diff --git a/content/actions/concepts/about-actions-policies.md b/content/actions/concepts/about-actions-policies.md index fdbdb94c8cf5..ab807b142c1e 100644 --- a/content/actions/concepts/about-actions-policies.md +++ b/content/actions/concepts/about-actions-policies.md @@ -35,7 +35,7 @@ When enforced, disallowed workflow runs will fail with an error. For example: Event 'workflow_dispatch' is not allowed to trigger Actions workflows. Workflow file: '.github/workflows/0-welcome.yml'. ``` - + {% ifversion default-pull-req-target-policy %} @@ -43,7 +43,7 @@ Event 'workflow_dispatch' is not allowed to trigger Actions workflows. Workflow {% endif %} - + ### Available rules diff --git a/content/actions/how-tos/administer/control-workflow-execution.md b/content/actions/how-tos/administer/control-workflow-execution.md index 656cab729e28..70e0b937ceb1 100644 --- a/content/actions/how-tos/administer/control-workflow-execution.md +++ b/content/actions/how-tos/administer/control-workflow-execution.md @@ -15,7 +15,7 @@ product: 'All public repositories, and private repositories on {% data variables {% data reusables.actions.actions-policies-about-body %} For more information, see [AUTOTITLE](/actions/concepts/about-actions-policies). - + {% ifversion default-pull-req-target-policy %} @@ -23,7 +23,7 @@ product: 'All public repositories, and private repositories on {% data variables {% endif %} - + ## Preparing to add protections diff --git a/content/actions/reference/security/securely-using-pull_request_target.md b/content/actions/reference/security/securely-using-pull_request_target.md index 5a601d4d8cee..b1807de9472f 100644 --- a/content/actions/reference/security/securely-using-pull_request_target.md +++ b/content/actions/reference/security/securely-using-pull_request_target.md @@ -61,7 +61,7 @@ To help protect your workflows from untrusted pull requests, {% data variables.p For public repositories that do not already have an applicable Actions event policy, GitHub adds a default policy that blocks workflows triggered by `pull_request_target`. For more information about policies, see [AUTOTITLE](/actions/concepts/about-actions-policies). - + The default policy: @@ -70,9 +70,9 @@ The default policy: * Does not replace an applicable event policy that you have already configured. * Currently runs in **evaluate** mode. In this mode, workflow runs continue, but you can use policy insights to identify runs that would be blocked after enforcement. -On November 2, 2026, GitHub will enforce the default policy for affected repositories that were using the default `pull_request_target` policy before general availability. +On December 2, 2026, GitHub will enforce the default policy for affected repositories that were using the default `pull_request_target` policy before general availability. - + ### Reviewing the impact before enforcement diff --git a/content/billing/concepts/product-billing/cloud-and-local-sandboxes.md b/content/billing/concepts/product-billing/cloud-and-local-sandboxes.md index 1c6bfcf6841f..89214bb20071 100644 --- a/content/billing/concepts/product-billing/cloud-and-local-sandboxes.md +++ b/content/billing/concepts/product-billing/cloud-and-local-sandboxes.md @@ -61,7 +61,7 @@ You pay for cloud sandboxes using the payment method set up for your {% data var Cloud sandbox usage is billed to the account that owns the sandbox. -You are prompted to select an owner for the session only if you are not currently in a Git repository. In this case, when you create a cloud sandbox session with `copilot ‑‑cloud`, you are prompted to select an owner—your own personal account is listed first, ahead of any organizations you belong to. You must choose either your personal account or one of the listed organizations, and all usage for that session is billed to the account you select. +You are prompted to select an owner for the session only if you are not currently in a Git repository. In this case, when you create a cloud sandbox session with `copilot --cloud`, you are prompted to select an owner—your own personal account is listed first, ahead of any organizations you belong to. You must choose either your personal account or one of the listed organizations, and all usage for that session is billed to the account you select. If you are in a repository, the owner of the repository is billed and no owner selection is required. diff --git a/content/code-security/how-tos/view-and-interpret-data/analyze-organization-data/viewing-public-monitoring-alerts.md b/content/code-security/how-tos/view-and-interpret-data/analyze-organization-data/viewing-public-monitoring-alerts.md index 58b5b82fa856..c7e820db89fa 100644 --- a/content/code-security/how-tos/view-and-interpret-data/analyze-organization-data/viewing-public-monitoring-alerts.md +++ b/content/code-security/how-tos/view-and-interpret-data/analyze-organization-data/viewing-public-monitoring-alerts.md @@ -1,8 +1,8 @@ --- -title: Viewing public monitoring alerts -shortTitle: View public monitoring alerts +title: Viewing and managing public monitoring alerts +shortTitle: View and manage public monitoring alerts allowTitleToDifferFromFilename: true -intro: 'Find out which credentials your enterprise members have exposed in public repositories across {% data variables.product.github %}.' +intro: 'Find and manage alerts for credentials your enterprise members have exposed in public repositories across {% data variables.product.github %}.' permissions: 'Enterprise owners can access the public monitoring page in security overview.' versions: feature: secret-scanning-public-monitoring @@ -43,3 +43,29 @@ Public monitoring must be enabled for your enterprise. See [AUTOTITLE](/code-sec * Attribution details, including the committer's username and email * The file location where the secret was detected, with the secret highlighted in context * A **Recommendations** tab with suggested remediation steps + +## Dismissing and reopening alerts + +When you have reviewed an alert, you can dismiss it to remove it from the list of open alerts. If you need to revisit a dismissed alert later, you can reopen it. When you dismiss or reopen an alert, you can add an optional comment to record the reason for your decision. + +Dismissing alerts you have already triaged helps you manage a high volume of public monitoring alerts, keeping the active list focused on the exposures that still need attention. + +### Dismissing an alert + +{% data reusables.enterprise-accounts.access-enterprise %} +{% data reusables.enterprise-accounts.security-and-code-quality-tab %} +1. In the left sidebar, click **{% octicon "key" aria-hidden="true" aria-label="key" %} Public monitoring**. +1. Click the alert you want to dismiss. +1. Select the **Close as** dropdown menu, then click a reason for dismissing the alert. +1. Optionally, in the comment field, add a dismissal comment. +1. To confirm, click **Dismiss**. + +### Reopening an alert + +{% data reusables.enterprise-accounts.access-enterprise %} +{% data reusables.enterprise-accounts.security-and-code-quality-tab %} +1. In the left sidebar, click **{% octicon "key" aria-hidden="true" aria-label="key" %} Public monitoring**. +1. To view closed alerts, click **Closed**, then click the alert you want to reopen.  +1. Click **Reopen alert**. +1. Optionally, in the comment field, type a reason for reopening the alert. +1. To confirm, click **Reopen**. diff --git a/content/copilot/concepts/enterprise/default-availability.md b/content/copilot/concepts/enterprise/default-availability.md index 328889d8a21e..6805db6f4c82 100644 --- a/content/copilot/concepts/enterprise/default-availability.md +++ b/content/copilot/concepts/enterprise/default-availability.md @@ -17,17 +17,9 @@ redirect_from: {% data reusables.copilot.default-availability-policies %} - - ## Default availability of features -The **Default policy for new features** policy is available to configure but is **not** currently active. Starting from October 22, 2026, the value you have defined for this policy will be the default setting: it will apply to any new or existing GA feature that you have not explicitly configured. - -In your policy settings, you will see a banner showing how many eligible policies are currently unconfigured, so you can assess the impact of your global default and explicitly configure individual policies before October 22. - -This policy is enabled by default. If you don't take action, unconfigured features will be enabled on October 22. - - +The **Default policy for new features and clients** policy applies to any new or existing GA feature that you have not explicitly configured. ### When does the policy apply? @@ -46,7 +38,7 @@ At the enterprise level, the policy has the following possible states. Policy state | Outcome ------------ | -------- -**Let organizations decide** | Any unconfigured, GA feature is automatically available for organizations to enable or disable. The default state of the feature _in each of those organizations_ is determined by the organization-level **Default policy for new features** policy. +**Let organizations decide** | The "default availability" policy decision is delegated to organizations. An unconfigured feature is set to "Let organizations decide" if its policy supports that option; otherwise, it is disabled. For a feature delegated to organizations and not explicitly configured by an organization owner, the organization-level "default policy" for new features determines its availability. **Enabled everywhere** | Any unconfigured, GA feature is automatically enabled for all your {% data variables.product.prodname_copilot_short %} users, and organizations cannot disable it. **Disabled everywhere** | Any unconfigured, GA feature is automatically disabled for all your {% data variables.product.prodname_copilot_short %} users, and organizations cannot enable it. @@ -80,7 +72,7 @@ Policy state | Outcome ------------ | -------- **Enabled** | Any model labeled **Delegate to Default Policy** is automatically enabled for all your {% data variables.product.prodname_copilot_short %} users, and organizations or teams cannot disable it. **Disabled** | Any model labeled **Delegate to Default Policy** is automatically disabled for all your {% data variables.product.prodname_copilot_short %} users, and organizations or teams cannot enable it. -**Let organizations decide** | Any model labeled **Delegate to Default Policy** is automatically available for organizations to enable or disable. In each organization, an eligible model follows the organization-level **Default availability for released models** policy if the organization has not explicitly configured it. This state is not available if you have enabled enterprise teams mode. +**Let organizations decide** | (Not available in enterprise teams mode.) Any model labeled **Delegate to Default Policy** is automatically available for organizations to enable or disable. In each organization, an eligible model follows the organization-level **Default availability for released models** policy if the organization has not explicitly configured it. #### Policy states for models diff --git a/content/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes.md b/content/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes.md index 17f42f8ba8a7..2e6f8f44e82c 100644 --- a/content/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes.md +++ b/content/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes.md @@ -137,7 +137,7 @@ Cloud sandboxing is built on Azure Container Apps Sandboxes, with {% data variab To start a cloud-backed session, run the following command: ```shell copy -copilot ‑‑cloud ‑‑experimental +copilot --cloud --experimental ``` > [!NOTE] @@ -145,7 +145,7 @@ copilot ‑‑cloud ‑‑experimental The `‑‑cloud` command line option launches an interactive {% data variables.copilot.copilot_cli_short %} session inside a cloud sandbox. You can prompt {% data variables.product.prodname_copilot_short %} to perform tasks, run shell commands, and iterate on code, the same way you would in a local session. The commands that {% data variables.product.prodname_copilot_short %} runs execute in the cloud environment, not on your local machine. -Running `copilot ‑‑cloud` starts a single {% data variables.copilot.copilot_cli_short %} session in a cloud sandbox. It does not affect future {% data variables.product.prodname_copilot_short %} sessions. Each time you want to run a new session in a cloud sandbox, you must start the CLI with the `‑‑cloud` option. +Running `copilot --cloud` starts a single {% data variables.copilot.copilot_cli_short %} session in a cloud sandbox. It does not affect future {% data variables.product.prodname_copilot_short %} sessions. Each time you want to run a new session in a cloud sandbox, you must start the CLI with the `‑‑cloud` option. > [!NOTE] > Cloud sandboxing is only available for interactive {% data variables.copilot.copilot_cli_short %} sessions. You can't run the CLI programmatically in a cloud sandbox—that is, you can't combine the `‑‑cloud` option with the `-p` or `-i` options. diff --git a/content/copilot/how-tos/copilot-cli/use-copilot-cli/overview.md b/content/copilot/how-tos/copilot-cli/use-copilot-cli/overview.md index 79e14de11c30..1234ffd32a49 100644 --- a/content/copilot/how-tos/copilot-cli/use-copilot-cli/overview.md +++ b/content/copilot/how-tos/copilot-cli/use-copilot-cli/overview.md @@ -315,7 +315,7 @@ For situations where you trust {% data variables.product.prodname_copilot_short You can use sandboxing to restrict what {% data variables.product.prodname_copilot_short %} can access. Local sandboxing does not run the CLI itself in a sandbox; instead, the commands and tools that {% data variables.copilot.copilot_cli_short %} runs on your behalf are restricted, limiting their access to your filesystem, network, and system capabilities. To enable local sandboxing, enter `/sandbox enable` inside a session. -Alternatively, with cloud sandboxing, the entire {% data variables.copilot.copilot_cli_short %} session runs remotely in an isolated environment. To start a {% data variables.copilot.copilot_cli_short %} session in the cloud, run `copilot ‑‑cloud`. For more information, see [AUTOTITLE](/copilot/concepts/about-cloud-and-local-sandboxes). +Alternatively, with cloud sandboxing, the entire {% data variables.copilot.copilot_cli_short %} session runs remotely in an isolated environment. To start a {% data variables.copilot.copilot_cli_short %} session in the cloud, run `copilot --cloud`. For more information, see [AUTOTITLE](/copilot/concepts/about-cloud-and-local-sandboxes). ### Toggle reasoning visibility diff --git a/data/reusables/actions/workflows/pull-request-target-policy.md b/data/reusables/actions/workflows/pull-request-target-policy.md index 371eb2fcfc3a..9b32f9a9f986 100644 --- a/data/reusables/actions/workflows/pull-request-target-policy.md +++ b/data/reusables/actions/workflows/pull-request-target-policy.md @@ -1 +1 @@ -{% data variables.product.company_short %} has added a default policy that will block the `pull_request_target` event in public repositories. This policy will be enforced on November 2, 2026. See [AUTOTITLE](/actions/reference/security/securely-using-pull_request_target#default-policy-for-pull_request_target). +{% data variables.product.company_short %} has added a default policy that will block the `pull_request_target` event in public repositories. This policy will be enforced on December 2, 2026. See [AUTOTITLE](/actions/reference/security/securely-using-pull_request_target#default-policy-for-pull_request_target). diff --git a/data/reusables/copilot/default-availability-policies.md b/data/reusables/copilot/default-availability-policies.md index f6c55c3d9de7..a0a2e1cc9f88 100644 --- a/data/reusables/copilot/default-availability-policies.md +++ b/data/reusables/copilot/default-availability-policies.md @@ -1,7 +1,3 @@ -For enterprises with {% data variables.copilot.copilot_business_short %} or {% data variables.copilot.copilot_enterprise_short %} plans, two separate policies control whether unconfigured generally available (GA) features and models default to enabled or disabled. If these policies are enabled, users benefit from the latest features and models without the need for administrator intervention. +For enterprises with {% data variables.copilot.copilot_business_short %} or {% data variables.copilot.copilot_enterprise_short %} plans, two separate policies control whether unconfigured generally available (GA) features and models default to enabled or disabled. - - -The models policy is already active. The feature policy will become active soon. - - +If these policies are enabled, users benefit from the latest features and models without the need for administrator intervention.