Skip to content

Commit 8fb2d4e

Browse files
cmwilson21cmwilson21
authored
Merge branch 'main' into codewithdev-20631
2 parents 9fac760 + 72b3840 commit 8fb2d4e

File tree

67 files changed

+12336
-3683
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+12336
-3683
lines changed

‎components/guides/ProductGuides.tsx

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -17,26 +17,28 @@ export const ProductGuides = () => {
1717
<GuidesHero />
1818
</LandingSection>
1919

20-
{learningTracks && learningTracks.length > 0 && (
21-
<LandingSection
22-
title={`${title} learning paths`}
23-
className="border-top py-6"
24-
sectionLink="learning-paths"
25-
description={t('learning_paths_desc')}
26-
>
27-
<LearningTracks />
28-
</LandingSection>
29-
)}
20+
<div data-search="article-body">
21+
{learningTracks && learningTracks.length > 0 && (
22+
<LandingSection
23+
title={`${title} learning paths`}
24+
className="border-top py-6"
25+
sectionLink="learning-paths"
26+
description={t('learning_paths_desc')}
27+
>
28+
<LearningTracks />
29+
</LandingSection>
30+
)}
3031

31-
{includeGuides && (
32-
<LandingSection
33-
title={`All ${title} guides`}
34-
className="border-top py-6 color-border-default"
35-
sectionLink="all-guides"
36-
>
37-
<ArticleCards />
38-
</LandingSection>
39-
)}
32+
{includeGuides && (
33+
<LandingSection
34+
title={`All ${title} guides`}
35+
className="border-top py-6 color-border-default"
36+
sectionLink="all-guides"
37+
>
38+
<ArticleCards />
39+
</LandingSection>
40+
)}
41+
</div>
4042
</DefaultLayout>
4143
)
4244
}

‎content/actions/creating-actions/creating-a-docker-container-action.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ Next, the script gets the current time and sets it as an output variable that ac
124124
1. Make your `entrypoint.sh` file executable. Git provides a way to explicitly change the permission mode of a file so that it doesn’t get reset every time there is a clone/fork.
125125

126126
```shell{:copy}
127-
$ git update-index —chmod=+x entrypoint.sh
127+
$ git update-index --chmod=+x entrypoint.sh
128128
```
129129

130130
1. Optionally, to check the permission mode of the file in the git index, run the following command.

‎content/code-security/dependabot/dependabot-alerts/browsing-security-advisories-in-the-github-advisory-database.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,8 @@ Generally, we name our supported ecosystems after the software programming langu
5757
- Maven (registry: https://repo.maven.apache.org/maven2)
5858
- npm (registry: https://www.npmjs.com/)
5959
- NuGet (registry: https://www.nuget.org/)
60-
- pip (registry: https://pypi.org/)
60+
- pip (registry: https://pypi.org/){% ifversion dependency-graph-dart-support %}
61+
- pub (registry: https://pub.dev/packages/registry){% endif %}
6162
- RubyGems (registry: https://rubygems.org/)
6263
- Rust (registry: https://crates.io/)
6364

‎content/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ jobs:
6161
go-version: ">=1.18.0"
6262

6363
- name: Run snapshot action
64-
uses: @actions/go-dependency-submission@v1
64+
uses: actions/go-dependency-submission@v1
6565
with:
6666
# Required: Define the repo path to the go.mod file used by the
6767
# build target

‎content/developers/overview/secret-scanning-partner-program.md

Lines changed: 41 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -59,26 +59,25 @@ Send this information to <a href="mailto:secret-scanning@github.com">secret-scan
5959

6060
Create a public, internet accessible HTTP endpoint at the URL you provided to us. When a match of your regular expression is found in a public repository, {% data variables.product.prodname_dotcom %} will send an HTTP `POST` message to your endpoint.
6161

62-
#### Example POST sent to your endpoint
62+
#### Example request body
6363

64-
```http
65-
POST / HTTP/2
66-
Host: HOST
67-
Accept: */*
68-
Content-Type: application/json
69-
GITHUB-PUBLIC-KEY-IDENTIFIER: f9525bf080f75b3506ca1ead061add62b8633a346606dc5fe544e29231c6ee0d
70-
GITHUB-PUBLIC-KEY-SIGNATURE: MEUCIQDfLvT8/zM8F1aB3cM0ZwyeWF1m5YR6IhcUIv1OKQYL0wIgBZ5lVXB3gHK+dT8+xt0WgRVLqvsTPFiDO9QP/7eJ4yE=
71-
Content-Length: 187
72-
73-
[{"token":"NMIfyYncKcRALEXAMPLE","type":"mycompany_api_token","url":"https://github.com/octocat/Hello-World/blob/12345600b9cbe38a219f39a9941c9319b600c002/foo/bar.txt","source":"content"}]
64+
```json
65+
[
66+
{
67+
"token":"NMIfyYncKcRALEXAMPLE",
68+
"type":"mycompany_api_token",
69+
"url":"https://github.com/octocat/Hello-World/blob/12345600b9cbe38a219f39a9941c9319b600c002/foo/bar.txt",
70+
"source":"content"
71+
}
72+
]
7473
```
7574

76-
The message body is a JSON array that contains one or more objects with the following contents. When multiple matches are found, {% data variables.product.prodname_dotcom %} may send a single message with more than one secret match. Your endpoint should be able to handle requests with a large number of matches without timing out.
75+
The message body is a JSON array that contains one or more objects, with each object representing a single secret match. Your endpoint should be able to handle requests with a large number of matches without timing out. The keys for each secret match are:
7776

7877
* **token**: The value of the secret match.
7978
* **type**: The unique name you provided to identify your regular expression.
8079
* **url**: The public URL where the match was found (may be empty)
81-
* **source**: Where the token was found on GitHub.
80+
* **source**: Where the token was found on {% data variables.product.prodname_dotcom %}.
8281

8382
The list of valid values for `source` are:
8483

@@ -97,26 +96,32 @@ The list of valid values for `source` are:
9796

9897
### Implement signature verification in your secret alert service
9998

100-
We strongly recommend you implement signature validation in your secret alert service to ensure that the messages you receive are genuinely from {% data variables.product.prodname_dotcom %} and not malicious.
99+
The HTTP request to your service will also contain headers that we strongly recommend using
100+
to validate the messages you receive are genuinely from {% data variables.product.prodname_dotcom %}, and are not malicious.
101+
102+
The two HTTP headers to look for are:
103+
104+
* `GITHUB-PUBLIC-KEY-IDENTIFIER`: Which `key_identifier` to use from our API
105+
* `GITHUB-PUBLIC-KEY-SIGNATURE`: Signature of the payload
101106

102-
You can retrieve the {% data variables.product.prodname_dotcom %} secret scanning public key from https://api.github.com/meta/public_keys/secret_scanning and validate the message using the `ECDSA-NIST-P256V1-SHA256` algorithm.
107+
You can retrieve the {% data variables.product.prodname_dotcom %} secret scanning public key from https://api.github.com/meta/public_keys/secret_scanning and validate the message using the `ECDSA-NIST-P256V1-SHA256` algorithm. The endpoint
108+
will provide several `key_identifier` and public keys. You can determine which public
109+
key to use based on the value of `GITHUB-PUBLIC-KEY-IDENTIFIER`.
103110

104111
{% note %}
105112

106113
**Note**: When you send a request to the public key endpoint above, you may hit rate limits. To avoid hitting rate limits, you can use a personal access token (no scopes required) as suggested in the samples below, or use a conditional request. For more information, see "[Getting started with the REST API](/rest/guides/getting-started-with-the-rest-api#conditional-requests)."
107114

108115
{% endnote %}
109116

110-
Assuming you receive the following message, the code snippets below demonstrate how you could perform signature validation.
111-
The code snippets assume you've set an environment variable called `GITHUB_PRODUCTION_TOKEN` with a generated PAT (https://github.com/settings/tokens) to avoid hitting rate limits. The PAT does not need any scopes/permissions.
112-
113117
{% note %}
114118

115119
**Note**: The signature was generated using the raw message body. So it's important you also use the raw message body for signature validation, instead of parsing and stringifying the JSON, to avoid rearranging the message or changing spacing.
116120

117121
{% endnote %}
118122

119-
**Sample message sent to verify endpoint**
123+
**Sample HTTP POST sent to verify endpoint**
124+
120125
```http
121126
POST / HTTP/2
122127
Host: HOST
@@ -129,6 +134,23 @@ Content-Length: 83
129134
[{"token":"some_token","type":"some_type","url":"some_url","source":"some_source"}]
130135
```
131136

137+
{% note %}
138+
139+
**Note**: The key id and signature from the example payload is derived from a test key.
140+
The public key for them is:
141+
142+
```
143+
-----BEGIN PUBLIC KEY-----
144+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsz9ugWDj5jK5ELBK42ynytbo38gP
145+
HzZFI03Exwz8Lh/tCfL3YxwMdLjB+bMznsanlhK0RwcGP3IDb34kQDIo3Q==
146+
-----END PUBLIC KEY-----
147+
```
148+
149+
{% endnote %}
150+
151+
The following code snippets demonstrate how you could perform signature validation.
152+
The code examples assume you've set an environment variable called `GITHUB_PRODUCTION_TOKEN` with a generated [personal access token](https://github.com/settings/tokens) (PAT) to avoid hitting rate limits. The PAT does not need any scopes/permissions.
153+
132154
**Validation sample in Go**
133155
```golang
134156
package main

‎content/get-started/writing-on-github/working-with-saved-replies/about-saved-replies.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ versions:
1515

1616
Saved replies allow you to create a reusable response to issues and pull requests. Save time by creating a saved reply for the responses you use most frequently.
1717

18-
Once you've added a saved reply, it can be used in both issues and pull requests. Saved replies are tied to your personal account. Once they're created, you'll be able to use them across repositories and organizations.
18+
Once you've added a saved reply, it can be used in issues, pull requests, and discussions. Saved replies are tied to your personal account. Once they're created, you'll be able to use them across repositories and organizations.
1919

2020
You can create a maximum of 100 saved replies. If you've reached the maximum limit, you can delete saved replies that you no longer use or edit existing saved replies.
2121

‎content/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,10 @@ With other CI providers, you may need to update your CI configuration to run whe
5757

5858
Repository administrators can require a merge queue by enabling the branch protection setting "Require merge queue" in the protection rules for the base branch.
5959

60+
### About the merge group size setting
61+
62+
You can configure a merge queue's merge group size, which determines how many pull requests are included in each merge group. When there are no status check failures or merge conflicts, choosing the default "small" merge group size will form groups containing 2 pull requests. If you want to group more pull requests per group, you may choose the "medium" merge group size to form groups containing 5 pull requests each.
63+
6064
For information about how to enable the merge queue protection setting, see "[Managing a branch protection rule](/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule#creating-a-branch-protection-rule)."
6165

6266
## Further reading

‎content/rest/enterprise-admin/scim.md

Lines changed: 68 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,77 @@
11
---
22
title: SCIM
3-
intro: ''
3+
intro: 'You can automate user creation and team memberships using the SCIM API.'
44
versions:
55
ghes: '>=3.6'
66
topics:
77
- API
88
miniTocMaxHeadingLevel: 3
99
---
1010

11+
{% note %}
12+
13+
**Note:** The SCIM API for {% data variables.product.product_name %} is currently in private beta and subject to change. To access the private beta and test the API, contact your account manager on {% data variables.contact.contact_enterprise_sales %}.
14+
15+
{% endnote %}
16+
17+
## About the SCIM API
18+
19+
{% data variables.product.product_name %} provides a SCIM API for use by SCIM-enabled Identity Providers (IdPs). An integration on the IdP can use the API to automatically provision, manage, or deprovision user accounts on a {% data variables.product.product_name %} instance that uses SAML single sign-on (SSO) for authentication. For more information about SAML SSO, see "[About SAML for enterprise IAM](/admin/identity-and-access-management/using-saml-for-enterprise-iam/about-saml-for-enterprise-iam)."
20+
21+
The SCIM API is based on SCIM 2.0. For more information, see the [specification](https://www.simplecloud.info/#Specification).
22+
23+
### SCIM endpoint URLs
24+
25+
An IdP can use the following root URL to communicate with the SCIM API for a {% data variables.product.product_name %} instance.
26+
27+
```
28+
{% data variables.product.api_url_code %}/scim/v2/
29+
```
30+
31+
Endpoint URLs for the SCIM API are case-sensitive. For example, the first letter in the `Users` endpoint must be capitalized.
32+
33+
```shell
34+
GET /scim/v2/Users/{scim_user_id}
35+
```
36+
37+
### Authenticating calls to the SCIM API
38+
39+
The SCIM integration on the IdP performs actions on behalf of an enterprise owner for the {% data variables.product.product_name %} instance. For more information, see "[Roles in an enterprise](/admin/user-management/managing-users-in-your-enterprise/roles-in-an-enterprise#enterprise-owners)."
40+
41+
To authenticate requests to the API, the person who configures SCIM on the IdP must use a personal access token (classic) with `admin:enterprise` scope, which the IdP must provide in the request's `Authorization` header. For more information about personal access tokens (classic), see "[Creating a personal access token](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)".
42+
43+
{% note %}
44+
45+
**Note:** Enterprise owners must generate and use a personal access token (classic) for authentication of requests to the SCIM API. {% ifversion ghes > 3.8 %}Fine-grained personal access tokens and {% endif %}GitHub app callers are not supported at this time.
46+
47+
{% endnote %}
48+
49+
### About mapping of SAML and SCIM data
50+
51+
The {% data variables.product.product_name %} instance links each user who authenticates successfully with SAML SSO to a SCIM identity. To link the identities successfully, the SAML IdP and the SCIM integration must use matching SAML `NameID` and SCIM `userName` values for each user.
52+
53+
{% ifversion ghes > 3.7 %}
54+
{% note %}
55+
56+
**Note:** If the {% data variables.product.product_name %} uses Azure AD as a SAML IdP, {% data variables.product.product_name %} will also check the SCIM `externalId` claim and SAML `http://schemas.microsoft.com/identity/claims/objectidentifier` claim to match users first, instead of using `NameID` and `userName`.
57+
58+
{% endnote %}
59+
{% endif %}
60+
61+
### Supported SCIM user attributes
62+
63+
The SCIM API's `User` endpoints support the following attributes within a request's parameters.
64+
65+
| Name | Type | Description |
66+
| :- | :- | :- |
67+
| `displayName` | String | Human-readable name for a user. |
68+
| `name.formatted` | String | The user's full name, including all middle names, titles, and suffixes, formatted for display.
69+
| `name.givenName` | String | The first name of the user. |
70+
| `name.familyName` | String | The last name of the user. |
71+
| `userName` | String | The username for the user, generated by the IdP. Undergoes [normalization](/admin/identity-and-access-management/managing-iam-for-your-enterprise/username-considerations-for-external-authentication#about-username-normalization) before being used.
72+
| `emails` | Array | List of the user's emails. |
73+
| `roles` | Array | List of the user's roles. |
74+
| `externalId` | String | This identifier is generated by an IdP provider. You can find the `externalId` for a user either on the IdP, or by using the [List SCIM provisioned identities](#list-scim-provisioned-identities-for-an-enterprise) endpoint and filtering on other known attributes, such as a user's username or email address on the {% data variables.product.product_name %} instance. |
75+
| `id` | String | Identifier generated by the instance's SCIM endpoint. |
76+
| `active` | Boolean | Indicates whether the identity is active (`true`) or should be suspended (`false`). |
77+

‎data/release-notes/enterprise-server/3-3/12.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,4 @@ sections:
2020
- Resource limits that are specific to processing pre-receive hooks may cause some pre-receive hooks to fail.
2121
- '{% data variables.product.prodname_actions %} storage settings cannot be validated and saved in the {% data variables.enterprise.management_console %} when "Force Path Style" is selected, and must instead be configured with the `ghe-actions-precheck` command line utility.'
2222
- '{% data reusables.release-notes.ghas-3.4-secret-scanning-known-issue %}'
23+
- The [file finder](/search-github/searching-on-github/finding-files-on-github) does not return any results. To restore functionality, reinstall the 3.3.12 patch release using a full upgrade package. For more information, see "[Upgrading GitHub Enterprise Server](/admin/enterprise-management/updating-the-virtual-machine-and-physical-resources/upgrading-github-enterprise-server#upgrading-with-an-upgrade-package)."

‎lib/redirects/static/client-side-rest-api-redirects.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -956,8 +956,8 @@
956956
"/rest/teams#unlink-external-idp-group-team-connection": "/rest/teams/external-groups#unlink-external-idp-group-team-connection",
957957
"/rest/teams#list-idp-groups-for-a-team": "/rest/teams/team-sync#list-idp-groups-for-a-team",
958958
"/rest/teams#create-or-update-idp-group-connections": "/rest/teams/team-sync#create-or-update-idp-group-connections",
959-
"/rest/actions/oidc#get-the-opt-out-flag-of-an-oidc-subject-claim-customization-for-a-repository": "/rest/actions/oidc#get-the-opt-out-flag-of-an-oidc-subject-claim-customization-for-a-repository",
960-
"/rest/actions/oidc#set-the-opt-out-flag-of-an-oidc-subject-claim-customization-for-a-repository": "/rest/actions/oidc#set-the-opt-out-flag-of-an-oidc-subject-claim-customization-for-a-repository",
959+
"/rest/actions/oidc#get-the-customization-template-for-an-oidc-subject-claim-for-a-repository": "/rest/actions/oidc#get-the-customization-template-for-an-oidc-subject-claim-for-a-repository",
960+
"/rest/actions/oidc#set-the-customization-template-for-an-oidc-subject-claim-for-a-repository": "/rest/actions/oidc#set-the-customization-template-for-an-oidc-subject-claim-for-a-repository",
961961
"/rest/teams#list-idp-groups-for-a-team-legacy": "/rest/teams/team-sync#list-idp-groups-for-a-team-legacy",
962962
"/rest/teams#create-or-update-idp-group-connections-legacy": "/rest/teams/team-sync#create-or-update-idp-group-connections-legacy",
963963
"/rest/enterprise-admin#list-global-webhooks": "/rest/enterprise-admin/global-webhooks#list-global-webhooks",

0 commit comments

Comments
 (0)