Repo sync

content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/create-custom-configuration.md

@@ -70,7 +70,7 @@ When creating a security configuration, keep in mind that:
 1. Optionally, in the "Policy" section, you can use additional options to control how the configuration is applied:
    * **Use as default for newly created repositories**. Select the **None** {% octicon "triangle-down" aria-hidden="true" aria-label="triangle-down" %} dropdown menu, then click **Public**, **Private and internal**, or **All repositories**.
         {% data reusables.security-configurations.default-configuration-exception-repo-transfers %}
-   * **Enforce configuration**. Block repository owners from changing features that are enabled or disabled by the configuration (features that are not set aren't enforced). Select **Enforce** from the dropdown menu.
+   * **Enforce configuration**. {% ifversion security-configuration-enterprise-organization-enforcement %}{% data reusables.permissions.security-configuration-enterprise-enable %} can block repository owners only, or both repository and organization owners, from changing features that are enabled or disabled by the configuration. Features that are not set aren't enforced. Select **Don't enforce**, **Enforce for repository owners**, or **Enforce for repository and organization owners** from the dropdown menu.{% else %}Block repository owners from changing features that are enabled or disabled by the configuration (features that are not set aren't enforced). Select **Enforce** from the dropdown menu.{% endif %}
 
     {% data reusables.code-scanning.security-configuration-enforcement-edge-cases %}
 
@@ -111,8 +111,7 @@ When creating a security configuration, keep in mind that:
 1. Optionally, in the "Policy" section, you can use additional options to control how the configuration is applied:
    * **Use as default for newly created repositories**. Select the **None** {% octicon "triangle-down" aria-hidden="true" aria-label="triangle-down" %} dropdown menu, then click **Public**, **Private and internal**, or **All repositories**.
         {% data reusables.security-configurations.default-configuration-exception-repo-transfers %}
-   * **Enforce configuration**. Block repository owners from changing features that are enabled or disabled by the configuration (features that are not set aren't enforced). Select **Enforce** from the dropdown menu.
-
+   * **Enforce configuration**. {% ifversion security-configuration-enterprise-organization-enforcement %}{% data reusables.permissions.security-configuration-enterprise-enable %} can block repository owners only, or both repository and organization owners, from changing features that are enabled or disabled by the configuration. Features that are not set aren't enforced. Select **Don't enforce**, **Enforce for repository owners**, or **Enforce for repository and organization owners** from the dropdown menu.{% else %}Block repository owners from changing features that are enabled or disabled by the configuration (features that are not set aren't enforced). Select **Enforce** from the dropdown menu.{% endif %}
     {% data reusables.code-scanning.security-configuration-enforcement-edge-cases %}
 
 {% data reusables.code-scanning.save-custom-configuration %}

content/code-security/how-tos/secure-at-scale/configure-enterprise-security/manage-your-coverage/edit-custom-configuration.md

@@ -25,7 +25,7 @@ After creating and applying a {% data variables.product.prodname_custom_security
 1. In the "Configurations" section, click the name of the {% data variables.product.prodname_custom_security_configuration %} you want to edit.
 1. Edit the name and description of your {% data variables.product.prodname_custom_security_configuration %} as desired.
 1. Edit the enablement settings of your {% data variables.product.prodname_custom_security_configuration %} as desired.
-1. In the "Policy" section, you can modify the configuration's enforcement status. Enforcing a configuration will block repository owners from changing features that are enabled or disabled by the configuration, but features that are not set aren't enforced. Next to "Enforce configuration", select **Enforce** or **Don't enforce** from the dropdown menu.
+1. In the "Policy" section, you can modify the configuration's enforcement status. {% ifversion security-configuration-enterprise-organization-enforcement %}{% data reusables.permissions.security-configuration-enterprise-enable %} can block repository owners only, or both repository and organization owners, from changing features that are enabled or disabled by the configuration. Features that are not set aren't enforced. Select **Don't enforce**, **Enforce for repository owners**, or **Enforce for repository and organization owners** from the dropdown menu.{% else %}Enforcing a configuration will block repository owners from changing features that are enabled or disabled by the configuration, but features that are not set aren't enforced. Next to "Enforce configuration", select **Enforce** or **Don't enforce** from the dropdown menu.{% endif %}
 
     {% data reusables.code-scanning.security-configuration-enforcement-edge-cases %}
 

content/code-security/reference/security-at-scale/configuration-enforcement.md

@@ -13,8 +13,18 @@ redirect_from:
   - /code-security/reference/security-at-scale/security-configuration-enforcement
 ---
 
+{% ifversion security-configuration-enterprise-organization-enforcement %}
+
+{% data variables.product.prodname_security_configurations_caps %} can be enforced at the organization{% ifversion security-configuration-enterprise-level %} or enterprise{% endif %} level to prevent owners from changing the enablement status of configured security features.
+{% data reusables.permissions.security-configuration-enterprise-enable %}
+* At the **organization** level, enforcement means repository owners cannot change the enablement status of features that are enabled or disabled by the configuration.
+* At the **enterprise** level,  you can enforce for repository owners only, or for both repository and organization owners. When enforcement applies to both, neither repository owners nor organization owners can change the enablement status of features that are enabled or disabled by the configuration.
+{% else %}
+
 {% data variables.product.prodname_security_configurations_caps %} can be enforced, meaning repository owners cannot change the enablement status of features that are enabled or disabled by the configuration.
 
+{% endif %}
+
 ## Situations that break enforcement
 
 Some situations can break the enforcement of {% data variables.product.prodname_security_configurations %}. For example, the enablement of {% data variables.product.prodname_code_scanning %} will not apply to a repository if:

content/copilot/concepts/enterprise/agent-management.md

@@ -9,6 +9,8 @@ category:
   - Learn about Copilot
 redirect_from:
   - /copilot/concepts/agents/enterprise-management
+docsTeamMetrics:
+  - ai-governance
 ---
 
 ## Overview

content/copilot/concepts/enterprise/learning-about-new-features-and-models.md

@@ -10,6 +10,8 @@ category:
 redirect_from:
   - /copilot/concepts/preparing-for-new-features-and-models
   - /copilot/concepts/learning-about-new-features-and-models
+docsTeamMetrics:
+  - ai-governance
 ---
 
 {% data variables.product.prodname_copilot %} is evolving rapidly, with new features and models released regularly. If you're an enterprise administrator, staying informed helps you make confident decisions about which capabilities to enable, when to adopt them, and how to manage risk across your organizations.

content/copilot/concepts/enterprise/policies.md

@@ -10,6 +10,8 @@ redirect_from:
   - /copilot/concepts/policies
 category:
   - Manage Copilot for a team
+docsTeamMetrics:
+  - ai-governance
 ---
 
 ## How do policies work?

content/copilot/get-started/enterprise-ai-governance.md

@@ -50,4 +50,6 @@ journeyTracks:
     guides:
       - href: '/copilot/concepts/enterprise/learning-about-new-features-and-models'
       - href: '/copilot/tutorials/roll-out-at-scale/govern-at-scale/pilot-a-feature-or-model'
+docsTeamMetrics:
+  - ai-governance
 ---

content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/enable-copilot-cloud-agent.md

@@ -20,6 +20,8 @@ redirect_from:
 contentType: how-tos
 category:
   - Manage Copilot for a team
+docsTeamMetrics:
+  - ai-governance
 ---
 
 ## Prerequisites

content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/enable-copilot-code-review.md

@@ -12,6 +12,8 @@ redirect_from:
 contentType: how-tos
 category:
   - Manage Copilot for a team
+docsTeamMetrics:
+  - ai-governance
 ---
 
 {% data variables.product.prodname_copilot %} can review pull requests in your enterprise. This can save time for human reviewers by detecting bugs or vulnerabilities and enforcing consistent coding standards.

content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/monitor-agentic-activity.md

@@ -8,6 +8,8 @@ shortTitle: Monitor agentic activity
 contentType: how-tos
 category:
   - Manage Copilot for a team
+docsTeamMetrics:
+  - ai-governance
 ---
 
 ## Viewing active and recent agentic sessions in your enterprise

content/copilot/how-tos/administer-copilot/manage-for-enterprise/review-audit-logs.md

@@ -23,6 +23,8 @@ versions:
 contentType: how-tos
 category:
   - Manage Copilot for a team
+docsTeamMetrics:
+  - ai-governance
 ---
 
 You can use the audit log to review actions taken in your enterprise. The audit log includes a record of:

content/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist.md

@@ -10,6 +10,8 @@ contentType: how-tos
 category:
   - Configure Copilot
   - Manage Copilot for a team
+docsTeamMetrics:
+  - ai-governance
 ---
 
 ## About allowlists

content/copilot/how-tos/copilot-cli/administer-copilot-cli-for-your-enterprise.md

@@ -12,6 +12,7 @@ category:
   - Administer Copilot CLI # Copilot CLI bespoke landing page
 docsTeamMetrics:
   - copilot-cli
+  - ai-governance
 ---
 
 {% data variables.copilot.copilot_cli_short %} brings agentic capabilities to developers' command line. When {% data variables.copilot.copilot_cli_short %} is enabled, developers can use it to ask {% data variables.product.prodname_copilot_short %} to work on tasks locally or delegate work to {% data variables.copilot.copilot_cloud_agent %}.

content/copilot/how-tos/copilot-on-github/set-up-copilot/enable-copilot/set-up-for-enterprise.md

@@ -17,6 +17,8 @@ redirect_from:
 contentType: how-tos
 category:
   - Configure Copilot
+docsTeamMetrics:
+  - ai-governance
 ---
 
 ## Enable {% data variables.product.prodname_copilot %}

content/copilot/tutorials/cloud-agent/build-guardrails.md

@@ -8,6 +8,8 @@ contentType: tutorials
 category:
   - Roll Copilot out at scale
   - Manage Copilot for a team
+docsTeamMetrics:
+  - ai-governance
 ---
 
 Before you enable {% data variables.copilot.copilot_cloud_agent %}, it is good practice to set up your enterprise so you can be confident {% data variables.product.prodname_copilot_short %} will operate within secure, predictable guardrails.

content/copilot/tutorials/cloud-agent/give-access-to-resources.md

@@ -8,6 +8,8 @@ contentType: tutorials
 category:
   - Manage Copilot for a team
   - Roll Copilot out at scale
+docsTeamMetrics:
+  - ai-governance
 ---
 
 {% data variables.copilot.copilot_cloud_agent %} can connect to MCP servers, use private packages, and access external services, but only if your organization's repositories are configured to allow it.

content/copilot/tutorials/copilot-cli-hooks.md

@@ -12,6 +12,7 @@ category:
 allowTitleToDifferFromFilename: true
 docsTeamMetrics:
   - copilot-cli
+  - ai-governance
 ---
 
 This tutorial is for DevOps engineers, platform teams, and engineering leaders who support developers using {% data variables.copilot.copilot_cli_short %}.

content/copilot/tutorials/roll-out-at-scale/assign-licenses/choose-enterprise-plan.md

@@ -13,6 +13,8 @@ redirect_from:
 contentType: tutorials
 category:
   - Manage Copilot for a team
+docsTeamMetrics:
+  - ai-governance
 ---
 
 ## Introduction

content/copilot/tutorials/roll-out-at-scale/enable-developers/integrate-ai-agents.md

@@ -14,6 +14,8 @@ contentType: tutorials
 category:
   - Roll Copilot out at scale
   - Manage Copilot for a team
+docsTeamMetrics:
+  - ai-governance
 ---
 
 ## About AI agents on {% data variables.product.github %}

content/copilot/tutorials/roll-out-at-scale/govern-at-scale/govern-for-adoption.md

@@ -11,6 +11,8 @@ contentType: tutorials
 allowTitleToDifferFromFilename: true
 redirect_from:
   - /copilot/tutorials/roll-out-at-scale/govern-for-adoption
+docsTeamMetrics:
+  - ai-governance
 ---
 
 Getting the most from {% data variables.product.prodname_copilot %} means finding the right balance between governance and developer access. Too restrictive, and developers can't use the features that make them productive. Too permissive, and you may not meet your compliance requirements.

content/copilot/tutorials/roll-out-at-scale/govern-at-scale/maintain-codebase-standards.md

@@ -11,6 +11,8 @@ category:
 contentType: tutorials
 redirect_from:
   - /copilot/tutorials/roll-out-at-scale/maintain-codebase-standards
+docsTeamMetrics:
+  - ai-governance
 ---
 
 Most enterprises are aware of the productivity benefits that AI coding tools can bring. However, many worry that improper usage in their company, such as malicious prompts or developers accepting AI suggestions without review, will lead to their codebase's standards being compromised.

content/copilot/tutorials/roll-out-at-scale/govern-at-scale/pilot-a-feature-or-model.md

@@ -9,6 +9,8 @@ category:
   - Roll Copilot out at scale
 contentType: tutorials
 allowTitleToDifferFromFilename: true
+docsTeamMetrics:
+  - ai-governance
 ---
 
 This tutorial walks you through running a pilot end to end: setting a budget, enabling the feature for a contained group, monitoring results, and using the evidence to make and report a go or no-go decision.

content/copilot/tutorials/roll-out-at-scale/govern-at-scale/resources-for-approval.md

@@ -9,6 +9,8 @@ category:
   - Manage Copilot for a team
 redirect_from:
   - /copilot/get-started/resources-for-approval
+docsTeamMetrics:
+  - ai-governance
 ---
 
 Before you can roll out a tool like {% data variables.product.prodname_copilot %} in your company, you will likely need signoff from legal, compliance, and cybersecurity teams.

data/features/security-configuration-enterprise-organization-enforcement.yml

@@ -0,0 +1,5 @@
+# Reference: github/releases#9912
+# Enterprise security configuration enforcement for organization owners
+versions:
+  ghec: '*'
+  ghes: '>=3.24'

src/article-api/transformers/article-transformer.ts

@@ -2,14 +2,11 @@ import type { Context, Page } from '@/types'
 import type { PageTransformer } from './types'
 
 /**
- * Transformer for regular articles.
- *
- * This is a catch-all transformer registered last in the registry.
- * It renders the page body as markdown and prepends the title and intro.
+ * Catch-all transformer, registered last. Renders the page body as markdown
+ * and prepends the title and intro.
  */
 export class ArticleTransformer implements PageTransformer {
   canTransform(page: Page): boolean {
-    // Catch-all: handles any page not matched by a more specific transformer.
     return page != null
   }
 

src/article-api/transformers/audit-logs-transformer.ts

@@ -7,8 +7,7 @@ import { loadTemplate } from '@/article-api/lib/load-template'
 import matter from '@gr2m/gray-matter'
 
 /**
- * Transformer for Audit Logs pages
- * Converts audit log events and their data into markdown format using a Liquid template
+ * Converts audit log events and their data into markdown using a Liquid template.
  */
 export class AuditLogsTransformer implements PageTransformer {
   templateName = 'audit-logs-page.template.md'
@@ -22,7 +21,6 @@ export class AuditLogsTransformer implements PageTransformer {
     const { getCategorizedAuditLogEvents, getCategoryNotes, resolveReferenceLinksToMarkdown } =
       await import('@/audit-logs/lib/index')
 
-    // Extract version from context
     const currentVersion = context.currentVersion!
 
     let pageType = ''
@@ -36,11 +34,9 @@ export class AuditLogsTransformer implements PageTransformer {
       throw new Error(`Unknown audit log page type for path: ${pathname}`)
     }
 
-    // Get the audit log events data
     const categorizedEvents = getCategorizedAuditLogEvents(pageType, currentVersion)
     const categoryNotes = getCategoryNotes()
 
-    // Prepare manual content
     let manualContent = ''
     if (page.markdown) {
       const markerIndex = page.markdown.indexOf(
@@ -63,7 +59,6 @@ export class AuditLogsTransformer implements PageTransformer {
       }
     }
 
-    // Prepare data for template
     const templateData = await this.prepareTemplateData(
       page,
       categorizedEvents,
@@ -73,10 +68,8 @@ export class AuditLogsTransformer implements PageTransformer {
       resolveReferenceLinksToMarkdown,
     )
 
-    // Load and render template
     const templateContent = loadTemplate(this.templateName)
 
-    // Render the template with Liquid
     const rendered = await renderContent(templateContent, {
       ...context,
       ...templateData,
@@ -86,9 +79,6 @@ export class AuditLogsTransformer implements PageTransformer {
     return rendered
   }
 
-  /**
-   * Prepare data for the Liquid template
-   */
   private async prepareTemplateData(
     page: Page,
     categorizedEvents: CategorizedEvents,
@@ -100,7 +90,6 @@ export class AuditLogsTransformer implements PageTransformer {
       context: TitleResolutionContext,
     ) => Promise<string>,
   ): Promise<Record<string, unknown>> {
-    // Prepare page intro
     const intro = page.intro ? await page.renderProp('intro', context, { textOnly: true }) : ''
 
     // Sort categories and events, and compute fields shared by most (≥80%) events

src/article-api/transformers/bespoke-landing-transformer.ts

@@ -13,10 +13,9 @@ interface BespokeLandingPage extends Omit<Page, 'featuredLinks'> {
 }
 
 /**
- * Transforms bespoke-landing pages into markdown format.
- * Handles carousels and full article listings.
- * Note: Unlike discovery-landing, bespoke-landing shows ALL articles
- * regardless of includedCategories.
+ * Transforms bespoke-landing pages into markdown.
+ * Unlike discovery-landing, this shows every article regardless of
+ * includedCategories, which only filters discovery-landing pages.
  */
 export class BespokeLandingTransformer implements PageTransformer {
   templateName = 'landing-page.template.md'
@@ -80,7 +79,6 @@ export class BespokeLandingTransformer implements PageTransformer {
 
         const validLinks = links.filter((l) => l.href && l.title)
         if (validLinks.length > 0) {
-          // Use carousel key as title (capitalize first letter)
           const sectionTitle = carouselKey.charAt(0).toUpperCase() + carouselKey.slice(1)
           sections.push({
             title: sectionTitle,
@@ -90,14 +88,12 @@ export class BespokeLandingTransformer implements PageTransformer {
       }
     }
 
-    // Articles section: recursively gather ALL descendant articles
-    // This matches the behavior of the site which uses genericTocFlat/genericTocNested
-    // Note: For bespoke-landing pages, the site shows ALL articles regardless of includedCategories
-    // (includedCategories only filters for discovery-landing pages)
+    // Recursively gather every descendant article, matching the site's
+    // genericTocFlat/genericTocNested behaviour.
     if (bespokePage.children && bespokePage.children.length > 0) {
       const tocItems = await getAllTocItems(page, context)
 
-      // Flatten to get all leaf articles (excludeParents: true means only get articles, not category pages)
+      // excludeParents keeps only leaf TOC items, dropping anything with children.
       const allArticles = flattenTocItems(tocItems, { excludeParents: true })
 
       if (allArticles.length > 0) {