From f219414e4552acd7ee8aafe4e9da3516aab4a890 Mon Sep 17 00:00:00 2001 From: Brian DeHamer Date: Wed, 12 Aug 2026 00:10:00 +0000 Subject: [PATCH 1/5] docs: add GITHUB_ARTIFACTS and GITHUB_ARTIFACTS_LIST env files (#62574) Signed-off-by: Brian DeHamer Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Joe Clark <31087804+jc-clark@users.noreply.github.com> Copilot-Session: 68bd6853-1101-4aa0-80d5-da928dc71905 --- .../workflows-and-actions/contexts.md | 4 + .../workflows-and-actions/variables.md | 4 + .../workflow-commands.md | 95 +++++++++++++++++++ data/features/actions-artifacts-file.yml | 6 ++ 4 files changed, 109 insertions(+) create mode 100644 data/features/actions-artifacts-file.yml diff --git a/content/actions/reference/workflows-and-actions/contexts.md b/content/actions/reference/workflows-and-actions/contexts.md index 14d958089ea2..73f4e13158f9 100644 --- a/content/actions/reference/workflows-and-actions/contexts.md +++ b/content/actions/reference/workflows-and-actions/contexts.md @@ -181,6 +181,10 @@ The `github` context contains information about the workflow run and the event t | `github.actor` | `string` | The username of the user that triggered the initial workflow run. If the workflow run is a re-run, this value may differ from `github.triggering_actor`. Any workflow re-runs will use the privileges of `github.actor`, even if the actor initiating the re-run (`github.triggering_actor`) has different privileges. | | `github.actor_id` | `string` | {% data reusables.actions.actor_id-description %} | | `github.api_url` | `string` | The URL of the {% data variables.product.prodname_dotcom %} REST API. | +| {% ifversion actions-artifacts-file %} | +| `github.artifacts` | `string` | Path on the runner to the file that identifies workflow artifacts for the current step. Write one declaration per line to identify files or OCI digest references as workflow artifacts. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-commands#declaring-workflow-artifacts). | +| `github.artifacts_list` | `string` | Path on the runner to a read-only file containing the aggregated workflow artifact metadata for the current job as JSON. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-commands#reading-workflow-artifacts). | +| {% endif %} | | `github.base_ref` | `string` | The `base_ref` or target branch of the pull request in a workflow run. This property is only available when the event that triggers a workflow run is either `pull_request` or `pull_request_target`. | | `github.env` | `string` | Path on the runner to the file that sets environment variables from workflow commands. This file is unique to the current step and is a different file for each step in a job. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-commands#setting-an-environment-variable). | | `github.event` | `object` | The full event webhook payload. You can access individual properties of the event using this context. This object is identical to the webhook payload of the event that triggered the workflow run, and is different for each event. The webhooks for each {% data variables.product.prodname_actions %} event is linked in [AUTOTITLE](/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_call). For example, for a workflow run triggered by the [`push` event](/actions/reference/workflows-and-actions/events-that-trigger-workflows#push), this object contains the contents of the [push webhook payload](/webhooks/webhook-events-and-payloads#push). | diff --git a/content/actions/reference/workflows-and-actions/variables.md b/content/actions/reference/workflows-and-actions/variables.md index 49633212b7fc..bcbfe5bc38bf 100644 --- a/content/actions/reference/workflows-and-actions/variables.md +++ b/content/actions/reference/workflows-and-actions/variables.md @@ -37,6 +37,10 @@ We strongly recommend that actions use variables to access the filesystem rather | `GITHUB_ACTOR` | The name of the person or app that initiated the workflow. For example, `octocat`. | | `GITHUB_ACTOR_ID` | {% data reusables.actions.actor_id-description %} | | `GITHUB_API_URL` | Returns the API URL. For example: `{% data variables.product.rest_url %}`. | +| {% ifversion actions-artifacts-file %} | +| `GITHUB_ARTIFACTS` | The path on the runner to the file that declares workflow artifacts for the current step. Write one declaration per line to identify files or OCI digest references as workflow artifacts. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-commands#declaring-workflow-artifacts). | +| `GITHUB_ARTIFACTS_LIST` | The path on the runner to a read-only file that contains aggregated workflow artifact metadata for the current job as a JSON object. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-commands#reading-workflow-artifacts). | +| {% endif %} | | `GITHUB_BASE_REF` | The name of the base ref or target branch of the pull request in a workflow run. This is only set when the event that triggers a workflow run is either `pull_request` or `pull_request_target`. For example, `main`. | | `GITHUB_ENV` | The path on the runner to the file that sets variables from workflow commands. The path to this file is unique to the current step and changes for each step in a job. For example, `/home/runner/work/_temp/_runner_file_commands/set_env_87406d6e-4979-4d42-98e1-3dab1f48b13a`. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-commands#setting-an-environment-variable). | | `GITHUB_EVENT_NAME` | The name of the event that triggered the workflow. For example, `workflow_dispatch`. | diff --git a/content/actions/reference/workflows-and-actions/workflow-commands.md b/content/actions/reference/workflows-and-actions/workflow-commands.md index c664639300a4..9800fd4c0eff 100644 --- a/content/actions/reference/workflows-and-actions/workflow-commands.md +++ b/content/actions/reference/workflows-and-actions/workflow-commands.md @@ -959,3 +959,98 @@ This example demonstrates how to add the user `$env:HOMEPATH/.local/bin` directo ``` {% endpowershell %} + +{% ifversion actions-artifacts-file %} + +## Declaring workflow artifacts + +Declare files or OCI references as workflow artifacts by writing one declaration per line to the `GITHUB_ARTIFACTS` environment file. Each step writes to a fresh, per-step file; the path is unique to that step. + +Metadata about declared artifacts is collected across all steps in a job and exposed through the `GITHUB_ARTIFACTS_LIST` file. + +Each line must be one of the following formats. Blank lines and lines starting with `#` are ignored. + +* **File path**: A relative or absolute path to a file, optionally prefixed with `file://`. Relative paths are resolved against `GITHUB_WORKSPACE`. The path must point to an existing regular file (not a directory). The runner records the file's base name and its SHA-256 digest. +* **OCI reference**: A reference in the form `REFERENCE@ALGORITHM:HEX`, optionally prefixed with `oci://`. `REFERENCE` is the image name (including optional tag), and `ALGORITHM` must be one of `sha256`, `sha384`, or `sha512`. `HEX` must be the full lowercase digest for the algorithm: 64 hexadecimal characters for `sha256`, 96 for `sha384`, or 128 for `sha512`. + +Limits: + +* The per-step command file is capped at 1MiB. +* A job can accumulate up to 500 workflow artifacts across all steps. +* If the same artifact is declared more than once with identical name and digest, it is deduplicated. Conflicting declarations (same name, different digest) produce an error. + +{% bash %} + +```bash copy +echo "dist/my-binary" >> "$GITHUB_ARTIFACTS" +``` + +To declare an OCI reference: + +```bash copy +echo "oci://ghcr.io/octocat/myapp:1.0.0@sha256:914b38d45a65e4263a179d9c2b09cc04dcbcaa8257fa85100cf42f9a3b408cfb" >> "$GITHUB_ARTIFACTS" +``` + +{% endbash %} + +{% powershell %} + +```powershell copy +"dist/my-binary" >> $env:GITHUB_ARTIFACTS +``` + +To declare an OCI reference: + +```powershell copy +"oci://ghcr.io/octocat/myapp:1.0.0@sha256:914b38d45a65e4263a179d9c2b09cc04dcbcaa8257fa85100cf42f9a3b408cfb" >> $env:GITHUB_ARTIFACTS +``` + +{% endpowershell %} + +## Reading workflow artifacts + +Read the aggregated workflow artifact metadata declared by earlier steps in the current job from the `GITHUB_ARTIFACTS_LIST` environment file. This file is read-only and is updated by the runner after each step completes. It contains a UTF-8-encoded JSON object with the following structure: + +```json +{ + "version": 1, + "subjects": [ + { + "name": "my-binary", + "digest": "sha256:abc123...", + "kind": "file" + }, + { + "name": "ghcr.io/octocat/myapp:1.0.0", + "digest": "sha256:a1b2c3d4...", + "kind": "oci" + } + ] +} +``` + +Each entry in the `subjects` array contains: + +* `name`: The base name of the file or the OCI reference name (without the digest). +* `digest`: The `algorithm:hex` digest of the artifact. +* `kind`: Either `file` or `oci`. + +Artifacts are sorted alphabetically by `name`. + +{% bash %} + +```bash copy +cat "$GITHUB_ARTIFACTS_LIST" +``` + +{% endbash %} + +{% powershell %} + +```powershell copy +Get-Content $env:GITHUB_ARTIFACTS_LIST +``` + +{% endpowershell %} + +{% endif %} diff --git a/data/features/actions-artifacts-file.yml b/data/features/actions-artifacts-file.yml new file mode 100644 index 000000000000..863fb13d6c07 --- /dev/null +++ b/data/features/actions-artifacts-file.yml @@ -0,0 +1,6 @@ +# Reference: actions/runner#4527 +# Versioning for the GITHUB_ARTIFACTS and GITHUB_ARTIFACTS_LIST environment files. +versions: + fpt: '*' + ghec: '*' + ghes: '>=3.22' From 719be3d45230b0de1681433ae1a7d33cce0efa4d Mon Sep 17 00:00:00 2001 From: Leah Dudley Date: Wed, 12 Aug 2026 06:53:06 +0000 Subject: [PATCH 2/5] Add access note about commit comments (#62702) --- content/rest/guides/working-with-comments.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/rest/guides/working-with-comments.md b/content/rest/guides/working-with-comments.md index f6ec4d1b4ff0..2bbb836e3231 100644 --- a/content/rest/guides/working-with-comments.md +++ b/content/rest/guides/working-with-comments.md @@ -115,3 +115,9 @@ end Note that this API call will retrieve single line comments, as well as comments made on the entire commit. + +{% ifversion ghes > 3.21 %} + +Creating commit comments can be enabled or disabled for a repository. Organization owners can configure the default setting for repositories in their organization. For more information, see [AUTOTITLE](/organizations/managing-organization-settings/managing-commit-comments-for-your-organization). + +{% endif %} From c1986734b5c81789e9d5239dd622682bf1bc2a6b Mon Sep 17 00:00:00 2001 From: John Clement <70238417+jclement136@users.noreply.github.com> Date: Wed, 12 Aug 2026 09:29:44 +0000 Subject: [PATCH 3/5] =?UTF-8?q?Consolidate=20=E2=80=9CProtecting=20branche?= =?UTF-8?q?s=20in=20your=20enterprise=20with=20rulesets=E2=80=9D=20(#62634?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../enforcing-policies-for-code-governance.md | 18 +++++++---- .../govern-people-and-repositories/index.md | 12 ------- .../protect-branches.md | 32 ------------------- content/enterprise-onboarding/index.md | 6 ++-- 4 files changed, 14 insertions(+), 54 deletions(-) delete mode 100644 content/enterprise-onboarding/govern-people-and-repositories/index.md delete mode 100644 content/enterprise-onboarding/govern-people-and-repositories/protect-branches.md diff --git a/content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance.md b/content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance.md index 6880b0281ef0..2e4e921117f6 100644 --- a/content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance.md +++ b/content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance.md @@ -6,9 +6,14 @@ versions: feature: enterprise-code-rulesets permissions: Enterprise owners shortTitle: Create rulesets +redirect_from: + - /enterprise-onboarding/govern-people-and-repositories/protect-branches + - /enterprise-onboarding/feature-enhancements/about-rulesets contentType: how-tos category: - Secure and govern your enterprise +docsTeamMetrics: + - enterprise-onboarding --- ## Introduction @@ -17,12 +22,14 @@ category: To learn more, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets). +As you onboard your enterprise, rulesets are how you apply consistent protections across many repositories at once, rather than configuring each repository individually. + +If you have used **branch protection rules** on individual repositories, rulesets serve a similar goal at enterprise scale. Unlike a branch protection rule, which applies to a single repository, a ruleset can target many organizations, repositories, and branches at the same time, and you can set it to an evaluate status to preview its impact before you enforce it. + ## Importing rulesets To import a prebuilt ruleset created by {% data variables.product.company_short %}, see [`github/ruleset-recipes`](https://github.com/github/ruleset-recipes). -{% data reusables.repositories.import-a-ruleset-conceptual %} For more information, see [AUTOTITLE](/organizations/managing-organization-settings/managing-rulesets-for-repositories-in-your-organization#using-ruleset-history). - ## How will I define where my ruleset applies? Rulesets allow you to flexibly target the organizations, repositories, and branches where you want rules to apply. @@ -62,9 +69,7 @@ The following are eligible for bypass access: * {% data variables.copilot.copilot_cloud_agent %}. For more information about {% data variables.copilot.copilot_cloud_agent %}, see [AUTOTITLE](/copilot/concepts/agents/cloud-agent/about-cloud-agent#limitations-in-copilot-cloud-agents-compatibility-with-other-features). {%- endif %} -1. To grant bypass permissions for the ruleset, in the "Bypass list" section, click **Add bypass**. - -1. In the "Add bypass" modal dialog that appears, search for the role, team, or app you would like to grant bypass permissions, then select the role, team, or app from the "Suggestions" section and click Add Selected. +1. In the "Bypass list" section, click **Add bypass**, then search for and select the role, team, or app you want to grant bypass permissions, and click **Add Selected**. {% data reusables.repositories.rulesets-branch-tag-bypass-optional-step %} @@ -125,8 +130,7 @@ You can grant certain roles, teams, or apps bypass permissions as well as the ab * {% data variables.copilot.copilot_cloud_agent %}. For more information about {% data variables.copilot.copilot_cloud_agent %}, see [AUTOTITLE](/copilot/concepts/agents/cloud-agent/about-cloud-agent#limitations-in-copilot-cloud-agents-compatibility-with-other-features). {%- endif %} -1. To grant bypass permissions for the ruleset, in the "Bypass list" section, click **Add bypass**. -1. In the "Add bypass" modal dialog that appears, search for the role, team, or app you would like to grant bypass permissions, then select the role, team, or app from the "Suggestions" section and click Add Selected. +1. In the "Bypass list" section, click **Add bypass**, then search for and select the role, team, or app you want to grant bypass permissions, and click **Add Selected**. ### Choosing which organizations to target in your enterprise diff --git a/content/enterprise-onboarding/govern-people-and-repositories/index.md b/content/enterprise-onboarding/govern-people-and-repositories/index.md deleted file mode 100644 index 46c1b17aa102..000000000000 --- a/content/enterprise-onboarding/govern-people-and-repositories/index.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: Governing people and repositories -shortTitle: Govern people and repositories -intro: Implement policies, custom properties, and rulesets to govern users and repositories across your enterprise. -versions: - ghec: '*' -children: - - /protect-branches -contentType: concepts -docsTeamMetrics: - - enterprise-onboarding ---- diff --git a/content/enterprise-onboarding/govern-people-and-repositories/protect-branches.md b/content/enterprise-onboarding/govern-people-and-repositories/protect-branches.md deleted file mode 100644 index cfe0cd6c8dfe..000000000000 --- a/content/enterprise-onboarding/govern-people-and-repositories/protect-branches.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Protecting branches in your enterprise with rulesets -shortTitle: Protect branches -intro: Create rulesets at the enterprise level to enforce code governance policies across all repositories. -versions: - ghec: '*' -redirect_from: - - /enterprise-onboarding/feature-enhancements/about-rulesets -contentType: how-tos -docsTeamMetrics: - - enterprise-onboarding ---- - -{% data reusables.enterprise-onboarding.rulesets-intro %} - -## Using ruleset enforcement statuses - -{% data reusables.repositories.rulesets-about-enforcement-statuses %} - -## Creating a branch or tag ruleset - -{% data reusables.enterprise-accounts.access-enterprise %} -{% data reusables.enterprise-accounts.policies-tab %} -1. Under "Policies", click **Code**. -{% data reusables.repositories.create-ruleset-step %} -{% data reusables.repositories.rulesets-general-step %} - -For a more detailed explanation of the available options, see [AUTOTITLE](/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance). - -## Next steps - -Learn how to monitor and audit activity in your enterprise. See [AUTOTITLE](/enterprise-onboarding/govern-people-and-repositories/using-the-audit-log-for-your-enterprise). diff --git a/content/enterprise-onboarding/index.md b/content/enterprise-onboarding/index.md index 2a0f85fb6e26..7a64917b6156 100644 --- a/content/enterprise-onboarding/index.md +++ b/content/enterprise-onboarding/index.md @@ -32,7 +32,7 @@ journeyTracks: - href: '/admin/concepts/security-and-compliance/enterprise-policies' - href: '/admin/managing-accounts-and-repositories/managing-repositories-in-your-enterprise/managing-custom-properties-for-repositories-in-your-enterprise' - href: '/admin/managing-accounts-and-repositories/managing-repositories-in-your-enterprise/governing-how-people-use-repositories-in-your-enterprise' - - href: '/enterprise-onboarding/govern-people-and-repositories/protect-branches' + - href: '/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance' - href: '/admin/concepts/security-and-compliance/audit-log-for-an-enterprise' - id: 'github_apps' title: 'Automating processes with GitHub Apps' @@ -43,11 +43,11 @@ journeyTracks: - href: '/apps/using-github-apps/installing-a-github-app-on-your-enterprise' versions: ghec: '*' -children: - - /govern-people-and-repositories +children: [] redirect_from: - /enterprise-onboarding/feature-enhancements - /enterprise-onboarding/getting-started-with-your-enterprise + - /enterprise-onboarding/govern-people-and-repositories docsTeamMetrics: - enterprise-onboarding --- From 0c35fba7f83f1bddfba98013485e2863dd60a404 Mon Sep 17 00:00:00 2001 From: Meagan <50200557+meagancojocar@users.noreply.github.com> Date: Wed, 12 Aug 2026 13:59:56 +0000 Subject: [PATCH 4/5] Fix Slack cloud agent mention handle to @GitHub (#62195) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> --- .../cloud-agent/integrate-cloud-agent-with-slack.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/copilot/how-tos/use-copilot-agents/cloud-agent/integrate-cloud-agent-with-slack.md b/content/copilot/how-tos/use-copilot-agents/cloud-agent/integrate-cloud-agent-with-slack.md index 99fd255a2ef1..65d9d06a05d2 100644 --- a/content/copilot/how-tos/use-copilot-agents/cloud-agent/integrate-cloud-agent-with-slack.md +++ b/content/copilot/how-tos/use-copilot-agents/cloud-agent/integrate-cloud-agent-with-slack.md @@ -25,7 +25,7 @@ For information about additional {% data variables.product.prodname_copilot_shor ## Security considerations -When you @mention {% data variables.product.prodname_copilot_short %} in Slack, consider the following. +Before you @mention the {% data variables.product.prodname_github_app %} in Slack, consider the following. * {% data variables.product.prodname_copilot_short %} may perform write actions on your behalf, such as creating pull requests or issues, in addition to answering questions. {% data variables.product.prodname_copilot_short %} uses the permissions of your linked {% data variables.product.github %} account for any actions it takes. * {% data variables.copilot.copilot_cloud_agent %} will capture the entire thread as context for your request, understanding and implementing solutions based on the discussion. This context is stored in the pull request. If you want to limit the context, you can send a direct message to the {% data variables.product.prodname_github_app %} for Slack instead. @@ -40,7 +40,7 @@ When you @mention {% data variables.product.prodname_copilot_short %} in Slack, The first time you use the {% data variables.product.prodname_github_app %} in Slack, the app will prompt you to connect it to your {% data variables.product.github %} account and set a default repository. The default repository is where pull requests created by {% data variables.copilot.copilot_cloud_agent %} sessions will be opened. -1. In Slack, open a direct message with the {% data variables.product.prodname_github_app %} or mention {% data variables.product.prodname_copilot_short %} in a thread by typing `@{% data variables.product.prodname_copilot %}`. +1. In Slack, open a direct message with the {% data variables.product.prodname_github_app %} or mention the {% data variables.product.prodname_github_app %} in a thread by typing `@{% data variables.product.github %}`. 1. Send a prompt to {% data variables.copilot.copilot_cloud_agent %}. This can be a request to perform a task, or simply `login`. 1. If asked to connect your {% data variables.product.github %} account, follow the instructions in {% data variables.product.prodname_copilot_short %}'s reply and authorize the app to access your {% data variables.product.github %} account. 1. In the Slack message thread, click **Configure settings** to set a default repository for pull requests. You can change this repository later using the `settings` command. From a26c14c5912f2f0590eefcbf00f4b3397bfab9c0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 14:21:17 +0000 Subject: [PATCH 5/5] Bump github/gh-base-image/gh-base-noble from 20260731-094650-g61ba3829f to 20260811-222802-g1cf85b160 in the baseimages group (#62720) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 916adde6da48..d1585939156e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,7 +10,7 @@ # --------------------------------------------------------------- # To update the sha: # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble -FROM ghcr.io/github/gh-base-image/gh-base-noble:20260731-094650-g61ba3829f@sha256:965152ebc8311c75bc9db9fc1c178a8c04718ca5d5521c30f55ba40ef229ff4d AS base +FROM ghcr.io/github/gh-base-image/gh-base-noble:20260811-222802-g1cf85b160@sha256:235f4854c8354b24fe8fefabf31fe57239723f2e4df4fb380d50f48844ab0737 AS base # Install curl for Node install and determining the early access branch # Install git for cloning docs-early-access & translations repos