diff --git a/content/authentication/authenticating-with-single-sign-on/authorizing-a-personal-access-token-for-use-with-single-sign-on.md b/content/authentication/authenticating-with-single-sign-on/authorizing-a-personal-access-token-for-use-with-single-sign-on.md index 4d839af497c4..9b6148595390 100644 --- a/content/authentication/authenticating-with-single-sign-on/authorizing-a-personal-access-token-for-use-with-single-sign-on.md +++ b/content/authentication/authenticating-with-single-sign-on/authorizing-a-personal-access-token-for-use-with-single-sign-on.md @@ -7,6 +7,7 @@ redirect_from: - /github/authenticating-to-github/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on - /github/authenticating-to-github/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on - /authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on + - /authentication/authenticating-with-single-sign-on/authorizing-credentials-for-single-sign-on-with-a-github-app versions: ghec: '*' shortTitle: '{% data variables.product.pat_generic_caps %} with SSO' @@ -19,10 +20,6 @@ You must authorize your {% data variables.product.pat_v1 %} after creation befor {% data reusables.saml.authorized-creds-info %} -Enterprise administrators can use a {% data variables.product.prodname_github_app %} to authorize credentials for multiple organizations. See [AUTOTITLE](/authentication/authenticating-with-single-sign-on/authorizing-credentials-for-single-sign-on-with-a-github-app). - -## Authorizing a {% data variables.product.pat_v1 %} - {% data reusables.user-settings.access_settings %} {% data reusables.user-settings.developer_settings %} {% data reusables.user-settings.personal_access_tokens %} diff --git a/content/authentication/authenticating-with-single-sign-on/authorizing-credentials-for-single-sign-on-with-a-github-app.md b/content/authentication/authenticating-with-single-sign-on/authorizing-credentials-for-single-sign-on-with-a-github-app.md deleted file mode 100644 index d0c9bcbf30f9..000000000000 --- a/content/authentication/authenticating-with-single-sign-on/authorizing-credentials-for-single-sign-on-with-a-github-app.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Authorizing credentials for single sign-on with a GitHub App -intro: 'Authorize credentials for multiple organizations by allowing an enterprise-installed {% data variables.product.prodname_github_app %} to manage single sign-on (SSO) authorizations.' -versions: - ghec: '*' -permissions: Enterprise owners and users with the "Manage enterprise credentials" permission -shortTitle: Authorize credentials with an app -category: - - Sign in with SSO or a passkey ---- - -## About authorizing credentials with a {% data variables.product.prodname_github_app %} - -By default, enterprise-installed {% data variables.product.prodname_github_apps %} cannot authorize credentials. To reduce the number of times that enterprise members must authorize the same credential for individual organizations, you can allow an app to authorize existing {% data variables.product.pat_v1_plural %} or verified, user-owned SSH authentication keys. Up to 50 selected organizations are allowed per request. - -To authorize a credential for a single organization without a {% data variables.product.prodname_github_app %}, see [AUTOTITLE](/authentication/authenticating-with-single-sign-on/authorizing-a-personal-access-token-for-use-with-single-sign-on) or [AUTOTITLE](/authentication/authenticating-with-single-sign-on/authorizing-an-ssh-key-for-use-with-single-sign-on). - -## Prerequisites - -Before the app can authorize credentials, the following requirements must be met: - -* The enterprise must use enterprise-level SSO. -* The credential owner must be a member of every organization where the app will authorize the credential. - -## Creating the {% data variables.product.prodname_github_app %} - -1. Register a new app. For instructions, see [AUTOTITLE](/apps/creating-github-apps/registering-a-github-app/registering-a-github-app#registering-a-github-app). The app must: - - * Be owned by the enterprise or an organization in the enterprise. - * Have write access to the "Enterprise credentials" permission. - -1. Note the app's client ID, then generate and securely store a private key. See [AUTOTITLE](/apps/creating-github-apps/authenticating-with-a-github-app/managing-private-keys-for-github-apps). -1. Install the app on your enterprise account. See [AUTOTITLE](/apps/using-github-apps/installing-a-github-app-on-your-enterprise). -1. In the URL of the app's installation page, note the installation ID. The ID is the string of numbers at the end of the `/enterprises/ENTERPRISE/settings/installations/ID` URL. - -## Allowing a {% data variables.product.prodname_github_app %} to authorize credentials - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.security-tab %} - -1. Under "Credentials," enable **Allow {% data variables.product.prodname_github_apps %} to authorize credentials**. - -## Generating an installation access token - -The app must use an enterprise installation access token to authenticate its API requests. Organization installation access tokens, user access tokens, and {% data variables.product.pat_generic_plural %} are not supported. - -To generate an installation access token: - -1. Use the app's client ID and private key to generate a JSON Web Token (JWT). See [AUTOTITLE](/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app). -1. Use the JWT and enterprise installation ID to create an installation access token. See [AUTOTITLE](/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app). - -The installation access token inherits the enterprise permissions granted to the app, cannot be scoped down, and expires after one hour. - -## Finding credential identifiers - -For credentials that are already authorized for an organization in your enterprise, an organization owner can use the REST API to obtain identifiers in bulk. See [AUTOTITLE](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization). - -In the response, use `authorized_credential_id` for a {% data variables.product.pat_v1 %}, or `fingerprint` for an SSH key. Do not use `credential_id`, which identifies the credential's authorization for that organization. - -This endpoint does not return credentials that have not been authorized for the organization. To obtain an identifier for another credential, use one of these methods: - -* For a {% data variables.product.pat_v1 %}, open the token from the [token settings](https://github.com/settings/tokens) page. The token ID is the number at the end of the `/settings/tokens/ID` URL. Alternatively, if the token was used for an action recorded in the enterprise audit log, an enterprise owner can find the ID in the event's `token_id` field. The ID is available in the audit log only while an enterprise-visible event authenticated with that token is retained. Share the ID, not the token value. For more information, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/searching-the-audit-log-for-your-enterprise). -* For an SSH key, find the SHA-256 fingerprint for the verified, user-owned authentication key. For more information, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys). - -## Authorizing a credential - -Use the REST API to authorize the credential for selected organizations. For example: - -```shell -curl --request POST \ - --url "https://api.github.com/enterprises/ENTERPRISE/credential-authorizations" \ - --header "Accept: application/vnd.github+json" \ - --header "Authorization: Bearer INSTALLATION-ACCESS-TOKEN" \ - --header "X-GitHub-Api-Version: 2026-03-10" \ - --data '{ - "credential_id": 12345678, - "credential_type": "classic_pat", - "organizations": ["ORGANIZATION-1", "ORGANIZATION-2"] - }' -``` - -Replace `ENTERPRISE` with the enterprise slug, `INSTALLATION-ACCESS-TOKEN` with the installation access token, and `ORGANIZATION-1` and `ORGANIZATION-2` with the organization slugs. Replace `12345678` with the ID of the {% data variables.product.pat_v1 %}. To authorize an SSH key instead, replace `12345678` with the key's SHA-256 fingerprint and replace `classic_pat` with `ssh_key`. - -For more information, see [AUTOTITLE](/rest/enterprise-admin/credential-authorizations). - -## Disabling credential authorization by {% data variables.product.prodname_github_apps %} - -Disabling the setting prevents apps from creating new credential authorizations. Existing authorizations remain active until they are revoked, the credential is revoked or deleted, or the credential owner loses membership in the organization. - -You can use the same REST API to revoke authorizations that an app created through enterprise delegation. diff --git a/content/authentication/authenticating-with-single-sign-on/index.md b/content/authentication/authenticating-with-single-sign-on/index.md index 009aeeb7561c..ec5e85d9e6a8 100644 --- a/content/authentication/authenticating-with-single-sign-on/index.md +++ b/content/authentication/authenticating-with-single-sign-on/index.md @@ -13,7 +13,6 @@ children: - /about-authentication-with-single-sign-on - /authorizing-an-ssh-key-for-use-with-single-sign-on - /authorizing-a-personal-access-token-for-use-with-single-sign-on - - /authorizing-credentials-for-single-sign-on-with-a-github-app - /authorizing-an-app-for-single-sign-on - /viewing-and-managing-your-active-sso-sessions shortTitle: Authenticate with SSO diff --git a/content/code-security/index.md b/content/code-security/index.md index 35f07c8632ae..dfbe2524f7ad 100644 --- a/content/code-security/index.md +++ b/content/code-security/index.md @@ -8,7 +8,7 @@ redirect_from: - /enterprise-onboarding/feature-enhancements/about-code-security-for-your-enterprise - /enterprise-onboarding/feature-enhancements/about-enterprise-security introLinks: - overview: '{% ifversion ghes %}/code-security/getting-started/github-security-features{% endif %}' + overview: '/code-security/getting-started/github-security-features' generate_secret_risk_assessment_report_for_free: '{% ifversion secret-risk-assessment %}https://github.com/get_started?with=risk-assessment{% endif %}' layout: discovery-landing contentType: landing diff --git a/content/copilot/how-tos/copilot-cli/use-copilot-cli/set-session-limit.md b/content/copilot/how-tos/copilot-cli/use-copilot-cli/set-session-limit.md index d4ba136edc09..acd352e880f2 100644 --- a/content/copilot/how-tos/copilot-cli/use-copilot-cli/set-session-limit.md +++ b/content/copilot/how-tos/copilot-cli/use-copilot-cli/set-session-limit.md @@ -27,8 +27,8 @@ These session limits are **soft limits**. If a response is in progress when the How the limit is set and applied depends on whether you are in an interactive session or running the CLI programmatically. -> [!TIP] -> {% data variables.product.prodname_ai_credit_singular %} session limits work best when set to > 30 {% data variables.product.prodname_ai_credits_short %} as most model calls will cost more than 20 {% data variables.product.prodname_ai_credits_short %}. +> [!NOTE] +> {% data variables.product.prodname_ai_credit_singular %} session limits must be set to at least 30 {% data variables.product.prodname_ai_credits_short %}. ### Setting a limit within an interactive session diff --git a/content/copilot/how-tos/copilot-cli/use-copilot-cli/steer-agents.md b/content/copilot/how-tos/copilot-cli/use-copilot-cli/steer-agents.md index e6d25c59e903..83e1a083ff34 100644 --- a/content/copilot/how-tos/copilot-cli/use-copilot-cli/steer-agents.md +++ b/content/copilot/how-tos/copilot-cli/use-copilot-cli/steer-agents.md @@ -16,9 +16,11 @@ docsTeamMetrics: ## Steer the conversation while {% data variables.product.prodname_copilot_short %} is thinking -While {% data variables.product.prodname_copilot_short %} is working on a task, you can enter a new prompt at any time. Any input you send while {% data variables.product.prodname_copilot_short %} is thinking is treated as steering and is considered in the context of the current task. +While {% data variables.product.prodname_copilot_short %} is working on a task, you can enter a new prompt at any time. By default, a plain prompt you send while {% data variables.product.prodname_copilot_short %} is thinking is treated as steering and is considered in the context of the current task. -There is no separate instruction queue. To provide additional instructions, enter another prompt while {% data variables.product.prodname_copilot_short %} is running. {% data variables.product.prodname_copilot_short %} processes each message in order as part of the active task. +## Queue a prompt to be processed next + +You can also queue a message instead of steering with it, by pressing Ctrl+Enter (or Ctrl+Q) instead of Enter. A queued message waits until the current task finishes, then runs as the next turn, instead of being folded into the task that's in progress. For more information about queued prompts, see [AUTOTITLE](/copilot/concepts/agents/copilot-cli/cancel-and-roll-back). Steering lets you: diff --git a/content/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks.md b/content/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks.md index c4c7e31a47b6..24a40a5ecd31 100644 --- a/content/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks.md +++ b/content/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks.md @@ -50,6 +50,25 @@ Use the pull request status checks box to identify which commit must pass. See [AUTOTITLE](/rest/pulls/pulls#get-a-pull-request). +## Checks from some workflow jobs are not evaluated + +A {% data variables.product.prodname_actions %} workflow run can report checks that do not appear in a pull request's checks section or satisfy required status checks in a branch ruleset. For checks created by workflow jobs to be evaluated for a pull request, the workflow run must be triggered by one of these events: + +* `push` +* `pull_request` +* `pull_request_review` +* `pull_request_target` +* `deployment` +* `deployment_status` + +For example, if a workflow is triggered by `workflow_dispatch` on a pull request's head branch, checks reported by its jobs do not appear in the pull request's checks section. Even if the checks pass for the head commit, they do not satisfy a required status check in a branch ruleset. + +Check the event that triggered the workflow run. If the workflow uses another event, update its `on` configuration to use an eligible event appropriate for your workflow, such as `pull_request`. See [AUTOTITLE](/actions/reference/workflows-and-actions/events-that-trigger-workflows). + +This restriction applies only to checks created by workflow jobs, not to checks created by an external {% data variables.product.prodname_github_app %}. + +Merge queues require the separate `merge_group` event. See [Status checks with {% data variables.product.prodname_actions %} and a Merge queue](#status-checks-with-github-actions-and-a-merge-queue). + ## Handling skipped but required checks | Cause | Result | How to fix or check | diff --git a/data/reusables/enterprise-accounts/enterprise-apps-capabilities.md b/data/reusables/enterprise-accounts/enterprise-apps-capabilities.md index 8fa813f053ac..92167705bd5f 100644 --- a/data/reusables/enterprise-accounts/enterprise-apps-capabilities.md +++ b/data/reusables/enterprise-accounts/enterprise-apps-capabilities.md @@ -7,9 +7,6 @@ Enterprise-installed {% data variables.product.prodname_github_apps %} cannot ca {%- ifversion enterprise-billing-github-app %} * Manage enterprise billing, including budgets, cost centers, and usage reports. For more information, see [AUTOTITLE](/rest/billing). {%- endif %} -{%- ifversion ghec %} -* Authorize {% data variables.product.pat_v1_plural %} and verified, user-owned SSH authentication keys for SSO in selected organizations. See [AUTOTITLE](/authentication/authenticating-with-single-sign-on/authorizing-credentials-for-single-sign-on-with-a-github-app). -{%- endif %} * Call the enterprise SCIM APIs Check the [changelog](https://github.blog/changelog/) for updates on new APIs and permissions for {% data variables.product.prodname_github_apps %}.