Skip to content

Commit 284d837

Browse files
docs-botdocs-bot
authored
Merge pull request github#36675 from github/repo-sync
Repo sync
2 parents dbb256b + e06558e commit 284d837

File tree

23 files changed

+306
-41
lines changed

23 files changed

+306
-41
lines changed

‎content/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ redirect_from:
2626

2727
{% data variables.product.prodname_copilot_autofix_short %} is allowed by default and enabled for every repository using {% data variables.product.prodname_codeql %}, but you can choose to opt out and disable {% data variables.product.prodname_copilot_autofix_short %}. To learn how to disable {% data variables.product.prodname_copilot_autofix_short %} at the enterprise, organization and repository levels, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/disabling-autofix-for-code-scanning).
2828

29-
In an organization's security overview dashboard, you can view the total number of code suggestions generated on open and closed pull requests in the organization for a given time period. For more information, see [AUTOTITLE](/enterprise-cloud@latest/code-security/security-overview/viewing-security-insights#autofix-suggestions) in the {% data variables.product.prodname_ghe_cloud %} documentation.
29+
In an organization's security overview dashboard, you can view the total number of code suggestions generated on open and closed pull requests in the organization for a given time period. For more information, see {% ifversion ghas-products-cloud %}[AUTOTITLE](/code-security/security-overview/viewing-security-insights#autofix-suggestions){% elsif fpt %}[AUTOTITLE](/enterprise-cloud@latest/code-security/security-overview/viewing-security-insights#autofix-suggestions) in the {% data variables.product.prodname_ghe_cloud %} documentation{% endif %}.
3030

3131
## Developer experience
3232

‎content/code-security/getting-started/index.md

+1
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,5 @@ children:
1919
- /adding-a-security-policy-to-your-repository
2020
- /auditing-security-alerts
2121
- /best-practices-for-preventing-data-leaks-in-your-organization
22+
- /understanding-github-secret-types
2223
---

‎content/code-security/getting-started/understanding-github-secret-types.md

+188
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
---
2+
title: Understanding GitHub secret types
3+
intro: 'Learn about the usage, scope, and access permissions for {% data variables.product.github %} secrets.'
4+
versions:
5+
fpt: '*'
6+
ghes: '*'
7+
ghec: '*'
8+
type: overview
9+
topics:
10+
- Repositories
11+
- Dependencies
12+
- Vulnerabilities
13+
- Advanced Security
14+
shortTitle: GitHub secret types
15+
---
16+
17+
## About {% data variables.product.github %}'s secret types
18+
19+
{% data variables.product.github %} secrets are used to securely store sensitive information like API keys, tokens, and passwords in repositories.
20+
21+
When you store the sensitive information as a {% data variables.product.github %} secret, you remove the need to hardcode the credential or key, and prevent exposure of it in your code or logs. The secret can then be used to authenticate services, manage credentials, and securely pass sensitive data in workflows.
22+
23+
There are {% ifversion fpt or ghec %}three {% else %}two {% endif %}types of secrets used by {% data variables.product.github %}:
24+
25+
* [{% data variables.product.prodname_dependabot %} secrets](#dependabot-secrets)
26+
* [Actions secrets](#actions-secrets){% ifversion fpt or ghec %}
27+
* [{% data variables.product.prodname_codespaces %} secrets](#codespaces-secrets){% endif %}
28+
29+
Depending on the {% data variables.product.github %} secret type, you can create and manage secrets under your repository, organization, or personal account security settings page.
30+
31+
{% ifversion fpt or ghec %}
32+
33+
### Understanding how {% data variables.product.github %} stores secrets
34+
35+
{% data variables.product.github %} uses [Libsodium sealed boxes](https://libsodium.gitbook.io/doc/public-key_cryptography/sealed_boxes) to encrypt secrets. A secret is encrypted before reaching {% data variables.product.github %} and remains encrypted until it's used by the relevant service ({% data variables.product.prodname_dependabot %}, {% data variables.product.prodname_actions %}, or {% data variables.product.prodname_codespaces %}).
36+
37+
{% endif %}
38+
39+
## {% data variables.product.prodname_dependabot %} secrets
40+
41+
{% data variables.product.prodname_dependabot %} secrets are used to store credentials and sensitive information for use within {% data variables.product.prodname_dependabot %}.
42+
43+
{% data variables.product.prodname_dependabot %} secrets are referenced in a repository's `dependabot.yml` file.
44+
45+
### Usage
46+
47+
{% data variables.product.prodname_dependabot %} secrets are typically used by {% data variables.product.prodname_dependabot %} to authenticate to private package registries. This allows {% data variables.product.prodname_dependabot %} to open pull requests to update vulnerable or outdated dependencies in private repositories. Used for authentication, these {% data variables.product.prodname_dependabot %} secrets are referenced in a repository's `dependabot.yml` file.
48+
49+
{% data variables.product.prodname_dependabot %} secrets can also include secrets required for workflows initiated by {% data variables.product.prodname_dependabot %}. For example, {% data variables.product.prodname_dependabot %} can trigger {% data variables.product.prodname_actions %} workflows when it creates pull requests to update dependencies, or comments on pull requests. In this case, {% data variables.product.prodname_dependabot %} secrets can be referenced from workflow files (`.github/workflows/*.yml`) as long as the workflow is triggered by a {% data variables.product.prodname_dependabot %} event.
50+
51+
### Scope
52+
53+
You can define {% data variables.product.prodname_dependabot %} secrets at:
54+
55+
* Repository level
56+
* Organization level
57+
58+
{% data variables.product.prodname_dependabot %} secrets can be shared across repositories when set at the organization-level. You must specify which repositories in the organization can access the secret.
59+
60+
### Access permissions
61+
62+
{% data variables.product.prodname_dependabot %} secrets are accessed by {% data variables.product.prodname_dependabot %} when authenticating to private registries to update dependencies.
63+
64+
{% data variables.product.prodname_dependabot %} secrets are accessed by {% data variables.product.prodname_actions %} workflows when the trigger event for the workflow is initiated by {% data variables.product.prodname_dependabot %}. This is because when a workflow is initiated by {% data variables.product.prodname_dependabot %}, only {% data variables.product.prodname_dependabot %} secrets are available - Actions secrets are not accessible. Therefore, any secrets required for these workflows must be stored as {% data variables.product.prodname_dependabot %} secrets, rather than Actions secrets. There are additional security restrictions for the `pull_request_target` event. See [Limitations and restrictions](#limitations-and-restrictions).
65+
66+
#### User access permissions
67+
68+
Repository-level secrets:
69+
* Users with **admin access** to the repository can create and manage {% data variables.product.prodname_dependabot %} secrets.
70+
* Users with **collaborator access** to the repository can use the secret for {% data variables.product.prodname_dependabot %}.
71+
72+
Organization-level secrets:
73+
* **Organization owners** can create and manage {% data variables.product.prodname_dependabot %} secrets.
74+
* Users with **collaborator access** to the repositories with access to each secret can use the secret for {% data variables.product.prodname_dependabot %}.
75+
76+
### Limitations and restrictions
77+
78+
For workflows initiated by {% data variables.product.prodname_dependabot %}, the `pull_request_target` event is treated differently to other events. For this event, if the base ref of the pull request was created by {% data variables.product.prodname_dependabot %} (`github.event.pull_request.user.login == 'dependabot[bot]'`):
79+
80+
* The workflow receives a read-only `GITHUB_TOKEN`.
81+
* Secrets are **not** available to the workflow.
82+
83+
This extra restriction helps prevent potential security risks that could arise from pull requests created by {% data variables.product.prodname_dependabot %}.
84+
85+
{% data variables.product.prodname_dependabot %} secrets are not passed to forks.
86+
87+
## Actions secrets
88+
89+
Actions secrets are used to store sensitive information such as API keys, authentication tokens, and other credentials in workflows.
90+
91+
### Usage
92+
93+
Actions secrets are referenced in workflow files (`.github/workflows/*.yml`).
94+
95+
### Scope
96+
97+
You can define Actions secrets at:
98+
99+
* Repository level
100+
* Environment level
101+
* Organization level
102+
103+
Environment-level secrets are specific to a particular environment, such as production or staging.
104+
Actions secrets can be shared across repositories if set at the organization-level. You can use access policies to control which repositories have access to the secret.
105+
106+
### Access permissions
107+
108+
Actions secrets are only available within {% data variables.product.prodname_actions %} workflows. Despite running on Actions, {% data variables.product.prodname_dependabot %} does not have access to Actions secrets.
109+
110+
For workflows initiated by {% data variables.product.prodname_dependabot %}, Actions secrets are not available. These workflow secrets must be stored as {% data variables.product.prodname_dependabot %} secrets in order to be accessible to the workflow.
111+
112+
The location where you store the Actions secret determines its accessibility:
113+
114+
* Repository secret: all workflows in the repository can access the secret.
115+
* Environment secret: secret is limited to jobs referencing that particular environment.
116+
* Organization secret: all workflows in the repositories that have been granted access by the organization can access the organization secrets.
117+
118+
#### User access permissions
119+
120+
Repository-level and environment secrets:
121+
* Users with **admin access** to the repository can create and manage Actions secrets.
122+
* Users with **collaborator access** to the repository can use the secret.
123+
124+
Organization-level secrets:
125+
* **Organization owners** can create and manage Actions secrets.
126+
* Users with **collaborator access** to the repositories with access to each secret can use the secret.
127+
128+
### Limitations and restrictions
129+
130+
* Actions secrets are not available to workflows initiated by {% data variables.product.prodname_dependabot %}.
131+
* Actions secrets are not passed to workflows that are triggered by a pull request from a fork.
132+
* {% data variables.product.prodname_actions %} automatically redacts the contents of all {% data variables.product.github %} secrets that are printed to workflow logs.
133+
* You can store up to 1,000 organization secrets, 100 repository secrets, and 100 environment secrets. Secrets are limited to 48 KB in size. For more information, see [Limits for secrets](/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#limits-for-secrets).
134+
135+
{% ifversion fpt or ghec %}
136+
137+
## {% data variables.product.prodname_codespaces %} secrets
138+
139+
{% data variables.product.prodname_codespaces %} secrets store credentials and sensitive information, such as API tokens and SSH keys, for use within {% data variables.product.prodname_github_codespaces %}, allowing you to configure secure development environments.
140+
141+
### Usage
142+
143+
{% data variables.product.prodname_codespaces %} secrets are referenced within the {% data variables.product.prodname_codespaces %} development container configuration (`devcontainer.json`).
144+
145+
### Scope
146+
147+
You can define {% data variables.product.prodname_codespaces %} secrets at:
148+
149+
* User account level
150+
* Repository level
151+
* Organization level
152+
153+
For user account level secrets, you can choose which repositories have access to the secret.
154+
{% data variables.product.prodname_codespaces %} secrets can be shared across repositories if set at the organization-level. You can use access policies to control which repositories have access to the secret.
155+
156+
### Access permissions
157+
158+
{% data variables.product.prodname_codespaces %} secrets are only accessible in {% data variables.product.prodname_codespaces %}.
159+
160+
{% data variables.product.prodname_actions %} cannot access {% data variables.product.prodname_codespaces %} secrets.
161+
162+
#### User access permissions
163+
164+
User account-level secrets:
165+
* {% data variables.product.prodname_codespaces %} secrets are available to any codespace you create using repositories with access to that secret.
166+
167+
Repository-level secrets:
168+
* Users with **admin access** to the repository can create and manage {% data variables.product.prodname_codespaces %} secrets.
169+
* Users with **collaborator access** to the repository can use the secret.
170+
171+
Organization-level secrets:
172+
* **Organization owners** can create and manage {% data variables.product.prodname_codespaces %} secrets.
173+
* Users with **collaborator access** to the repositories with access to each secret can use the secret.
174+
175+
### Limitations and restrictions
176+
177+
* You can store up to 100 secrets for {% data variables.product.prodname_github_codespaces %}.
178+
* Secrets are limited to 48 KB in size.
179+
* {% data variables.product.prodname_codespaces %} secrets are not passed to forks.
180+
181+
{% endif %}
182+
183+
## Further reading
184+
185+
* [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#storing-credentials-for-dependabot-to-use)
186+
* [AUTOTITLE](/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions){% ifversion fpt or ghec %}
187+
* [AUTOTITLE](/codespaces/managing-codespaces-for-your-organization/managing-development-environment-secrets-for-your-repository-or-organization)
188+
* [AUTOTITLE](/codespaces/managing-your-codespaces/managing-your-account-specific-secrets-for-github-codespaces){% endif %}

‎content/code-security/secret-scanning/copilot-secret-scanning/index.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Enhance your secret detection capabilities with Copilot secret scanning
33
shortTitle: Copilot secret scanning
44
allowTitleToDifferFromFilename: true
55
intro: 'Learn how {% data variables.product.prodname_secret_scanning %} uses AI to detect generic secrets in your code, and generate regular expressions for your custom patterns.'
6-
product: '{% data reusables.gated-features.copilot-secret-scanning %}'
6+
product: '{% data reusables.rai.secret-scanning.copilot-secret-scanning-gated-feature %}'
77
versions:
88
ghec: '*'
99
topics:

‎content/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Responsible detection of generic secrets with Copilot secret scanning
33
shortTitle: Generic secret detection
44
intro: 'Learn how {% data variables.secret-scanning.copilot-secret-scanning %} uses AI responsibly to scan and create alerts for unstructured secrets, such as passwords.'
55
allowTitleToDifferFromFilename: true
6-
product: '{% data reusables.gated-features.copilot-secret-scanning %}'
6+
product: '{% data reusables.rai.secret-scanning.copilot-secret-scanning-gated-feature %}'
77
versions:
88
feature: secret-scanning-ai-generic-secret-detection
99
fpt: '*'
@@ -27,7 +27,7 @@ redirect_from:
2727

2828
{% data reusables.rai.secret-scanning.copilot-secret-scanning-generic-secrets-subscription-note %}
2929

30-
{% data variables.product.prodname_GH_advanced_security %} users can already receive {% data variables.secret-scanning.alerts %} for partner or custom patterns found in their source code, but unstructured secrets are not easily discoverable. {% data variables.secret-scanning.copilot-secret-scanning %} uses large language models (LLMs) to identify this type of secret.
30+
{% data variables.product.prodname_GH_secret_protection %} users can already receive {% data variables.secret-scanning.alerts %} for partner or custom patterns found in their source code, but unstructured secrets are not easily discoverable. {% data variables.secret-scanning.copilot-secret-scanning %} uses large language models (LLMs) to identify this type of secret.
3131

3232
When a password is detected, an alert is displayed in the "Experimental" list of {% data variables.product.prodname_secret_scanning %} alerts (under the **Security** tab of the repository, organization, or enterprise), so that maintainers and security managers can review the alert and, where necessary, remove the credential or implement a fix.
3333

‎content/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-regex-generator.md

+4-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Responsible generation of regular expressions with Copilot secret scanning
33
shortTitle: Generate regular expressions with AI
44
intro: 'Learn about the capabilities and limitations of the {% data variables.secret-scanning.custom-pattern-regular-expression-generator %} in helping you to define custom patterns to extend the capabilities of {% data variables.product.prodname_secret_scanning %}.'
5-
product: '{% data reusables.gated-features.copilot-secret-scanning %}'
5+
product: '{% data reusables.rai.secret-scanning.copilot-secret-scanning-gated-feature %}'
66
allowTitleToDifferFromFilename: true
77
versions:
88
feature: secret-scanning-custom-pattern-ai-generated
@@ -71,7 +71,9 @@ Note that {% data variables.secret-scanning.copilot-secret-scanning %}'s {% data
7171

7272
## Further reading
7373

74-
{% ifversion fpt %}
74+
{% ifversion ghas-products-cloud %}
75+
<!-- Nothing to show because the bullets controlled by the feature version below will be visible to fpt -->
76+
{% elsif fpt %}
7577
* [AUTOTITLE](/code-security/secret-scanning/introduction/about-secret-scanning)
7678
* [AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning)
7779
{% endif %}

‎content/copilot/using-github-copilot/ai-models/using-claude-sonnet-in-github-copilot.md

+2
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ redirect_from:
3131

3232
{% data variables.product.prodname_copilot %} uses {% data variables.copilot.copilot_claude_sonnet %} hosted on Amazon Web Services. When using {% data variables.copilot.copilot_claude_sonnet %}, prompts and metadata are sent to Amazon's Bedrock service, which makes the [following data commitments](https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html): _Amazon Bedrock doesn't store or log your prompts and completions. Amazon Bedrock doesn't use your prompts and completions to train any AWS models and doesn't distribute them to third parties_.
3333

34+
Beginning March 11th, 2025, {% data variables.copilot.copilot_claude_sonnet %} will additionally be hosted by Anthropic PBC and Google Cloud Platform when used in {% data variables.product.prodname_copilot %} to provide additional model capacity and reliability.
35+
3436
When using {% data variables.copilot.copilot_claude_sonnet %}, input prompts and output completions continue to run through {% data variables.product.prodname_copilot %}'s content filters for public code matching, when applied, along with those for harmful, offensive, or off-topic content.
3537

3638
## Configuring access

0 commit comments

Comments
 (0)