reviews, see [AUTOTITLE](/copilot/concepts/agents/code-review#about-automatic-pull-request-reviews). - -## Configuring automatic code review for your own pull requests - -> [!NOTE] -> This is only available if you are on the {% data variables.copilot.copilot_pro_short %}, {% data variables.copilot.copilot_pro_plus_short %}, or {% data variables.copilot.copilot_max_short %} plans. - -{% data reusables.copilot.your-copilot %} -1. Locate the **Automatic {% data variables.copilot.copilot_code-review_short %}** option and click the dropdown button. - - ![Screenshot of the "Automatic {% data variables.copilot.copilot_code-review_short %}" setting with the dropdown menu displayed.](/assets/images/help/copilot/code-review/automatic-code-review-personal.png) - -1. In the dropdown menu, select **Enabled**. - -## Configuring automatic code review for a single repository - -{% data reusables.repositories.navigate-to-repo %} -{% data reusables.repositories.sidebar-settings %} -{% data reusables.repositories.repo-rulesets-settings %} -{% data reusables.repositories.repo-new-ruleset %} -1. Under "Target branches," click **Add target** and choose one of the options—for example, **Include default branch** or **Include all branches**. -{% data reusables.copilot.auto-code-review-steps %} - -## Configuring automatic code review for repositories in an organization - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -{% data reusables.organizations.access-ruleset-settings %} -{% data reusables.repositories.repo-new-ruleset %} -1. Under "Target repositories," click **Add target** and choose either **Include by pattern** or **Exclude by pattern**. -1. Type a pattern that matches the repository names you want to target—for example, `*feature` to match all repositories with names ending in `feature`. - - For pattern-matching syntax, see [AUTOTITLE](/organizations/managing-organization-settings/creating-rulesets-for-repositories-in-your-organization#using-fnmatch-syntax). - -1. Click **Add inclusion pattern** or **Add exclusion pattern**. -1. Repeat for any additional patterns. - - > [!NOTE] - > You can add multiple targeting criteria to the same ruleset. Exclusion patterns are applied after inclusion patterns. For example, you could include any repositories matching the pattern `*cat*`, and specifically exclude a repository matching the pattern `not-a-cat`. - -{% data reusables.copilot.auto-code-review-steps %} - -## Configuring review effort level for an organization - -You can set the default review effort level that {% data variables.copilot.copilot_code-review_short %} uses for automatic reviews at both the organization and repository levels. Repository settings override organization defaults. For an overview of review effort levels, see [AUTOTITLE](/copilot/concepts/agents/code-review#review-effort-level). - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -1. {% data reusables.user-settings.code-planning-automation %} click **{% octicon "copilot" aria-hidden="true" aria-label="copilot" %} {% data variables.product.prodname_copilot_short %}**, then **Code review**. -1. Next to "Review effort level," select the default effort level for automatic reviews in repositories in your organization. - * **Lite**: Standard review. - * **Balanced**: Deeper analysis of complex logic, security-sensitive code, and cross-service changes. - -Balanced reviews use more {% data variables.product.prodname_ai_credits_short %}, and may consume marginally more {% data variables.product.prodname_actions %} minutes. For more information on the cost of review effort levels, see [AUTOTITLE](/copilot/concepts/agents/code-review#estimated-consumption). - -## Configuring review effort level for a repository - -You can override the organization default and set a different default review effort level for automatic reviews in a repository. - -{% data reusables.repositories.navigate-to-repo %} -{% data reusables.repositories.sidebar-settings %} -1. {% data reusables.user-settings.code-planning-automation %} click **{% octicon "copilot" aria-hidden="true" aria-label="copilot" %} {% data variables.product.prodname_copilot_short %}**, then **Code review**. -1. Next to "Review effort level," select the effort level for automatic reviews in this repository. - * **Lite**: Standard review. - * **Balanced**: Deeper analysis of complex logic, security-sensitive code, and cross-service changes. - -Balanced reviews use more {% data variables.product.prodname_ai_credits_short %}, and may consume marginally more {% data variables.product.prodname_actions %} minutes. For more information on the cost of review effort levels, see [AUTOTITLE](/copilot/concepts/agents/code-review#estimated-consumption). diff --git a/content/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review.md b/content/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review.md new file mode 100644 index 000000000000..80e262f0aa45 --- /dev/null +++ b/content/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review.md @@ -0,0 +1,141 @@ +--- +title: Configuring code review by GitHub Copilot +shortTitle: Configure code review +allowTitleToDifferFromFilename: true +intro: Set up {% data variables.product.prodname_copilot_short %} to review pull requests. +versions: + feature: copilot +redirect_from: + - /copilot/using-github-copilot/code-review/configuring-automatic-code-review-by-copilot + - /copilot/how-tos/agents/copilot-code-review/configuring-automatic-code-review-by-copilot + - /copilot/how-tos/agents/copilot-code-review/automatic-code-review + - /copilot/how-tos/agents/copilot-code-review/configure-automatic-review + - /copilot/how-tos/agents/request-a-code-review/configure-automatic-review + - /copilot/how-tos/use-copilot-agents/request-a-code-review/configure-automatic-review + - /copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review +contentType: how-tos +category: + - Configure Copilot +--- + +## Introduction + +You can configure {% data variables.copilot.copilot_code-review_short %} to review pull requests automatically. For an overview of automatic pull request reviews, see [AUTOTITLE](/copilot/concepts/agents/code-review#automatic-pull-request-reviews). + +## Configuring automatic code review for your own pull requests + +> [!NOTE] +> This is only available if you are on the {% data variables.copilot.copilot_pro_short %}, {% data variables.copilot.copilot_pro_plus_short %}, or {% data variables.copilot.copilot_max_short %} plans. + +{% data reusables.copilot.your-copilot %} +1. Locate the **Automatic {% data variables.copilot.copilot_code-review_short %}** option and click the dropdown button. + + ![Screenshot of the "Automatic {% data variables.copilot.copilot_code-review_short %}" setting with the dropdown menu displayed.](/assets/images/help/copilot/code-review/automatic-code-review-personal.png) + +1. In the dropdown menu, select **Enabled**. + +## Configuring automatic code review for a repository + +You can enable automatic code reviews for a repository and customize how code reviews are performed. + +### Enabling automatic reviews + +{% data reusables.repositories.navigate-to-repo %} +{% data reusables.repositories.sidebar-settings %} +{% data reusables.repositories.repo-rulesets-settings %} +{% data reusables.repositories.repo-new-ruleset %} +1. Under "Target branches," click **Add target** and choose one of the options—for example, **Include default branch** or **Include all branches**. +{% data reusables.copilot.auto-code-review-steps %} + +### Customizing {% data variables.copilot.copilot_code-review_short %} + +You can configure how {% data variables.copilot.copilot_code-review_short %} completes code reviews in your repository. + +{% data reusables.repositories.navigate-to-repo %} +{% data reusables.repositories.sidebar-settings %} +1. {% data reusables.user-settings.code-planning-automation %} click **{% octicon "copilot" aria-hidden="true" aria-label="copilot" %} {% data variables.product.prodname_copilot_short %}**, then **Code review**. +1. To choose the depth of {% data variables.product.prodname_copilot_short %} code reviews, next to "Review effort level," select the effort level for automatic reviews in this repository. + * **Lite**: Standard review. + * **Balanced**: Deeper analysis of complex logic, security-sensitive code, and cross-service changes. + + Balanced reviews use more {% data variables.product.prodname_ai_credits_short %}, and may consume marginally more {% data variables.product.prodname_actions %} minutes. See [AUTOTITLE](/copilot/concepts/agents/code-review#estimated-consumption). +1. To choose whether {% data variables.product.prodname_copilot_short %} can approve pull requests in your repository, configure the settings under "Auto-approval." + * **Allow {% data variables.product.prodname_copilot_short %} to approve pull requests**: Toggle on to let {% data variables.product.prodname_copilot_short %} submit approving reviews. + * **Allow {% data variables.product.prodname_copilot_short %} approvals to count toward merge requirements**: Toggle on so {% data variables.product.prodname_copilot_short %} approvals can satisfy pull request approval requirements. + * **File paths**: Optionally, limit which pull requests count toward merge requirements. Enter one file glob per line to count approvals only on pull requests where every changed file matches one of the globs. Leave blank to count approvals for all files. Up to 15 globs are supported. + + > [!NOTE] + > {% data reusables.copilot.automatic-approvals-public-preview %} + +## Configuring automatic code review for repositories in an organization + +You can enable automatic code reviews for repositories in your organization and customize how code reviews are performed. + +### Enabling automatic reviews + +{% data reusables.profile.access_org %} +{% data reusables.profile.org_settings %} +{% data reusables.organizations.access-ruleset-settings %} +{% data reusables.repositories.repo-new-ruleset %} +1. Under "Target repositories," click **Add target** and choose either **Include by pattern** or **Exclude by pattern**. +1. Type a pattern that matches the repository names you want to target—for example, `*feature` to match all repositories with names ending in `feature`. + + For pattern-matching syntax, see [AUTOTITLE](/organizations/managing-organization-settings/creating-rulesets-for-repositories-in-your-organization#using-fnmatch-syntax). + +1. Click **Add inclusion pattern** or **Add exclusion pattern**. +1. Repeat for any additional patterns. + + > [!NOTE] + > You can add multiple targeting criteria to the same ruleset. Exclusion patterns are applied after inclusion patterns. For example, you could include any repositories matching the pattern `*cat*`, and specifically exclude a repository matching the pattern `not-a-cat`. + +{% data reusables.copilot.auto-code-review-steps %} + +### Customizing {% data variables.copilot.copilot_code-review_short %} + +You can configure how {% data variables.copilot.copilot_code-review_short %} completes code reviews in repositories in your organization. + +{% data reusables.profile.access_org %} +{% data reusables.profile.org_settings %} +1. {% data reusables.user-settings.code-planning-automation %} click **{% octicon "copilot" aria-hidden="true" aria-label="copilot" %} {% data variables.product.prodname_copilot_short %}**, then **Code review**. +1. To choose the depth of {% data variables.product.prodname_copilot_short %} code reviews, next to "Review effort level," select the default effort level for automatic reviews in repositories in your organization. + * **Lite**: Standard review. + * **Balanced**: Deeper analysis of complex logic, security-sensitive code, and cross-service changes. + + Balanced reviews use more {% data variables.product.prodname_ai_credits_short %}, and may consume marginally more {% data variables.product.prodname_actions %} minutes. See [AUTOTITLE](/copilot/concepts/agents/code-review#estimated-consumption). +1. To choose whether {% data variables.product.prodname_copilot_short %} can approve pull requests in your repositories, select an option under "Approvals," next to "Count {% data variables.product.prodname_copilot_short %} approvals toward merge requirements." + * **Enabled everywhere**: {% data variables.product.prodname_copilot_short %} approvals can count toward merge requirements in every repository in the organization. + * **Let repositories decide**: Repository admins can decide this in repository settings. + * **Enable for selected repositories**: {% data variables.product.prodname_copilot_short %} approvals can count toward merge requirements only in the repositories you select. If you choose this option, also assign the repositories you want to enable this for. + * **Disabled everywhere**: {% data variables.product.prodname_copilot_short %} approvals cannot count toward merge requirements in any repository in the organization. + + > [!NOTE] + > {% data reusables.copilot.automatic-approvals-public-preview %} + +## Configuring automatic code review for an enterprise + +You can enable automatic code reviews for your enterprise and customize how code reviews are performed. + +### Enabling automatic reviews + +1. Create an enterprise-level branch ruleset. See [AUTOTITLE](/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance). +1. Target the organizations and repositories where {% data variables.copilot.copilot_code-review_short %} should run automatically. +1. Enable the **Automatically request {% data variables.copilot.copilot_code-review_short %}** policy. +1. Optionally, enable automatic reviews for draft pull requests and after each push to a pull request. +1. Click **Create**. + +### Customizing {% data variables.copilot.copilot_code-review_short %} + +You can configure how {% data variables.copilot.copilot_code-review_short %} completes code reviews for your enterprise. + +{% data reusables.enterprise-accounts.access-enterprise %} +{% data reusables.enterprise-accounts.ai-controls-tab %} +1. Scroll down to "Available Agents", then click **{% data variables.copilot.copilot_code-review_short %}**. +1. Next to "{% data variables.copilot.copilot_code-review_short %}", select a policy. +1. Then choose which {% data variables.copilot.copilot_code-review_short %} features to enable for your enterprise. +1. To choose whether {% data variables.product.prodname_copilot_short %} can approve pull requests in your organizations, next to "Allow {% data variables.product.prodname_copilot_short %} to approve pull requests," select a policy. + * **Let organizations decide**: Organization owners can choose whether to enable {% data variables.product.prodname_copilot_short %} approvals. + * **Enable for selected organizations**: {% data variables.product.prodname_copilot_short %} approvals are enabled only for the organizations you select. + * **Disabled everywhere**: Organizations cannot enable {% data variables.product.prodname_copilot_short %} approvals. This is the default. + + > [!NOTE] + > {% data reusables.copilot.automatic-approvals-public-preview %} diff --git a/content/copilot/how-tos/copilot-on-github/set-up-copilot/index.md b/content/copilot/how-tos/copilot-on-github/set-up-copilot/index.md index 8c0385331bc4..998d17803840 100644 --- a/content/copilot/how-tos/copilot-on-github/set-up-copilot/index.md +++ b/content/copilot/how-tos/copilot-on-github/set-up-copilot/index.md @@ -1,13 +1,14 @@ --- -title: 'Set up {% data variables.product.prodname_copilot_short %}' +title: Set up {% data variables.product.prodname_copilot_short %} shortTitle: Set up {% data variables.product.prodname_copilot_short %} -intro: 'Enable {% data variables.product.prodname_copilot %} and configure features on {% data variables.product.github %}.' +intro: Enable {% data variables.product.prodname_copilot %} and configure features on {% data variables.product.github %}. versions: feature: copilot children: - /enable-copilot - /configure-access-to-ai-models - - /configure-automatic-review + - /configure-code-review - /configure-runners contentType: how-tos --- + diff --git a/content/copilot/how-tos/copilot-on-github/use-copilot-agents/copilot-code-review.md b/content/copilot/how-tos/copilot-on-github/use-copilot-agents/copilot-code-review.md index 23da4e23e1d1..b9ffeb91fd26 100644 --- a/content/copilot/how-tos/copilot-on-github/use-copilot-agents/copilot-code-review.md +++ b/content/copilot/how-tos/copilot-on-github/use-copilot-agents/copilot-code-review.md @@ -25,7 +25,7 @@ category: ![Screenshot of a code review left by {% data variables.product.prodname_copilot_short %}.](/assets/images/help/copilot/code-review/review-comment@2x.png) -{% data variables.product.prodname_copilot_short %} always leaves a "Comment" review, not an "Approve" or "Request changes" review. Its reviews do not count toward required approvals and will not block merging. +By default, {% data variables.product.prodname_copilot_short %} leaves a "Comment" review, not an "Approve" review or a "Request changes" review. This means that, by default, {% data variables.product.prodname_copilot_short %}'s reviews do not count toward required approvals for the pull request. However, if configured to do so, {% data variables.product.prodname_copilot_short %} can leave "Approve" reviews. For more information, see [AUTOTITLE](/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review#pull-request-approvals-from-copilot). {% data variables.product.prodname_copilot_short %}'s review comments work like comments from human reviewers. Add reactions, reply, resolve, or hide them. Any replies you add are visible to other people but not to {% data variables.product.prodname_copilot_short %}. diff --git a/content/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review.md b/content/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review.md index a3361b40ed62..b7a48aca3e1a 100644 --- a/content/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review.md +++ b/content/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review.md @@ -45,7 +45,7 @@ These instructions explain how to use {% data variables.copilot.copilot_code-rev ![Screenshot of a code review left by {% data variables.product.prodname_copilot_short %}.](/assets/images/help/copilot/code-review/review-comment@2x.png) - {% data variables.product.prodname_copilot_short %} always leaves a "Comment" review, not an "Approve" review or a "Request changes" review. This means that {% data variables.product.prodname_copilot_short %}'s reviews do not count toward required approvals for the pull request, and {% data variables.product.prodname_copilot_short %}'s reviews will not block merging changes. For more details, see [AUTOTITLE](/pull-requests/how-tos/review-pull-requests/approving-a-pull-request-with-required-reviews). + By default, {% data variables.product.prodname_copilot_short %} leaves a "Comment" review, not an "Approve" review or a "Request changes" review. This means that, by default, {% data variables.product.prodname_copilot_short %}'s reviews do not count toward required approvals for the pull request. However, if configured to do so, {% data variables.product.prodname_copilot_short %} can leave "Approve" reviews. For more information, see [Pull request approvals from {% data variables.product.prodname_copilot_short %}](#pull-request-approvals-from-copilot). 1. {% data variables.product.prodname_copilot_short %}'s review comments behave like review comments from humans. You can add reactions to them, comment on them, resolve them and hide them. @@ -89,6 +89,17 @@ To automatically request re-reviews from {% data variables.product.prodname_copi > [!NOTE] When re-reviewing a pull request, {% data variables.product.prodname_copilot_short %} may repeat the same comments again, even if they have been dismissed with the "Resolve conversation" button or downvoted with the thumbs down (:-1:) button. +## Pull request approvals from {% data variables.product.prodname_copilot_short %} + +> [!NOTE] +> {% data reusables.copilot.automatic-approvals-public-preview %} + +Every {% data variables.copilot.copilot_code-review_short %} includes an approval assessment in the overview comment, indicating whether {% data variables.product.prodname_copilot_short %} considers the pull request ready to approve. On its own, this assessment does not count toward merge requirements. + +When approvals are enabled, {% data variables.product.prodname_copilot_short %} can submit an approving review that satisfies your repository's required-approval rule the same way a teammate's approval would. If new commits are pushed after {% data variables.product.prodname_copilot_short %} approves, the approval is dismissed, and you can re-request a review. For more details on required reviews, see [AUTOTITLE](/pull-requests/how-tos/review-pull-requests/approving-a-pull-request-with-required-reviews). + +Approvals are off by default and can be configured at the enterprise, organization, and repository levels. Repository administrators can also use file paths to control which {% data variables.product.prodname_copilot_short %} approvals count toward merge requirements. For configuration steps, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-automatic-review#customizing-copilot-code-review). + ## Customizing {% data variables.product.prodname_copilot_short %}'s reviews with custom instructions {% data reusables.copilot.code-review.custom-instructions-information %} diff --git a/content/copilot/reference/ai-models/model-hosting.md b/content/copilot/reference/ai-models/model-hosting.md index 7093dd0c888a..91e17bbefcf8 100644 --- a/content/copilot/reference/ai-models/model-hosting.md +++ b/content/copilot/reference/ai-models/model-hosting.md @@ -51,15 +51,24 @@ Used for: * {% data variables.copilot.copilot_claude_opus_48_fast %} * {% data variables.copilot.copilot_claude_opus_5 %} * {% data variables.copilot.copilot_claude_fable_5 %} - -> [!WARNING] -> When {% data variables.copilot.copilot_claude_fable_5 %} is used, Anthropic retains data, including prompts and outputs, to operate safety classifiers that detect harmful use. Other Claude models in {% data variables.product.prodname_copilot %} remain covered by {% data variables.product.github %}'s existing data retention agreements, as documented below. Enterprise and business users need to enable the {% data variables.copilot.copilot_claude_fable_5 %} model to make it available for your organization. You can read more about Anthropic's data handling practices for this model under section F of their [Service Specific Terms](https://www.anthropic.com/legal/service-specific-terms). +* {% data variables.copilot.copilot_claude_fable_51 %} + +> [!WARNING] +> When {% data variables.copilot.copilot_claude_fable_5 %} or {% data variables.copilot.copilot_claude_fable_51 %} is used, Anthropic retains data, including prompts and outputs, by default to operate safety classifiers that detect harmful use. +> +> Customers can request to use {% data variables.copilot.copilot_claude_fable_5 %} or {% data variables.copilot.copilot_claude_fable_51 %} with zero data retention (ZDR) through the end of 2026 under a time-bound exemption while Anthropic rolls out Enterprise Frontier Safeguards (EFS). After that point, continued use of these models would require EFS, which will enable eligible customers to keep their data under their own control while also enabling automated safety monitoring. For an enterprise that has been approved and configured for this type of access, {% data variables.copilot.copilot_claude_fable_5 %} and {% data variables.copilot.copilot_claude_fable_51 %} requests will use the ZDR endpoint through the end of 2026 when the models are enabled. +> +> To learn whether your enterprise is eligible and request access, contact your {% data variables.product.github %} account team. +> +> Approval for access does not automatically enable {% data variables.copilot.copilot_claude_fable_5 %} or {% data variables.copilot.copilot_claude_fable_51 %}. An enterprise or organization administrator must still enable each model before users can access it. Other Claude models, except for {% data variables.copilot.copilot_claude_fable_5 %} and {% data variables.copilot.copilot_claude_fable_51 %}, continue to operate under ZDR. +> +> Customers who enable a Fable model with ZDR agree to use this model only for internal operations, including to develop and evaluate products for their own customers. They may not make the model endpoints or outputs available externally. These models are hosted by Amazon Web Services, Anthropic PBC, and Google Cloud Platform. {% data variables.product.github %} has provider agreements in place to ensure data is not used for training. Additional details for each provider are included below: * Amazon Bedrock: Amazon makes the [following data commitments](https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html): _Amazon Bedrock doesn't store or log your prompts and completions. Amazon Bedrock doesn't use your prompts and completions to train any AWS models and doesn't distribute them to third parties_. -* Anthropic PBC: {% data variables.product.github %} maintains a [zero data retention agreement](https://privacy.anthropic.com/en/articles/8956058-i-have-a-zero-retention-agreement-with-anthropic-what-products-does-it-apply-to) with Anthropic for generally available Anthropic features in {% data variables.product.prodname_copilot %}. Some Anthropic features in beta or {% data variables.release-phases.public_preview %}—including tool search via the Messages API—are not covered by this agreement. For these features, data may be retained by Anthropic in accordance with [Anthropic's ZDR documentation](https://platform.claude.com/docs/en/build-with-claude/zero-data-retention). {% data variables.product.github %} will update this page as ZDR coverage changes. +* Anthropic PBC: {% data variables.product.github %} maintains a [zero data retention agreement](https://privacy.anthropic.com/en/articles/8956058-i-have-a-zero-retention-agreement-with-anthropic-what-products-does-it-apply-to) with Anthropic for generally available Anthropic features in {% data variables.product.prodname_copilot %}. {% data variables.copilot.copilot_claude_fable_5 %} and {% data variables.copilot.copilot_claude_fable_51 %} are not covered by this agreement by default. Enterprises that meet eligibility requirements can use {% data variables.copilot.copilot_claude_fable_5 %} and {% data variables.copilot.copilot_claude_fable_51 %} with zero data retention through the end of 2026 under a separate time-bound exemption; contact your account manager to learn more. Some Anthropic features in beta or {% data variables.release-phases.public_preview %}—including tool search via the Messages API—are also not covered by this agreement. For these features, data may be retained by Anthropic in accordance with [Anthropic's ZDR documentation](https://platform.claude.com/docs/en/build-with-claude/zero-data-retention). {% data variables.product.github %} will update this page as ZDR coverage changes. * Google Cloud: [Google commits to not training on {% data variables.product.github %} data as part of their service terms](https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance). {% data variables.product.github %} is additionally not subject to prompt logging for abuse monitoring. diff --git a/content/copilot/reference/ai-models/supported-models.md b/content/copilot/reference/ai-models/supported-models.md index ddf586e41d1c..ca8671ff7fb1 100644 --- a/content/copilot/reference/ai-models/supported-models.md +++ b/content/copilot/reference/ai-models/supported-models.md @@ -39,12 +39,12 @@ This table lists the AI models available in {% data variables.product.prodname_c | Model name | Provider | Release status | |--------------------------------------------------------|-----------|----------------------------| | {% for model in tables.copilot.model-release-status %} | -| {{ model.name }}{% if model.name == 'GPT-5.4 nano' %}[^gpt54nano]{% endif %}{% if model.name == 'MAI-Code-1-Flash' or model.name == 'MAI-Code-1.1-Flash' %}[^mai-code-1-flash]{% endif %}{% if model.name == 'Claude Fable 5' %}[^claude-fable-5]{% endif %}| {{ model.provider }} | {{ model.release_status }} | +| {{ model.name }}{% if model.name == 'GPT-5.4 nano' %}[^gpt54nano]{% endif %}{% if model.name == 'MAI-Code-1-Flash' or model.name == 'MAI-Code-1.1-Flash' %}[^mai-code-1-flash]{% endif %}{% if model.name == 'Claude Fable 5' or model.name == 'Claude Fable 5.1' %}[^claude-fable-5]{% endif %}| {{ model.provider }} | {{ model.release_status }} | | {% endfor %} | {% endrowheaders %} -[^claude-fable-5]: When {% data variables.copilot.copilot_claude_fable_5 %} is used, Anthropic retains data, including prompts and outputs, to operate safety classifiers that detect harmful use. Other Claude models in {% data variables.product.prodname_copilot %} remain covered by {% data variables.product.github %}'s existing data retention agreements, as documented at [AUTOTITLE](/copilot/reference/ai-models/model-hosting#anthropic-models). Enterprise and business users need to enable the {% data variables.copilot.copilot_claude_fable_5 %} model to make it available for your organization. You can read more about Anthropic's data handling practices for this model under section F of their [Service Specific Terms](https://www.anthropic.com/legal/service-specific-terms). To enable {% data variables.copilot.copilot_claude_fable_5 %}, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-access-to-ai-models). +[^claude-fable-5]: When {% data variables.copilot.copilot_claude_fable_5 %} or {% data variables.copilot.copilot_claude_fable_51 %} is used, Anthropic retains data, including prompts and outputs, by default to operate safety classifiers that detect harmful use. Customers can request to use {% data variables.copilot.copilot_claude_fable_5 %} or {% data variables.copilot.copilot_claude_fable_51 %} with zero data retention (ZDR) through the end of 2026 under a time-bound exemption while Anthropic rolls out Enterprise Frontier Safeguards (EFS). After that point, continued use of these models would require EFS, which will enable eligible customers to keep their data under their own control while also enabling automated safety monitoring. For an enterprise that has been approved and configured for this type of access, {% data variables.copilot.copilot_claude_fable_5 %} and {% data variables.copilot.copilot_claude_fable_51 %} requests will use the ZDR endpoint through the end of 2026 when the models are enabled. To learn whether your enterprise is eligible and request access, contact your {% data variables.product.github %} account team. Approval for access does not automatically enable {% data variables.copilot.copilot_claude_fable_5 %} or {% data variables.copilot.copilot_claude_fable_51 %}. An enterprise or organization administrator must still enable each model before users can access it. Other Claude models, except for {% data variables.copilot.copilot_claude_fable_5 %} and {% data variables.copilot.copilot_claude_fable_51 %}, continue to operate under ZDR. Customers who enable a Fable model with ZDR agree to use this model only for internal operations, including to develop and evaluate products for their own customers. They may not make the model endpoints or outputs available externally. To enable these models, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-access-to-ai-models). ## Supported AI models in {% data variables.copilot.copilot_auto_model_selection_short_cap_a %} @@ -86,6 +86,7 @@ Choosing a larger context window or higher reasoning will impact {% data variabl | {% data variables.copilot.copilot_claude_sonnet_5 %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | | {% data variables.copilot.copilot_claude_opus_48_fast %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | | {% data variables.copilot.copilot_claude_fable_5 %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | +| {% data variables.copilot.copilot_claude_fable_51 %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | | {% data variables.copilot.copilot_gpt_53_codex %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | | {% data variables.copilot.copilot_gpt_54 %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | | {% data variables.copilot.copilot_gpt_55 %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | @@ -137,6 +138,7 @@ Some {% data variables.product.prodname_copilot_short %} models require minimum | {% data variables.copilot.copilot_claude_opus_5 %} | `v1.128.0` | `17.14.22` | TBD | TBD | TBD | | {% data variables.copilot.copilot_claude_sonnet_5 %} | `v1.124` | `17.14.6` | TBD | TBD | TBD | | {% data variables.copilot.copilot_claude_fable_5 %} | `v1.124` | `17.14.6` | TBD | TBD | TBD | +| {% data variables.copilot.copilot_claude_fable_51 %} | TBD | TBD | TBD | TBD | TBD | | {% data variables.copilot.copilot_kimi_k27_code %} | `v1.127` | `17.14.6` | `1.9.1-251` | TBD | TBD | | {% data variables.copilot.copilot_kimi_k3 %} | `v1.131` | TBD | TBD | TBD | TBD | | {% data variables.copilot.copilot_mai_code_1_flash %} | `v1.121` | TBD | TBD | TBD | TBD | diff --git a/content/copilot/reference/copilot-cli-reference/cli-command-reference.md b/content/copilot/reference/copilot-cli-reference/cli-command-reference.md index ed0e196afd86..6a7706b2ca18 100644 --- a/content/copilot/reference/copilot-cli-reference/cli-command-reference.md +++ b/content/copilot/reference/copilot-cli-reference/cli-command-reference.md @@ -190,12 +190,13 @@ With `--skill`, pass either a skill name or the path to a custom skill directory | Ctrl+L | Clear the screen. | | Ctrl+Enter or Ctrl+Q | Queue a message to send while the agent is busy. | | Ctrl+R | Reverse search through command history. | -| Ctrl+Space | Toggle voice dictation on or off (alias for Ctrl+X then `v`). Hold Space to record instead of toggling. | +| Ctrl+Space | Toggle voice dictation on or off (alias for Ctrl+X then `v`). This only works if your terminal and OS pass it through. You may need to free this in your OS or terminal key bindings. Use Ctrl+X then `v` as an alternative. | | Ctrl+V | Paste from clipboard as an attachment. | | Alt+V | Paste image from clipboard as an attachment. | | Ctrl+X then `/` | After you have started typing a prompt, this allows you to run a slash command—for example, if you want to change the model without having to retype your prompt. | | Ctrl+X then `e` | Edit the prompt in an external editor (`$EDITOR`). | | Ctrl+X then `b` | Promote the running task or shell command to the background. | +| Ctrl+X then `g` | Collapse or expand the autopilot goal panel. | | Ctrl+X then `o` | Open the most recent link from the timeline. | | Ctrl+X then `v` | Toggle voice dictation on or off. | | Ctrl+Z | Suspend the process to the background (Unix). | @@ -315,7 +316,7 @@ These are the slash commands you can use from within an interactive CLI session. | `/app` | Open the current session in the {% data variables.copilot.github_copilot_app %} (requires version 1.1.3 or later), or show the download URL if the app is not installed. | | `/ask QUESTION` | Ask a quick side question without adding to the conversation history. | | `/allow-all [off\|auto\|show]`, `/yolo [off\|auto\|show]` | Enable all permissions (tools, paths, and URLs). This is an alias for `/permissions allow-all`; see the `/permissions` row for the canonical command and its subcommands. | -| `/autopilot [OBJECTIVE]`, `/goal [OBJECTIVE]` | Start or refocus autopilot mode, optionally with an explicit objective (for example, `/goal Refactor the auth module`). Without an objective, autopilot infers intent from context, and the status panel shows your last prompt as the inferred objective. You can cap AI-credit spend for the objective by using `--max-ai-credits N` (for example, `/goal Refactor the auth module --max-ai-credits 5`). When the cap is reached, autopilot pauses and opens a panel reporting credits used against the cap. Enter a new amount to resume with a fresh credit window, or dismiss the panel to stay paused. You can also resume a paused objective yourself, without the panel, by running the option on its own with no objective text—for example, `/goal --max-ai-credits 5`. This is the same action the panel performs: it opens a fresh window of the credits you specify (the full new cap, not an increment) and continues the objective. `/goal on` and `/goal off` toggle autopilot mode without setting an objective and don't accept `--max-ai-credits`. | +| `/autopilot [OBJECTIVE]`, `/goal [OBJECTIVE]` | Start or refocus autopilot mode, optionally with an explicit objective (for example, `/goal Refactor the auth module`). Without an objective, autopilot infers intent from context, and the status panel shows your last prompt as the inferred objective. You can cap AI-credit spend for the objective by using `--max-ai-credits N` (for example, `/goal Refactor the auth module --max-ai-credits 5`). When the cap is reached, autopilot pauses and opens a panel reporting credits used against the cap. Enter a new amount to resume with a fresh credit window, or dismiss the panel to stay paused. You can also resume a paused objective yourself, without the panel, by running the option on its own with no objective text—for example, `/goal --max-ai-credits 5`. This is the same action the panel performs: it opens a fresh window of the credits you specify (the full new cap, not an increment) and continues the objective. `/goal on` and `/goal off` toggle autopilot mode without setting an objective and don't accept `--max-ai-credits`. An active goal renders as a pinned panel above the composer, showing the objective, credits used, and todo progress. The panel auto-collapses to a single identity row on short terminals (below 30 rows) and expands above that threshold; press Ctrl+X then `g` to override the automatic sizing by hand. | | `/changelog [summarize] [VERSION\|last N\|since VERSION]`, `/release-notes [summarize] [VERSION\|last N\|since VERSION]` | Display the CLI changelog. Optionally specify a version, a count of recent releases, or a starting version. Add the keyword `summarize` for an AI-generated summary. | | `/chronicle ` | Session history tools and insights. The `skills` subcommands draft, review, and track the status of repository skill proposals generated from observed usage. See [AUTOTITLE](/copilot/concepts/agents/copilot-cli/chronicle). | | `/clear [PROMPT]`, `/new [PROMPT]`, `/reset [PROMPT]` | Start a new conversation. | @@ -368,11 +369,11 @@ These are the slash commands you can use from within an interactive CLI session. | `/rename [NAME]` | Rename the current session (auto-generates a name if omitted; alias for `/session rename`). | | `/research TOPIC` | Run a deep research investigation using {% data variables.product.github %} search and web sources. See [AUTOTITLE](/copilot/concepts/agents/copilot-cli/research). | | `/reset-allowed-tools` | Reset the list of allowed tools. | -| `/restart` | Restart the CLI, preserving the current session. | +| `/restart` | Restart the CLI, restoring all of the current process's live sessions, not only the foreground one. If the target CLI version can't restore multiple sessions, you're prompted to continue with only the foreground session or cancel. | | `/resume [SESSION-ID]`, `/continue [SESSION-ID]` | Switch to a different session by choosing from a list (optionally specify a session ID). | | `/review [PROMPT]` | Run the code review agent to analyze changes. See [AUTOTITLE](/copilot/how-tos/copilot-cli/use-copilot-cli/agentic-code-review). | | `/rubber-duck [PROMPT]` | Consult the rubber duck agent for a second opinion on plans, code, and tests. See [AUTOTITLE](/copilot/concepts/agents/copilot-cli/rubber-duck). | -| `/sandbox [config\|status\|policy\|enable\|disable]` | Manage OS-level sandboxing that restricts filesystem and network access for shell commands, MCP/LSP servers, and built-in file/web tools. `config` (or bare `/sandbox`) opens the sandbox settings dialog. `status` shows whether sandboxing is enabled. `policy` shows the effective policy, including path grants, denials, and network access. `enable`/`disable` turn sandboxing on or off directly. {% data reusables.copilot.experimental %} | +| `/sandbox [config\|status\|policy\|enable\|disable]` | Manage OS-level sandboxing that restricts filesystem and network access for shell commands, MCP/LSP servers, and built-in file/web tools. `config` (or bare `/sandbox`) opens the sandbox settings dialog. `status` shows whether sandboxing is enabled. `policy` shows the effective policy, with path grants grouped by source (user-configured, system, working directory, current session, and `~/.copilot`) and access type, plus the network stance and any detected developer tools. `enable`/`disable` turn sandboxing on or off directly. {% data reusables.copilot.experimental %} | | `/search [QUERY]`, `/find [QUERY]` | Search the conversation timeline. | | `/security-review [PROMPT]` | Run a focused security review of active local code changes and return prioritized vulnerability findings with remediation suggestions. This command is not a full repository security audit. | | `/session [info\|checkpoints [n]\|files\|plan\|rename [NAME]\|cleanup\|prune\|delete [ID]\|delete-all]`, `/sessions [info\|checkpoints [n]\|files\|plan\|rename [NAME]\|cleanup\|prune\|delete [ID]\|delete-all]` | Show session information and manage sessions. The `info` subcommand shows session details including the session link (when available). Subcommands: `info`, `checkpoints`, `files`, `plan`, `rename`, `cleanup`, `prune`, `delete`, `delete-all`. | @@ -511,6 +512,8 @@ An enterprise-managed policy can enforce OS-level shell sandboxing as a minimum When a managed policy overrides your setting, the CLI shows a warning in the interactive timeline (or on stderr when using `-p`) so it is clear that the behavior comes from policy enforcement rather than the option failing to work. Contact your administrator if you need the policy changed. The `/sandbox` command is also registered whenever a managed policy forces sandboxing on, even without experimental features enabled, so you can still inspect the effective policy and status while the floor applies. {% data reusables.copilot.experimental %} +Adding the managed `sandbox.failIfUnavailable` setting set to `true`, alongside `sandbox.enabled` set to `true`, makes the sandbox mandatory. Instead of falling back to running commands unsandboxed, {% data variables.product.prodname_copilot_short %} blocks model and tool execution if the policy can't be validated, compiled, or enforced by a usable sandbox backend, and you can't disable it. See [AUTOTITLE](/copilot/reference/copilot-cli-reference/cli-config-dir-reference#user-settings-copilotsettingsjson). + The CLI also warns when a managed policy enables sandboxing in a session that you did not request, not only when it overrides `--no-sandbox`. This includes sessions where the policy arrives after startup, because server-managed settings are only available after login. The warning is omitted if your own settings or the `--sandbox` option already requested sandboxing, since the session state would then be expected. If a device has a managed policy that could not be read, the CLI fails closed and enforces sandboxing at its most restrictive level. The notice explains that the policy couldn't be determined and tells you to wait for it to resolve. The startup warning for an unsupported host uses the same wording. @@ -724,6 +727,8 @@ Local (stdio) servers that spawn inside the sandbox (see the `/sandbox` slash co Toggling `/sandbox` restarts only local (stdio) MCP servers, since they spawn inside the sandbox. Remote (HTTP/SSE) servers stay connected. +`/mcp edit ` rejects a workspace-sourced server—one defined in a repository's `.mcp.json`—instead of opening the user-tier wizard, since saving would silently create a same-name user entry that the workspace one still shadows. The error names the file to edit directly. `/mcp delete ` reports the same file when asked to remove a workspace-sourced server. + ### `copilot mcp` subcommand Use `copilot mcp` to manage MCP server configurations from the command line without starting an interactive session. @@ -834,6 +839,8 @@ The `--registry` option and other npm configuration options (`--userconfig`, `-- Remote MCP servers that use OAuth may show a `needs-auth` status when a token expires or when a different account is required. Use `/mcp auth ` to trigger a fresh OAuth flow. This opens a browser authentication prompt, allowing you to sign in or switch accounts. After completing the flow, the server reconnects automatically. +On Windows, remote MCP servers protected by Microsoft Entra ID authenticate through the OS authentication broker (Web Account Manager) instead, usually with no prompt. On other platforms, and on Windows machines without the broker library, sign-in falls back to the browser flow described above. Passing `--device-code` bypasses the broker and forces the OAuth device code flow rather than the browser flow. + ### Headless OAuth (`client_credentials` grant) For CI or cron use cases where no browser is available, set `oauthGrantType: "client_credentials"`. This requires: @@ -1053,6 +1060,8 @@ Custom agents are specialized AI agents defined in Markdown files. The filename `code-review` and `security-review` never forward a full review to another review agent: launching one already fulfills a request to "use" or "call" a reviewer, so it performs the review itself instead of delegating the whole task to a nested `code-review` or `security-review` subagent, recursively, across the entire delegation chain. `code-review` still hands off to the dedicated `security-review` specialist for security-focused portions of a request, and both agents may delegate narrow, independently scoped fact-finding work to non-review agents such as `explore`. +Only the root agent can call `store_memory` or `vote_memory` to save or vote on a memory. Subagents keep read access to stored memories through `read_memories`, but can't write or vote on them. + ### Custom agent frontmatter fields | Field | Type | Required | Description | @@ -1063,7 +1072,7 @@ Custom agents are specialized AI agents defined in Markdown files. The filename | `model` | string | No | AI model for this agent. When unset, inherits the outer agent's model. When the session model is set to `Auto` (server-selected), subagents always inherit the resolved session model regardless of this field. | | `name` | string | No | Display name. Defaults to the filename. | | `reasoningEffort` | string | No | Default reasoning effort for this agent (for example, `"low"`, `"medium"`, or `"high"`). When unset, inherits the outer agent's effort. | -| `tools` | string[] | No | Tools available to the agent. Default: `["*"]` (all tools). | +| `tools` | string[] | No | Tools available to the agent. Default: `["*"]` (all tools). Include `*` anywhere in the list to grant full tool access—for example, `["view", "*"]` grants every tool, not just `view`. | `model` and `reasoningEffort` apply whether the agent is dispatched through the `task` tool or started directly—for example, through the SDK's `session.startSubagent`. They're resolved with this precedence, highest first: an explicit per-call value, the `subagents` override in `~/.copilot/settings.json`, the agent definition's `model`/`reasoningEffort` field, then the parent session's value. A declared model or effort that can't be honored falls back to the session's value instead of failing the dispatch. diff --git a/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md b/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md index bb4b39074afa..1a82bc22f1a6 100644 --- a/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md +++ b/content/copilot/reference/copilot-cli-reference/cli-config-dir-reference.md @@ -485,6 +485,7 @@ These settings apply across all your sessions and repositories. You can use the | `respectGitignore` | `boolean` | `true` | Exclude gitignored files from the `@` file mention picker. When `false`, the picker includes files normally excluded by `.gitignore`. | | `sandbox.allowBypass` | `boolean` | `true` | Allow sandboxed commands to request a bypass for specific operations (surfaces a permission prompt) so tools like `grep` and `glob` keep working when the sandbox would otherwise block them. Set to `false` to opt out. | | `sandbox.enabled` | `boolean` | `false` | Restrict shell commands, MCP/LSP servers, and built-in file/web tools to a sandboxed environment with limited file system and network access. Enable it from the `/sandbox` dialog or with `/sandbox enable`. | +| `sandbox.failIfUnavailable` | `boolean` | `false` | Make sandboxing mandatory instead of falling back to unsandboxed execution: blocks model and tool execution if the policy can't be validated, compiled, or enforced by a usable sandbox backend. Typically set by a managed policy alongside `sandbox.enabled: true`; when set that way, you can't disable it. | | `sandbox.auth.git` | `boolean` | `true` | Inject Git credentials into the sandbox so commands running inside it can authenticate with Git. Set to `false` to opt out. Renamed from `sandbox.gitAuth`; the old key has no migration and is ignored wherever it still appears. | | `sandbox.auth.gh` | `boolean` | `true` | Inject {% data variables.product.prodname_cli %} (`gh`) credentials into the sandbox so commands running inside it can authenticate with the {% data variables.product.prodname_cli %}. Set to `false` to opt out. Renamed from `sandbox.ghAuth`; the old key has no migration and is ignored wherever it still appears. | | `sandbox.userPolicy.network.allowLocalNetwork` | `boolean` | `true` | Allow sandboxed commands to reach local network addresses (for example, local dev servers). Set to `false` to opt out. | @@ -518,6 +519,19 @@ These settings apply across all your sessions and repositories. You can use the > [!TIP] > Run `copilot help sandbox` for the full sandbox reference, including supported hosts and all `sandbox` settings keys. +#### Proxy client certificates (mTLS) + +When a request routed through an `https://` proxy (set with `proxyUrl`, `HTTPS_PROXY`, or `HTTP_PROXY`) requests a client certificate, {% data variables.copilot.copilot_cli_short %} automatically selects an OS-managed client identity. You don't need to configure a certificate path, private key, or passphrase. Private keys never leave the platform store. + +| Platform | Identity source | +|----------|-----------------| +| Windows | Current user's `MY` certificate store. | +| macOS | User keychain search list, including a preferred identity for the proxy host. | +| Linux (glibc) | Chromium-compatible NSS database and its configured PKCS#11 modules. | +| Linux (musl) and other platforms | Unsupported. Ordinary proxy behavior is unchanged. | + +Client identity selection only activates for `https://` proxies. Direct requests, `NO_PROXY` matches, and plaintext `http://` proxies never install a client identity. The platform store is re-read on every request, so certificate rotation or smart-card insertion doesn't require a session restart. + The `/sandbox` dialog groups `git`, `gh`, and keychain access under a dedicated **Auth** tab, and shows the `settings.json` path where the current sandbox configuration is stored. Press Ctrl+E in the `/sandbox` dialog to save any pending changes and open `settings.json` in your editor (`COPILOT_EDITOR`, `VISUAL`, or `EDITOR`), matching the same shortcut in `/settings`. The dialog reloads its state from disk after you edit and save the file. Sandboxing is powered by [Microsoft eXecution Container (MXC)](https://github.com/microsoft/mxc), which provides platform-specific containment backends. {% data variables.copilot.copilot_cli_short %} uses Seatbelt on macOS, Bubblewrap on Linux, and ProcessContainer on Windows. @@ -640,6 +654,9 @@ Only the following keys are supported in MDM managed settings. | `remoteControl` | Control whether sessions on this device can be controlled from other devices. `mode` is `"enabled"`, `"disabled"`, or `"requireSSO"` (requires `githubDotComOrganizations` when set). | | `shellShortcut` | Force-enable or force-disable the `$` interactive shell shortcut for all users. A managed value always overrides the user's own `shellShortcut` setting. | | `strictKnownMarketplaces` | Restrict plugins to known marketplaces | +| `strictPluginOnlyCustomization` | Customization lockdown baseline. Prevents standalone user and workspace/project customizations from the named surfaces, so eligible customizations may then originate only from plugins or managed settings. `true` locks all four surfaces (`skills`, `agents`, `hooks`, MCP servers); an array (for example, `["skills", "mcp"]`) locks only the named surfaces. Unset preserves existing behavior. This does **not** mean managed-plugin-only—plugin-provided customizations are still permitted. Use `allowManagedMcpServersOnly` and `allowManagedHooksOnly` for the stricter managed-only overlays described below. | +| `allowManagedMcpServersOnly` | A stricter overlay on top of `strictPluginOnlyCustomization`. When `true`, only the managed `allowedMcpServers` allowlist (plus MCP servers from managed or force-enabled plugins, and any fixed managed-MCP deployment) governs which MCP servers are eligible. Lower-precedence user and workspace/project allowlist entries can't broaden it; `deniedMcpServers` still applies. Trusted first-party servers (for example, the built-in {% data variables.product.github %} MCP server) remain exempt. See [Managed MCP server allow/deny list](#managed-mcp-server-allowdeny-list). | +| `allowManagedHooksOnly` | A stricter overlay on top of `strictPluginOnlyCustomization`. When `true`, only enterprise-managed hooks and hooks supplied by plugins force-enabled through managed `enabledPlugins` may load; user, workspace/project, and otherwise user-enabled plugin hooks are blocked. Normal managed permission and sandbox policies still apply. | | `telemetry` | Push baseline OpenTelemetry export configuration: `enabled`, `endpoint`, `protocol`, `headers`, `resourceAttributes`, `captureContent`, `lockCaptureContent`, and `serviceName`. See [AUTOTITLE](/copilot/reference/copilot-cli-reference/cli-command-reference#opentelemetry-monitoring). | > [!NOTE] @@ -654,6 +671,9 @@ Only the following keys are supported in MDM managed settings. > [!NOTE] > Most managed keys lock the entire row: a local edit is silently overridden by the managed value on the next load. `enabledPlugins` and `extraKnownMarketplaces` are the exception—the managed layer merges these maps with your own entries field-by-field instead of replacing them outright. This means the lock applies **per entry**, not to the whole key: a plugin or marketplace pinned by a managed policy can't be re-enabled, disabled, or repointed locally, but other entries in the same map remain fully user-controlled. +> [!NOTE] +> `strictPluginOnlyCustomization`, `allowManagedMcpServersOnly`, and `allowManagedHooksOnly` compose across managed sources with a most-restrictive-wins strategy: a surface locked, or an overlay set to `true`, by any managed source stays locked or `true` even if a lower-priority managed source leaves it unset. + ### Managed permission rules Push `deny`, `ask`, and `allow` rule lists under the managed `permissions` key to enforce a permission policy across all users, independent of `permissions.disableBypassPermissionsMode`. @@ -712,6 +732,8 @@ Rules: * **Deny always wins**—a server matching `deniedMcpServers` is blocked even if it also matches `allowedMcpServers`. * For remote servers, a match must come from a `serverUrl` entry; `serverName` only counts when no `serverUrl` entries exist. For stdio servers, a match must come from a `serverCommand` entry; `serverName` only counts when no `serverCommand` entries exist. +Set the managed `allowManagedMcpServersOnly` key to `true` for a stricter overlay: only the managed `allowedMcpServers` allowlist (plus MCP servers from managed or force-enabled plugins, and any fixed managed-MCP deployment) governs which servers are eligible, and lower-precedence user or workspace/project allowlist entries can no longer broaden it. `deniedMcpServers` still applies, and trusted first-party servers remain exempt. + ## Further reading * [AUTOTITLE](/copilot/how-tos/copilot-cli) diff --git a/content/copilot/reference/hooks-reference.md b/content/copilot/reference/hooks-reference.md index 77521d55b880..23f47571a662 100644 --- a/content/copilot/reference/hooks-reference.md +++ b/content/copilot/reference/hooks-reference.md @@ -84,7 +84,7 @@ Hook configuration files use JSON format with version `1`. ### Command hooks -Command hooks run shell scripts and are supported on all hook types. +Command hooks run shell scripts or executables and are supported on all hook types. > [!NOTE] > **Cloud agent only.** Cloud agent runs hooks in a Linux sandbox. Only the `bash` field is honored; `powershell` entries are ignored. The cross-platform `command` field is honored as a fallback. @@ -107,13 +107,39 @@ Command hooks run shell scripts and are supported on all hook types. } ``` +In {% data variables.copilot.copilot_cli_short %}, you can use `exec` and `args` to run an executable directly instead of using a shell: + +```json +{ + "version": 1, + "hooks": { + "preToolUse": [ + { + "type": "command", + "exec": "YOUR_EXECUTABLE", + "args": ["YOUR_ARGUMENT"], + "cwd": "OPTIONAL/WORKING/DIRECTORY", + "env": { "VAR": "VALUE" }, + "timeoutSec": 30 + } + ] + } +} +``` + +Replace `YOUR_EXECUTABLE` with the executable name or path and `YOUR_ARGUMENT` with an argument to pass to it. You can include additional arguments in the `args` array. + +Do not combine `exec` with `bash`, `powershell`, or `command`. Arguments are passed directly to the executable without shell interpretation, so shell features such as pipes, redirection, and glob expansion are not available. + | Field | Type | Required | Description | |-------|------|----------|-------------| -| `bash` | string | One of `bash`, `powershell`, or `command` | Shell command for Unix. | -| `command` | string | One of `bash`, `powershell`, or `command` | Cross-platform fallback. Copied to both `bash` and `powershell` when those fields are absent; explicit `bash` or `powershell` entries take precedence on their respective platforms. | +| `args` | array of strings | No | Arguments passed directly to `exec`. Only supported in {% data variables.copilot.copilot_cli_short %}. | +| `bash` | string | One of `bash`, `powershell`, or `command`, unless `exec` is specified | Shell command for Unix. | +| `command` | string | One of `bash`, `powershell`, or `command`, unless `exec` is specified | Cross-platform fallback. Copied to both `bash` and `powershell` when those fields are absent; explicit `bash` or `powershell` entries take precedence on their respective platforms. | | `cwd` | string | No | Working directory for the command (relative to repository root or absolute). | | `env` | object | No | Environment variables to set (supports variable expansion). | -| `powershell` | string | One of `bash`, `powershell`, or `command` | Shell command for Windows. | +| `exec` | string | Instead of `bash`, `powershell`, and `command` | Executable name or path. Runs the executable directly without a shell. Only supported in {% data variables.copilot.copilot_cli_short %}. | +| `powershell` | string | One of `bash`, `powershell`, or `command`, unless `exec` is specified | Shell command for Windows. | | `timeout` | number | No | Alias for `timeoutSec`, in seconds. Used only when `timeoutSec` is absent; `timeoutSec` takes precedence when both are present. | | `timeoutSec` | number | No | Timeout in seconds. Default: `30`. | | `type` | `"command"` | No | Hook type. Defaults to `"command"` when omitted. | @@ -797,7 +823,7 @@ If multiple hooks of the same type are configured, they execute in order. For `p | `0` | Success. `stdout` is parsed as the hook output JSON if present. | | `2` | Treated as a warning by default. `stderr` is surfaced to the user but the run continues. For `permissionRequest` and `preToolUse`, exit `2` is treated as a deny: any `stdout` JSON is merged with the deny decision and the tool call is denied even if that JSON reports `permissionDecision: "allow"`. For `postToolUseFailure`, exit `2` is treated as `additionalContext` and `stdout` is appended to the failure shown to the agent. | | Other non-zero | Logged as a hook failure. The run continues (fail-open). **Exception: `preToolUse` is fail-closed**—a non-zero exit (other than exit 2) denies the tool call with `"Denied by preToolUse hook (hook errored)"`. | -| Timeout | Killed after `timeoutSec`. Error logged, execution continues. **Timeouts are fail-open for every event, including `preToolUse` and admin-deployed policy hooks**—a warning is surfaced and processing proceeds as if the hook had not run. For `preToolUse`, the tool call proceeds through the normal permission flow rather than being denied. A crashed or explicitly-denying hook still fails-closed; only timeouts are exempt. | +| Timeout | Killed after `timeoutSec`. Error logged, execution continues. **Timeouts are fail-open for every event, including `preToolUse` and admin-deployed policy hooks**—a warning is surfaced and processing proceeds as if the hook had not run. For `preToolUse`, the tool call proceeds through the normal permission flow rather than being denied. A crashed or explicitly-denying hook still fails-closed; only timeouts are exempt. The logged message includes the command that timed out, for example `Hook command timed out after 30 seconds: my-validation-script.sh` (the bash/PowerShell script text, or `program arg1 arg2 …` for exec hooks), truncated to 80 characters. | For most events, non-zero exits and timeouts are logged and skipped—agent execution continues. For `preToolUse` command hooks, exit 2, crashes, and other non-zero exits all fail-closed and deny the tool call—exit 2 always denies, even if the hook's `stdout` JSON reports `permissionDecision: "allow"`—but **timeouts always fail-open**—a slow or unreachable hook must not silently block tool calls or work, even when the hook was deployed by an administrator as policy. diff --git a/content/copilot/tutorials/budgets/getting-started-with-budget-controls.md b/content/copilot/tutorials/budgets/getting-started-with-budget-controls.md index 50e34f05c758..e68253eed67b 100644 --- a/content/copilot/tutorials/budgets/getting-started-with-budget-controls.md +++ b/content/copilot/tutorials/budgets/getting-started-with-budget-controls.md @@ -36,6 +36,8 @@ Once you have a universal ULB in place, review your AI usage dashboard to identi For these users, set an individual user-level budget override. Individual overrides take precedence over the universal default. You can increase or decrease the limit for a specific user without affecting anyone else. +If the override is only meant to be temporary, such as a higher limit for one sprint or one incident, set an expiration date on it. {% data variables.product.github %} removes the budget on that date. The user then falls back to their cost center or universal budget, if one applies, so you don't have to track the cleanup yourself. See [AUTOTITLE](/copilot/concepts/billing/budgets-for-usage-based-billing#expiration-dates-for-individual-user-level-budgets). + > [!TIP] > If you're setting up budgets for the first time and don't yet have usage data, start with a universal ULB that feels reasonable for your organization and revisit after your first billing cycle. Your AI usage dashboard will give you the data you need to tune individual overrides. diff --git a/content/get-started/writing-on-github/working-with-advanced-formatting/attaching-files.md b/content/get-started/writing-on-github/working-with-advanced-formatting/attaching-files.md index 07f5c730cc0e..3384fa987554 100644 --- a/content/get-started/writing-on-github/working-with-advanced-formatting/attaching-files.md +++ b/content/get-started/writing-on-github/working-with-advanced-formatting/attaching-files.md @@ -19,7 +19,9 @@ category: > [!NOTE] > For public repositories, uploaded files can be accessed without authentication. In the case of private and internal repositories, only people with access to the repository can view the uploaded files. -To attach a file to an issue or pull request conversation, drag and drop it into the comment box. +You can attach files to issues, pull requests, and comments in your browser.{% ifversion fpt or ghec %} You can also attach local images and videos from the command line with {% data variables.product.prodname_cli %}. For more information, see [AUTOTITLE](/github-cli/github-cli/attaching-files-with-github-cli).{% endif %} + +To attach a file in your browser, drag and drop it into the comment box. Alternatively, you can click {% octicon "paperclip" aria-label="Attach files" %} below the issue comment box to browse, select, and add a file from your computer. ![Screenshot of the issue comment box. The "Attach files" icon is outlined in orange.](/assets/images/help/issues/attach-file.png) diff --git a/content/github-cli/github-cli/attaching-files-with-github-cli.md b/content/github-cli/github-cli/attaching-files-with-github-cli.md new file mode 100644 index 000000000000..682566272129 --- /dev/null +++ b/content/github-cli/github-cli/attaching-files-with-github-cli.md @@ -0,0 +1,102 @@ +--- +title: Attaching files with GitHub CLI +intro: Attach local images and videos to issues, pull requests, and comments without leaving the command line. +versions: + fpt: '*' + ghec: '*' +contentType: how-tos +category: + - Use and extend the CLI +--- + +You can attach a local image or video from the command line with {% data variables.product.prodname_cli %} using the `--attach` flag. {% data variables.product.prodname_cli %} uploads the file to {% data variables.product.github %} and writes the resulting URL into the body of your issue, pull request, or comment, so it renders inline just as it would if you attached it in your browser. + +You need push access to the repository to attach files. + +The `--attach` flag is available on the following commands: + +* `gh issue create` +* `gh issue edit` +* `gh issue comment` +* `gh pr create` +* `gh pr edit` +* `gh pr comment` + +## Attaching a file + +Pass `--attach` with the path to a local file. In the following example, replace ISSUE-NUMBER with the number of your issue and PATH/TO/IMAGE with the path to your image. You can repeat the flag to attach more than one file, but you can't attach the same file twice. + +```shell +gh issue comment ISSUE-NUMBER --attach PATH/TO/IMAGE +``` + +You can combine `--attach` with `--body` or `--body-file` to embed images and videos in your Markdown. The following example uses placeholders for the pull request title, Markdown body file, and two image files. + +```shell +gh pr create \ + --title "PULL-REQUEST-TITLE" \ + --body-file PATH/TO/BODY-FILE \ + --attach PATH/TO/FIRST-IMAGE \ + --attach PATH/TO/SECOND-IMAGE +``` + +To set alt text for an image, add it to the end of the path after a `#`, in place of ALT-TEXT. + +```shell +gh issue comment ISSUE-NUMBER --attach 'PATH/TO/IMAGE#ALT-TEXT' +``` + +If you do not provide alt text, {% data variables.product.prodname_cli %} uses the file name. + +> [!NOTE] +> Alt text is not supported on video files. + +## Embedding an attachment in Markdown + +If your Markdown text already references a local file, and you attach that same file with `--attach`, {% data variables.product.prodname_cli %} rewrites the reference in place to point at the uploaded file, rather than appending a second copy at the end. This lets you write Markdown with ordinary local paths, preview it locally where the images render, then post it unchanged. The reference is rewritten no matter where the body text comes from: `--body`, `--body-file`, standard input, or the text editor. + +### Embedding an image + +For example, save the following content in `PATH/TO/BODY-FILE`: + +```markdown +The sign-in screen shows an error where the form should be: + +![the sign-in screen showing an authentication error](PATH/TO/IMAGE) +``` + +Run the following command with `--body-file`: + +```shell +gh issue comment \ + ISSUE-NUMBER \ + --body-file PATH/TO/BODY-FILE \ + --attach PATH/TO/IMAGE +``` + +{% data variables.product.prodname_cli %} replaces the local path with the uploaded URL and keeps your Markdown and alt text. When a reference is rewritten, the alt text comes from the Markdown, so any `#` alt text on the flag applies only to files that are appended. + +Any attached file that the body does not reference is appended to the end of the body, in the order you passed the flags. + +### Embedding a video + +To embed a video as a player, save the following Markdown image reference in `PATH/TO/VIDEO-BODY-FILE`. The reference must be the only content in its paragraph. + +```markdown +![](PATH/TO/VIDEO) +``` + +Then attach the same video: + +```shell +gh issue comment \ + ISSUE-NUMBER \ + --body-file PATH/TO/VIDEO-BODY-FILE \ + --attach PATH/TO/VIDEO +``` + +{% data variables.product.prodname_cli %} replaces the entire reference with the uploaded URL, which renders as a player. If the reference appears within a sentence, it renders as a link instead. + +## Limitations + +The {% data variables.product.prodname_cli %} only supports uploading image and media files. For a list of supported file types, see [AUTOTITLE](/get-started/writing-on-github/working-with-advanced-formatting/attaching-files#image-and-media-files). diff --git a/content/github-cli/github-cli/index.md b/content/github-cli/github-cli/index.md index 193ddf6741b7..54cf9a745403 100644 --- a/content/github-cli/github-cli/index.md +++ b/content/github-cli/github-cli/index.md @@ -9,10 +9,10 @@ versions: children: - /about-github-cli - /quickstart + - /attaching-files-with-github-cli - /using-multiple-accounts - /creating-github-cli-extensions - /using-github-cli-extensions - /github-cli-telemetry - /github-cli-reference --- - diff --git a/content/migrations/elm/about-live-migrations.md b/content/migrations/elm/about-live-migrations.md index 906316c44faa..6b825973cd2b 100644 --- a/content/migrations/elm/about-live-migrations.md +++ b/content/migrations/elm/about-live-migrations.md @@ -9,11 +9,9 @@ versions: contentType: concepts --- -{% data reusables.elm.preview-note %} - ## What is {% data variables.product.prodname_elm %}? -{% data variables.product.prodname_elm %} ({% data variables.product.prodname_elm_short %}) is a service for migrating repositories from {% data variables.product.prodname_ghe_server %} to {% data variables.enterprise.data_residency %} ({% data variables.enterprise.data_residency_site %}). It is operated using a command line tool on {% data variables.product.prodname_ghe_server %}. +{% data variables.product.prodname_elm %} ({% data variables.product.prodname_elm_short %}) is a service for migrating repositories from {% data variables.product.prodname_ghe_server %} to {% data variables.enterprise.data_residency %} ({% data variables.enterprise.data_residency_site %}). It is operated using an extension of the {% data variables.product.prodname_cli %}. Migrations are "live" because users can continue using the source repository during most of the migration process. After the repository data is initially collected, webhooks check for changes to the repository, such as new commits or updates to settings. These changes are reported to {% data variables.product.prodname_elm_short %} and included in the migration. @@ -35,7 +33,7 @@ You may want to use both tools over the course of a platform migration, prioriti ## Overview of a migration -Typically, a site administrator runs a migration using the `elm` CLI tool, in a terminal session over SSH. The operator must provide {% data variables.product.pat_generic_plural %} with access to both {% data variables.product.prodname_ghe_server %} and the destination enterprise. +A site administrator runs a migration using the {% data variables.product.prodname_cli %}. Before running the migration, the operator must configure the {% data variables.product.prodname_ghe_server %} instance and provide {% data variables.product.pat_generic_plural %} with access to both {% data variables.product.prodname_ghe_server %} and the destination enterprise. The high-level phases of a migration are: diff --git a/content/migrations/elm/complete-your-migration.md b/content/migrations/elm/complete-your-migration.md index 2a52b9db435d..4d26183c8849 100644 --- a/content/migrations/elm/complete-your-migration.md +++ b/content/migrations/elm/complete-your-migration.md @@ -10,9 +10,7 @@ contentType: how-tos permissions: 'Organization owners on {% data variables.enterprise.data_residency_site %}' --- -{% data reusables.elm.preview-note %} - -After you have run a migration with the `elm` CLI tool, there are some follow-up tasks to complete. +After you have run a migration with the {% data variables.product.prodname_elm_cli %} tool, there are some follow-up tasks to complete. ## Restore users' access @@ -25,15 +23,44 @@ Because {% data variables.product.prodname_ghe_server %} and {% data variables.e {% data reusables.enterprise-migration-tool.about-mannequins %} For more information, see [AUTOTITLE](/migrations/overview/mannequins-and-user-activity). -Once user accounts have been added to the organization on {% data variables.enterprise.data_residency_site %}, you can invite users to reclaim a mannequin's activity. You can do this in the browser or, with the {% data variables.product.prodname_gei_cli %} tool, reclaim mannequins in bulk without the invite process. +Once user accounts have been added to the organization on {% data variables.enterprise.data_residency_site %}, you can invite users to reclaim a mannequin's activity. You can do this in the browser or, with the {% data variables.product.prodname_elm_cli %} tool, reclaim mannequins in bulk without the invite process. -### Reclaiming mannequins in the browser +### Reclaiming mannequins in bulk using the {% data variables.product.prodname_elm_cli %} -{% data reusables.elm.reclaim-mannequins-in-browser %} +You can use the {% data variables.product.prodname_elm_cli %} to reclaim mannequins in bulk. + +1. Generate the list of mannequins in the migration. The following command produces a CSV file that maps mannequins to organization members. Optionally, to include mannequins that have already been reclaimed, add the `--include-reclaimed` flag. + + ```shell copy + gh target mannequin list ORGANIZATION_NAME + ``` + + This will produce a CSV file of all mannequins in the target organization, in the form `mannequin-user,mannequin-id,target-user`: -### Reclaiming mannequins in bulk + ```text + ghe-admin,M_kgDOAAw-zw, + unit-test,M_kgDOAA5FYg, + admin-octoshift,M_kgDOAA5FZw, + ``` -You can install the {% data variables.product.prodname_gei_cli %} to reclaim mannequins in bulk. See [AUTOTITLE](/migrations/using-github-enterprise-importer/completing-your-migration-with-github-enterprise-importer/reclaiming-mannequins-for-github-enterprise-importer#reclaiming-mannequins-with-the-gei-extension). +1. Output the command to a file that you can edit. + + ```shell copy + gh elm target mannequin list ORGANIZATION_NAME > MANNEQUINS.csv + ``` + +1. Edit the CSV file, adding the username of the organization member that corresponds to each mannequin. Ensure you save the file after you edit it. +1. Reclaim mannequins using the `mannequin reclaim` command. Use the ORGANIZATION_NAME and filename from the previous step. + + ```shell copy + gh target mannequin reclaim ORGANIZATION_NAME --csv MANNEQUINS.csv + ``` + +For a full reference of the reclaim command, including options to control invitations and prompting, see [AUTOTITLE](/migrations/elm/elm-cli-reference). + +### Reclaiming mannequins in the browser + +{% data reusables.elm.reclaim-mannequins-in-browser %} ## Reattribute Git activity diff --git a/content/migrations/elm/elm-cli-reference.md b/content/migrations/elm/elm-cli-reference.md index fa2ab60bc75f..c33b1253d1d8 100644 --- a/content/migrations/elm/elm-cli-reference.md +++ b/content/migrations/elm/elm-cli-reference.md @@ -1,7 +1,7 @@ --- title: Enterprise Live Migrations CLI reference shortTitle: ELM CLI reference -intro: 'Detailed usage information for the {% data variables.product.prodname_elm_short %} CLI tool.' +intro: 'Detailed usage information for the {% data variables.product.prodname_elm_cli %} tool.' versions: fpt: '*' ghes: '*' @@ -9,59 +9,82 @@ versions: contentType: reference --- -{% data reusables.elm.preview-note %} +## Installation -## `elm migration` commands +```shell +gh extension install github/gh-elm +``` + +The extension requires {% data variables.product.prodname_cli %} (`gh`) version 2.0 or later. + +## Setup commands + +| Command | Description | +|-----------------------|----------------------------------------------------------------| +| `gh elm config` | Interactively configure the endpoints and tokens for ELM use | +| `gh elm config reset` | Remove stored configuration and credentials | +| `gh elm config show` | Show the current configuration, with tokens redacted | +| `gh elm completion` | Generate a shell autocompletion script for the specified shell | + + +## Migration commands | Command | Description | |---|---| -| `elm migration create` | Creates a new migration for a single source repository | -| `elm migration start --migration-id MIGRATION-ID` | Starts a migration | -| `elm migration status --migration-id MIGRATION-ID` | Shows the status, progress, cutover readiness, and timing of a migration | -| `elm migration list` | Lists all migrations and their statuses | -| `elm migration cancel --migration-id MIGRATION-ID` | Cancels a migration in progress | -| `elm migration cutover-to-destination --migration-id MIGRATION-ID` | Initiates the final cutover, archiving the source repository and completing the migration | +| `gh elm migration list` | List migrations | +| `gh elm migration create` | Create a new migration | +| `gh elm migration start MIGRATION-ID` | Start a previously created migration | +| `gh elm migration status MIGRATION-ID` | Get the status and details of a migration | +| `gh elm migration watch MIGRATION-ID` | Watch migration progress with a live-updating display | +| `gh elm migration pause MIGRATION-ID` | Pause a running migration | +| `gh elm migration resume MIGRATION-ID` | Resume a paused migration | +| `gh elm migration cancel MIGRATION-ID` | Cancel and terminate a migration | +| `gh elm migration target-id MIGRATION-ID` | Look up the target (destination) migration ID for a migration | +| `gh elm migration cutover MIGRATION-ID` | Initiate a cutover to the destination for a migration | +| `gh elm migration cutover status MIGRATION-ID` | Get the cutover status and progress for a migration | +| `gh elm migration cutover revert MIGRATION-ID` | Revert the effects of a cutover so the source repository can be migrated again | Some of these commands can take additional options. See the later sections in this article. -## `elm migration create` options +## Target commands + +| Command | Description | +| ------- | ----------- | +| `gh elm target mannequin reclaim` | Claim (reclaim) one or more mannequins on the target organization | +| `gh elm target mannequin list` | List a target organization's mannequins as CSV | +| `gh elm target report request` | Request a node report for a migration | +| `gh elm target report status` | Query the status of a migration's node report | +| `gh elm target report url` | Get a signed download URL for a finished report | +| `gh elm target resources` | List a migration's resources from the target | + +## `gh elm migration create` options Create a new migration to prepare for repository export and import. -| Flag | Required | Default | Description | -|---|---|---|---| -| `--source-org` | Yes | N/A | Slug of the source organization on {% data variables.product.prodname_ghe_server %} | -| `--source-repo` | Yes | N/A | Name of the source repository | -| `--target-org` | Yes | N/A | Slug of the destination organization on {% data variables.enterprise.data_residency_site %} | -| `--target-repo` | Yes | N/A | Name of the destination repository | -| `--target-api` | Yes | N/A | {% data reusables.elm.ghe-url-description %} | -| `--pat-name` | Yes | N/A | This must be set to a static string: `system-pat` | -| `--target-visibility` | No | `internal` | Visibility of the destination repository. Must be `private` or `internal`. Public repositories are not supported. | -| `--start` | No | `false` | Automatically starts the migration after creating it | - -## `elm migration list` options - -| Flag | Required | Default | Description | -|---|---|---|---| -| `--status` | No | N/A | Filters results by migration status. Valid values: `created`, `queued`, `in_progress`, `paused`, `completed`, `failed`, `terminated`. | -| `--page-size` | No | N/A | Number of results per page | -| `--after` | No | N/A | Cursor for pagination, from a previous response | - -## `elm migration cutover-to-destination` options - -| Flag | Required | Default | Description | -|---|---|---|---| -| `--migration-id` | Yes | N/A | The ID of a migration that is ready for cutover. | -| `--force` | No | `false` | By default, the command checks whether the migration target reports readiness before proceeding. Use `--force` to bypass this check when you are certain the migration state is correct. | - -## Global flags and variables - -The following properties can be provided either as environment variables or as flags on any command, with command flags taking priority. You should set these values _after_ applying the `ghe-config` configuration. - -| Variable | Flag | Required | Description | -|----------|------|----------|-------------| -| API_URL | `--api-url` | Yes | Must be set to `{% data reusables.elm.localhost-value %}`. | -| MIGRATION_MANAGER_HMAC_KEY | `--migration-manager-hmac-key` | Yes | Must be set to `{% data reusables.elm.hmac-key-value %}`. | -| MIGRATION_TARGET_URL | `--migration-target-url` | Yes | {% data reusables.elm.ghe-url-description %} | -| MIGRATION_TARGET_TOKEN | `--migration-target-token` | Yes | {% data reusables.elm.ghe-pat-description %} | -| DEBUG_HTTP | `--debug-http` | No | Set to `true` to print the HTTP method, URL, headers, and error response body for each request, for debugging purposes | +| Flag | Required | Default | Description | +|-----------------------|----------|------------|-------------------------------------------------------------------------------------------------------------------| +| `--source-org` | Yes | N/A | Slug of the source organization on {% data variables.product.prodname_ghe_server %} | +| `--source-repo` | Yes | N/A | Name of the source repository | +| `--target-org` | Yes | N/A | Slug of the destination organization on {% data variables.enterprise.data_residency_site %} | +| `--target-repo` | Yes | N/A | Name of the destination repository | +| `--target-visibility` | No | `internal` | Visibility of the destination repository. Must be `private` or `internal`. Public repositories are not supported. | +| `--start` | No | `false` | Automatically starts the migration after creating it | +| `--json` | No | `false` | Output the API's raw JSON response instead of human-readable text | + +## `gh elm migration list` options + +| Flag | Required | Default | Description | +|---------------|----------|---------|---------------------------------------------------------------------------------------------------------------------------------------| +| `--status` | No | N/A | Filters results by migration status. Valid values: `created`, `queued`, `in_progress`, `paused`, `completed`, `failed`, `terminated`. | +| `--page-size` | No | N/A | Number of results per page | +| `--after` | No | N/A | Cursor for pagination, from a previous response | +| `--json` | No | `false` | Output the API's raw JSON response instead of human-readable text | + +## `gh elm migration cutover` options + +| Flag | Required | Default | Description | +|------------------|----------|---------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `--migration-id` | Yes | N/A | The ID of a migration that is ready for cutover. | +| `--force` | No | `false` | By default, the command checks whether the migration target reports readiness before proceeding. Use `--force` to bypass this check when you are certain the migration state is correct. | +| `--watch` | No | `false` | After triggering cutover, enter live watch mode | + diff --git a/content/migrations/elm/migrate-your-repository.md b/content/migrations/elm/migrate-your-repository.md index 10ba3bf63e90..bec6e42faf11 100644 --- a/content/migrations/elm/migrate-your-repository.md +++ b/content/migrations/elm/migrate-your-repository.md @@ -10,40 +10,15 @@ contentType: how-tos permissions: 'Site administrators on {% data variables.product.prodname_ghe_server %} who are also enterprise owners on {% data variables.enterprise.data_residency_site %}.' --- -{% data reusables.elm.preview-note %} - >[!TIP] As you follow this guide, you can refer to the [AUTOTITLE](/migrations/elm/elm-cli-reference) for more detailed usage information. If you encounter errors, see [AUTOTITLE](/migrations/elm/troubleshooting). ## Prerequisites -Make sure you're ready for your migration. See [AUTOTITLE](/migrations/elm/prepare-for-your-migration). - -## 1. Create access tokens - -You must authenticate with a {% data variables.product.pat_v1 %} for both the source and destination of the migration. For detailed instructions, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic). - -**Make a note of both tokens**, as you will need them in the next step. - -1. Create a {% data variables.product.pat_v1 %} on **{% data variables.product.prodname_ghe_server %}** with the following scopes. +Make sure your environments and developers are ready for the migration. See [AUTOTITLE](/migrations/elm/prepare-for-your-migration). - * `repo` - * `admin:org` - * `admin:repo_hook` - * `admin:org_hook` +## 1. Configure {% data variables.product.prodname_ghe_server %} -1. Create a {% data variables.product.pat_v1 %} on **{% data variables.enterprise.data_residency_site %}** with the following scopes. - - * `repo` - * `workflow` - * `admin:org` - * `admin:repo_hook` - * `admin:enterprise` - -1. If single sign-on is enforced on the target organization on {% data variables.enterprise.data_residency_site %}, authorize the {% data variables.enterprise.data_residency_site %} token. - -## 2. Configure {% data variables.product.prodname_ghe_server %} - -You must set some configuration on the {% data variables.product.prodname_ghe_server %} instance before performing a migration. These configuration values apply to all {% data variables.product.prodname_elm_short %} migrations. Developers on {% data variables.product.prodname_ghe_server %} may experience a brief downtime when you apply the new configuration. +You must set some configuration on the {% data variables.product.prodname_ghe_server %} instance before creating tokens and performing a migration. These configuration values apply to all {% data variables.product.prodname_elm_short %} migrations. Developers on {% data variables.product.prodname_ghe_server %} may experience a brief downtime when you apply the new configuration. 1. Access the {% data variables.product.prodname_ghe_server %} administrative shell over SSH. See [AUTOTITLE]({% ifversion not ghes %}/enterprise-server@latest{% endif %}/admin/administering-your-instance/administering-your-instance-from-the-command-line/accessing-the-administrative-shell-ssh). 1. Set the following configuration variables with `ghe-config`. @@ -56,10 +31,7 @@ You must set some configuration on the {% data variables.product.prodname_ghe_se | `app.elm.internal-webhooks-enabled` | `true` | | `app.elm-exporter.webhooks-loopback-address-enabled` | `true` | | `secrets.elm-exporter.migration-target-url` | {% data reusables.elm.ghe-url-description %} | - | `secrets.elm-exporter.migration-target-token` | The access token you created for {% data variables.enterprise.data_residency_site %}. | - | `secrets.elm-exporter.source-token` | The access token you created for {% data variables.product.prodname_ghe_server %}. | - | `secrets.elm-exporter.source-user` | The username associated with the {% data variables.product.prodname_ghe_server %} token (for example: `ghe-admin`). | - | `app.migrations.enabled` | If you don't already have migrations enabled on the instance, you must set this to `true`. | + | `secrets.elm-exporter.source-user` | The username associated with the operator's {% data variables.product.prodname_ghe_server %} token. This should be your username on {% data variables.product.prodname_ghe_server %}; if someone else is going to create this token, the value here should be set to their username. We recommend the `ghe-admin` user. | 1. Apply the configuration. @@ -67,51 +39,126 @@ You must set some configuration on the {% data variables.product.prodname_ghe_se ghe-config-apply ``` -## 3. Set required environment variables +1. Leave the SSH session. You will run the rest of the commands in a local terminal session. -When the configuration has been applied, and before starting a migration, set required environment variables. For example: +## 2. Create operator tokens with enterprise access -```shell -export API_URL='{% data reusables.elm.localhost-value %}' -``` +The operator must authenticate to both the source and destination enterprise with a {% data variables.product.pat_v1 %}. For instructions on creating tokens, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic). + +**Ensure that you make a note of both tokens**, as you will need them in the next step. + +1. On **{% data variables.product.prodname_ghe_server %}**, create a {% data variables.product.pat_v1 %} and select the required scope: + + * `admin:enterprise` + + You will use this token as the **Source token** when configuring the {% data variables.product.prodname_elm_cli %}. + +1. On **{% data variables.enterprise.data_residency_site %}**, create a {% data variables.product.pat_v1 %} and select the required scopes: + + * `admin:enterprise` + * `admin:org` ->[!IMPORTANT] Copy the values for `API_URL` and `MIGRATION_MANAGER_HMAC_KEY` verbatim. The other variables are specific to your environment. + You will use this token as the **Target token** when configuring the {% data variables.product.prodname_elm_cli %}. -| Variable | Required value | -| -------- | -------------- | -| API_URL | `{% data reusables.elm.localhost-value %}` | -| MIGRATION_MANAGER_HMAC_KEY | `{% data reusables.elm.hmac-key-value %}` | -| MIGRATION_TARGET_URL | {% data reusables.elm.ghe-url-description %} | -| MIGRATION_TARGET_TOKEN | {% data reusables.elm.ghe-pat-description %} | +## 3. Configure the {% data variables.product.prodname_elm_short %} command line tool + +You will run the migration from a local terminal session, using an extension of the {% data variables.product.prodname_cli %}. + +1. Install the [{% data variables.product.prodname_cli %}](https://cli.github.com/) on your local machine. You must be using version 2.0 or later. +1. Install the {% data variables.product.prodname_elm_short %} extension. + + ```shell copy + gh extension install github/gh-elm + ``` + +1. Launch the installation wizard to configure the extension. + + ```shell copy + gh elm configure + ``` -Any of these values can also be provided as CLI flags on any `elm` command, which will take priority over the variables. For example: `--api-url {% data reusables.elm.localhost-value %}`. +1. Follow the instructions in the installation wizard, providing the API URLs (for example: `https://api.{% data variables.enterprise.data_residency_domain %}`) for your source and destination and the tokens you created in the previous step. -## 4. Create a migration +Any of these values can also be provided as CLI flags on any `gh elm` command, which will take priority over the configuration. For example: `--target-url https://api.{% data variables.enterprise.data_residency_domain %}`. -Create a new migration by specifying the source and target repository details. `--pat-name` must be set to `system-pat` as a static value. The other values are placeholders specific to your environment. +This setup process will store the URLs in a platform-specific configuration file in your operating system's configuration directory, at `gh-elm/config.json`. The access tokens will be securely stored in your computer's secret storage. + +## 4. Configure the live migration secrets + +In addition to the operator tokens with enterprise access, you must create a {% data variables.product.pat_v1 %} for the source and target organizations. You must repeat these steps for every organization you are migrating from. + +### Create access tokens + +{% data variables.product.prodname_elm_short %} must authenticate with a {% data variables.product.pat_v1 %} for both the source and destination of the migration. For instructions on creating tokens, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic). + +**Ensure that you make a note of these tokens**, as you will need them in the next step. + +1. Create a {% data variables.product.pat_v1 %} on **{% data variables.product.prodname_ghe_server %}** with the following scopes: + + * `repo` + * `admin:org` + * `admin:repo_hook` + * `admin:org_hook` + + This is your source token. + +1. Create a {% data variables.product.pat_v1 %} on **{% data variables.enterprise.data_residency_site %}** with the following scopes: + + * `repo` + * `workflow` + * `admin:org` + * `admin:repo_hook` + * `admin:enterprise` + + This is your target token. + + > [!IMPORTANT] + > If single sign-on is enforced on the target organization on {% data variables.enterprise.data_residency_site %}, you must authorize the {% data variables.enterprise.data_residency_site %} token for SSO. + +### Configure your organization's {% data variables.product.prodname_elm_short %} secrets + +Use the `gh elm config` commands to set the source and target access tokens: + +1. Set the source token. + + ```shell copy + gh elm config set-source-pat EXISTING-GHES-ORG + ``` + + Paste the source token into the terminal when asked. + +1. Set the target token. + + ```shell copy + gh elm config set-target-pat EXISTING-GHES-ORG + ``` + + Paste the target token into the terminal when asked. + +You can also set the tokens interactively, using `gh elm config org-tokens EXISTING-GHES-ORG`, or in your organization settings at `https://GHES_HOSTNAME/organizations/EXISTING-GHES-ORG/settings/secrets/elm-exporter/`. + +## 5. Create a migration + +Create a new migration by specifying the source and target repository details. >[!NOTE] The `target-org` can be new or existing. If the target organization doesn't already exist, it will be created during the migration. However, no settings from the source organization will be migrated. ```shell copy -elm migration create \ +gh elm migration create \ --source-org EXISTING-GHES-ORG \ --source-repo EXISTING-GHES-REPO \ --target-org GHEC-ORG \ - --target-repo NEW-GHEC-REPO \ - --target-api GHEC-API-URL \ - --pat-name system-pat + --target-repo NEW-GHEC-REPO ``` For example: ``` shell -elm migration create \ +gh elm migration create \ --source-org my-ghes-org \ --source-repo my-ghes-repo \ --target-org my-dr-org \ - --target-repo my-dr-repo \ - --target-api $MIGRATION_TARGET_URL \ - --pat-name system-pat + --target-repo my-dr-repo ``` Optional flags: @@ -135,24 +182,34 @@ Export the `migrationId` as a variable, as you will need it for the next command export MIGRATION_ID='2b5c9eae-b5da-4306-ab04-2a29cc2b7cb9' ``` -## 5. Start the migration +## 6. Start the migration If you didn't already start the migration, start it now using the migration ID you just saved. ``` shell copy -elm migration start --migration-id $MIGRATION_ID +gh elm migration start --migration-id $MIGRATION_ID ``` This launches the backfill and live update processes. {% data variables.product.prodname_elm_short %} is now collecting data from the source repository and listening for supported webhook events. -## 6. Monitor the migration +## 7. Monitor the migration When the migration has started, you should see a new repository on {% data variables.enterprise.data_residency_site %}. During the migration, you will see the repository fill with an initial load of data and receive updates as developers continue to work in the source repository. -Run the following command regularly to monitor the migration status. You will see a breakdown of the statuses of the source and target, and information on live data being migrated. +You can monitor the progress of the migration interactively using the `watch` command: + +```shell +gh elm migration watch $MIGRATION_ID +``` + +This will poll the migration status API and display a self-refreshing text UI that reflects the current progress. + +### Programmatic monitoring using `migration status` + +If you want a migration status suitable for automation, use the `status` command: ``` shell copy -elm migration status --migration-id $MIGRATION_ID +gh elm migration status --migration-id $MIGRATION_ID ``` The most important indicator in the response is the status in the **combinedState** object. When the status reaches `COMBINED_STATUS_READY_FOR_CUTOVER`, you should be ready to proceed to the next step. However, you will be alerted in the `displayMessage` if any individual resources failed to migrate, which you may need to investigate. @@ -177,15 +234,15 @@ For example: Tips: -* If you're running multiple migrations, you can check the status of all of them with `elm migration list`. This command shows in-progress migrations by default, but you can also filter by `--status`. +* If you're running multiple migrations, you can check the status of all of them with `gh elm migration list`. This command shows in-progress migrations by default, but you can also filter by `--status`. * If you encounter failure statuses that require attention, see [AUTOTITLE](/migrations/elm/troubleshooting#statuses-and-recommended-actions). -## 7. Complete the migration +## 8. Complete the migration When a migration is ready for cutover, you can complete the migration. The cutover process will archive the source repository, making it **permanently read-only** unless a repository administrator unarchives it. ``` shell copy -elm migration cutover-to-destination --migration-id $MIGRATION_ID +gh elm migration cutover --migration-id $MIGRATION_ID ``` Continue to monitor the migration. When you see the `MIGRATION_STATUS_COMPLETED` status at the top of the response, the migration is complete, although there are some follow-up tasks to give access to users from {% data variables.product.prodname_ghe_server %}. diff --git a/content/migrations/elm/migrated-data-reference.md b/content/migrations/elm/migrated-data-reference.md index bf08b9d9143e..126f713efbc3 100644 --- a/content/migrations/elm/migrated-data-reference.md +++ b/content/migrations/elm/migrated-data-reference.md @@ -9,8 +9,6 @@ versions: contentType: reference --- -{% data reusables.elm.preview-note %} - ## Data that is migrated {% data variables.product.prodname_elm_short %} migrates almost all repository-level data. Organization-level resources, such as teams, projects, and organizations settings and webhooks, are excluded from the migration and must be configured manually on the target. diff --git a/content/migrations/elm/prepare-for-your-migration.md b/content/migrations/elm/prepare-for-your-migration.md index afafef08806d..3dbbc6605ec1 100644 --- a/content/migrations/elm/prepare-for-your-migration.md +++ b/content/migrations/elm/prepare-for-your-migration.md @@ -9,19 +9,17 @@ versions: contentType: concepts --- -{% data reusables.elm.preview-note %} - ## Is our {% data variables.product.prodname_ghe_server %} instance ready? {% data variables.product.prodname_elm_short %} is available in the latest patch releases for {% data variables.product.prodname_ghe_server %} 3.17 and later. This documentation assumes you are using the following patch version or later. The instructions may not work on earlier versions. -* `3.21.2` -* `3.20.4` -* `3.19.8` -* `3.18.11` -* `3.17.17` +* `3.21.3` +* `3.20.5` +* `3.19.9` +* `3.18.12` +* `3.17.18` Your {% data variables.product.prodname_ghe_server %} instance must also: diff --git a/content/migrations/elm/troubleshooting.md b/content/migrations/elm/troubleshooting.md index 36d1afba4fad..ab7b7ec59b17 100644 --- a/content/migrations/elm/troubleshooting.md +++ b/content/migrations/elm/troubleshooting.md @@ -9,19 +9,17 @@ versions: contentType: other --- -{% data reusables.elm.preview-note %} - -If your migration encounters a problem, check the migration status with `elm migration status --migration-id MIGRATION-ID` and review the error information. +If your migration encounters a problem, check the migration status with `gh elm migration status --migration-id MIGRATION-ID` and review the error information. ## Statuses and recommended actions | Status | Meaning | Recommended action | |---|---|---| -| **Created** | The migration has been created but not yet started | Run `elm migration start` | +| **Created** | The migration has been created but not yet started | Run `gh elm migration start` | | **Queued** | The migration is waiting to start | Wait | -| **Exporting** | Data is being exported from the source | Monitor with `elm migration status` | -| **Processing** | Exported data is being imported to the destination | Monitor with `elm migration status` | -| **Ready for cutover** | The initial migration is complete and the migration is ready for cutover | When ready, run `elm migration cutover-to-destination` | +| **Exporting** | Data is being exported from the source | Monitor with `gh elm migration status` | +| **Processing** | Exported data is being imported to the destination | Monitor with `gh elm migration status` | +| **Ready for cutover** | The initial migration is complete and the migration is ready for cutover | When ready, run `gh elm migration cutover` | | **Cutting over** | The source repository is archived and remaining changes are being applied to the destination | Monitor; the status will transition to **Completed** | | **Completed** | The migration has finished successfully | Verify the destination repository and reclaim mannequins | | **Failed** | The migration encountered an unrecoverable failure | Investigate the error (see below) | @@ -33,36 +31,36 @@ If your migration encounters a problem, check the migration status with `elm mig A migration enters the **Failed** status when an unrecoverable error prevents it from continuing. This is distinct from individual resources failing to import—a failed migration means the migration itself cannot proceed. -To investigate, run `elm migration status --migration-id MIGRATION-ID` and review the error details in the response. Each failure includes a correlation ID in the format `(Correlation ID for Support: UUID)`. If you contact {% data variables.contact.github_support %}, provide this ID so the support team can investigate. +To investigate, run `gh elm migration status --migration-id MIGRATION-ID` and review the error details in the response. Each failure includes a correlation ID in the format `(Correlation ID for Support: UUID)`. If you contact {% data variables.contact.github_support %}, provide this ID so the support team can investigate. -After resolving the underlying issue, abort the failed migration with `elm migration cancel --migration-id MIGRATION-ID` and start a new migration. +After resolving the underlying issue, abort the failed migration with `gh elm migration cancel --migration-id MIGRATION-ID` and start a new migration. ## Migration status is "Paused" -A migration enters the **Paused** status when an issue requires your intervention before it can continue. Run `elm migration status --migration-id MIGRATION-ID` and check the pause reason. +A migration enters the **Paused** status when an issue requires your intervention before it can continue. Run `gh elm migration status --migration-id MIGRATION-ID` and check the pause reason. Common pause reasons: -* **Credential expiry**: One of the {% data variables.product.pat_v1_plural %} has expired. Create a new token with the required scopes and update it with `elm credential update`. Then restart the migration. +* **Credential expiry**: One of the {% data variables.product.pat_v1_plural %} has expired. Create a new token with the required scopes and update it with `gh elm credential update`. Then restart the migration. * **Rate limiting**: The migration hit API rate limits. Wait a few minutes, then restart. To restart a paused migration after resolving the underlying issue: ```shell -elm migration start --migration-id MIGRATION-ID +gh elm migration start --migration-id MIGRATION-ID ``` ## Migration status is "Degraded" A **Degraded** status means the migration service on the {% data variables.product.prodname_ghe_server %} appliance cannot reach the destination enterprise. The migration continues on the source side, but the destination status is unknown. -Check network connectivity between the {% data variables.product.prodname_ghe_server %} appliance and your subdomain of {% data variables.enterprise.data_residency_site %}, then run `elm migration status --migration-id MIGRATION-ID` again. The status response includes a timestamp for the last successful contact with the destination, which can help you assess how long the connectivity issue has been occurring. +Check network connectivity between the {% data variables.product.prodname_ghe_server %} appliance and your subdomain of {% data variables.enterprise.data_residency_site %}, then run `gh elm migration status --migration-id MIGRATION-ID` again. The status response includes a timestamp for the last successful contact with the destination, which can help you assess how long the connectivity issue has been occurring. ## Migration stuck in "Exporting" If your migration remains in the **Exporting** status with no progress change for 30 minutes or more, the exporter may be stuck. -1. Run `elm migration status --migration-id MIGRATION-ID` and note whether resource counts are changing. +1. Run `gh elm migration status --migration-id MIGRATION-ID` and note whether resource counts are changing. 1. If counts are static, check the appliance's network connectivity to the destination. 1. Review exporter logs on the {% data variables.product.prodname_ghe_server %} appliance (requires SSH admin access): @@ -75,7 +73,7 @@ If your migration remains in the **Exporting** status with no progress change fo ## Git synchronization not completing -If `elm migration status` shows that the initial Git push has not completed after an extended period, check the Git syncer logs: +If `gh elm migration status` shows that the initial Git push has not completed after an extended period, check the Git syncer logs: ```shell copy journalctl -t elm-exporter-git-syncer --since "2 hours ago" @@ -84,14 +82,14 @@ journalctl -t elm-exporter-git-syncer --since "2 hours ago" Look for: * **`connection refused`**: A network issue between the {% data variables.product.prodname_ghe_server %} appliance and the destination. Check firewall rules and DNS resolution. -* **`authentication failed`**: The {% data variables.product.pat_v1 %} may lack the required scopes or has expired. +* **`authentication failed`**: The {% data variables.product.pat_v1 %} may lack the required scopes or may have expired. * **`remote: error`**: The destination may be rejecting the push. Contact {% data variables.contact.github_support %} with the error details. ## Some resources failed to import -Individual resources can fail to import without causing the overall migration to fail. You can see a count of failed resources in the output of `elm migration status --migration-id MIGRATION-ID`. +Individual resources can fail to import without causing the overall migration to fail. You can see a count of failed resources in the output of `gh elm migration status --migration-id MIGRATION-ID`. -Failed resources are only shown after all automatic retries have been exhausted, so any failures you see are confirmed as unresolvable without intervention. Review the error details in the status response: each failed resource in backfill or live updates will display `"state": "failed"`. +Failed resources are only shown after all automatic retries have been exhausted, so any failures you see are confirmed as unresolvable without intervention. Review the error details in the status response: each failed resource in backfill or live updates will display `"state": "failed"`. If the number and types of failed resources are acceptable, you can proceed with cutover. If not, abort the migration, resolve the underlying issue, then start a new migration. @@ -103,18 +101,69 @@ If the number and types of failed resources are acceptable, you can proceed with If someone force-pushes to the default branch of the source repository while a migration is in progress, the Git synchronization between the source and destination breaks. Force pushes rewrite commit history in a way that cannot be reconciled incrementally. -If this happens, abort the migration with `elm migration cancel --migration-id MIGRATION-ID` and start a new migration. Before restarting, communicate to your team that force pushes to the default branch are not permitted while a migration is active. +If this happens, abort the migration with `gh elm migration cancel --migration-id MIGRATION-ID` and start a new migration. Before restarting, communicate to your team that force pushes to the default branch are not permitted while a migration is active. -## Access token was rejected +## Migration access token was rejected If your migration fails with an authentication error, check that: -* Both the source and destination tokens are {% data variables.product.pat_v1_plural %}. Fine-grained tokens are not supported. -* The tokens have the scopes specified in [AUTOTITLE](/migrations/elm/migrate-your-repository#1-create-access-tokens). +* Both the source and destination tokens are {% data variables.product.pat_v1_plural %}. {% data variables.product.pat_v2_caps_plural %} are not supported. * If the destination organization enforces SAML single sign-on, the token must be authorized for SSO. +* Both tokens have the scopes specified in [AUTOTITLE](/migrations/elm/migrate-your-repository#4-configure-the-live-migration-secrets). If you recently rotated a token, the migration picks up new credentials automatically. You do not need to run `ghe-config-apply` or restart the migration service. +## {% data variables.product.prodname_cli %} access token was rejected + +{% data variables.product.prodname_elm %} uses two sets of credentials. This section applies to the **operator tokens** created in step 2 and stored locally by `gh elm configure`. + +The operator must use a {% data variables.product.pat_v1 %} for each endpoint: + +* The **source operator token** must be created on {% data variables.product.prodname_ghe_server %}. +* The **target operator token** must be created on {% data variables.enterprise.data_residency_site %}. +* Both tokens have the scopes specified in [AUTOTITLE](/migrations/elm/migrate-your-repository#2-create-the-tokens-used-by-the-operator-who-will-perform-the-migration). +* The token owner must be an administrator of the corresponding enterprise. Selecting a scope does not grant the user administrative access. +* {% data variables.product.pat_v2_caps_plural %} are not supported. + +### Common responses + +| Response | Meaning | Remedy | +| --- | --- | --- | +| `401 Bad credentials` | The endpoint could not authenticate the token. Authorization scopes have not been evaluated yet. | Check that the token has not expired or been revoked, that it was copied completely, and that the source and target tokens were not exchanged. Confirm that each token was created on the host where it is being used. | +| `403 Forbidden` | The token was authenticated, but its user or scopes do not authorize the operation. | Use a {% data variables.product.pat_v1 %} with `admin:enterprise`. Confirm that the token owner is an administrator of the enterprise. If SAML SSO applies, authorize the token for SSO. | +| `Resource not accessible by {% data variables.product.pat_generic %}` | The token type or permissions are unsupported. This commonly occurs with a {% data variables.product.pat_v2 %}. | Replace it with a {% data variables.product.pat_v1 %} that has `admin:enterprise`. | +| `404 Not Found` | The request may be using the wrong API URL, or {% data variables.product.prodname_elm %} may not be enabled for the destination enterprise. | For {% data variables.enterprise.data_residency_site %}, use the tenant API URL, such as `https://api.SUBDOMAIN.ghe.com`, without a trailing slash. Verify the source API URL as well. If both URLs are correct, contact {% data variables.contact.github_support %} to confirm that {% data variables.product.prodname_elm %} is enabled. | + +### Validate the tokens independently + +Test each token against the `/user` endpoint before using it with {% data variables.product.prodname_elm %}. These commands print response headers but discard the response body. + +For the source ({% data variables.product.prodname_ghe_server %}) token: + +```shell +curl --silent --show-error --output /dev/null --dump-header - \ + --header "Authorization: Bearer $SOURCE_OPERATOR_TOKEN" \ + "$SOURCE_API_URL/user" +``` + +For the target token: + +```shell +curl --silent --show-error --output /dev/null --dump-header - \ + --header "Authorization: Bearer $TARGET_OPERATOR_TOKEN" \ + "$TARGET_API_URL/user" +``` + +Each request should return `200 OK`. The `X-OAuth-Scopes` response header should include `admin:enterprise`. + +If `/user` returns `200 OK` but an {% data variables.product.prodname_elm %} command returns `401 Bad credentials`, the CLI may have a different token or URL stored. Run `gh elm configure` again and carefully associate each token with its corresponding endpoint. + +Operator tokens are stored locally by the {% data variables.product.prodname_elm %} CLI. After rotating an operator token, run `gh elm configure` again or supply the replacement credentials using the appropriate command-line options. + +This differs from the migration service tokens configured in step 4. Updated migration service credentials are picked up automatically and do not require `ghe-config-apply` or a migration-service restart. + +Do not include access tokens in logs, screenshots, support bundles, or support requests. If the problem continues, provide {% data variables.contact.github_support %} with the HTTP status, endpoint hostname, migration ID, timestamp with timezone, and any correlation ID—but not the token. + ## The source GHES URL was rejected {% data variables.product.prodname_elm %} requires the {% data variables.product.prodname_ghe_server %} URL to use HTTPS. If the URL is configured with HTTP, the migration will fail preflight validation. @@ -123,8 +172,8 @@ If you recently rotated a token, the migration picks up new credentials automati When contacting {% data variables.contact.github_support %}, the most useful artifacts are: -1. **A support bundle** (preferred): Run `ghe-support-bundle -u` on the {% data variables.product.prodname_ghe_server %} appliance. This captures all ELM logs automatically. -1. **Migration status output**: `elm migration status --migration-id MIGRATION-ID` +1. **A support bundle** (preferred): Run `ghe-support-bundle -u` on the {% data variables.product.prodname_ghe_server %} appliance. This captures all {% data variables.product.prodname_elm %} logs automatically. +1. **Migration status output**: `gh elm migration status --migration-id MIGRATION-ID` 1. **The migration ID** and approximate time of failure (with timezone) 1. **Any correlation IDs** from error messages diff --git a/content/migrations/overview/mannequins-and-user-activity.md b/content/migrations/overview/mannequins-and-user-activity.md index 3fb3ca1d09fd..27efa4aa452f 100644 --- a/content/migrations/overview/mannequins-and-user-activity.md +++ b/content/migrations/overview/mannequins-and-user-activity.md @@ -23,7 +23,7 @@ Reclaiming is optional and can happen any time after a migration is finished. Fo ## How can I reclaim mannequins? -{% data reusables.enterprise-migration-tool.how-to-reclaim %} For instructions, see [AUTOTITLE](/migrations/using-github-enterprise-importer/completing-your-migration-with-github-enterprise-importer/reclaiming-mannequins-for-github-enterprise-importer). +{% data reusables.enterprise-migration-tool.how-to-reclaim %} For instructions, see [AUTOTITLE](/migrations/using-github-enterprise-importer/completing-your-migration-with-github-enterprise-importer/reclaiming-mannequins-for-github-enterprise-importer) or [AUTOTITLE](/migrations/elm/complete-your-migration#reattribute-activity-to-users). By default, reclaiming a mannequin will send an attribution invitation to the target user. The target user can choose to accept or reject the invitation. diff --git a/content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization.md b/content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization.md index 00eb198750ad..caeb5a661880 100644 --- a/content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization.md +++ b/content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization.md @@ -88,7 +88,8 @@ Some of the features listed below are limited to organizations using {% data var | Merge a [pull request](/pull-requests/reference/pull-request-merges) | ✗ | ✗ | ✓ | ✓ | ✓ | | Push to (write) the person or team's assigned repositories | ✗ | ✗ | ✓ | ✓ | ✓ | | Edit and delete anyone's comments on commits, pull requests, and issues | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Hide anyone's comments](/communities/moderating-comments-and-conversations/managing-disruptive-comments) | ✗ | {% ifversion discussions-moderators-control-who-can-report %}✓{% endif %} | ✓ | ✓ | ✓ | +| [Hide anyone's comments on discussions](/communities/moderating-comments-and-conversations/managing-disruptive-comments) | ✗ | ✓ | ✓ | ✓ | ✓ | +| [Hide anyone's comments on issues, pull requests, and commits](/communities/moderating-comments-and-conversations/managing-disruptive-comments) | ✗ | ✗ | ✓ | ✓ | ✓ | | [Lock conversations](/communities/moderating-comments-and-conversations/locking-conversations) | ✗ | ✗ | ✓ | ✓ | ✓ | | Transfer issues (see [AUTOTITLE](/issues/tracking-your-work-with-issues/administering-issues/transferring-an-issue-to-another-repository) for details) | ✗ | ✗ | ✓ | ✓ | ✓ | | [Act as a designated code owner for a repository](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners) | ✗ | ✗ | ✓ | ✓ | ✓ | @@ -155,7 +156,7 @@ Some of the features listed below are limited to organizations using {% data var | Create autolink references to external resources, like Jira or Zendesk (see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/configuring-autolinks-to-reference-external-resources)) | ✗ | ✗ | ✗ | ✗ | ✓ | | [Enable {% data variables.product.prodname_discussions %}](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/enabling-or-disabling-github-discussions-for-a-repository) in a repository | ✗ | ✗ | ✗ | ✓ | ✓ | | [Create and edit categories](/discussions/managing-discussions-for-your-community/managing-categories-for-discussions) for {% data variables.product.prodname_discussions %} | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Move a discussion to a different category](/discussions/managing-discussions-for-your-community/managing-discussions) | ✗ | {% ifversion discussions-moderators-control-who-can-report %}✓{% endif %} | ✓ | ✓ | ✓ | +| [Move a discussion to a different category](/discussions/managing-discussions-for-your-community/managing-discussions) | ✗ | ✓ | ✓ | ✓ | ✓ | | [Transfer a discussion](/discussions/managing-discussions-for-your-community/managing-discussions) to a new repository| ✗ | ✗ | ✓ | ✓ | ✓ | | [Manage pinned discussions](/discussions/managing-discussions-for-your-community/managing-discussions) | ✗ | ✗ | ✓ | ✓ | ✓ | | [Lock and unlock discussions](/discussions/managing-discussions-for-your-community/moderating-discussions) | ✗ | ✓ | ✓ | ✓ | ✓ | diff --git a/content/rest/enterprise-admin/live-migrations.md b/content/rest/enterprise-admin/live-migrations.md index 993a74f3890d..b1bd383a280d 100644 --- a/content/rest/enterprise-admin/live-migrations.md +++ b/content/rest/enterprise-admin/live-migrations.md @@ -10,6 +10,4 @@ category: - Administer enterprises and billing --- -{% data reusables.elm.preview-note %} - diff --git a/contributing/translations-for-translators.md b/contributing/translations-for-translators.md index 4982f7726386..ea19788c9da5 100644 --- a/contributing/translations-for-translators.md +++ b/contributing/translations-for-translators.md @@ -15,6 +15,6 @@ We do not accept translation changes from open source contributors. - [ ] Lint all `*.yml` files before submitting to make sure they are valid YAML format. - [ ] Lint all frontmatter (between the triple dashes at the top of all `/content` files) to make sure they are valid YAML format. -- [ ] Do not translate anything inside of Liquid tags, such as `{% data %}` or `{% ifversion ... %}`, `{% note %}` or `{{ someVariable }}`. +- [ ] Do not translate anything inside of Liquid tags, such as `{% data %}` or `{% ifversion ... %}`, `{% octicon %}` or `{{ someVariable }}`. - [ ] Be sure to translate the frontmatter properties `title`, `shortTitle`, `intro`, `permissions` but leave all other keys in each content `.md` file - [ ] For every `{% ifversion ... %}` there's a `{% endif %}` following it diff --git a/data/features/actions-paths-filter-limit.yml b/data/features/actions-paths-filter-limit.yml new file mode 100644 index 000000000000..dfdd88066b03 --- /dev/null +++ b/data/features/actions-paths-filter-limit.yml @@ -0,0 +1,6 @@ +# Workflow path filters evaluate up to 3,000 changed files + +versions: + fpt: '*' + ghec: '*' + ghes: '>=3.22' diff --git a/data/release-notes/enterprise-server/3-17/0.yml b/data/release-notes/enterprise-server/3-17/0.yml index eee5e0a963f9..a5da08881b03 100644 --- a/data/release-notes/enterprise-server/3-17/0.yml +++ b/data/release-notes/enterprise-server/3-17/0.yml @@ -2,11 +2,7 @@ date: '2025-06-03' release_candidate: false deprecated: false intro: | - {% warning %} - - **Warning**: We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] - - {% endwarning %} + > [!WARNING] We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] sections: # Remove section heading if the section contains no notes. diff --git a/data/release-notes/enterprise-server/3-17/1.yml b/data/release-notes/enterprise-server/3-17/1.yml index 0a74e0379c94..db55926a3d9a 100644 --- a/data/release-notes/enterprise-server/3-17/1.yml +++ b/data/release-notes/enterprise-server/3-17/1.yml @@ -1,10 +1,6 @@ date: '2025-06-18' intro: | - {% warning %} - - **Warning**: We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] - - {% endwarning %} + > [!WARNING] We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-17/12.yml b/data/release-notes/enterprise-server/3-17/12.yml index 483290992335..b750ebe624e8 100644 --- a/data/release-notes/enterprise-server/3-17/12.yml +++ b/data/release-notes/enterprise-server/3-17/12.yml @@ -1,10 +1,6 @@ date: '2026-03-10' intro: | - {% warning %} - - **Warning**: {% data variables.product.prodname_ghe_server %} 3.17.12 has been unpublished due to mismatched Git versions between containers. Please use the most recent available patch release of 3.17. [Updated: 2026-03-13] - - {% endwarning %} + > [!WARNING] {% data variables.product.prodname_ghe_server %} 3.17.12 has been unpublished due to mismatched Git versions between containers. Please use the most recent available patch release of 3.17. [Updated: 2026-03-13] sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-17/18.yml b/data/release-notes/enterprise-server/3-17/18.yml index c35bc7af6562..fcff853f10b0 100644 --- a/data/release-notes/enterprise-server/3-17/18.yml +++ b/data/release-notes/enterprise-server/3-17/18.yml @@ -5,6 +5,8 @@ sections: features: - | Site administrators can configure a customer-managed cloud object store (Amazon S3, Azure Blob Storage, or Google Cloud Storage) as an Elasticsearch snapshot repository. This enables incremental Elasticsearch snapshots for backup, restore, and disaster recovery. Management scripts are available for manual snapshot operations and testing. + - | + The Enterprise Live Migrations (ELM) service is generally available, allowing enterprises to migrate repositories from GitHub Enterprise Server to GHE.com with minimal downtime. A new GitHub CLI extension allows administrators to operate the service from their local machine. See [AUTOTITLE](/migrations/elm/about-live-migrations). [Updated: 2026-08-25] security_fixes: - | **HIGH**: An attacker who had code execution inside the Dependabot updater container could write attacker-controlled files to arbitrary paths in a repository that Dependabot updates, including GitHub Actions workflow files. This was possible because dependency-file path validation checked only the declared file name and not the effective path derived from the file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, the injected workflow could execute with access to the repository's GitHub Actions secrets. GitHub has requested CVE ID [CVE-2026-15343](https://www.cve.org/cverecord?id=CVE-2026-15343) for this vulnerability. diff --git a/data/release-notes/enterprise-server/3-17/2.yml b/data/release-notes/enterprise-server/3-17/2.yml index 715da25381e1..d257b15c495f 100644 --- a/data/release-notes/enterprise-server/3-17/2.yml +++ b/data/release-notes/enterprise-server/3-17/2.yml @@ -1,10 +1,6 @@ date: '2025-07-01' intro: | - {% warning %} - - **Warning**: We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] - - {% endwarning %} + > [!WARNING] We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-17/3.yml b/data/release-notes/enterprise-server/3-17/3.yml index 56e7c3770b79..bae20351e1d6 100644 --- a/data/release-notes/enterprise-server/3-17/3.yml +++ b/data/release-notes/enterprise-server/3-17/3.yml @@ -1,10 +1,6 @@ date: '2025-07-15' intro: | - {% warning %} - - **Warning**: We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] - - {% endwarning %} + > [!WARNING] We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-17/4.yml b/data/release-notes/enterprise-server/3-17/4.yml index 78dbd7f086a0..ca3683d556a6 100644 --- a/data/release-notes/enterprise-server/3-17/4.yml +++ b/data/release-notes/enterprise-server/3-17/4.yml @@ -1,10 +1,6 @@ date: '2025-07-29' intro: | - {% warning %} - - **Warning**: We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] - - {% endwarning %} + > [!WARNING] We received a few reports of performance issues with GitHub Enterprise Server versions 3.15, 3.16, and 3.17 and have shipped performance fixes to the affected versions. You can now upgrade to 3.15.12, 3.16.8, 3.17.5, or later. We do not recommend upgrading to earlier releases of 3.15, 3.16, or 3.17. [Updated: 2025-08-25] sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-17/5.yml b/data/release-notes/enterprise-server/3-17/5.yml index ed33b7296cbb..73241617951e 100644 --- a/data/release-notes/enterprise-server/3-17/5.yml +++ b/data/release-notes/enterprise-server/3-17/5.yml @@ -1,10 +1,6 @@ date: '2025-08-25' intro: | - {% warning %} - - **Warning**: We are lifting the pause on upgrade to 3.17. You can now upgrade to version 3.17.5, but not to earlier releases of 3.17. This release includes optimizations that address performance issues reported in recent versions of GitHub Enterprise Server. As an additional step, it is recommended to check system capacity before upgrading. See [check system capacity before upgrading](/admin/upgrading-your-instance/preparing-to-upgrade/check-system-capacity-before-upgrading). - - {% endwarning %} + > [!WARNING] We are lifting the pause on upgrade to 3.17. You can now upgrade to version 3.17.5, but not to earlier releases of 3.17. This release includes optimizations that address performance issues reported in recent versions of GitHub Enterprise Server. As an additional step, it is recommended to check system capacity before upgrading. See [check system capacity before upgrading](/admin/upgrading-your-instance/preparing-to-upgrade/check-system-capacity-before-upgrading). sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-18/12.yml b/data/release-notes/enterprise-server/3-18/12.yml index 0e2739749932..37320a4b4c15 100644 --- a/data/release-notes/enterprise-server/3-18/12.yml +++ b/data/release-notes/enterprise-server/3-18/12.yml @@ -5,6 +5,8 @@ sections: features: - | Site administrators can configure a customer-managed cloud object store (Amazon S3, Azure Blob Storage, or Google Cloud Storage) as an Elasticsearch snapshot repository. This enables incremental Elasticsearch snapshots for backup, restore, and disaster recovery. Management scripts are available for manual snapshot operations and testing. + - | + The Enterprise Live Migrations (ELM) service is generally available, allowing enterprises to migrate repositories from GitHub Enterprise Server to GHE.com with minimal downtime. A new GitHub CLI extension allows administrators to operate the service from their local machine. See [AUTOTITLE](/migrations/elm/about-live-migrations). [Updated: 2026-08-25] security_fixes: - | **HIGH**: An attacker who had code execution inside the Dependabot updater container could write attacker-controlled files to arbitrary paths in a repository that Dependabot updates, including GitHub Actions workflow files. This was possible because dependency-file path validation checked only the declared file name and not the effective path derived from the file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, the injected workflow could execute with access to the repository's GitHub Actions secrets. GitHub has requested CVE ID [CVE-2026-15343](https://www.cve.org/cverecord?id=CVE-2026-15343) for this vulnerability. diff --git a/data/release-notes/enterprise-server/3-18/6.yml b/data/release-notes/enterprise-server/3-18/6.yml index cc9a69c78242..337c1a413484 100644 --- a/data/release-notes/enterprise-server/3-18/6.yml +++ b/data/release-notes/enterprise-server/3-18/6.yml @@ -1,10 +1,6 @@ date: '2026-03-10' intro: | - {% warning %} - - **Warning**: {% data variables.product.prodname_ghe_server %} 3.18.6 has been unpublished for operational reasons. Please use the most recent available patch release of 3.18. [Updated: 2026-3-13] - - {% endwarning %} + > [!WARNING] {% data variables.product.prodname_ghe_server %} 3.18.6 has been unpublished for operational reasons. Please use the most recent available patch release of 3.18. [Updated: 2026-3-13] sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-19/3.yml b/data/release-notes/enterprise-server/3-19/3.yml index 76aa379727c5..a8463a736de9 100644 --- a/data/release-notes/enterprise-server/3-19/3.yml +++ b/data/release-notes/enterprise-server/3-19/3.yml @@ -1,10 +1,6 @@ date: '2026-03-10' intro: | - {% warning %} - - **Warning**: {% data variables.product.prodname_ghe_server %} 3.19.3 has been unpublished for operational reasons. Please use the most recent available patch release of 3.19. [Updated: 2026-03-13] - - {% endwarning %} + > [!WARNING] {% data variables.product.prodname_ghe_server %} 3.19.3 has been unpublished for operational reasons. Please use the most recent available patch release of 3.19. [Updated: 2026-03-13] sections: security_fixes: - | diff --git a/data/release-notes/enterprise-server/3-19/9.yml b/data/release-notes/enterprise-server/3-19/9.yml index aa11f8a90760..014a2f18044a 100644 --- a/data/release-notes/enterprise-server/3-19/9.yml +++ b/data/release-notes/enterprise-server/3-19/9.yml @@ -5,6 +5,8 @@ sections: features: - | Site administrators can configure a customer-managed cloud object store (Amazon S3, Azure Blob Storage, or Google Cloud Storage) as an Elasticsearch snapshot repository. This enables incremental Elasticsearch snapshots for backup, restore, and disaster recovery. Management scripts are available for manual snapshot operations and testing. + - | + The Enterprise Live Migrations (ELM) service is generally available, allowing enterprises to migrate repositories from GitHub Enterprise Server to GHE.com with minimal downtime. A new GitHub CLI extension allows administrators to operate the service from their local machine. See [AUTOTITLE](/migrations/elm/about-live-migrations). [Updated: 2026-08-25] security_fixes: - | **HIGH**: An attacker who had code execution inside the Dependabot updater container could write attacker-controlled files to arbitrary paths in a repository that Dependabot updates, including GitHub Actions workflow files. This was possible because dependency-file path validation checked only the declared file name and not the effective path derived from the file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, the injected workflow could execute with access to the repository's GitHub Actions secrets. GitHub has requested CVE ID [CVE-2026-15343](https://www.cve.org/cverecord?id=CVE-2026-15343) for this vulnerability. diff --git a/data/release-notes/enterprise-server/3-20/5.yml b/data/release-notes/enterprise-server/3-20/5.yml index cc6071365bff..8cd3e1d88aaa 100644 --- a/data/release-notes/enterprise-server/3-20/5.yml +++ b/data/release-notes/enterprise-server/3-20/5.yml @@ -5,6 +5,8 @@ sections: features: - | Site administrators can configure a customer-managed cloud object store (Amazon S3, Azure Blob Storage, or Google Cloud Storage) as an Elasticsearch snapshot repository. This enables incremental Elasticsearch snapshots for backup, restore, and disaster recovery. Management scripts are available for manual snapshot operations and testing. + - | + The Enterprise Live Migrations (ELM) service is generally available, allowing enterprises to migrate repositories from GitHub Enterprise Server to GHE.com with minimal downtime. A new GitHub CLI extension allows administrators to operate the service from their local machine. See [AUTOTITLE](/migrations/elm/about-live-migrations). [Updated: 2026-08-25] security_fixes: - | **HIGH**: An attacker who had code execution inside the Dependabot updater container could write attacker-controlled files to arbitrary paths in a repository that Dependabot updates, including GitHub Actions workflow files. This was possible because dependency-file path validation checked only the declared file name and not the effective path derived from the file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, the injected workflow could execute with access to the repository's GitHub Actions secrets. GitHub has requested CVE ID [CVE-2026-15343](https://www.cve.org/cverecord?id=CVE-2026-15343) for this vulnerability. diff --git a/data/release-notes/enterprise-server/3-21/3.yml b/data/release-notes/enterprise-server/3-21/3.yml index 8b2dbee50b39..a33e1b74e7d5 100644 --- a/data/release-notes/enterprise-server/3-21/3.yml +++ b/data/release-notes/enterprise-server/3-21/3.yml @@ -2,6 +2,9 @@ date: '2026-07-16' intro: | > [!NOTE] As part of a security enhancement to {% data variables.product.prodname_ghe_server %} support bundle uploads, {% data variables.product.company_short %} will begin rejecting uploads from older unpatched appliances on August 18, 2026. Please update to this patch release to avoid interruptions when submitting support bundles with `ghe-support-bundle`, `ghe-cluster-support-bundle`, or `ghe-support-upload`. The minimum required patch versions to submit support bundles are 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18. If you cannot update to the required patch version before August 18, 2026, and need to upload a support bundle, contact [GitHub Support](https://support.github.com/enterprise-and-teams#enterprise-administrators-server) for guidance. sections: + features: + - | + The Enterprise Live Migrations (ELM) service is generally available, allowing enterprises to migrate repositories from GitHub Enterprise Server to GHE.com with minimal downtime. A new GitHub CLI extension allows administrators to operate the service from their local machine. See [AUTOTITLE](/migrations/elm/about-live-migrations). [Updated: 2026-08-25] security_fixes: - | **HIGH**: An attacker who had code execution inside the Dependabot updater container could write attacker-controlled files to arbitrary paths in a repository that Dependabot updates, including GitHub Actions workflow files. This was possible because dependency-file path validation checked only the declared file name and not the effective path derived from the file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, the injected workflow could execute with access to the repository's GitHub Actions secrets. GitHub has requested CVE ID [CVE-2026-15343](https://www.cve.org/cverecord?id=CVE-2026-15343) for this vulnerability. diff --git a/data/reusables/actions/workflows/triggering-a-workflow-paths5.md b/data/reusables/actions/workflows/triggering-a-workflow-paths5.md index 12cc9254cee2..8f5768e75b25 100644 --- a/data/reusables/actions/workflows/triggering-a-workflow-paths5.md +++ b/data/reusables/actions/workflows/triggering-a-workflow-paths5.md @@ -9,7 +9,7 @@ In some situations, {% data variables.product.prodname_actions %} applies limits * If a push contains more than 1,000 commits, the workflow will **always** run. * If generating the diff times out, the workflow will **always** run. -* If the generated diff contains more than 3,000 files and the files the workflow filter matches are not in the first 3,000 returned by the filter, the workflow will **not** run. +* If the generated diff contains more than {% ifversion actions-paths-filter-limit %}3,000{% else %}300{% endif %} files and the files the workflow filter matches are not in the first {% ifversion actions-paths-filter-limit %}3,000{% else %}300{% endif %} returned by the filter, the workflow will **not** run. If you observe these behaviors, you might need to make your filters more specific, or change how you work with pushes and pull requests to generate simpler diffs. diff --git a/data/reusables/copilot/auto-code-review-steps.md b/data/reusables/copilot/auto-code-review-steps.md index ec87d1b92489..d3f01ae59731 100644 --- a/data/reusables/copilot/auto-code-review-steps.md +++ b/data/reusables/copilot/auto-code-review-steps.md @@ -1,10 +1,6 @@ 1. Under "Target branches," click **Add target** and choose one of the target options. 1. Under "Branch rules," select **Automatically request {% data variables.copilot.copilot_code-review_short %}**. - This expands a set of subsidiary options. - - ![Screenshot of the "Automatically request {% data variables.copilot.copilot_code-review_short %}" branch ruleset option.](/assets/images/help/copilot/code-review/automatic-code-review.png) - 1. Optionally, if you want {% data variables.product.prodname_copilot_short %} to review all new pushes to the pull request, select **Review new pushes**. If this option is not selected, {% data variables.product.prodname_copilot_short %} will only review the pull request once. diff --git a/data/reusables/copilot/automatic-approvals-public-preview.md b/data/reusables/copilot/automatic-approvals-public-preview.md new file mode 100644 index 000000000000..56c582cbb3db --- /dev/null +++ b/data/reusables/copilot/automatic-approvals-public-preview.md @@ -0,0 +1 @@ +{% data variables.product.prodname_copilot_short %} approvals are in {% data variables.release-phases.public_preview %} and subject to change. diff --git a/data/reusables/copilot/available-models-per-plan.md b/data/reusables/copilot/available-models-per-plan.md index 201a79219d15..a3321d13c733 100644 --- a/data/reusables/copilot/available-models-per-plan.md +++ b/data/reusables/copilot/available-models-per-plan.md @@ -5,7 +5,7 @@ | Available models | {% data variables.copilot.copilot_pro_short %} | {% data variables.copilot.copilot_pro_plus_short %} | {% data variables.copilot.copilot_max_short %} | {% data variables.copilot.copilot_business_short %} | {% data variables.copilot.copilot_enterprise_short %} | |---------------------------------------------------------|-------------------------------------------------|-----------------------------------------------------|------------------------------------------------|-----------------------------------------------------|-------------------------------------------------------| | {% for model in tables.copilot.model-supported-plans %} | -| {{ model.name }}{% if model.name == 'GPT-5.4 nano' %}[^gpt54nano]{% endif %}{% if model.name == 'Claude Fable 5' %}[^claude-fable-5]{% endif %} | {% if model.pro == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.pro_plus == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.max == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.business == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.enterprise == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | +| {{ model.name }}{% if model.name == 'GPT-5.4 nano' %}[^gpt54nano]{% endif %}{% if model.name == 'Claude Fable 5' or model.name == 'Claude Fable 5.1' %}[^claude-fable-5]{% endif %} | {% if model.pro == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.pro_plus == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.max == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.business == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | {% if model.enterprise == true %}{% octicon "check" aria-label="Included" %}{% else %}{% octicon "x" aria-label="Not included" %}{% endif %} | | {% endfor %} | {% endrowheaders %} diff --git a/data/reusables/copilot/custom-instructions-note.md b/data/reusables/copilot/custom-instructions-note.md index c4f83f7a74f2..64bb6b44cd82 100644 --- a/data/reusables/copilot/custom-instructions-note.md +++ b/data/reusables/copilot/custom-instructions-note.md @@ -1,10 +1,10 @@ -{% note %} +
Did you successfully add a custom instructions file to your repository? Yes No -{% endnote %} +
## Custom instructions in use diff --git a/data/reusables/copilot/model-autoenablement-excluded-models.md b/data/reusables/copilot/model-autoenablement-excluded-models.md index abd15457165d..22c637d12d2d 100644 --- a/data/reusables/copilot/model-autoenablement-excluded-models.md +++ b/data/reusables/copilot/model-autoenablement-excluded-models.md @@ -4,5 +4,5 @@ The following models are **not** in scope. They are disabled by default, regardl * Pre-GA models * Open weight models (DeepSeek, {% data variables.copilot.copilot_kimi_k27_code %}, {% data variables.copilot.copilot_kimi_k3 %}) -* Models that are not covered by {% data variables.product.company_short %}'s data retention agreement ({% data variables.copilot.copilot_claude_fable_5 %}) +* Models that are not covered by {% data variables.product.company_short %}'s data retention agreement ({% data variables.copilot.copilot_claude_fable_5 %}, {% data variables.copilot.copilot_claude_fable_51 %}) * For enterprises that have restricted models to data-resident or FedRAMP-compliant models, any models that do not respect these policies diff --git a/data/reusables/elm/locked-repo.md b/data/reusables/elm/locked-repo.md index 4377959ca7f7..051ed7c35180 100644 --- a/data/reusables/elm/locked-repo.md +++ b/data/reusables/elm/locked-repo.md @@ -2,4 +2,4 @@ If a cutover fails after the source repository has been archived, the {% data va Be aware that unarchiving a repository will cause additional load on the instance, as all issues and pull requests in the repository will be reindexed in Elasticsearch. -After the source repository is unarchived, you can either retry cutover using `elm migration cutover-to-destination --migration-id MIGRATION-ID`, or abort the migration with `elm migration cancel --migration-id MIGRATION-ID` and start a new migration when you're ready. +After the source repository is unarchived, you can either retry cutover using `gh elm migration cutover --migration-id MIGRATION-ID`, or abort the migration with `gh elm migration cancel --migration-id MIGRATION-ID` and start a new migration when you're ready. diff --git a/data/reusables/elm/preview-note.md b/data/reusables/elm/preview-note.md deleted file mode 100644 index 62330c7645e6..000000000000 --- a/data/reusables/elm/preview-note.md +++ /dev/null @@ -1 +0,0 @@ ->[!NOTE] {% data variables.product.prodname_elm %} is in {% data variables.release-phases.public_preview %} and subject to change. diff --git a/data/reusables/organizations/access-ruleset-settings.md b/data/reusables/organizations/access-ruleset-settings.md index 2c2988c2f5d6..337073a725ef 100644 --- a/data/reusables/organizations/access-ruleset-settings.md +++ b/data/reusables/organizations/access-ruleset-settings.md @@ -1,3 +1 @@ 1. {% data reusables.user-settings.code-planning-automation %} click **{% octicon "repo" aria-hidden="true" aria-label="repo" %} Repository**, then click **Rulesets**. - - ![Screenshot of an organization's settings page. In the sidebar, a link labeled "Rulesets" is outlined in orange.](/assets/images/help/organizations/sidebar-repository-rulesets.png) diff --git a/data/reusables/repositories/repo-rulesets-settings.md b/data/reusables/repositories/repo-rulesets-settings.md index f8bb9ddc97d3..58e612798f2c 100644 --- a/data/reusables/repositories/repo-rulesets-settings.md +++ b/data/reusables/repositories/repo-rulesets-settings.md @@ -1,3 +1 @@ -1. In the left sidebar, under "Code and automation," click **Rules**, then click **Rulesets**. - - ![Screenshot of the sidebar of the "Settings" page for a repository. The "Rules" sub-menu is expanded, and the "Rulesets" option is outlined in orange.](/assets/images/help/repository/rulesets-settings.png) +1. In the left sidebar, under "Code and automation," click **Rulesets**, then click **Rulesets**. diff --git a/data/tables/copilot/model-comparison.yml b/data/tables/copilot/model-comparison.yml index 31d587a6d269..8642369cd620 100644 --- a/data/tables/copilot/model-comparison.yml +++ b/data/tables/copilot/model-comparison.yml @@ -54,6 +54,11 @@ excels_at: First-attempt correctness through upfront reasoning, aggressive parallel tool batching, and proactive verification of pre-existing test state before debugging further_reading: '[Claude Fable 5 model card](https://anthropic.com/claude-fable-5-mythos-5-system-card)' +- name: Claude Fable 5.1 + task_area: Long-horizon, autonomous coding and knowledge-work + excels_at: Substantial, long-running coding tasks, including deep codebase research, feature development, and complex agentic workflows + further_reading: '[Claude Fable 5.1 model card](https://www-cdn.anthropic.com/0339e6a7c5c7b87f5c07798616dc32c215d14235/Claude%20Fable%205.1%20&%20Claude%20Mythos%205.1%20System%20Card.pdf)' + - name: Claude Haiku 4.5 task_area: Fast help with simple or repetitive tasks excels_at: Fast, reliable answers to lightweight coding questions diff --git a/data/tables/copilot/model-release-status.yml b/data/tables/copilot/model-release-status.yml index cad722f3b30a..d78e86ee515b 100644 --- a/data/tables/copilot/model-release-status.yml +++ b/data/tables/copilot/model-release-status.yml @@ -57,6 +57,10 @@ provider: 'Anthropic' release_status: 'GA' +- name: 'Claude Fable 5.1' + provider: 'Anthropic' + release_status: 'GA' + - name: 'Claude Haiku 4.5' provider: 'Anthropic' release_status: 'GA' diff --git a/data/tables/copilot/model-supported-clients.yml b/data/tables/copilot/model-supported-clients.yml index b577516a76f9..bf1b49a18acd 100644 --- a/data/tables/copilot/model-supported-clients.yml +++ b/data/tables/copilot/model-supported-clients.yml @@ -86,6 +86,15 @@ xcode: true jetbrains: true +- name: Claude Fable 5.1 + dotcom: true + cli: true + vscode: true + vs: true + eclipse: true + xcode: true + jetbrains: true + - name: Claude Sonnet 4.5 dotcom: true cli: true diff --git a/data/tables/copilot/model-supported-plans.yml b/data/tables/copilot/model-supported-plans.yml index 36a24c840595..6eabd09e603c 100644 --- a/data/tables/copilot/model-supported-plans.yml +++ b/data/tables/copilot/model-supported-plans.yml @@ -68,6 +68,13 @@ business: true enterprise: true +- name: Claude Fable 5.1 + pro: false + pro_plus: true + max: true + business: true + enterprise: true + - name: Claude Sonnet 4.5 pro: true pro_plus: true diff --git a/data/tables/copilot/models-and-pricing.yml b/data/tables/copilot/models-and-pricing.yml index 218c664cd4bc..7c8586788f21 100644 --- a/data/tables/copilot/models-and-pricing.yml +++ b/data/tables/copilot/models-and-pricing.yml @@ -283,6 +283,15 @@ output: $50.00 cache_write: $12.50 +- model: Claude Fable 5.1 + provider: anthropic + release_status: GA + category: Powerful + input: $10.00 + cached_input: $0.25 + output: $50.00 + cache_write: $12.50 + # Google - model: 'Gemini 3.1 Pro' provider: google diff --git a/data/variables/copilot.yml b/data/variables/copilot.yml index 8c78b460bf3f..490cc998ca67 100644 --- a/data/variables/copilot.yml +++ b/data/variables/copilot.yml @@ -192,6 +192,7 @@ copilot_claude_opus_48: 'Claude Opus 4.8' copilot_claude_opus_48_fast: 'Claude Opus 4.8 (fast mode) (preview)' copilot_claude_opus_5: 'Claude Opus 5' copilot_claude_fable_5: 'Claude Fable 5' +copilot_claude_fable_51: 'Claude Fable 5.1' copilot_claude_sonnet: 'Claude Sonnet' copilot_claude_sonnet_35: 'Claude Sonnet 3.5' copilot_claude_sonnet_37: 'Claude Sonnet 3.7' diff --git a/data/variables/product.yml b/data/variables/product.yml index 97449a43bb92..f10fb985f9ed 100644 --- a/data/variables/product.yml +++ b/data/variables/product.yml @@ -59,6 +59,7 @@ prodname_ghos: GitHub-owned blob storage ## Enterprise Live Migrations prodname_elm: Enterprise Live Migrations prodname_elm_short: ELM +prodname_elm_cli: ELM CLI # GitHub Education prodname_education: 'GitHub Education' diff --git a/src/content-pipelines/state/copilot-cli.sha b/src/content-pipelines/state/copilot-cli.sha index 50c4cf7927f3..dcbb3c91d1b3 100644 --- a/src/content-pipelines/state/copilot-cli.sha +++ b/src/content-pipelines/state/copilot-cli.sha @@ -1 +1 @@ -745e8ea3bfaf5c1a004b802837bbe7c1ae444c2c +bc65d3739bbe4d7f9832b2bceea9d03f633b6d0b diff --git a/src/content-render/liquid/engine.ts b/src/content-render/liquid/engine.ts index 9f79a81fa09e..034fa453ddf2 100644 --- a/src/content-render/liquid/engine.ts +++ b/src/content-render/liquid/engine.ts @@ -4,7 +4,6 @@ import Data from './data' import Octicon from './octicon' import Ifversion from './ifversion' import { Tool, tags as toolTags } from './tool' -import { Spotlight, tags as spotlightTags } from './spotlight' import { Prompt } from './prompt' import { CodeTab, CodeTabs, tags as codeTabTags } from './codetabs' import IndentedDataReference from './indented-data-reference' @@ -14,7 +13,6 @@ type LiquidTagDef = Parameters[1] const dataTag = Data as unknown as LiquidTagDef const ifversionTag = Ifversion as unknown as LiquidTagDef const toolTag = Tool as unknown as LiquidTagDef -const spotlightTag = Spotlight as unknown as LiquidTagDef const promptTag = Prompt as unknown as LiquidTagDef const codeTabsTag = CodeTabs as unknown as LiquidTagDef const codeTabTag = CodeTab as unknown as LiquidTagDef @@ -34,10 +32,6 @@ for (const tag of toolTags) { engine.registerTag(tag, toolTag) } -for (const tag in spotlightTags) { - engine.registerTag(tag, spotlightTag) -} - for (const tag of codeTabTags) { engine.registerTag(tag, tag === 'codetabs' ? codeTabsTag : codeTabTag) } diff --git a/src/content-render/liquid/spotlight.ts b/src/content-render/liquid/spotlight.ts deleted file mode 100644 index 4a48154976cb..000000000000 --- a/src/content-render/liquid/spotlight.ts +++ /dev/null @@ -1,64 +0,0 @@ -interface LiquidToken { - name: string - getText(): string -} - -interface LiquidTemplate { - [key: string]: unknown -} - -interface LiquidStream { - on(event: string, callback: () => void): LiquidStream - stop(): void - start(): void -} - -interface LiquidEngine { - parser: { - parseStream(tokens: LiquidToken[]): LiquidStream - } - renderer: { - renderTemplates(templates: LiquidTemplate[], scope: Record): string - } - parseAndRender(template: string, context: Record): string -} - -export const tags: Record = { - note: 'accent', - tip: 'success', - warning: 'attention', - danger: 'danger', -} - -const template: string = - '
{{ output }}
' - -export const Spotlight = { - type: 'block' as const, - tagName: '' as string, - templates: [] as LiquidTemplate[], - liquid: null as LiquidEngine | null, - - parse(tagToken: LiquidToken, remainTokens: LiquidToken[]): void { - this.tagName = tagToken.name - this.templates = [] - - const stream = this.liquid!.parser.parseStream(remainTokens) - stream - .on(`tag:end${this.tagName}`, () => stream.stop()) - .on('template', (tpl: LiquidTemplate) => this.templates.push(tpl)) - .on('end', () => { - throw new Error(`tag ${tagToken.getText()} not closed`) - }) - stream.start() - }, - - *render(scope: Record): Generator { - const output = yield this.liquid!.renderer.renderTemplates(this.templates, scope) - - return yield this.liquid!.parseAndRender(template, { - color: tags[this.tagName], - output, - }) - }, -} diff --git a/src/content-render/stylesheets/alerts.scss b/src/content-render/stylesheets/alerts.scss index f26c5c92d3d0..7ab6af66dc7e 100644 --- a/src/content-render/stylesheets/alerts.scss +++ b/src/content-render/stylesheets/alerts.scss @@ -40,15 +40,4 @@ $colors: color: var(--fgColor-#{$color}, var(--color-#{$color}-fg)); } } - - // Temporary: so that the existing "notes" "callouts" etc color the first word - .ghd-spotlight-#{$color} { - p:first-child { - strong:first-child, - b:first-child { - color: var(--fgColor-#{$color}, var(--color-#{$color}-fg)); - } - } - } - // End temporary } diff --git a/src/fixtures/fixtures/content/get-started/liquid/danger.md b/src/fixtures/fixtures/content/get-started/liquid/danger.md deleted file mode 100644 index c05c666c7acc..000000000000 --- a/src/fixtures/fixtures/content/get-started/liquid/danger.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Danger liquid tag -intro: Demonstrates the HTML that becomes of a `danger` Liquid tag -versions: - fpt: '*' - ghes: '*' - ghec: '*' -contentType: how-tos ---- - -## Introduction - -{% danger %} - -Danger, Will Robinson. - -{% enddanger %} - -This is outside the danger. diff --git a/src/fixtures/fixtures/content/get-started/liquid/index.md b/src/fixtures/fixtures/content/get-started/liquid/index.md index 563e64156991..be22c5602b56 100644 --- a/src/fixtures/fixtures/content/get-started/liquid/index.md +++ b/src/fixtures/fixtures/content/get-started/liquid/index.md @@ -6,10 +6,6 @@ versions: ghes: "*" ghec: "*" children: - - /warnings - - /danger - - /tips - - /notes - /raw - /platform-specific - /whitespace diff --git a/src/fixtures/fixtures/content/get-started/liquid/notes.md b/src/fixtures/fixtures/content/get-started/liquid/notes.md deleted file mode 100644 index bb19002f5ed9..000000000000 --- a/src/fixtures/fixtures/content/get-started/liquid/notes.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Note Liquid tag -intro: Demonstrates the HTML that becomes of a `note` Liquid tag -versions: - fpt: '*' - ghes: '*' - ghec: '*' -contentType: how-tos ---- - -## Introduction - -{% note %} - -**Note!** This is inside the note. - -{% endnote %} - -This is outside the note. diff --git a/src/fixtures/fixtures/content/get-started/liquid/tips.md b/src/fixtures/fixtures/content/get-started/liquid/tips.md deleted file mode 100644 index e459a196a3c2..000000000000 --- a/src/fixtures/fixtures/content/get-started/liquid/tips.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Tip Liquid tag -intro: Demonstrates the HTML that becomes of a `tip` Liquid tag -versions: - fpt: '*' - ghes: '*' - ghec: '*' -contentType: how-tos ---- - -## Introduction - -{% tip %} - -**Tip!** This is inside the tip. - -{% endtip %} - -This is outside the tip. diff --git a/src/fixtures/fixtures/content/get-started/liquid/warnings.md b/src/fixtures/fixtures/content/get-started/liquid/warnings.md deleted file mode 100644 index 58572fc6a9e6..000000000000 --- a/src/fixtures/fixtures/content/get-started/liquid/warnings.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Warning Liquid tag -intro: Demonstrates the HTML that becomes of a `warning` Liquid tag -versions: - fpt: '*' - ghes: '*' - ghec: '*' -contentType: how-tos ---- - -## Introduction - -{% warning %} - -This is inside the warning. - -{% endwarning %} - -This is outside the warning. diff --git a/src/fixtures/tests/liquid.ts b/src/fixtures/tests/liquid.ts index 5a8ceba9bf20..af380472590f 100644 --- a/src/fixtures/tests/liquid.ts +++ b/src/fixtures/tests/liquid.ts @@ -5,36 +5,6 @@ import { getDataByLanguage } from '@/data-directory/lib/get-data' import { getDOM } from '@/tests/helpers/e2etest' import { supported } from '@/versions/lib/enterprise-server-releases' -describe('spotlight', () => { - test('renders styled warnings', async () => { - const $: CheerioAPI = await getDOM('/get-started/liquid/warnings') - const nodes = $('.ghd-spotlight-attention') - expect(nodes.length).toBe(1) - expect(nodes.text().includes('This is inside the warning.')).toBe(true) - }) - - test('renders styled danger', async () => { - const $: CheerioAPI = await getDOM('/get-started/liquid/danger') - const nodes = $('.ghd-spotlight-danger') - expect(nodes.length).toBe(1) - expect(nodes.text().includes('Danger, Will Robinson.')).toBe(true) - }) - - test('renders styled tips', async () => { - const $: CheerioAPI = await getDOM('/get-started/liquid/tips') - const nodes = $('.ghd-spotlight-success') - expect(nodes.length).toBe(1) - expect(nodes.text().includes('This is inside the tip.')).toBe(true) - }) - - test('renders styled notes', async () => { - const $: CheerioAPI = await getDOM('/get-started/liquid/notes') - const nodes = $('.ghd-spotlight-accent') - expect(nodes.length).toBe(1) - expect(nodes.text().includes('This is inside the note.')).toBe(true) - }) -}) - describe('raw', () => { test('renders raw', async () => { const $: CheerioAPI = await getDOM('/get-started/liquid/raw') diff --git a/src/languages/lib/correct-translation-content.ts b/src/languages/lib/correct-translation-content.ts index 380a2568b8a7..b9084d1c55c7 100644 --- a/src/languages/lib/correct-translation-content.ts +++ b/src/languages/lib/correct-translation-content.ts @@ -1488,6 +1488,23 @@ export function correctTranslatedContentStrings( 'доступом {% ifversion ghec %}к организациям, принадлежащим вашей организации{% endif %}{% data variables.product.prodname_dotcom_the_website %}{% elsif ghes %}{% data variables.location.product_location %}.', 'доступом {% ifversion ghec %}к организациям, принадлежащим вашей организации на {% data variables.product.prodname_dotcom_the_website %}{% elsif ghes %}к {% data variables.location.product_location %}{% endif %}.', ) + + // gated-features/ghas-ghec.md: `{% ifversion fpt or ghec %}` was moved to + // the very end of the sentence (after `{% endif %}`), leaving an orphan + // `elsif` with no matching opener (`tag "elsif" not found`). Move the + // `{% ifversion fpt or ghec %}` tag back to open the conditional, and move + // `{% data variables.product.prodname_GH_secret_protection %}` back next + // to the first `{% data ... %}` tag it was separated from. + // The corruption also dropped the preposition `на` and left `и` before the + // first product, so the fpt/ghec branch has to be reconstructed to + // `аккаунтов на {% team %} и {% ghe_cloud %}`. That matches the English + // ("accounts on GitHub Team and GitHub Enterprise Cloud") and parallels the + // surviving `elsif ghes` branch. Without it the branch renders as + // `аккаунтов и GitHub TeamGitHub Enterprise Cloud`: valid Liquid, broken prose. + content = content.replaceAll( + '{% data variables.product.prodname_GH_code_security %}и доступны для аккаунтов и {% data variables.product.prodname_team %}{% data variables.product.prodname_ghe_cloud %}{% elsif ghes %}аккаунтов на {% data variables.product.prodname_ghe_server %}{% endif %}.{% ifversion fpt or ghec %}{% data variables.product.prodname_GH_secret_protection %}', + '{% data variables.product.prodname_GH_code_security %} и {% data variables.product.prodname_GH_secret_protection %} доступны для {% ifversion fpt or ghec %}аккаунтов на {% data variables.product.prodname_team %} и {% data variables.product.prodname_ghe_cloud %}{% elsif ghes %}аккаунтов на {% data variables.product.prodname_ghe_server %}{% endif %}.', + ) } if (context.code === 'fr') { @@ -1718,6 +1735,28 @@ export function correctTranslatedContentStrings( content = content.replaceAll('{% 데이터 reusables.', '{% data reusables.') content = content.replaceAll('{% 데이터 변수.', '{% data variables.') content = content.replaceAll('{% 데이터 변숫값.', '{% data variables.') + // data/reusables/actions/change-retention-period-for-artifacts-logs.md: + // the `{% else %}...{% endif %}` branch was dropped entirely, leaving an + // unclosed `{% ifversion ghes %}` (`tag {% ifversion ghes %} not closed`). + // The English step renders for every version and only its opening clause is + // GHES-only, so the conditional has to wrap just the section name. Closing + // the tag at the end of the sentence instead would delete step 1 for + // FPT/GHEC, and dropping the opener would leak the GHES-only "Artifact, + // log, and cache settings" section name to dotcom readers. + // The corruption also inverted the containment relationship, so the two + // clauses are reordered: the section contains the setting, not the reverse. + content = content.replace( + /1\. \{% ifversion ghes %\} \*\*아티팩트 및 로그 보존\*\*의 "아티팩트, 로그 및 캐시 설정" 구역에서 새 값을 입력합니다\./, + '1. {% ifversion ghes %}"아티팩트, 로그 및 캐시 설정" 구역의 {% endif %}**아티팩트 및 로그 보존**에서 새 값을 입력합니다.', + ) + // gated-features/ghas-ghec.md: the `{% data ...ghe_server %}{% endif %}` + // and `{% data ...ghe_cloud %}{% elsif ghes %}` clauses were swapped, and + // the final `{% endif %}` was dropped (`tag "elsif" not found`). + // Reconstruct the intended ifversion/elsif/endif structure. + content = content.replaceAll( + '{% data variables.product.prodname_team %}의 {% ifversion fpt or ghec %}계정과 {% data variables.product.prodname_ghe_server %}{% endif %}의 {% data variables.product.prodname_ghe_cloud %}{% elsif ghes %}계정에서 사용할 수 있습니다.', + '{% ifversion fpt or ghec %}{% data variables.product.prodname_team %}의 계정과 {% data variables.product.prodname_ghe_cloud %}{% elsif ghes %}{% data variables.product.prodname_ghe_server %}의 계정{% endif %}에서 사용할 수 있습니다.', + ) content = content.replaceAll('{% 기타 %}', '{% else %}') content = content.replaceAll('{%- 기타 %}', '{%- else %}') // `{% other %}` — English "other" used as an alias for else by the translator diff --git a/src/languages/tests/correct-translation-content.ts b/src/languages/tests/correct-translation-content.ts index 3ba2c5d7070d..3e99a6b66c69 100644 --- a/src/languages/tests/correct-translation-content.ts +++ b/src/languages/tests/correct-translation-content.ts @@ -2,6 +2,11 @@ import { describe, expect, test } from 'vitest' import { performance } from 'perf_hooks' import { correctTranslatedContentStrings } from '@/languages/lib/correct-translation-content' +import { liquid } from '@/content-render/index' +import { allVersions } from '@/versions/lib/all-versions' +import { supported } from '@/versions/lib/enterprise-server-releases' +import shortVersionsMiddleware from '@/versions/middleware/short-versions' +import type { ExtendedRequest } from '@/types' function fix(content: string, code: string, englishContent = '') { return correctTranslatedContentStrings(content, englishContent, { @@ -11,6 +16,26 @@ function fix(content: string, code: string, englishContent = '') { }) } +const ghesVersion = `enterprise-server@${supported[0]}` + +// A string fix can produce valid Liquid that still renders the wrong thing for +// a given version: a dropped separator, or a branch that swallows the whole +// sentence. `render` evaluates a corrected string per version so those failures +// are caught. Product names resolve from the English data directory, since only +// `en` is loaded in tests, but the branch structure under test is language +// independent. +async function render(content: string, currentVersion: string) { + const req = {} as ExtendedRequest + req.context = { + allVersions, + currentVersion, + currentVersionObj: allVersions[currentVersion], + currentLanguage: 'en', + } + shortVersionsMiddleware(req, null, () => {}) + return (await liquid.parseAndRender(content, req.context)).trim() +} + describe('correctTranslatedContentStrings', () => { // ─── SPANISH (es) ─────────────────────────────────────────────────── @@ -2836,4 +2861,82 @@ Para más información, consulta "[AUTOTITLE](/path)". expect(fix(fixed, 'ko')).toBe(fixed) }) }) + + describe('ru: gated-features/ghas-ghec.md per-file fix', () => { + const broken = + '{% data variables.product.prodname_GH_code_security %}и доступны для аккаунтов и {% data variables.product.prodname_team %}{% data variables.product.prodname_ghe_cloud %}{% elsif ghes %}аккаунтов на {% data variables.product.prodname_ghe_server %}{% endif %}.{% ifversion fpt or ghec %}{% data variables.product.prodname_GH_secret_protection %}' + const fixed = + '{% data variables.product.prodname_GH_code_security %} и {% data variables.product.prodname_GH_secret_protection %} доступны для {% ifversion fpt or ghec %}аккаунтов на {% data variables.product.prodname_team %} и {% data variables.product.prodname_ghe_cloud %}{% elsif ghes %}аккаунтов на {% data variables.product.prodname_ghe_server %}{% endif %}.' + + test('moves ifversion tag back to the start of the conditional and reunites split data tags', () => { + expect(fix(broken, 'ru')).toBe(fixed) + expect(fix(fixed, 'ru')).toBe(fixed) + }) + + test('renders readable Russian on fpt and ghec, with the products separated', async () => { + for (const version of ['free-pro-team@latest', 'enterprise-cloud@latest']) { + const output = await render(fix(broken, 'ru'), version) + expect(output).toBe( + 'GitHub Code Security и GitHub Secret Protection доступны для аккаунтов на GitHub Team и GitHub Enterprise Cloud.', + ) + } + }) + + test('renders the ghes branch alone on ghes', async () => { + const output = await render(fix(broken, 'ru'), ghesVersion) + expect(output).toBe( + 'GitHub Code Security и GitHub Secret Protection доступны для аккаунтов на GitHub Enterprise Server.', + ) + }) + }) + + describe('ko: gated-features/ghas-ghec.md per-file fix', () => { + const broken = + '{% data variables.product.prodname_team %}의 {% ifversion fpt or ghec %}계정과 {% data variables.product.prodname_ghe_server %}{% endif %}의 {% data variables.product.prodname_ghe_cloud %}{% elsif ghes %}계정에서 사용할 수 있습니다.' + const fixed = + '{% ifversion fpt or ghec %}{% data variables.product.prodname_team %}의 계정과 {% data variables.product.prodname_ghe_cloud %}{% elsif ghes %}{% data variables.product.prodname_ghe_server %}의 계정{% endif %}에서 사용할 수 있습니다.' + + test('reconstructs the scrambled ifversion/elsif/endif structure', () => { + expect(fix(broken, 'ko')).toBe(fixed) + expect(fix(fixed, 'ko')).toBe(fixed) + }) + + test('renders only the cloud products on fpt and ghec', async () => { + for (const version of ['free-pro-team@latest', 'enterprise-cloud@latest']) { + const output = await render(fix(broken, 'ko'), version) + expect(output).toBe('GitHub Team의 계정과 GitHub Enterprise Cloud에서 사용할 수 있습니다.') + } + }) + + test('renders only the server product on ghes', async () => { + const output = await render(fix(broken, 'ko'), ghesVersion) + expect(output).toBe('GitHub Enterprise Server의 계정에서 사용할 수 있습니다.') + }) + }) + + describe('ko: change-retention-period-for-artifacts-logs.md per-file fix', () => { + const broken = + '1. {% ifversion ghes %} **아티팩트 및 로그 보존**의 "아티팩트, 로그 및 캐시 설정" 구역에서 새 값을 입력합니다.' + const fixed = + '1. {% ifversion ghes %}"아티팩트, 로그 및 캐시 설정" 구역의 {% endif %}**아티팩트 및 로그 보존**에서 새 값을 입력합니다.' + + test('scopes the unclosed ifversion tag to the GHES-only clause', () => { + expect(fix(broken, 'ko')).toBe(fixed) + expect(fix(fixed, 'ko')).toBe(fixed) + }) + + test('keeps the step on fpt and ghec without the GHES-only section name', async () => { + for (const version of ['free-pro-team@latest', 'enterprise-cloud@latest']) { + const output = await render(fix(broken, 'ko'), version) + expect(output).toBe('1. **아티팩트 및 로그 보존**에서 새 값을 입력합니다.') + } + }) + + test('keeps the GHES-only section name on ghes', async () => { + const output = await render(fix(broken, 'ko'), ghesVersion) + expect(output).toBe( + '1. "아티팩트, 로그 및 캐시 설정" 구역의 **아티팩트 및 로그 보존**에서 새 값을 입력합니다.', + ) + }) + }) }) diff --git a/src/workflows/unallowed-contributions.ts b/src/workflows/unallowed-contributions.ts index cc21e2bfdcc7..51cdccc814f7 100755 --- a/src/workflows/unallowed-contributions.ts +++ b/src/workflows/unallowed-contributions.ts @@ -44,8 +44,9 @@ async function main() { // Format into Markdown bulleted list to use in the PR comment const listUnallowedChangedFiles = unallowedChangedFiles.map((file) => `\n - ${file}`).join('') - const listUnallowedFiles = filters.notAllowed.map((file: string) => `\n - ${file}`).join('') - + const listUnallowedFiles = filters.notAllowed + .map((file: string) => `\n - ${file === '*' ? 'Anything in the root directory' : file}`) + .join('') const reviewMessage = `👋 Hi there! It looks like you've modified some files that we can't accept as contributions:${listUnallowedChangedFiles}\n\nYou'll need to raise a new PR that doesn't include those files, before we can review.\n\nThe complete list of files we can't accept are:${listUnallowedFiles}\n\nWe also can't accept contributions to files in the content directory with frontmatter \`contentType: rai\`. You can always check out our full [contribution guidelines](https://docs.github.com/en/contributing).` let workflowFailMessage =