зеркало из https://github.com/github/docs.git
Merge branch 'main' into main
This commit is contained in:
Коммит
f440542976
|
@ -4,17 +4,13 @@
|
|||
// can be added it this list.
|
||||
|
||||
module.exports = [
|
||||
'actions/cache@70655ec8323daeeaa7ef06d7c56e1b9191396cbe',
|
||||
'actions/cache@d1255ad9362389eac595a9ae406b8e8cb3331f16',
|
||||
'actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675',
|
||||
'actions/github-script@5d03ada4b0a753e9460b312e61cc4f8fdeacf163',
|
||||
'actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45',
|
||||
'actions/github-script@44b873bc975058192f5279ebe7579496381f575d',
|
||||
'actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9',
|
||||
'actions/labeler@5f867a63be70efff62b767459b009290364495eb',
|
||||
'actions/setup-node@56899e050abffc08c2b3b61f3ec6a79a9dc3223d',
|
||||
'actions/setup-ruby@5f29a1cd8dfebf420691c4c9a0e832e2fae5a526',
|
||||
'actions/stale@44f9eae0adddf72dbf3eedfacc999f70afcec1a8',
|
||||
'actions/cache@d1255ad9362389eac595a9ae406b8e8cb3331f16', //actions/cache@v2.1.2
|
||||
'actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675', //actions/checkout@v2.3.3
|
||||
'actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9', //actions/script@v3.0.0
|
||||
'actions/labeler@5f867a63be70efff62b767459b009290364495eb', //actions/labeler@v2.2.0
|
||||
'actions/setup-node@56899e050abffc08c2b3b61f3ec6a79a9dc3223d', //actions/setup-node@v1.4.4
|
||||
'actions/setup-ruby@5f29a1cd8dfebf420691c4c9a0e832e2fae5a526', //actions/setup-ruby@v1.1.2
|
||||
'actions/stale@44f9eae0adddf72dbf3eedfacc999f70afcec1a8', //actions/stale@v3.0.12
|
||||
'crowdin/github-action@fd9429dd63d6c0f8a8cb4b93ad8076990bd6e688',
|
||||
'dawidd6/action-delete-branch@47743101a121ad657031e6704086271ca81b1911',
|
||||
'docker://chinthakagodawita/autoupdate-action:v1',
|
||||
|
|
|
@ -15,7 +15,7 @@ jobs:
|
|||
with:
|
||||
node-version: 14.x
|
||||
- name: cache node modules
|
||||
uses: actions/cache@70655ec8323daeeaa7ef06d7c56e1b9191396cbe
|
||||
uses: actions/cache@d1255ad9362389eac595a9ae406b8e8cb3331f16
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
|
|
|
@ -11,7 +11,7 @@ jobs:
|
|||
|
||||
steps:
|
||||
- name: Check if the event originated from a team member
|
||||
uses: actions/github-script@44b873bc975058192f5279ebe7579496381f575d
|
||||
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
|
||||
id: set-result
|
||||
with:
|
||||
github-token: ${{secrets.DOCUBOT_FR_PROJECT_BOARD_WORKFLOWS_REPO_ORG_READ_SCOPES}}
|
||||
|
@ -53,12 +53,12 @@ jobs:
|
|||
|
||||
first-responder-remove-pr:
|
||||
name: Remove PR from FR project board
|
||||
if: github.repository == 'github/docs-internal' && (github.event.label.name == 'docs-content-fr' && github.event.action == 'unlabeled') || github.event.action == 'closed'
|
||||
if: github.repository == 'github/docs-internal' && ((github.event.label.name == 'docs-content-fr' && github.event.action == 'unlabeled') || github.event.action == 'closed')
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Remove card from project
|
||||
uses: actions/github-script@44b873bc975058192f5279ebe7579496381f575d
|
||||
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
|
||||
with:
|
||||
github-token: ${{secrets.DOCUBOT_FR_PROJECT_BOARD_WORKFLOWS_REPO_ORG_READ_SCOPES}}
|
||||
result-encoding: string
|
||||
|
|
|
@ -12,7 +12,7 @@ jobs:
|
|||
steps:
|
||||
- name: Add issues with engineering label to project board
|
||||
if: contains(github.event.issue.labels.*.name, 'engineering') || contains(github.event.issue.labels.*.name, 'design') || contains(github.event.issue.labels.*.name, 'Design')
|
||||
uses: actions/github-script@44b873bc975058192f5279ebe7579496381f575d
|
||||
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
|
||||
with:
|
||||
github-token: ${{ secrets.DOCUBOT_FR_PROJECT_BOARD_WORKFLOWS_REPO_ORG_READ_SCOPES }}
|
||||
script: |
|
||||
|
|
|
@ -12,7 +12,7 @@ jobs:
|
|||
DRAFT_COLUMN_ID: 10095775
|
||||
REGULAR_COLUMN_ID: 10095779
|
||||
steps:
|
||||
- uses: actions/github-script@44b873bc975058192f5279ebe7579496381f575d
|
||||
- uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
|
||||
continue-on-error: true
|
||||
with:
|
||||
github-token: ${{ secrets.DOCUBOT_FR_PROJECT_BOARD_WORKFLOWS_REPO_ORG_READ_SCOPES }}
|
||||
|
|
|
@ -18,7 +18,7 @@ jobs:
|
|||
with:
|
||||
node-version: 14.x
|
||||
- name: cache node modules
|
||||
uses: actions/cache@70655ec8323daeeaa7ef06d7c56e1b9191396cbe
|
||||
uses: actions/cache@d1255ad9362389eac595a9ae406b8e8cb3331f16
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
||||
|
|
|
@ -77,3 +77,5 @@ jobs:
|
|||
|
||||
- name: Run tests
|
||||
run: npx jest tests/${{ matrix.test-group }}/
|
||||
env:
|
||||
NODE_OPTIONS: "--max_old_space_size=4096"
|
||||
|
|
|
@ -47,3 +47,5 @@ jobs:
|
|||
|
||||
- name: Run tests
|
||||
run: npx jest tests/${{ matrix.test-group }}/
|
||||
env:
|
||||
NODE_OPTIONS: "--max_old_space_size=4096"
|
||||
|
|
|
@ -116,6 +116,8 @@ jobs:
|
|||
- if: ${{ needs.see_if_should_skip.outputs.should_skip != 'true' }}
|
||||
name: Run tests
|
||||
run: npx jest tests/${{ matrix.test-group }}/
|
||||
env:
|
||||
NODE_OPTIONS: "--max_old_space_size=4096"
|
||||
|
||||
- name: Send Slack notification if workflow fails
|
||||
uses: rtCamp/action-slack-notify@e17352feaf9aee300bf0ebc1dfbf467d80438815
|
||||
|
|
|
@ -24,7 +24,7 @@ jobs:
|
|||
branch: translations
|
||||
- if: ${{ steps.pr.outputs.number }}
|
||||
name: Check if already labeled
|
||||
uses: actions/github-script@5d03ada4b0a753e9460b312e61cc4f8fdeacf163
|
||||
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
|
||||
id: has-label
|
||||
with:
|
||||
script: |
|
||||
|
@ -44,7 +44,7 @@ jobs:
|
|||
number: ${{ steps.pr.outputs.number }}
|
||||
- if: ${{ !steps.has-label.outputs.result }}
|
||||
name: Add automerge label
|
||||
uses: actions/github-script@5d03ada4b0a753e9460b312e61cc4f8fdeacf163
|
||||
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
script: |
|
||||
|
|
|
@ -10,7 +10,7 @@ jobs:
|
|||
|
||||
steps:
|
||||
- name: Check if the event originated from a team member
|
||||
uses: actions/github-script@6e5ee1dc1cb3740e5e5e76ad668e3f526edbfe45
|
||||
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
|
||||
id: is-internal-contributor
|
||||
with:
|
||||
github-token: ${{secrets.GITHUB_TOKEN}}
|
||||
|
|
|
@ -45,7 +45,7 @@ When you're done making changes and you'd like to propose them for review, use t
|
|||
### Your PR is merged!
|
||||
Congratulations! The whole GitHub community thanks you. :sparkles:
|
||||
|
||||
Once your PR is merged, you can be added as a contributor in the [readme](README.md#contributors-).
|
||||
Once your PR is merged, you will be proudly listed as a contributor in the [contributor chart](https://github.com/github/docs/graphs/contributors).
|
||||
|
||||
### Keep contributing as you use GitHub Docs
|
||||
|
||||
|
|
|
@ -166,6 +166,12 @@ featuredLinks:
|
|||
- Type: `Boolean`. Default is `false`.
|
||||
- Optional.
|
||||
|
||||
### `changelog`
|
||||
|
||||
- Purpose: Render a list of changelog items with timestamps on product pages (ex: `layouts/product-landing.html`)
|
||||
- Type: `Array`, items are objects `{ href: string, title: string, date: 'YYYY-MM-DD' }`
|
||||
- Optional.
|
||||
|
||||
### Escaping single quotes
|
||||
|
||||
If you see two single quotes in a row (`''`) in YML frontmatter where you might expect to see one (`'`), this is the YML-preferred way to escape a single quote. From [the YAML spec](https://yaml.org/spec/history/2001-12-10.html):
|
||||
|
|
|
@ -4,17 +4,30 @@ shortTitle: GitHub Actions
|
|||
intro: 'Automate, customize, and execute your software development workflows right in your repository with {% data variables.product.prodname_actions %}. You can discover, create, and share actions to perform any job you''d like, including CI/CD, and combine actions in a completely customized workflow.'
|
||||
introLinks:
|
||||
quickstart: /actions/quickstart
|
||||
learn: /actions/learn-github-actions
|
||||
reference: /actions/reference
|
||||
featuredLinks:
|
||||
guides:
|
||||
- /actions/guides/setting-up-continuous-integration-using-workflow-templates
|
||||
- /actions/guides/about-packaging-with-github-actions
|
||||
gettingStarted:
|
||||
- /actions/managing-workflow-runs
|
||||
- /actions/hosting-your-own-runners
|
||||
guide:
|
||||
- /actions/guides/setting-up-continuous-integration-using-workflow-templates
|
||||
- /actions/guides/about-packaging-with-github-actions
|
||||
popular:
|
||||
- /actions/reference/workflow-syntax-for-github-actions
|
||||
- /actions/reference/events-that-trigger-workflows
|
||||
changelog:
|
||||
- title: Self-Hosted Runner Group Access Changes
|
||||
date: '2020-10-16'
|
||||
href: https://github.blog/changelog/2020-10-16-github-actions-self-hosted-runner-group-access-changes/
|
||||
- title: Ability to change retention days for artifacts and logs
|
||||
date: '2020-10-08'
|
||||
href: https://github.blog/changelog/2020-10-08-github-actions-ability-to-change-retention-days-for-artifacts-and-logs
|
||||
- title: Deprecating set-env and add-path commands
|
||||
date: '2020-10-01'
|
||||
href: https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands
|
||||
- title: Fine-tune access to external actions
|
||||
date: '2020-10-01'
|
||||
href: https://github.blog/changelog/2020-10-01-github-actions-fine-tune-access-to-external-actions
|
||||
redirect_from:
|
||||
- /articles/automating-your-workflow-with-github-actions/
|
||||
- /articles/customizing-your-project-with-github-actions/
|
||||
|
@ -36,44 +49,8 @@ versions:
|
|||
<!-- {% link_with_intro /hosting-your-own-runners %} -->
|
||||
<!-- {% link_with_intro /reference %} -->
|
||||
|
||||
<!-- Article links -->
|
||||
<div class="d-lg-flex gutter my-6 py-6">
|
||||
<div class="col-12 col-lg-4 mb-4 mb-lg-0">
|
||||
<div class="featured-links-heading pb-4">
|
||||
<h3 class="f5 text-normal text-mono underline-dashed color-gray-5">{% data ui.toc.guides %}</h3>
|
||||
</div>
|
||||
<ul class="list-style-none">
|
||||
{% for link in featuredLinks.guide %}
|
||||
<li>{% include featured-link %}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<div class="col-12 col-lg-4 mb-4 mb-lg-0">
|
||||
<div class="featured-links-heading pb-4">
|
||||
<h3 class="f5 text-normal text-mono underline-dashed color-gray-5">{% data ui.toc.popular_articles %}</h3>
|
||||
</div>
|
||||
<ul class="list-style-none">
|
||||
{% for link in featuredLinks.popular %}
|
||||
<li>{% include featured-link %}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<div class="col-12 col-lg-4 mb-4 mb-lg-0">
|
||||
<div class="featured-links-heading pb-4">
|
||||
<h3 class="f5 text-normal text-mono underline-dashed color-gray-5">Manage workflows</h3>
|
||||
</div>
|
||||
<ul class="list-style-none">
|
||||
{% for link in featuredLinks.gettingStarted %}
|
||||
<li>{% include featured-link %}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Code examples -->
|
||||
<div class="mt-6 pt-6">
|
||||
<div class="my-6 pt-6">
|
||||
<h2 class="mb-2">More guides</h2>
|
||||
|
||||
<div class="d-flex flex-wrap gutter">
|
||||
|
|
|
@ -232,12 +232,19 @@ Jenkins Pipeline
|
|||
|
||||
```yaml
|
||||
pipeline {
|
||||
agent none
|
||||
stages {
|
||||
stage('Run Tests') {
|
||||
parallel {
|
||||
stage('Test On MacOS') {
|
||||
agent { label "macos" }
|
||||
agent none
|
||||
stages {
|
||||
stage('Run Tests') {
|
||||
matrix {
|
||||
axes {
|
||||
axis {
|
||||
name: 'PLATFORM'
|
||||
values: 'macos', 'linux'
|
||||
}
|
||||
}
|
||||
agent { label "${PLATFORM}" }
|
||||
stages {
|
||||
stage('test') {
|
||||
tools { nodejs "node-12" }
|
||||
steps {
|
||||
dir("scripts/myapp") {
|
||||
|
@ -246,19 +253,10 @@ pipeline {
|
|||
}
|
||||
}
|
||||
}
|
||||
stage('Test On Linux') {
|
||||
agent { label "linux" }
|
||||
tools { nodejs "node-12" }
|
||||
steps {
|
||||
dir("script/myapp") {
|
||||
sh(script: "npm install -g bats")
|
||||
sh(script: "bats tests")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
|
|
|
@ -1,11 +1,11 @@
|
|||
---
|
||||
title: Enabling alerts for vulnerable dependencies on GitHub Enterprise Server
|
||||
intro: 'You can connect {% data variables.product.product_location %} to {% data variables.product.prodname_ghe_cloud %} and enable {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts for vulnerable dependencies in repositories in your instance.'
|
||||
intro: 'You can connect {% data variables.product.product_location %} to {% data variables.product.prodname_ghe_cloud %} and enable {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts for vulnerable dependencies in repositories in your instance.'
|
||||
redirect_from:
|
||||
- /enterprise/admin/installation/enabling-security-alerts-for-vulnerable-dependencies-on-github-enterprise-server
|
||||
- /enterprise/admin/configuration/enabling-security-alerts-for-vulnerable-dependencies-on-github-enterprise-server
|
||||
- /enterprise/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server
|
||||
permissions: 'Site administrators for {% data variables.product.prodname_ghe_server %} who are also owners of the connected {% data variables.product.prodname_ghe_cloud %} organization or enterprise account can enable {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}.'
|
||||
permissions: 'Site administrators for {% data variables.product.prodname_ghe_server %} who are also owners of the connected {% data variables.product.prodname_ghe_cloud %} organization or enterprise account can enable {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}.'
|
||||
versions:
|
||||
enterprise-server: '*'
|
||||
---
|
||||
|
@ -14,11 +14,11 @@ versions:
|
|||
|
||||
{% data reusables.repositories.tracks-vulnerabilities %} For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
|
||||
|
||||
You can connect {% data variables.product.product_location %} to {% data variables.product.prodname_dotcom_the_website %}, then sync vulnerability data to your instance and generate {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts in repositories with a vulnerable dependency.
|
||||
You can connect {% data variables.product.product_location %} to {% data variables.product.prodname_dotcom_the_website %}, then sync vulnerability data to your instance and generate {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts in repositories with a vulnerable dependency.
|
||||
|
||||
After connecting {% data variables.product.product_location %} to {% data variables.product.prodname_dotcom_the_website %} and enabling {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts for vulnerable dependencies, vulnerability data is synced from {% data variables.product.prodname_dotcom_the_website %} to your instance once every hour. You can also choose to manually sync vulnerability data at any time. No code or information about code from {% data variables.product.product_location %} is uploaded to {% data variables.product.prodname_dotcom_the_website %}.
|
||||
After connecting {% data variables.product.product_location %} to {% data variables.product.prodname_dotcom_the_website %} and enabling {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts for vulnerable dependencies, vulnerability data is synced from {% data variables.product.prodname_dotcom_the_website %} to your instance once every hour. You can also choose to manually sync vulnerability data at any time. No code or information about code from {% data variables.product.product_location %} is uploaded to {% data variables.product.prodname_dotcom_the_website %}.
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}When {% data variables.product.product_location %} receives information about a vulnerability, it will identify repositories in your instance that use the affected version of the dependency and generate {% data variables.product.prodname_dependabot_short %} alerts. You can customize how you receive {% data variables.product.prodname_dependabot_short %} alerts. For more information, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies/#configuring-notifications-for-github-dependabot-alerts)."
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}When {% data variables.product.product_location %} receives information about a vulnerability, it will identify repositories in your instance that use the affected version of the dependency and generate {% data variables.product.prodname_dependabot_alerts %}. You can customize how you receive {% data variables.product.prodname_dependabot_alerts %}. For more information, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies/#configuring-notifications-for-dependabot-alerts)."
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "enterprise-server@2.21" %}When {% data variables.product.product_location %} receives information about a vulnerability, it will identify repositories in your instance that use the affected version of the dependency and generate security alerts. You can customize how you receive security alerts. For more information, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies/#configuring-notifications-for-security-alerts)."
|
||||
|
@ -28,23 +28,25 @@ After connecting {% data variables.product.product_location %} to {% data variab
|
|||
{% endif %}
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
### Enabling {% data variables.product.prodname_dependabot_short %} alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}
|
||||
### Enabling {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}
|
||||
{% else %}
|
||||
### Enabling security alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}
|
||||
{% endif %}
|
||||
|
||||
Before enabling {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts for vulnerable dependencies on {% data variables.product.product_location %}, you must connect {% data variables.product.product_location %} to {% data variables.product.prodname_dotcom_the_website %}. For more information, see "[Connecting {% data variables.product.prodname_ghe_server %} to {% data variables.product.prodname_ghe_cloud %}](/enterprise/{{ currentVersion }}/admin/guides/installation/connecting-github-enterprise-server-to-github-enterprise-cloud)."
|
||||
Before enabling {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts for vulnerable dependencies on {% data variables.product.product_location %}, you must connect {% data variables.product.product_location %} to {% data variables.product.prodname_dotcom_the_website %}. For more information, see "[Connecting {% data variables.product.prodname_ghe_server %} to {% data variables.product.prodname_ghe_cloud %}](/enterprise/{{ currentVersion }}/admin/guides/installation/connecting-github-enterprise-server-to-github-enterprise-cloud)."
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.20" %}
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}We recommend configuring {% data variables.product.prodname_dependabot_short %} alerts without notifications for the first few days to avoid an overload of emails. After a few days, you can enable notifications to receive {% data variables.product.prodname_dependabot_short %} alerts as usual.{% endif %}
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}We recommend configuring {% data variables.product.prodname_dependabot_alerts %} without notifications for the first few days to avoid an overload of emails. After a few days, you can enable notifications to receive {% data variables.product.prodname_dependabot_alerts %} as usual.{% endif %}
|
||||
|
||||
{% if currentVersion == "enterprise-server@2.21" %}We recommend configuring security alerts without notifications for the first few days to avoid an overload of emails. After a few days, you can enable notifications to receive security alerts as usual.{% endif %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% data reusables.enterprise_site_admin_settings.sign-in %}
|
||||
1. In the administrative shell, enable the {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts for vulnerable dependencies on {% data variables.product.product_location %}:
|
||||
|
||||
1. In the administrative shell, enable the {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts for vulnerable dependencies on {% data variables.product.product_location %}:
|
||||
|
||||
``` shell
|
||||
$ ghe-dep-graph-enable
|
||||
```
|
||||
|
|
|
@ -92,13 +92,8 @@ Now that you've created and published your repository, you're ready to make chan
|
|||
|
||||
4. At the bottom of the **Changes** list, enter a commit message. To the right of your profile picture, type a short description of the commit. Since we're changing the _README.md_ file, "Add information about purpose of project" would be a good commit summary. Below the summary, you'll see a "Description" text field where you can type a longer description of the changes in the commit, which is helpful when looking back at the history of a project and understanding why changes were made. Since you're making a basic update of a _README.md_ file, you can skip the description.
|
||||
![Commit message](/assets/images/help/desktop/getting-started-guide/commit-message.png)
|
||||
<<<<<<< HEAD
|
||||
5. Click **Commit to BRANCH NAME**. The commit button shows your current branch so you can be sure to commit to the branch you want.
|
||||
![Commit to branch](/assets/images/help/desktop/getting-started-guide/click-commit-to-master.png)
|
||||
=======
|
||||
5. Click **Commit to master**. The commit button shows your current branch, which in this case is `master`, so that you know which branch you are making a commit to.
|
||||
![Commit to master](/assets/images/help/desktop/getting-started-guide/click-commit-to-master.png)
|
||||
>>>>>>> master
|
||||
6. To push your changes to the remote repository on {% data variables.product.product_name %}, click **Push origin**.
|
||||
![Push origin](/assets/images/help/desktop/getting-started-guide/push-to-origin.png)
|
||||
- The **Push origin** button is the same one that you clicked to publish your repository to {% data variables.product.product_name %}. This button changes contextually based on where you are at in the Git workflow. It should now say `Push origin` with a `1` next to it, indicating that there is one commit that has not been pushed up to {% data variables.product.product_name %}.
|
||||
|
|
|
@ -1,8 +1,10 @@
|
|||
---
|
||||
title: About GitHub Dependabot version updates
|
||||
title: About Dependabot version updates
|
||||
intro: 'You can use {% data variables.product.prodname_dependabot %} to keep the packages you use updated to the latest versions.'
|
||||
redirect_from:
|
||||
- /github/administering-a-repository/about-github-dependabot
|
||||
- /github/administering-a-repository/about-dependabot
|
||||
- /github/administering-a-repository/about-github-dependabot-version-updates
|
||||
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
@ -13,11 +15,11 @@ versions:
|
|||
|
||||
{% data variables.product.prodname_dependabot %} takes the effort out of maintaining your dependencies. You can use it to ensure that your repository automatically keeps up with the latest releases of the packages and applications it depends on.
|
||||
|
||||
You enable {% data variables.product.prodname_dependabot_version_updates %} by checking a configuration file in to your repository. The configuration file specifies the location of the manifest, or other package definition files, stored in your repository. {% data variables.product.prodname_dependabot_short %} uses this information to check for outdated packages and applications. {% data variables.product.prodname_dependabot_short %} determines if there is a new version of a dependency by looking at the semantic versioning ([semver](https://semver.org/)) of the dependency to decide whether it should update to that version. For certain package managers, {% data variables.product.prodname_dependabot_version_updates %} also supports vendoring. Vendored (or cached) dependencies are dependencies that are checked in to a specific directory in a repository, rather than referenced in a manifest. Vendored dependencies are available at build time even if package servers are unavailable. {% data variables.product.prodname_dependabot_version_updates %} can be configured to check vendored dependencies for new versions and update them if necessary.
|
||||
You enable {% data variables.product.prodname_dependabot_version_updates %} by checking a configuration file in to your repository. The configuration file specifies the location of the manifest, or other package definition files, stored in your repository. {% data variables.product.prodname_dependabot %} uses this information to check for outdated packages and applications. {% data variables.product.prodname_dependabot %} determines if there is a new version of a dependency by looking at the semantic versioning ([semver](https://semver.org/)) of the dependency to decide whether it should update to that version. For certain package managers, {% data variables.product.prodname_dependabot_version_updates %} also supports vendoring. Vendored (or cached) dependencies are dependencies that are checked in to a specific directory in a repository, rather than referenced in a manifest. Vendored dependencies are available at build time even if package servers are unavailable. {% data variables.product.prodname_dependabot_version_updates %} can be configured to check vendored dependencies for new versions and update them if necessary.
|
||||
|
||||
When {% data variables.product.prodname_dependabot_short %} identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. For vendored dependencies, {% data variables.product.prodname_dependabot_short %} raises a pull request to directly replace the outdated dependency with the new version. You check that your tests pass, review the changelog and release notes included in the pull request summary, and then merge it. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
When {% data variables.product.prodname_dependabot %} identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. For vendored dependencies, {% data variables.product.prodname_dependabot %} raises a pull request to directly replace the outdated dependency with the new version. You check that your tests pass, review the changelog and release notes included in the pull request summary, and then merge it. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
|
||||
If you enable security updates, {% data variables.product.prodname_dependabot %} also raises pull requests to update vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)."
|
||||
If you enable security updates, {% data variables.product.prodname_dependabot %} also raises pull requests to update vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
|
||||
{% data reusables.dependabot.dependabot-tos %}
|
||||
|
||||
|
@ -27,7 +29,7 @@ You specify how often to check each ecosystem for new versions in the configurat
|
|||
|
||||
{% data reusables.dependabot.initial-updates %}
|
||||
|
||||
If you've enabled security updates, you'll sometimes see extra pull requests for security updates. These are triggered by a {% data variables.product.prodname_dependabot_short %} alert for a dependency on your default branch. {% data variables.product.prodname_dependabot %} automatically raises a pull request to update the vulnerable dependency.
|
||||
If you've enabled security updates, you'll sometimes see extra pull requests for security updates. These are triggered by a {% data variables.product.prodname_dependabot %} alert for a dependency on your default branch. {% data variables.product.prodname_dependabot %} automatically raises a pull request to update the vulnerable dependency.
|
||||
|
||||
### Supported repositories and ecosystems
|
||||
|
|
@ -30,7 +30,7 @@ People with admin permissions to a repository can choose whether {% data variabl
|
|||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
If a release fixes a security vulnerability, you should publish a security advisory in your repository. {% data variables.product.prodname_dotcom %} reviews each published security advisory and may use it to send {% data variables.product.prodname_dependabot_short %} alerts to affected repositories. For more information, see "[About GitHub Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
If a release fixes a security vulnerability, you should publish a security advisory in your repository. {% data variables.product.prodname_dotcom %} reviews each published security advisory and may use it to send {% data variables.product.prodname_dependabot_alerts %} to affected repositories. For more information, see "[About GitHub Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
|
||||
You can view the **Dependents** tab of the dependency graph to see which repositories and packages depend on code in your repository, and may therefore be affected by a new release. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
{% endif %}
|
||||
|
|
|
@ -21,14 +21,14 @@ The first step to securing a repository is to set up who can see and modify your
|
|||
|
||||
Privately discuss and fix security vulnerabilities in your repository's code. You can then publish a security advisory to alert your community to the vulnerability and encourage them to upgrade. For more information, see "[About {% data variables.product.prodname_security_advisories %}](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
|
||||
- **{% data variables.product.prodname_dependabot_short %} alerts and security updates**
|
||||
- **{% data variables.product.prodname_dependabot_alerts %} and security updates**
|
||||
|
||||
View alerts about dependencies that are known to contain security vulnerabilities, and choose whether to have pull requests generated automatically to update these dependencies. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)"
|
||||
and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)."
|
||||
and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
|
||||
- **{% data variables.product.prodname_dependabot_short %} version updates**
|
||||
- **{% data variables.product.prodname_dependabot %} version updates**
|
||||
|
||||
Use {% data variables.product.prodname_dependabot %} to automatically raise pull requests to keep your dependencies up-to-date. This helps reduce your exposure to older versions of dependencies. Using newer versions makes it easier to apply patches if security vulnerabilities are discovered, and also makes it easier for {% data variables.product.prodname_dependabot_security_updates %} to successfully raise pull requests to upgrade vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/github/administering-a-repository/about-github-dependabot-version-updates)."
|
||||
Use {% data variables.product.prodname_dependabot %} to automatically raise pull requests to keep your dependencies up-to-date. This helps reduce your exposure to older versions of dependencies. Using newer versions makes it easier to apply patches if security vulnerabilities are discovered, and also makes it easier for {% data variables.product.prodname_dependabot_security_updates %} to successfully raise pull requests to upgrade vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/github/administering-a-repository/about-dependabot-version-updates)."
|
||||
|
||||
- **{% data variables.product.prodname_code_scanning_capc %} alerts**
|
||||
|
||||
|
@ -44,6 +44,6 @@ The first step to securing a repository is to set up who can see and modify your
|
|||
* Ecosystems and packages that your repository depends on
|
||||
* Repositories and packages that depend on your repository
|
||||
|
||||
You must enable the dependency graph before {% data variables.product.prodname_dotcom %} can generate {% data variables.product.prodname_dependabot_short %} alerts for dependencies with security vulnerabilities.
|
||||
You must enable the dependency graph before {% data variables.product.prodname_dotcom %} can generate {% data variables.product.prodname_dependabot_alerts %} for dependencies with security vulnerabilities.
|
||||
|
||||
You can find the dependency graph on the **Insights** tab for your repository. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
|
|
|
@ -12,7 +12,7 @@ versions:
|
|||
|
||||
The {% data variables.product.prodname_dependabot %} configuration file, *dependabot.yml*, uses YAML syntax. If you're new to YAML and want to learn more, see "[Learn YAML in five minutes](https://www.codeproject.com/Articles/1214409/Learn-YAML-in-five-minutes)."
|
||||
|
||||
You must store this file in the `.github` directory of your repository. When you add or update the *dependabot.yml* file, this triggers an immediate check for version updates. Any options that also affect security updates are used the next time a security alert triggers a pull request with for security update. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)" and "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)."
|
||||
You must store this file in the `.github` directory of your repository. When you add or update the *dependabot.yml* file, this triggers an immediate check for version updates. Any options that also affect security updates are used the next time a security alert triggers a pull request with for security update. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)" and "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)."
|
||||
|
||||
### Configuration options for *dependabot.yml*
|
||||
|
||||
|
@ -56,13 +56,13 @@ In addition, the [`open-pull-requests-limit`](#open-pull-requests-limit) option
|
|||
|
||||
Security updates are raised for vulnerable package manifests only on the default branch. When configuration options are set for the same branch (true unless you use `target-branch`), and specify a `package-ecosystem` and `directory` for the vulnerable manifest, then pull requests for security updates use relevant options.
|
||||
|
||||
In general, security updates use any configuration options that affect pull requests, for example, adding metadata or changing their behavior. For more information about security updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)."
|
||||
In general, security updates use any configuration options that affect pull requests, for example, adding metadata or changing their behavior. For more information about security updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
### `package-ecosystem`
|
||||
|
||||
**Required** You add one `package-ecosystem` element for each package manager that you want {% data variables.product.prodname_dependabot_short %} to monitor for new versions. The repository must also contain a dependency manifest or lock file for each of these package managers. If you want to enable vendoring for a package manager that supports it, the vendored dependencies must be located in the required directory. For more information, see [`vendor`](#vendor) below.
|
||||
**Required** You add one `package-ecosystem` element for each package manager that you want {% data variables.product.prodname_dependabot %} to monitor for new versions. The repository must also contain a dependency manifest or lock file for each of these package managers. If you want to enable vendoring for a package manager that supports it, the vendored dependencies must be located in the required directory. For more information, see [`vendor`](#vendor) below.
|
||||
|
||||
{% data reusables.dependabot.supported-package-managers %}
|
||||
|
||||
|
@ -308,7 +308,7 @@ updates:
|
|||
|
||||
{% note %}
|
||||
|
||||
**Note**: {% data variables.product.prodname_dependabot_version_updates %} can't run version updates for any dependencies in manifests containing private git dependencies or private git registries, even if you add the private dependencies to the `ignore` option of your configuration file. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/github/administering-a-repository/about-github-dependabot#supported-repositories-and-ecosystems)."
|
||||
**Note**: {% data variables.product.prodname_dependabot_version_updates %} can't run version updates for any dependencies in manifests containing private git dependencies or private git registries, even if you add the private dependencies to the `ignore` option of your configuration file. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/github/administering-a-repository/about-dependabot#supported-repositories-and-ecosystems)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
|
@ -544,7 +544,7 @@ updates:
|
|||
|
||||
### `vendor`
|
||||
|
||||
Use the `vendor` option to tell {% data variables.product.prodname_dependabot_short %} to vendor dependencies when updating them.
|
||||
Use the `vendor` option to tell {% data variables.product.prodname_dependabot %} to vendor dependencies when updating them.
|
||||
|
||||
```yaml
|
||||
# Configure version updates for both dependencies defined in manifests and vendored dependencies
|
||||
|
@ -559,7 +559,7 @@ updates:
|
|||
interval: "weekly"
|
||||
```
|
||||
|
||||
{% data variables.product.prodname_dependabot_short %} only updates the vendored dependencies located in specific directories in a repository.
|
||||
{% data variables.product.prodname_dependabot %} only updates the vendored dependencies located in specific directories in a repository.
|
||||
|
||||
| Package manager | Required file path for vendored dependencies | More information |
|
||||
|------------------|-------------------------------|--------|
|
||||
|
|
|
@ -20,7 +20,7 @@ After you've enabled version updates, you can customize how {% data variables.pr
|
|||
|
||||
For more information about the configuration options, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates)."
|
||||
|
||||
When you update the *dependabot.yml* file in your repository, {% data variables.product.prodname_dependabot %} runs an immediate check with the new configuration. Within minutes you will see an updated list of dependencies on the **{% data variables.product.prodname_dependabot_short %}** tab, this may take longer if the repository has many dependencies. You may also see new pull requests for version updates. For more information, see "[Listing dependencies configured for version updates](/github/administering-a-repository/listing-dependencies-configured-for-version-updates)."
|
||||
When you update the *dependabot.yml* file in your repository, {% data variables.product.prodname_dependabot %} runs an immediate check with the new configuration. Within minutes you will see an updated list of dependencies on the **{% data variables.product.prodname_dependabot %}** tab, this may take longer if the repository has many dependencies. You may also see new pull requests for version updates. For more information, see "[Listing dependencies configured for version updates](/github/administering-a-repository/listing-dependencies-configured-for-version-updates)."
|
||||
|
||||
### Impact of configuration changes on security updates
|
||||
|
||||
|
|
|
@ -10,7 +10,7 @@ versions:
|
|||
|
||||
### About version updates for dependencies
|
||||
|
||||
You enable {% data variables.product.prodname_dependabot_version_updates %} by checking a *dependabot.yml* configuration file in to your repository's `.github` directory. {% data variables.product.prodname_dependabot_short %} then raises pull requests to keep the dependencies you configure up-to-date. For each package manager's dependencies that you want to update, you must specify the location of the package manifest files and how often to check for updates to the dependencies listed in those files. For information about enabling security updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)."
|
||||
You enable {% data variables.product.prodname_dependabot_version_updates %} by checking a *dependabot.yml* configuration file in to your repository's `.github` directory. {% data variables.product.prodname_dependabot %} then raises pull requests to keep the dependencies you configure up-to-date. For each package manager's dependencies that you want to update, you must specify the location of the package manifest files and how often to check for updates to the dependencies listed in those files. For information about enabling security updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)."
|
||||
|
||||
{% data reusables.dependabot.initial-updates %} For more information, see "[Customizing dependency updates](/github/administering-a-repository/customizing-dependency-updates)."
|
||||
|
||||
|
@ -72,7 +72,7 @@ On a fork, you also need to explicitly enable {% data variables.product.prodname
|
|||
|
||||
### Checking the status of version updates
|
||||
|
||||
After you enable version updates, you'll see a new **Dependabot** tab in the dependency graph for the repository. This tab shows which package managers {% data variables.product.prodname_dependabot %} is configured to monitor and when {% data variables.product.prodname_dependabot_short %} last checked for new versions.
|
||||
After you enable version updates, you'll see a new **Dependabot** tab in the dependency graph for the repository. This tab shows which package managers {% data variables.product.prodname_dependabot %} is configured to monitor and when {% data variables.product.prodname_dependabot %} last checked for new versions.
|
||||
|
||||
![Repository Insights tab, Dependency graph, Dependabot tab](/assets/images/help/dependabot/dependabot-tab-view-beta.png)
|
||||
|
||||
|
|
|
@ -91,11 +91,11 @@ versions:
|
|||
<!-- endif -->
|
||||
<!-- if currentVersion == "free-pro-team@latest" -->
|
||||
{% topic_link_in_list /keeping-your-dependencies-updated-automatically %}
|
||||
{% link_in_list /about-github-dependabot-version-updates %}
|
||||
{% link_in_list /about-dependabot-version-updates %}
|
||||
{% link_in_list /enabling-and-disabling-version-updates %}
|
||||
{% link_in_list /listing-dependencies-configured-for-version-updates %}
|
||||
{% link_in_list /managing-pull-requests-for-dependency-updates %}
|
||||
{% link_in_list /customizing-dependency-updates %}
|
||||
{% link_in_list /configuration-options-for-dependency-updates %}
|
||||
{% link_in_list /keeping-your-actions-up-to-date-with-github-dependabot %}
|
||||
{% link_in_list /keeping-your-actions-up-to-date-with-dependabot %}
|
||||
<!-- endif -->
|
||||
|
|
|
@ -1,6 +1,8 @@
|
|||
---
|
||||
title: Keeping your actions up to date with GitHub Dependabot
|
||||
title: Keeping your actions up to date with Dependabot
|
||||
intro: 'You can use {% data variables.product.prodname_dependabot %} to keep the actions you use updated to the latest versions.'
|
||||
redirect_from:
|
||||
- /github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
@ -9,7 +11,7 @@ versions:
|
|||
|
||||
### About {% data variables.product.prodname_dependabot_version_updates %} for actions
|
||||
|
||||
Actions are often updated with bug fixes and new features to make automated processes more reliable, faster, and safer. When you enable {% data variables.product.prodname_dependabot_version_updates %} for {% data variables.product.prodname_actions %}, {% data variables.product.prodname_dependabot %} will help ensure that references to actions in a repository's *workflow.yml* file are kept up to date. For each action in the file, {% data variables.product.prodname_dependabot_short %} checks the action's reference (typically a version number or commit identifier associated with the action) against the latest version. If a more recent version of the action is available, {% data variables.product.prodname_dependabot_short %} will send you a pull request that updates the reference in the workflow file to the latest version. For more information about {% data variables.product.prodname_dependabot_version_updates %}, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/github/administering-a-repository/about-github-dependabot-version-updates)." For more information about configuring workflows for {% data variables.product.prodname_actions %}, see "[Learn {% data variables.product.prodname_actions %}](/actions/learn-github-actions)."
|
||||
Actions are often updated with bug fixes and new features to make automated processes more reliable, faster, and safer. When you enable {% data variables.product.prodname_dependabot_version_updates %} for {% data variables.product.prodname_actions %}, {% data variables.product.prodname_dependabot %} will help ensure that references to actions in a repository's *workflow.yml* file are kept up to date. For each action in the file, {% data variables.product.prodname_dependabot %} checks the action's reference (typically a version number or commit identifier associated with the action) against the latest version. If a more recent version of the action is available, {% data variables.product.prodname_dependabot %} will send you a pull request that updates the reference in the workflow file to the latest version. For more information about {% data variables.product.prodname_dependabot_version_updates %}, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/github/administering-a-repository/about-dependabot-version-updates)." For more information about configuring workflows for {% data variables.product.prodname_actions %}, see "[Learn {% data variables.product.prodname_actions %}](/actions/learn-github-actions)."
|
||||
|
||||
### Enabling {% data variables.product.prodname_dependabot_version_updates %} for actions
|
||||
|
||||
|
@ -23,7 +25,7 @@ You can also enable {% data variables.product.prodname_dependabot_version_update
|
|||
|
||||
#### Example *dependabot.yml* file for {% data variables.product.prodname_actions %}
|
||||
|
||||
The example *dependabot.yml* file below configures version updates for {% data variables.product.prodname_actions %}. The `directory` must be set to `"/"` to check for workflow files in `.github/workflows`. The `schedule.interval` is set to `"daily"`. After this file has been checked in or updated, {% data variables.product.prodname_dependabot %} checks for new versions of your actions. {% data variables.product.prodname_dependabot_short %} will raise pull requests for version updates for any outdated actions that it finds. After the initial version updates, {% data variables.product.prodname_dependabot_short %} will continue to check for outdated versions of actions once a day.
|
||||
The example *dependabot.yml* file below configures version updates for {% data variables.product.prodname_actions %}. The `directory` must be set to `"/"` to check for workflow files in `.github/workflows`. The `schedule.interval` is set to `"daily"`. After this file has been checked in or updated, {% data variables.product.prodname_dependabot %} checks for new versions of your actions. {% data variables.product.prodname_dependabot %} will raise pull requests for version updates for any outdated actions that it finds. After the initial version updates, {% data variables.product.prodname_dependabot %} will continue to check for outdated versions of actions once a day.
|
||||
|
||||
```yaml
|
||||
# Set update schedule for GitHub Actions
|
|
@ -9,7 +9,7 @@ versions:
|
|||
|
||||
### Viewing dependencies monitored by {% data variables.product.prodname_dependabot %}
|
||||
|
||||
After you've enabled version updates, you can confirm that your configuration is correct using the **{% data variables.product.prodname_dependabot_short %}** tab in the dependency graph for the repository. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
After you've enabled version updates, you can confirm that your configuration is correct using the **{% data variables.product.prodname_dependabot %}** tab in the dependency graph for the repository. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.accessing-repository-graphs %}
|
||||
|
@ -22,7 +22,7 @@ If any dependencies are missing, check the log files for errors. If any package
|
|||
|
||||
### Viewing {% data variables.product.prodname_dependabot %} log files
|
||||
|
||||
1. On the **{% data variables.product.prodname_dependabot_short %}** tab, click **Last checked *TIME* ago** to see the log file that {% data variables.product.prodname_dependabot %} generated during the last check for version updates.
|
||||
1. On the **{% data variables.product.prodname_dependabot %}** tab, click **Last checked *TIME* ago** to see the log file that {% data variables.product.prodname_dependabot %} generated during the last check for version updates.
|
||||
![View log file](/assets/images/help/dependabot/last-checked-link.png)
|
||||
2. Optionally, to rerun the version check, click **Check for updates**.
|
||||
![Check for updates](/assets/images/help/dependabot/check-for-updates.png)
|
||||
|
|
|
@ -11,7 +11,7 @@ versions:
|
|||
|
||||
{% data reusables.dependabot.pull-request-introduction %}
|
||||
|
||||
When {% data variables.product.prodname_dependabot %} raises a pull request, you're notified by your chosen method for the repository. Each pull request contains detailed information about the proposed change, taken from the package manager. These pull requests follow the normal checks and tests defined in your repository. In addition, where enough information is available, you'll see a compatibility score. This may also help you decide whether or not to merge the change. For information about this score, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)."
|
||||
When {% data variables.product.prodname_dependabot %} raises a pull request, you're notified by your chosen method for the repository. Each pull request contains detailed information about the proposed change, taken from the package manager. These pull requests follow the normal checks and tests defined in your repository. In addition, where enough information is available, you'll see a compatibility score. This may also help you decide whether or not to merge the change. For information about this score, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
|
||||
If you have many dependencies to manage, you may want to customize the configuration for each package manager so that pull requests have specific reviewers, assignees, and labels. For more information, see "[Customizing dependency updates](/github/administering-a-repository/customizing-dependency-updates)."
|
||||
|
||||
|
|
|
@ -38,6 +38,10 @@ You can view all of the reviews a pull request has received in the Conversation
|
|||
|
||||
{% data reusables.pull_requests.resolving-conversations %}
|
||||
|
||||
### Re-requesting a review
|
||||
|
||||
{% data reusables.pull_requests.re-request-review %}
|
||||
|
||||
### Required reviews
|
||||
|
||||
{% data reusables.pull_requests.required-reviews-for-prs-summary %}
|
||||
|
|
|
@ -29,6 +29,10 @@ Each person who suggested a change included in the commit will be a co-author of
|
|||
5. Click **Commit changes.**
|
||||
![Commit changes button](/assets/images/help/pull_requests/commit-changes-button.png)
|
||||
|
||||
### Re-requesting a review
|
||||
|
||||
{% data reusables.pull_requests.re-request-review %}
|
||||
|
||||
### Opening an issue for an out-of-scope suggestion
|
||||
|
||||
If someone suggests changes to your pull request and the changes are out of the pull request's scope, you can open a new issue to track the feedback. For more information, see "[Opening an issue from a comment](/github/managing-your-work-on-github/opening-an-issue-from-a-comment)."
|
||||
|
|
|
@ -32,14 +32,14 @@ Some open-source projects provide mirrors on {% data variables.product.prodname_
|
|||
|
||||
Here are a few prominent repositories that are mirrored on {% data variables.product.prodname_dotcom_the_website %}:
|
||||
|
||||
- [android](https://github.com/android)
|
||||
- [Android Open Source Project](https://github.com/aosp-mirror)
|
||||
- [The Apache Software Foundation](https://github.com/apache)
|
||||
- [The Chromium Project](https://github.com/chromium)
|
||||
- [The Eclipse Foundation](https://github.com/eclipse)
|
||||
- [Eclipse Foundation](https://github.com/eclipse)
|
||||
- [The FreeBSD Project](https://github.com/freebsd)
|
||||
- [The Glasgow Haskell Compiler](https://github.com/ghc)
|
||||
- [Glasgow Haskell Compiler](https://github.com/ghc)
|
||||
- [GNOME](https://github.com/GNOME)
|
||||
- [The Linux kernel source tree](https://github.com/torvalds/linux)
|
||||
- [Linux kernel source tree](https://github.com/torvalds/linux)
|
||||
- [Qt](https://github.com/qt)
|
||||
|
||||
To set up your own mirror, you can configure [a post-receive hook](https://git-scm.com/book/en/Customizing-Git-Git-Hooks) on your official project repository to automatically push commits to a mirror repository on {% data variables.product.product_name %}.
|
||||
|
|
|
@ -13,7 +13,7 @@ versions:
|
|||
|
||||
You can request a 45-day trial to evaluate {% data variables.product.prodname_ghe_server %}. Your trial will be installed as a virtual appliance, with options for on-premises or cloud deployment. For a list of supported visualization platforms, see "[Setting up a GitHub Enterprise Server instance](/enterprise/admin/installation/setting-up-a-github-enterprise-server-instance)."
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}Security{% endif %} alerts and {% data variables.product.prodname_github_connect %} are not currently available in trials of {% data variables.product.prodname_ghe_server %}. For a demonstration of these features, contact {% data variables.contact.contact_enterprise_sales %}. For more information about these features, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[Connecting {% data variables.product.prodname_ghe_server %} to {% data variables.product.prodname_dotcom_the_website %}](/enterprise/admin/installation/connecting-github-enterprise-server-to-github-enterprise-cloud)."
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}Security{% endif %} alerts and {% data variables.product.prodname_github_connect %} are not currently available in trials of {% data variables.product.prodname_ghe_server %}. For a demonstration of these features, contact {% data variables.contact.contact_enterprise_sales %}. For more information about these features, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[Connecting {% data variables.product.prodname_ghe_server %} to {% data variables.product.prodname_dotcom_the_website %}](/enterprise/admin/installation/connecting-github-enterprise-server-to-github-enterprise-cloud)."
|
||||
|
||||
Trials are also available for {% data variables.product.prodname_ghe_cloud %}. For more information, see "[Setting up a trial of {% data variables.product.prodname_ghe_cloud %}](/articles/setting-up-a-trial-of-github-enterprise-cloud)."
|
||||
|
||||
|
|
|
@ -17,7 +17,7 @@ When your code depends on a package that has a security vulnerability, this vuln
|
|||
|
||||
### Detection of vulnerable dependencies
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %} detects vulnerable dependencies and sends {% data variables.product.prodname_dependabot_short %} alerts{% else %}{% data variables.product.product_name %} detects vulnerable dependencies and sends security alerts{% endif %} when:
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %} detects vulnerable dependencies and sends {% data variables.product.prodname_dependabot_alerts %}{% else %}{% data variables.product.product_name %} detects vulnerable dependencies and sends security alerts{% endif %} when:
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
- A new vulnerability is added to the {% data variables.product.prodname_advisory_database %}. For more information, see "[Browsing security vulnerabilities in the {% data variables.product.prodname_advisory_database %}](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database)."
|
||||
|
@ -49,11 +49,11 @@ You can also enable or disable {% data variables.product.prodname_dependabot_ale
|
|||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
When {% data variables.product.product_name %} identifies a vulnerable dependency, we generate a {% data variables.product.prodname_dependabot_short %} alert and display it on the Security tab for the repository. The alert includes a link to the affected file in the project, and information about a fixed version. {% data variables.product.product_name %} also notifies the maintainers of affected repositories about the new alert according to their notification preferences. For more information, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies)."
|
||||
When {% data variables.product.product_name %} identifies a vulnerable dependency, we generate a {% data variables.product.prodname_dependabot %} alert and display it on the Security tab for the repository. The alert includes a link to the affected file in the project, and information about a fixed version. {% data variables.product.product_name %} also notifies the maintainers of affected repositories about the new alert according to their notification preferences. For more information, see "[Configuring notifications for vulnerable dependencies](/github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies)."
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
For repositories where {% data variables.product.prodname_dependabot_security_updates %} are enabled, the alert may also contain a link to a pull request to update the manifest or lock file to the minimum version that resolves the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)."
|
||||
For repositories where {% data variables.product.prodname_dependabot_security_updates %} are enabled, the alert may also contain a link to a pull request to update the manifest or lock file to the minimum version that resolves the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_lt "enterprise-server@2.22" %}
|
||||
|
@ -66,12 +66,12 @@ When {% data variables.product.product_name %} identifies a vulnerable dependenc
|
|||
|
||||
{% endwarning %}
|
||||
|
||||
### Access to {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts
|
||||
### Access to {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts
|
||||
|
||||
You can see all of the alerts that affect a particular project{% if currentVersion == "free-pro-team@latest" %} on the repository's Security tab or{% endif %} in the repository's dependency graph.{% if currentVersion == "free-pro-team@latest" %} For more information, see "[Viewing and updating vulnerable dependencies in your repository](/articles/viewing-and-updating-vulnerable-dependencies-in-your-repository)."{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
By default, we notify people with admin permissions in the affected repositories about new {% data variables.product.prodname_dependabot_short %} alerts.{% endif %} {% if currentVersion == "free-pro-team@latest" %}{% data variables.product.product_name %} never publicly discloses identified vulnerabilities for any repository. You can also make {% data variables.product.prodname_dependabot_short %} alerts visible to additional people or teams working repositories that you own or have admin permissions for. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-github-dependabot-alerts)."
|
||||
By default, we notify people with admin permissions in the affected repositories about new {% data variables.product.prodname_dependabot_alerts %}.{% endif %} {% if currentVersion == "free-pro-team@latest" %}{% data variables.product.product_name %} never publicly discloses identified vulnerabilities for any repository. You can also make {% data variables.product.prodname_dependabot_alerts %} visible to additional people or teams working repositories that you own or have admin permissions for. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-dependabot-alerts)."
|
||||
{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_lt "enterprise-server@2.22" %}
|
||||
|
@ -83,6 +83,6 @@ We send security alerts to people with admin permissions in the affected reposit
|
|||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
### Further reading
|
||||
|
||||
- "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)"
|
||||
- "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)"
|
||||
- "[Viewing and updating vulnerable dependencies in your repository](/articles/viewing-and-updating-vulnerable-dependencies-in-your-repository)"
|
||||
- "[Understanding how {% data variables.product.product_name %} uses and protects your data](/categories/understanding-how-github-uses-and-protects-your-data)"{% endif %}
|
||||
|
|
|
@ -0,0 +1,35 @@
|
|||
---
|
||||
title: About Dependabot security updates
|
||||
intro: '{% data variables.product.prodname_dependabot %} can fix vulnerable dependencies for you by raising pull requests with security updates.'
|
||||
shortTitle: About Dependabot security updates
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/about-github-dependabot-security-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
### About {% data variables.product.prodname_dependabot_security_updates %}
|
||||
|
||||
{% data variables.product.prodname_dependabot_security_updates %} make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature, when a {% data variables.product.prodname_dependabot %} alert is raised for a vulnerable dependency in the dependency graph of your repository, {% data variables.product.prodname_dependabot %} automatically tries to fix it. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)."
|
||||
|
||||
{% data variables.product.prodname_dependabot %} checks whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then {% data variables.product.prodname_dependabot %} raises a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the {% data variables.product.prodname_dependabot %} alert, or reports an error on the alert. For more information, see "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)."
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**
|
||||
|
||||
The {% data variables.product.prodname_dependabot_security_updates %} feature is available for repositories where you have enabled the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. You will see a {% data variables.product.prodname_dependabot %} alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. {% data variables.product.prodname_dependabot %} is unable to update an indirect or transitive dependency that is not explicitly defined. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#dependencies-included)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
### About pull requests for security updates
|
||||
|
||||
Each pull request contains everything you need to quickly and safely review and merge a proposed fix into your project. This includes information about the vulnerability like release notes, changelog entries, and commit details. Details of which vulnerability a pull request resolves are hidden from anyone who does not have access to {% data variables.product.prodname_dependabot_alerts %} for the repository.
|
||||
|
||||
When you merge a pull request that contains a security update, the corresponding {% data variables.product.prodname_dependabot %} alert is marked as resolved for your repository. For more information about {% data variables.product.prodname_dependabot %} pull requests, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates)."
|
||||
|
||||
{% data reusables.dependabot.automated-tests-note %}
|
||||
|
||||
### About compatibility scores
|
||||
|
||||
{% data variables.product.prodname_dependabot_security_updates %} may include compatibility scores to let you know whether updating a vulnerability could cause breaking changes to your project. These are calculated from CI tests in other public repositories where the same security update has been generated. An update's compatibility score is the percentage of CI runs that passed when updating between specific versions of the dependency.
|
|
@ -1,33 +0,0 @@
|
|||
---
|
||||
title: About GitHub Dependabot security updates
|
||||
intro: '{% data variables.product.prodname_dependabot %} can fix vulnerable dependencies for you by raising pull requests with security updates.'
|
||||
shortTitle: About Dependabot security updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
### About {% data variables.product.prodname_dependabot_security_updates %}
|
||||
|
||||
{% data variables.product.prodname_dependabot_security_updates %} make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature, when a {% data variables.product.prodname_dependabot_short %} alert is raised for a vulnerable dependency in the dependency graph of your repository, {% data variables.product.prodname_dependabot_short %} automatically tries to fix it. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)."
|
||||
|
||||
{% data variables.product.prodname_dependabot %} checks whether it's possible to upgrade the vulnerable dependency to a fixed version without disrupting the dependency graph for the repository. Then {% data variables.product.prodname_dependabot_short %} raises a pull request to update the dependency to the minimum version that includes the patch and links the pull request to the {% data variables.product.prodname_dependabot %} alert, or reports an error on the alert. For more information, see "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors)."
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**
|
||||
|
||||
The {% data variables.product.prodname_dependabot_security_updates %} feature is available for repositories where you have enabled the dependency graph and {% data variables.product.prodname_dependabot_short %} alerts. You will see a {% data variables.product.prodname_dependabot_short %} alert for every vulnerable dependency identified in your full dependency graph. However, security updates are triggered only for dependencies that are specified in a manifest or lock file. {% data variables.product.prodname_dependabot_short %} is unable to update an indirect or transitive dependency that is not explicitly defined. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#dependencies-included)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
### About pull requests for security updates
|
||||
|
||||
Each pull request contains everything you need to quickly and safely review and merge a proposed fix into your project. This includes information about the vulnerability like release notes, changelog entries, and commit details. Details of which vulnerability a pull request resolves are hidden from anyone who does not have access to {% data variables.product.prodname_dependabot_short %} alerts for the repository.
|
||||
|
||||
When you merge a pull request that contains a security update, the corresponding {% data variables.product.prodname_dependabot_short %} alert is marked as resolved for your repository. For more information about {% data variables.product.prodname_dependabot_short %} pull requests, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates)."
|
||||
|
||||
{% data reusables.dependabot.automated-tests-note %}
|
||||
|
||||
### About compatibility scores
|
||||
|
||||
{% data variables.product.prodname_dependabot_security_updates %} may include compatibility scores to let you know whether updating a vulnerability could cause breaking changes to your project. These are calculated from CI tests in other public repositories where the same security update has been generated. An update's compatibility score is the percentage of CI runs that passed when updating between specific versions of the dependency.
|
|
@ -1,20 +1,21 @@
|
|||
---
|
||||
title: Configuring GitHub Dependabot security updates
|
||||
title: Configuring Dependabot security updates
|
||||
intro: 'You can use {% data variables.product.prodname_dependabot_security_updates %} or manual pull requests to easily update vulnerable dependencies.'
|
||||
shortTitle: Configuring Dependabot security updates
|
||||
redirect_from:
|
||||
- /articles/configuring-automated-security-fixes
|
||||
- /github/managing-security-vulnerabilities/configuring-automated-security-fixes
|
||||
- /github/managing-security-vulnerabilities/configuring-automated-security-updates
|
||||
shortTitle: Configuring Dependabot security updates
|
||||
- /github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
### About configuring {% data variables.product.prodname_dependabot_security_updates %}
|
||||
|
||||
You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_short %} alerts and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)."
|
||||
You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
|
||||
You can disable {% data variables.product.prodname_dependabot_security_updates %} for an individual repository or for all repositories owned by your user account or organization. For more information, see "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories](#managing-github-dependabot-security-updates-for-your-repositories)" below.
|
||||
You can disable {% data variables.product.prodname_dependabot_security_updates %} for an individual repository or for all repositories owned by your user account or organization. For more information, see "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories](#managing-dependabot-security-updates-for-your-repositories)" below.
|
||||
|
||||
{% data reusables.dependabot.dependabot-tos %}
|
||||
|
||||
|
@ -24,7 +25,7 @@ You can disable {% data variables.product.prodname_dependabot_security_updates %
|
|||
|
||||
{% note %}
|
||||
|
||||
**Note**: You can manually enable {% data variables.product.prodname_dependabot_security_updates %}, even if the repository doesn't meet some of the prerequisites below. For example, you can enable {% data variables.product.prodname_dependabot_security_updates %} on a fork, or for a package manager that isn't directly supported by following the instructions in "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories](#managing-github-dependabot-security-updates-for-your-repositories)."
|
||||
**Note**: You can manually enable {% data variables.product.prodname_dependabot_security_updates %}, even if the repository doesn't meet some of the prerequisites below. For example, you can enable {% data variables.product.prodname_dependabot_security_updates %} on a fork, or for a package manager that isn't directly supported by following the instructions in "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repositories](#managing-dependabot-security-updates-for-your-repositories)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
|
@ -34,7 +35,7 @@ You can disable {% data variables.product.prodname_dependabot_security_updates %
|
|||
| Repository is not archived | "[Archiving repositories](/github/creating-cloning-and-archiving-repositories/archiving-repositories)" |
|
||||
| Repository is public, or repository is private and you have enabled read-only analysis by {% data variables.product.prodname_dotcom %}, dependency graph, and vulnerability alerts in the repository's settings | "[Managing data use settings for your private repository](/github/understanding-how-github-uses-and-protects-your-data/managing-data-use-settings-for-your-private-repository)." |
|
||||
| Repository contains dependency manifest file from a package ecosystem that {% data variables.product.prodname_dotcom %} supports | "[Supported package ecosystems](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)" |
|
||||
| {% data variables.product.prodname_dependabot_security_updates %} are not disabled for the repository | "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repository](#managing-github-dependabot-security-updates-for-your-repositories)" |
|
||||
| {% data variables.product.prodname_dependabot_security_updates %} are not disabled for the repository | "[Managing {% data variables.product.prodname_dependabot_security_updates %} for your repository](#managing-dependabot-security-updates-for-your-repositories)" |
|
||||
| Repository is not already using an integration for dependency management | "[About integrations](/github/customizing-your-github-workflow/about-integrations)" |
|
||||
|
||||
If security updates are not enabled for your repository and you don't know why, first try enabling them using the instructions given in the procedural sections below. If security updates are still not working, you can [contact support](https://support.github.com/contact).
|
||||
|
@ -50,7 +51,7 @@ You can also enable or disable {% data variables.product.prodname_dependabot_sec
|
|||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-dependabot-alerts %}
|
||||
1. Above the list of alerts, use the drop-down menu and select or unselect **{% data variables.product.prodname_dependabot_short %} security updates**.
|
||||
1. Above the list of alerts, use the drop-down menu and select or unselect **{% data variables.product.prodname_dependabot %} security updates**.
|
||||
![Drop-down menu with the option to enable {% data variables.product.prodname_dependabot_security_updates %}](/assets/images/help/repository/enable-dependabot-security-updates-drop-down.png)
|
||||
|
||||
### Further reading
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
title: Configuring notifications for vulnerable dependencies
|
||||
shortTitle: Configuring notifications
|
||||
intro: 'Optimize how you receive notifications about {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts.'
|
||||
intro: 'Optimize how you receive notifications about {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.21'
|
||||
|
@ -9,10 +9,10 @@ versions:
|
|||
|
||||
### About notifications for vulnerable dependencies
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}When {% data variables.product.prodname_dependabot %} detects vulnerable dependencies in your repositories, we generate a {% data variables.product.prodname_dependabot_short %} alert and display it on the Security tab for the repository. {% data variables.product.product_name %} notifies the maintainers of affected repositories about the new alert according to their notification preferences.{% else %}When {% data variables.product.product_name %} detects vulnerable dependencies in your repositories, it sends security alerts.{% endif %}{% if currentVersion == "free-pro-team@latest" %} {% data variables.product.prodname_dependabot_short %} is enabled by default on all public repositories. For {% data variables.product.prodname_dependabot_alerts %}, by default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email, grouped by the specific vulnerability.
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}When {% data variables.product.prodname_dependabot %} detects vulnerable dependencies in your repositories, we generate a {% data variables.product.prodname_dependabot %} alert and display it on the Security tab for the repository. {% data variables.product.product_name %} notifies the maintainers of affected repositories about the new alert according to their notification preferences.{% else %}When {% data variables.product.product_name %} detects vulnerable dependencies in your repositories, it sends security alerts.{% endif %}{% if currentVersion == "free-pro-team@latest" %} {% data variables.product.prodname_dependabot %} is enabled by default on all public repositories. For {% data variables.product.prodname_dependabot_alerts %}, by default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email, grouped by the specific vulnerability.
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}If you're an organization owner, you can enable or disable {% data variables.product.prodname_dependabot_short %} alerts for all repositories in your organization with one click. You can also set whether the detection of vulnerable dependencies will be enabled or disabled for newly-created repositories. For more information, see "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-features-for-new-repositories)."
|
||||
{% if currentVersion == "free-pro-team@latest" %}If you're an organization owner, you can enable or disable {% data variables.product.prodname_dependabot_alerts %} for all repositories in your organization with one click. You can also set whether the detection of vulnerable dependencies will be enabled or disabled for newly-created repositories. For more information, see "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-features-for-new-repositories)."
|
||||
{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion == "enterprise-server@2.21" %}
|
||||
|
@ -21,7 +21,7 @@ Your site administrator needs to enable security alerts for vulnerable dependenc
|
|||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.20" %}
|
||||
By default, if your site administrator has configured email for notifications on your enterprise, you will receive {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %} by email.{% endif %}
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}Site administrators can also enable {% data variables.product.prodname_dependabot_alerts %} without notifications. For more information, see "[Enabling {% data variables.product.prodname_dependabot_short %} alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %}
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}Site administrators can also enable {% data variables.product.prodname_dependabot_alerts %} without notifications. For more information, see "[Enabling {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %}
|
||||
|
||||
{% if currentVersion ver_lt "enterprise-server@2.22" %}Site administrators can also enable security alerts without notifications. For more information, see "[Enabling security alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %}
|
||||
|
||||
|
@ -33,14 +33,14 @@ You can configure notification settings for yourself or your organization from t
|
|||
{% data reusables.notifications.vulnerable-dependency-notification-options %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
![{% data variables.product.prodname_dependabot_short %} alerts options](/assets/images/help/notifications-v2/dependabot-alerts-options.png)
|
||||
![{% data variables.product.prodname_dependabot_alerts %} options](/assets/images/help/notifications-v2/dependabot-alerts-options.png)
|
||||
{% else %}
|
||||
![Security alerts options](/assets/images/help/notifications-v2/security-alerts-options.png)
|
||||
{% endif %}
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note:** You can filter your {% data variables.product.company_short %} inbox notifications to show {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %} security{% endif %} alerts. For more information, see "[Managing notifications from your inbox](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#supported-queries-for-custom-filters)."
|
||||
**Note:** You can filter your {% data variables.product.company_short %} inbox notifications to show {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %} security{% endif %} alerts. For more information, see "[Managing notifications from your inbox](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#supported-queries-for-custom-filters)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
|
|
|
@ -30,9 +30,9 @@ versions:
|
|||
{% link_in_list /about-alerts-for-vulnerable-dependencies %}
|
||||
{% link_in_list /configuring-notifications-for-vulnerable-dependencies %}
|
||||
<!-- if currentVersion == "free-pro-team@latest" -->
|
||||
{% link_in_list /about-github-dependabot-security-updates %}
|
||||
{% link_in_list /configuring-github-dependabot-security-updates %}
|
||||
{% link_in_list /about-dependabot-security-updates %}
|
||||
{% link_in_list /configuring-dependabot-security-updates %}
|
||||
{% link_in_list /viewing-and-updating-vulnerable-dependencies-in-your-repository %}
|
||||
{% link_in_list /troubleshooting-the-detection-of-vulnerable-dependencies %}
|
||||
{% link_in_list /troubleshooting-github-dependabot-errors %}
|
||||
{% link_in_list /troubleshooting-dependabot-errors %}
|
||||
<!-- endif -->
|
||||
|
|
|
@ -0,0 +1,84 @@
|
|||
---
|
||||
title: Troubleshooting Dependabot errors
|
||||
intro: 'Sometimes {% data variables.product.prodname_dependabot %} is unable to raise a pull request to update your dependencies. You can review the error and unblock {% data variables.product.prodname_dependabot %}.'
|
||||
shortTitle: Troubleshooting errors
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
{% data reusables.dependabot.beta-note %}
|
||||
|
||||
### About {% data variables.product.prodname_dependabot %} errors
|
||||
|
||||
{% data reusables.dependabot.pull-request-introduction %}
|
||||
|
||||
If anything prevents {% data variables.product.prodname_dependabot %} from raising a pull request, this is reported as an error.
|
||||
|
||||
### Investigating errors with {% data variables.product.prodname_dependabot_security_updates %}
|
||||
|
||||
When {% data variables.product.prodname_dependabot %} is blocked from creating a pull request to fix a {% data variables.product.prodname_dependabot %} alert, it posts the error message on the alert. The {% data variables.product.prodname_dependabot_alerts %} view shows a list of any alerts that have not been resolved yet. To access the alerts view, click **{% data variables.product.prodname_dependabot_alerts %}** on the **Security** tab for the repository. Where a pull request that will fix the vulnerable dependency has been generated, the alert includes a link to that pull request.
|
||||
|
||||
![{% data variables.product.prodname_dependabot_alerts %} view showing a pull request link](/assets/images/help/dependabot/dependabot-alert-pr-link.png)
|
||||
|
||||
There are three reasons why an alert may have no pull request link:
|
||||
|
||||
1. {% data variables.product.prodname_dependabot_security_updates %} are not enabled for the repository.
|
||||
1. The alert is for an indirect or transitive dependency that is not explicitly defined in a lock file.
|
||||
1. An error blocked {% data variables.product.prodname_dependabot %} from creating a pull request.
|
||||
|
||||
If an error blocked {% data variables.product.prodname_dependabot %} from creating a pull request, you can display details of the error by clicking the alert.
|
||||
|
||||
![{% data variables.product.prodname_dependabot %} alert showing the error that blocked the creation of a pull request](/assets/images/help/dependabot/dependabot-security-update-error.png)
|
||||
|
||||
### Investigating errors with {% data variables.product.prodname_dependabot_version_updates %}
|
||||
|
||||
When {% data variables.product.prodname_dependabot %} is blocked from creating a pull request to update a dependency in an ecosystem, it posts the error icon on the manifest file. The manifest files that are managed by {% data variables.product.prodname_dependabot %} are listed on the {% data variables.product.prodname_dependabot %} tab. To access this tab, on the **Insights** tab for the repository click **Dependency graph**, and then click the **{% data variables.product.prodname_dependabot %}** tab.
|
||||
|
||||
![{% data variables.product.prodname_dependabot %} view showing an error](/assets/images/help/dependabot/dependabot-tab-view-error-beta.png)
|
||||
|
||||
To see the log file for any manifest file, click the **Last checked TIME ago** link. When you display the log file for a manifest that's shown with an error symbol (for example, Maven in the screenshot above), any errors are also displayed.
|
||||
|
||||
![{% data variables.product.prodname_dependabot %} version update error and log ](/assets/images/help/dependabot/dependabot-version-update-error-beta.png)
|
||||
|
||||
### Understanding {% data variables.product.prodname_dependabot %} errors
|
||||
|
||||
Pull requests for security updates act to upgrade a vulnerable dependency to the minimum version that includes a fix for the vulnerability. In contrast, pull requests for version updates act to upgrade a dependency to the latest version allowed by the package manifest and {% data variables.product.prodname_dependabot %} configuration files. Consequently, some errors are specific to one type of update.
|
||||
|
||||
#### {% data variables.product.prodname_dependabot %} cannot update DEPENDENCY to a non-vulnerable version
|
||||
|
||||
**Security updates only.** {% data variables.product.prodname_dependabot %} cannot create a pull request to update the vulnerable dependency to a secure version without breaking other dependencies in the dependency graph for this repository.
|
||||
|
||||
Every application that has dependencies has a dependency graph, that is, a directed acyclic graph of every package version that the application directly or indirectly depends on. Every time a dependency is updated, this graph must resolve otherwise the application won't build. When an ecosystem has a deep and complex dependency graph, for example, npm and RubyGems, it is often impossible to upgrade a single dependency without upgrading the whole ecosystem.
|
||||
|
||||
The best way to avoid this problem is to stay up to date with the most recently released versions, for example, by enabling version updates. This increases the likelihood that a vulnerability in one dependency can be resolved by a simple upgrade that doesn't break the dependency graph. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot %} cannot update to the required version as there is already an open pull request for the latest version
|
||||
|
||||
**Security updates only.** {% data variables.product.prodname_dependabot %} will not create a pull request to update the vulnerable dependency to a secure version because there is already an open pull request to update this dependency. You will see this error when a vulnerability is detected in a single dependency and there's already an open pull request to update the dependency to the latest version.
|
||||
|
||||
There are two options: you can review the open pull request and merge it as soon as you are confident that the change is safe, or close that pull request and trigger a new security update pull request. For more information, see "[Triggering a {% data variables.product.prodname_dependabot %} pull request manually](#triggering-a-dependabot-pull-request-manually)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot %} timed out during its update
|
||||
|
||||
{% data variables.product.prodname_dependabot %} took longer than the maximum time allowed to assess the update required and prepare a pull request. This error is usually seen only for large repositories with many manifest files, for example, npm or yarn monorepo projects with hundreds of *package.json* files. Updates to the Composer ecosystem also take longer to assess and may time out.
|
||||
|
||||
This error is difficult to address. If a version update times out, you could specify the most important dependencies to update using the `allow` parameter or, alternatively, use the `ignore` parameter to exclude some dependencies from updates. Updating your configuration might allow {% data variables.product.prodname_dependabot %} to review the version update and generate the pull request in the time available.
|
||||
|
||||
If a security update times out, you can reduce the chances of this happening by keeping the dependencies updated, for example, by enabling version updates. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot %} cannot open any more pull requests
|
||||
|
||||
There's a limit on the number of open pull requests {% data variables.product.prodname_dependabot %} will generate. When this limit is reached, no new pull requests are opened and this error is reported. The best way to resolve this error is to review and merge some of the open pull requests.
|
||||
|
||||
There are separate limits for security and version update pull requests, so that open version update pull requests cannot block the creation of a security update pull request. The limit for security update pull requests is 10. By default, the limit for version updates is 5 but you can change this using the `open-pull-requests-limit` parameter in the configuration file. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit)."
|
||||
|
||||
The best way to resolve this error is to merge or close some of the existing pull requests and trigger a new pull request manually. For more information, see "[Triggering a {% data variables.product.prodname_dependabot %} pull request manually](#triggering-a-dependabot-pull-request-manually)."
|
||||
|
||||
### Triggering a {% data variables.product.prodname_dependabot %} pull request manually
|
||||
|
||||
If you unblock {% data variables.product.prodname_dependabot %}, you can manually trigger a fresh attempt to create a pull request.
|
||||
|
||||
- **Security updates**—display the {% data variables.product.prodname_dependabot %} alert that shows the error you have fixed and click **Create {% data variables.product.prodname_dependabot %} security update**.
|
||||
- **Version updates**—display the log file for the manifest that shows the error that you have fixed and click **Check for updates**.
|
|
@ -1,82 +0,0 @@
|
|||
---
|
||||
title: Troubleshooting GitHub Dependabot errors
|
||||
intro: 'Sometimes {% data variables.product.prodname_dependabot %} is unable to raise a pull request to update your dependencies. You can review the error and unblock {% data variables.product.prodname_dependabot_short %}.'
|
||||
shortTitle: Troubleshooting errors
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
---
|
||||
|
||||
{% data reusables.dependabot.beta-note %}
|
||||
|
||||
### About {% data variables.product.prodname_dependabot %} errors
|
||||
|
||||
{% data reusables.dependabot.pull-request-introduction %}
|
||||
|
||||
If anything prevents {% data variables.product.prodname_dependabot_short %} from raising a pull request, this is reported as an error.
|
||||
|
||||
### Investigating errors with {% data variables.product.prodname_dependabot_security_updates %}
|
||||
|
||||
When {% data variables.product.prodname_dependabot_short %} is blocked from creating a pull request to fix a {% data variables.product.prodname_dependabot_short %} alert, it posts the error message on the alert. The {% data variables.product.prodname_dependabot_short %} alerts view shows a list of any alerts that have not been resolved yet. To access the alerts view, click **{% data variables.product.prodname_dependabot_short %} alerts** on the **Security** tab for the repository. Where a pull request that will fix the vulnerable dependency has been generated, the alert includes a link to that pull request.
|
||||
|
||||
![{% data variables.product.prodname_dependabot_short %} alerts view showing a pull request link](/assets/images/help/dependabot/dependabot-alert-pr-link.png)
|
||||
|
||||
There are three reasons why an alert may have no pull request link:
|
||||
|
||||
1. {% data variables.product.prodname_dependabot_security_updates %} are not enabled for the repository.
|
||||
1. The alert is for an indirect or transitive dependency that is not explicitly defined in a lock file.
|
||||
1. An error blocked {% data variables.product.prodname_dependabot_short %} from creating a pull request.
|
||||
|
||||
If an error blocked {% data variables.product.prodname_dependabot_short %} from creating a pull request, you can display details of the error by clicking the alert.
|
||||
|
||||
![{% data variables.product.prodname_dependabot_short %} alert showing the error that blocked the creation of a pull request](/assets/images/help/dependabot/dependabot-security-update-error.png)
|
||||
|
||||
### Investigating errors with {% data variables.product.prodname_dependabot_version_updates %}
|
||||
|
||||
When {% data variables.product.prodname_dependabot_short %} is blocked from creating a pull request to update a dependency in an ecosystem, it posts the error icon on the manifest file. The manifest files that are managed by {% data variables.product.prodname_dependabot_short %} are listed on the {% data variables.product.prodname_dependabot_short %} tab. To access this tab, on the **Insights** tab for the repository click **Dependency graph**, and then click the **{% data variables.product.prodname_dependabot_short %}** tab.
|
||||
|
||||
![{% data variables.product.prodname_dependabot_short %} view showing an error](/assets/images/help/dependabot/dependabot-tab-view-error-beta.png)
|
||||
|
||||
To see the log file for any manifest file, click the **Last checked TIME ago** link. When you display the log file for a manifest that's shown with an error symbol (for example, Maven in the screenshot above), any errors are also displayed.
|
||||
|
||||
![{% data variables.product.prodname_dependabot_short %} version update error and log ](/assets/images/help/dependabot/dependabot-version-update-error-beta.png)
|
||||
|
||||
### Understanding {% data variables.product.prodname_dependabot_short %} errors
|
||||
|
||||
Pull requests for security updates act to upgrade a vulnerable dependency to the minimum version that includes a fix for the vulnerability. In contrast, pull requests for version updates act to upgrade a dependency to the latest version allowed by the package manifest and {% data variables.product.prodname_dependabot_short %} configuration files. Consequently, some errors are specific to one type of update.
|
||||
|
||||
#### {% data variables.product.prodname_dependabot_short %} cannot update DEPENDENCY to a non-vulnerable version
|
||||
|
||||
**Security updates only.** {% data variables.product.prodname_dependabot_short %} cannot create a pull request to update the vulnerable dependency to a secure version without breaking other dependencies in the dependency graph for this repository.
|
||||
|
||||
Every application that has dependencies has a dependency graph, that is, a directed acyclic graph of every package version that the application directly or indirectly depends on. Every time a dependency is updated, this graph must resolve otherwise the application won't build. When an ecosystem has a deep and complex dependency graph, for example, npm and RubyGems, it is often impossible to upgrade a single dependency without upgrading the whole ecosystem.
|
||||
|
||||
The best way to avoid this problem is to stay up to date with the most recently released versions, for example, by enabling version updates. This increases the likelihood that a vulnerability in one dependency can be resolved by a simple upgrade that doesn't break the dependency graph. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot_short %} cannot update to the required version as there is already an open pull request for the latest version
|
||||
|
||||
**Security updates only.** {% data variables.product.prodname_dependabot_short %} will not create a pull request to update the vulnerable dependency to a secure version because there is already an open pull request to update this dependency. You will see this error when a vulnerability is detected in a single dependency and there's already an open pull request to update the dependency to the latest version.
|
||||
|
||||
There are two options: you can review the open pull request and merge it as soon as you are confident that the change is safe, or close that pull request and trigger a new security update pull request. For more information, see "[Triggering a {% data variables.product.prodname_dependabot_short %} pull request manually](#triggering-a-dependabot-pull-request-manually)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot_short %} timed out during its update
|
||||
|
||||
{% data variables.product.prodname_dependabot_short %} took longer than the maximum time allowed to assess the update required and prepare a pull request. This error is usually seen only for large repositories with many manifest files, for example, npm or yarn monorepo projects with hundreds of *package.json* files. Updates to the Composer ecosystem also take longer to assess and may time out.
|
||||
|
||||
This error is difficult to address. If a version update times out, you could specify the most important dependencies to update using the `allow` parameter or, alternatively, use the `ignore` parameter to exclude some dependencies from updates. Updating your configuration might allow {% data variables.product.prodname_dependabot_short %} to review the version update and generate the pull request in the time available.
|
||||
|
||||
If a security update times out, you can reduce the chances of this happening by keeping the dependencies updated, for example, by enabling version updates. For more information, see "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
|
||||
#### {% data variables.product.prodname_dependabot_short %} cannot open any more pull requests
|
||||
|
||||
There's a limit on the number of open pull requests {% data variables.product.prodname_dependabot_short %} will generate. When this limit is reached, no new pull requests are opened and this error is reported. The best way to resolve this error is to review and merge some of the open pull requests.
|
||||
|
||||
There are separate limits for security and version update pull requests, so that open version update pull requests cannot block the creation of a security update pull request. The limit for security update pull requests is 10. By default, the limit for version updates is 5 but you can change this using the `open-pull-requests-limit` parameter in the configuration file. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit)."
|
||||
|
||||
The best way to resolve this error is to merge or close some of the existing pull requests and trigger a new pull request manually. For more information, see "[Triggering a {% data variables.product.prodname_dependabot_short %} pull request manually](#triggering-a-dependabot-pull-request-manually)."
|
||||
|
||||
### Triggering a {% data variables.product.prodname_dependabot_short %} pull request manually
|
||||
|
||||
If you unblock {% data variables.product.prodname_dependabot_short %}, you can manually trigger a fresh attempt to create a pull request.
|
||||
|
||||
- **Security updates**—display the {% data variables.product.prodname_dependabot_short %} alert that shows the error you have fixed and click **Create {% data variables.product.prodname_dependabot_short %} security update**.
|
||||
- **Version updates**—display the log file for the manifest that shows the error that you have fixed and click **Check for updates**.
|
|
@ -14,14 +14,14 @@ The results of dependency detection reported by {% data variables.product.produc
|
|||
|
||||
* {% data variables.product.prodname_advisory_database %} is one of the data sources that {% data variables.product.prodname_dotcom %} uses to identify vulnerable dependencies. It's a free, curated database of vulnerability information for common package ecosystems on {% data variables.product.prodname_dotcom %}. It includes both data reported directly to {% data variables.product.prodname_dotcom %} from {% data variables.product.prodname_security_advisories %}, as well as official feeds and community sources. This data is reviewed and curated by {% data variables.product.prodname_dotcom %} to ensure that false or unactionable information is not shared with the development community. For more information, see "[Browsing security vulnerabilities in the {% data variables.product.prodname_advisory_database %}](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database)" and "[About {% data variables.product.prodname_security_advisories %}](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
* The dependency graph parses all known package manifest files in a user’s repository. For example, for npm it will parse the _package-lock.json_ file. It constructs a graph of all of the repository’s dependencies and public dependents. This happens when you enable the dependency graph and when anyone pushes to the default branch, and it includes commits that makes changes to a supported manifest format. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)."
|
||||
* {% data variables.product.prodname_dependabot_short %} scans any push, to the default branch, that contains a manifest file. When a new vulnerability record is added, it scans all existing repositories and generates an alert for each vulnerable repository. {% data variables.product.prodname_dependabot_short %} alerts are aggregated at the repository level, rather than creating one alert per vulnerability. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
|
||||
* {% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive an alert about a vulnerable dependency in your repository. Where possible, {% data variables.product.prodname_dependabot_short %} creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)" and "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors)."
|
||||
* {% data variables.product.prodname_dependabot %} scans any push, to the default branch, that contains a manifest file. When a new vulnerability record is added, it scans all existing repositories and generates an alert for each vulnerable repository. {% data variables.product.prodname_dependabot_alerts %} are aggregated at the repository level, rather than creating one alert per vulnerability. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
|
||||
* {% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive an alert about a vulnerable dependency in your repository. Where possible, {% data variables.product.prodname_dependabot %} creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)" and "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)."
|
||||
|
||||
{% data variables.product.prodname_dependabot_short %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is discovered and added to the advisory database.
|
||||
{% data variables.product.prodname_dependabot %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is discovered and added to the advisory database.
|
||||
|
||||
### Why don't I get vulnerability alerts for some ecosystems?
|
||||
|
||||
{% data variables.product.prodname_dotcom %} limits its support for vulnerability alerts to a set of ecosystems where we can provide high-quality, actionable data. Curated vulnerabilities in the {% data variables.product.prodname_advisory_database %}, the dependency graph, {% data variables.product.prodname_dependabot_short %} alerts, and {% data variables.product.prodname_dependabot_short %} security updates are provided for several ecosystems, including Java’s Maven, JavaScript’s npm and Yarn, .NET’s NuGet, Python’s pip, Ruby's RubyGems, and PHP’s Composer. We'll continue to add support for more ecosystems over time. For an overview of the package ecosystems that we support, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)."
|
||||
{% data variables.product.prodname_dotcom %} limits its support for vulnerability alerts to a set of ecosystems where we can provide high-quality, actionable data. Curated vulnerabilities in the {% data variables.product.prodname_advisory_database %}, the dependency graph, {% data variables.product.prodname_dependabot_alerts %}, and {% data variables.product.prodname_dependabot %} security updates are provided for several ecosystems, including Java’s Maven, JavaScript’s npm and Yarn, .NET’s NuGet, Python’s pip, Ruby's RubyGems, and PHP’s Composer. We'll continue to add support for more ecosystems over time. For an overview of the package ecosystems that we support, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)."
|
||||
|
||||
It's worth noting that [{% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories) may exist for other ecosystems. The information in a security advisory is provided by the maintainers of a particular repository. This data is not curated in the same way as information for the supported ecosystems.
|
||||
|
||||
|
@ -31,7 +31,7 @@ It's worth noting that [{% data variables.product.prodname_dotcom %} Security Ad
|
|||
|
||||
The dependency graph includes information on dependencies that are explicitly declared in your environment. That is, dependencies that are specified in a manifest or a lockfile. The dependency graph generally also includes transitive dependencies, even when they aren't specified in a lockfile, by looking at the dependencies of the dependencies in a manifest file.
|
||||
|
||||
{% data variables.product.prodname_dependabot_short %} alerts advise you about dependencies you should update, including transitive dependencies, where the version can be determined from a manifest or a lockfile. {% data variables.product.prodname_dependabot_short %} security updates only suggests a change where it can directly "fix" the dependency, that is, when these are:
|
||||
{% data variables.product.prodname_dependabot_alerts %} advise you about dependencies you should update, including transitive dependencies, where the version can be determined from a manifest or a lockfile. {% data variables.product.prodname_dependabot %} security updates only suggests a change where it can directly "fix" the dependency, that is, when these are:
|
||||
* Direct dependencies explicitly declared in a manifest or lockfile
|
||||
* Transitive dependencies declared in a lockfile
|
||||
|
||||
|
@ -51,21 +51,21 @@ Yes, the dependency graph has two categories of limits:
|
|||
|
||||
1. **Processing limits**
|
||||
|
||||
These affect the dependency graph displayed within {% data variables.product.prodname_dotcom %} and also prevent {% data variables.product.prodname_dependabot_short %} alerts being created.
|
||||
These affect the dependency graph displayed within {% data variables.product.prodname_dotcom %} and also prevent {% data variables.product.prodname_dependabot_alerts %} being created.
|
||||
|
||||
Manifests over 0.5 MB in size are only processed for enterprise accounts. For other accounts, manifests over 0.5 MB are ignored and will not create {% data variables.product.prodname_dependabot_short %} alerts.
|
||||
Manifests over 0.5 MB in size are only processed for enterprise accounts. For other accounts, manifests over 0.5 MB are ignored and will not create {% data variables.product.prodname_dependabot_alerts %}.
|
||||
|
||||
By default, {% data variables.product.prodname_dotcom %} will not process more than 20 manifests per repository. {% data variables.product.prodname_dependabot_short %} alerts are not be created for manifests beyond this limit. If you need to increase the limit, contact {% data variables.contact.contact_support %}.
|
||||
By default, {% data variables.product.prodname_dotcom %} will not process more than 20 manifests per repository. {% data variables.product.prodname_dependabot_alerts %} are not be created for manifests beyond this limit. If you need to increase the limit, contact {% data variables.contact.contact_support %}.
|
||||
|
||||
2. **Visualization limits**
|
||||
|
||||
These affect what's displayed in the dependency graph within {% data variables.product.prodname_dotcom %}. However, they don't affect the {% data variables.product.prodname_dependabot_short %} alerts that are created.
|
||||
These affect what's displayed in the dependency graph within {% data variables.product.prodname_dotcom %}. However, they don't affect the {% data variables.product.prodname_dependabot_alerts %} that are created.
|
||||
|
||||
The Dependencies view of the dependency graph for a repository only displays 100 manifests. Typically this is adequate as it is significantly higher than the processing limit described above. In situations where the processing limit is over 100, {% data variables.product.prodname_dependabot_short %} alerts are still created for any manifests that are not shown within {% data variables.product.prodname_dotcom %}.
|
||||
The Dependencies view of the dependency graph for a repository only displays 100 manifests. Typically this is adequate as it is significantly higher than the processing limit described above. In situations where the processing limit is over 100, {% data variables.product.prodname_dependabot_alerts %} are still created for any manifests that are not shown within {% data variables.product.prodname_dotcom %}.
|
||||
|
||||
**Check**: Is the missing dependency in a manifest file that's over 0.5 MB, or in a repository with a large number of manifests?
|
||||
|
||||
### Does {% data variables.product.prodname_dependabot_short %} generate alerts for vulnerabilities that have been known for many years?
|
||||
### Does {% data variables.product.prodname_dependabot %} generate alerts for vulnerabilities that have been known for many years?
|
||||
|
||||
The {% data variables.product.prodname_advisory_database %} was launched in November 2019, and initially back-filled to include vulnerability information for the supported ecosystems, starting from 2017. When adding CVEs to the database, we prioritize curating newer CVEs, and CVEs affecting newer versions of software.
|
||||
|
||||
|
@ -77,19 +77,19 @@ Some information on older vulnerabilities is available, especially where these C
|
|||
|
||||
Some third-party tools use uncurated CVE data that isn't checked or filtered by a human. This means that CVEs with tagging or severity errors, or other quality issues, will cause more frequent, more noisy, and less useful alerts.
|
||||
|
||||
Since {% data variables.product.prodname_dependabot_short %} uses curated data in the {% data variables.product.prodname_advisory_database %}, the volume of alerts may be lower, but the alerts you do receive will be accurate and relevant.
|
||||
Since {% data variables.product.prodname_dependabot %} uses curated data in the {% data variables.product.prodname_advisory_database %}, the volume of alerts may be lower, but the alerts you do receive will be accurate and relevant.
|
||||
|
||||
### Does each dependency vulnerability generate a separate alert?
|
||||
|
||||
When a dependency has multiple vulnerabilities, only one aggregated alert is generated for that dependency, instead of one alert per vulnerability.
|
||||
|
||||
The {% data variables.product.prodname_dependabot_short %} alerts count in {% data variables.product.prodname_dotcom %} shows a total for the number of alerts, that is, the number of dependencies with vulnerabilities, not the number of vulnerabilities.
|
||||
The {% data variables.product.prodname_dependabot_alerts %} count in {% data variables.product.prodname_dotcom %} shows a total for the number of alerts, that is, the number of dependencies with vulnerabilities, not the number of vulnerabilities.
|
||||
|
||||
![{% data variables.product.prodname_dependabot_short %} alerts view](/assets/images/help/repository/dependabot-alerts-view.png)
|
||||
![{% data variables.product.prodname_dependabot_alerts %} view](/assets/images/help/repository/dependabot-alerts-view.png)
|
||||
|
||||
When you click to display the alert details, you can see how many vulnerabilities are included in the alert.
|
||||
|
||||
![Multiple vulnerabilities for a {% data variables.product.prodname_dependabot_short %} alert](/assets/images/help/repository/dependabot-vulnerabilities-number.png)
|
||||
![Multiple vulnerabilities for a {% data variables.product.prodname_dependabot %} alert](/assets/images/help/repository/dependabot-vulnerabilities-number.png)
|
||||
|
||||
**Check**: If there is a discrepancy in the totals you are seeing, check that you are not comparing alert numbers with vulnerability numbers.
|
||||
|
||||
|
@ -98,4 +98,4 @@ When you click to display the alert details, you can see how many vulnerabilitie
|
|||
- "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)"
|
||||
- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)"
|
||||
- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"
|
||||
- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors)"
|
||||
- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"
|
||||
|
|
|
@ -10,11 +10,11 @@ versions:
|
|||
---
|
||||
Your repository's {% data variables.product.prodname_dependabot %} alerts tab lists all open and closed {% data variables.product.prodname_dependabot_alerts %} and corresponding {% data variables.product.prodname_dependabot_security_updates %}. You can sort the list of alerts using the drop-down menu, and you can click into specific alerts for more details. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)."
|
||||
|
||||
You can enable automatic security updates for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)."
|
||||
You can enable automatic security updates for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)."
|
||||
|
||||
### About updates for vulnerable dependencies in your repository
|
||||
|
||||
{% data variables.product.product_name %} generates {% data variables.product.prodname_dependabot_alerts %} when we detect vulnerabilities affecting your repository. For repositories where {% data variables.product.prodname_dependabot_security_updates %} are enabled, when {% data variables.product.product_name %} detects a vulnerable dependency {% data variables.product.prodname_dependabot_short %} creates a pull request to fix it. The pull request will upgrade the dependency to the minimum possible secure version needed to avoid the vulnerability.
|
||||
{% data variables.product.product_name %} generates {% data variables.product.prodname_dependabot_alerts %} when we detect vulnerabilities affecting your repository. For repositories where {% data variables.product.prodname_dependabot_security_updates %} are enabled, when {% data variables.product.product_name %} detects a vulnerable dependency {% data variables.product.prodname_dependabot %} creates a pull request to fix it. The pull request will upgrade the dependency to the minimum possible secure version needed to avoid the vulnerability.
|
||||
|
||||
### Viewing and updating vulnerable dependencies
|
||||
|
||||
|
@ -24,16 +24,16 @@ You can enable automatic security updates for any repository that uses {% data v
|
|||
1. Click the alert you'd like to view.
|
||||
![Alert selected in list of alerts](/assets/images/help/graphs/click-alert-in-alerts-list.png)
|
||||
1. Review the details of the vulnerability and, if available, the pull request containing the automated security update.
|
||||
1. Optionally, if there isn't already a {% data variables.product.prodname_dependabot_security_updates %} update for the alert, to create a pull request to resolve the vulnerability, click **Create {% data variables.product.prodname_dependabot_short %} security update**.
|
||||
![Create {% data variables.product.prodname_dependabot_short %} security update button](/assets/images/help/repository/create-dependabot-security-update-button.png)
|
||||
1. When you're ready to update your dependency and resolve the vulnerability, merge the pull request. Each pull request raised by {% data variables.product.prodname_dependabot_short %} includes information on commands you can use to control {% data variables.product.prodname_dependabot_short %}. For more information, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates#managing-github-dependabot-pull-requests-with-comment-commands)."
|
||||
1. Optionally, if there isn't already a {% data variables.product.prodname_dependabot_security_updates %} update for the alert, to create a pull request to resolve the vulnerability, click **Create {% data variables.product.prodname_dependabot %} security update**.
|
||||
![Create {% data variables.product.prodname_dependabot %} security update button](/assets/images/help/repository/create-dependabot-security-update-button.png)
|
||||
1. When you're ready to update your dependency and resolve the vulnerability, merge the pull request. Each pull request raised by {% data variables.product.prodname_dependabot %} includes information on commands you can use to control {% data variables.product.prodname_dependabot %}. For more information, see "[Managing pull requests for dependency updates](/github/administering-a-repository/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands)."
|
||||
1. Optionally, if the alert is being fixed, if it's incorrect, or located in unused code, use the "Dismiss" drop-down, and click a reason for dismissing the alert.
|
||||
![Choosing reason for dismissing the alert via the "Dismiss" drop-down](/assets/images/help/repository/dependabot-alert-dismiss-drop-down.png)
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)"
|
||||
- "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)"
|
||||
- "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)"
|
||||
- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"
|
||||
- "[Troubleshooting the detection of vulnerable dependencies](/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies)"
|
||||
- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors)"
|
||||
- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"
|
||||
|
|
|
@ -121,7 +121,7 @@ Email notifications from {% data variables.product.product_name %} contain the f
|
|||
3. On the notifications settings page, choose how you receive notifications when:
|
||||
- There are updates in repositories or team discussions you're watching or in a conversation you're participating in. For more information, see "[About participating and watching notifications](#about-participating-and-watching-notifications)."
|
||||
- You gain access to a new repository or you've joined a new team. For more information, see "[Automatic watching](#automatic-watching)."{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
- There are new {% data variables.product.prodname_dependabot_alerts %} in your repository. For more information, see "[{% data variables.product.prodname_dependabot_alerts %} notification options](#github-dependabot-alerts-notification-options)." {% endif %}{% if currentVersion == "enterprise-server@2.21" %}
|
||||
- There are new {% data variables.product.prodname_dependabot_alerts %} in your repository. For more information, see "[{% data variables.product.prodname_dependabot_alerts %} notification options](#dependabot-alerts-notification-options)." {% endif %}{% if currentVersion == "enterprise-server@2.21" %}
|
||||
- There are new security alerts in your repository. For more information, see "[Security alert notification options](#security-alert-notification-options)." {% endif %} {% if currentVersion == "free-pro-team@latest" %}
|
||||
- There are workflow runs updates on repositories set up with {% data variables.product.prodname_actions %}. For more information, see "[{% data variables.product.prodname_actions %} notification options](#github-actions-notification-options)."{% endif %}
|
||||
|
||||
|
|
|
@ -113,7 +113,7 @@ To filter notifications by why you've received an update, you can use the `reaso
|
|||
|
||||
#### Supported `is:` queries
|
||||
|
||||
To filter notifications for specific activity on {% data variables.product.product_name %}, you can use the `is` query. For example, to only see repository invitation updates, use `is:repository-invitation`{% if currentVersion != "github-ae@latest" %}, and to only see {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %} security{% endif %} alerts, use `is:repository-vulnerability-alert`.{% endif %}
|
||||
To filter notifications for specific activity on {% data variables.product.product_name %}, you can use the `is` query. For example, to only see repository invitation updates, use `is:repository-invitation`{% if currentVersion != "github-ae@latest" %}, and to only see {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %} security{% endif %} alerts, use `is:repository-vulnerability-alert`.{% endif %}
|
||||
|
||||
- `is:check-suite`
|
||||
- `is:commit`
|
||||
|
|
|
@ -64,7 +64,7 @@ Organization members can have *owner*{% if currentVersion == "free-pro-team@late
|
|||
| Purchase, install, manage billing for, and cancel {% data variables.product.prodname_marketplace %} apps | **X** | | |
|
||||
| List apps in {% data variables.product.prodname_marketplace %} | **X** | | |{% if currentVersion != "github-ae@latest" %}
|
||||
| Receive [{% data variables.product.prodname_dependabot_alerts %} about vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies) for all of an organization's repositories | **X** | | |
|
||||
| Manage {% data variables.product.prodname_dependabot_security_updates %} (see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-github-dependabot-security-updates)") | **X** | | |{% endif %}
|
||||
| Manage {% data variables.product.prodname_dependabot_security_updates %} (see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)") | **X** | | |{% endif %}
|
||||
| [Manage the forking policy](/github/setting-up-and-managing-organizations-and-teams/managing-the-forking-policy-for-your-organization) | **X** | | |
|
||||
| [Limit activity in public repositories in an organization](/articles/limiting-interactions-in-your-organization) | **X** | | |
|
||||
| Pull (read), push (write), and clone (copy) *all repositories* in the organization | **X** | | |
|
||||
|
|
|
@ -47,7 +47,7 @@ To search for specific events, use the `action` qualifier in your query. Actions
|
|||
| `repo` | Contains all activities related to the repositories owned by your organization.{% if currentVersion == "free-pro-team@latest" %}
|
||||
| `repository_content_analysis` | Contains all activities related to [enabling or disabling data use for a private repository](/articles/about-github-s-use-of-your-data).
|
||||
| `repository_dependency_graph` | Contains all activities related to [enabling or disabling the dependency graph for a private repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-and-dependents-of-a-repository).{% endif %}{% if currentVersion != "github-ae@latest" %}
|
||||
| `repository_vulnerability_alert` | Contains all activities related to [{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies).{% endif %}{% if currentVersion == "free-pro-team@latest" %}
|
||||
| `repository_vulnerability_alert` | Contains all activities related to [{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies).{% endif %}{% if currentVersion == "free-pro-team@latest" %}
|
||||
| `sponsors` | Contains all events related to sponsor buttons (see "[Displaying a sponsor button in your repository](/articles/displaying-a-sponsor-button-in-your-repository)"){% endif %}{% if enterpriseServerVersions contains currentVersion or currentVersion == "github-ae@latest" %}
|
||||
| `team` | Contains all activities related to teams in your organization.{% endif %}
|
||||
| `team_discussions` | Contains activities related to managing team discussions for an organization.
|
||||
|
@ -354,10 +354,10 @@ For more information, see "[Restricting publication of {% data variables.product
|
|||
|
||||
| Action | Description
|
||||
|------------------|-------------------
|
||||
| `create` | Triggered when {% data variables.product.product_name %} creates a [{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alert for a vulnerable dependency](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies) in a particular repository.
|
||||
| `create` | Triggered when {% data variables.product.product_name %} creates a [{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alert for a vulnerable dependency](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies) in a particular repository.
|
||||
| `resolve` | Triggered when someone with write access to a repository [pushes changes to update and resolve a vulnerability](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies) in a project dependency.
|
||||
| `dismiss` | Triggered when an organization owner or person with admin access to the repository dismisses a {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alert about a vulnerable dependency.{% if currentVersion == "free-pro-team@latest" %}
|
||||
| `authorized_users_teams` | Triggered when an organization owner or a member with admin permissions to the repository [updates the list of people or teams authorized to receive {% data variables.product.prodname_dependabot_short %} alerts](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-github-dependabot-alerts) for vulnerable dependencies in the repository.{% endif %}
|
||||
| `dismiss` | Triggered when an organization owner or person with admin access to the repository dismisses a {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alert about a vulnerable dependency.{% if currentVersion == "free-pro-team@latest" %}
|
||||
| `authorized_users_teams` | Triggered when an organization owner or a member with admin permissions to the repository [updates the list of people or teams authorized to receive {% data variables.product.prodname_dependabot_alerts %}](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-dependabot-alerts) for vulnerable dependencies in the repository.{% endif %}
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
|
|
|
@ -10,7 +10,7 @@ versions:
|
|||
|
||||
### About data use for your private repository
|
||||
|
||||
When you enable data use for your private repository, you'll be able to access the dependency graph, where you can track your repository's dependencies and receive {% data variables.product.prodname_dependabot_short %} alerts when {% data variables.product.product_name %} detects vulnerable dependencies. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#github-dependabot-alerts-for-vulnerable-dependencies)."
|
||||
When you enable data use for your private repository, you'll be able to access the dependency graph, where you can track your repository's dependencies and receive {% data variables.product.prodname_dependabot_alerts %} when {% data variables.product.product_name %} detects vulnerable dependencies. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)."
|
||||
|
||||
### Enabling or disabling data use features
|
||||
|
||||
|
|
|
@ -47,7 +47,7 @@ You can use the dependency graph to:
|
|||
|
||||
{% if currentVersion == "free-pro-team@latest" %}To generate a dependency graph, {% data variables.product.product_name %} needs read-only access to the dependency manifest and lock files for a repository. The dependency graph is automatically generated for all public repositories and you can choose to enable it for private repositories. For information about enabling or disabling it for private repositories, see "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)."{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21" %}If the dependency graph is not available in your system, your site administrator can enable the dependency graph and {% data variables.product.prodname_dependabot_short %} alerts. For more information, see "[Enabling alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %}
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21" %}If the dependency graph is not available in your system, your site administrator can enable the dependency graph and {% data variables.product.prodname_dependabot_alerts %}. For more information, see "[Enabling alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_lt "enterprise-server@2.22" %} If the dependency graph is not available in your system, your site administrator can enable the dependency graph and security alerts. For more information, see "[Enabling alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."
|
||||
|
||||
|
|
|
@ -36,7 +36,7 @@ If vulnerabilities have been detected in the repository, these are shown at the
|
|||
{% endif %}
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
Any direct and indirect dependencies that are specified in the repository's manifest or lock files are listed, grouped by ecosystem. If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to {% data variables.product.prodname_dependabot_short %} alerts.
|
||||
Any direct and indirect dependencies that are specified in the repository's manifest or lock files are listed, grouped by ecosystem. If vulnerabilities have been detected in the repository, these are shown at the top of the view for users with access to {% data variables.product.prodname_dependabot_alerts %}.
|
||||
|
||||
{% note %}
|
||||
|
||||
|
|
|
@ -21,7 +21,7 @@ You can help people understand and use your package by providing a description a
|
|||
{% data reusables.package_registry.package-immutability %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
If a new version of a package fixes a security vulnerability, you should publish a security advisory in your repository. {% data variables.product.prodname_dotcom %} reviews each published security advisory and may use it to send {% data variables.product.prodname_dependabot_short %} alerts to affected repositories. For more information, see "[About GitHub Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
If a new version of a package fixes a security vulnerability, you should publish a security advisory in your repository. {% data variables.product.prodname_dotcom %} reviews each published security advisory and may use it to send {% data variables.product.prodname_dependabot_alerts %} to affected repositories. For more information, see "[About GitHub Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."
|
||||
{% endif %}
|
||||
|
||||
### Publishing a package
|
||||
|
|
|
@ -342,7 +342,7 @@ Microsoft Style Guide:
|
|||
|
||||
## Voice and tone
|
||||
|
||||
Use clear, simple language that’s approachable and accessible for a wide range of readers. For more information, see “[Voice](https://brand.github.com/content/voice/)” in GitHub’s Brand Guide. To learn more about writing approachable content, see “[Microsoft's brand voice: Above all, simple and human](https://docs.microsoft.com/en-us/style-guide/brand-voice-above-all-simple-human) and “[Top 10 tips for Microsoft style and voice](https://docs.microsoft.com/en-us/style-guide/top-10-tips-style-voice).”
|
||||
Use clear, simple language that’s approachable and accessible for a wide range of readers. For more information, see “[Voice](https://brand.github.com/content/voice)” in GitHub’s Brand Guide. To learn more about writing approachable content, see “[Microsoft's brand voice: Above all, simple and human](https://docs.microsoft.com/en-us/style-guide/brand-voice-above-all-simple-human) and “[Top 10 tips for Microsoft style and voice](https://docs.microsoft.com/en-us/style-guide/top-10-tips-style-voice).”
|
||||
|
||||
## Word choice and terminology
|
||||
|
||||
|
|
|
@ -1,2 +1,2 @@
|
|||
4. Under "Dependency graph", click **{% data variables.product.prodname_dependabot_short %}**.
|
||||
![Dependency graph, {% data variables.product.prodname_dependabot_short %} tab](/assets/images/help/dependabot/dependabot-tab-beta.png)
|
||||
4. Under "Dependency graph", click **{% data variables.product.prodname_dependabot %}**.
|
||||
![Dependency graph, {% data variables.product.prodname_dependabot %} tab](/assets/images/help/dependabot/dependabot-tab-beta.png)
|
||||
|
|
|
@ -1 +1 @@
|
|||
By default, {% data variables.product.prodname_dependabot %} raises all pull requests with the `dependencies` label. If more than one package manager is defined, {% data variables.product.prodname_dependabot_short %} includes an additional label on each pull request. This indicates which language or ecosystem the pull request will update, for example: `java` for Gradle updates and `submodules` for git submodule updates. {% data variables.product.prodname_dependabot %} creates these default labels automatically, as necessary in your repository.
|
||||
By default, {% data variables.product.prodname_dependabot %} raises all pull requests with the `dependencies` label. If more than one package manager is defined, {% data variables.product.prodname_dependabot %} includes an additional label on each pull request. This indicates which language or ecosystem the pull request will update, for example: `java` for Gradle updates and `submodules` for git submodule updates. {% data variables.product.prodname_dependabot %} creates these default labels automatically, as necessary in your repository.
|
||||
|
|
|
@ -1,3 +1,3 @@
|
|||
When you first enable version updates, you may have many dependencies that are outdated and some may be many versions behind the latest version. {% data variables.product.prodname_dependabot %} checks for outdated dependencies as soon as it's enabled. You may see new pull requests for version updates within minutes of adding the configuration file, depending on the number of manifest files for which you configure updates.
|
||||
|
||||
To keep pull requests manageable and easy to review, {% data variables.product.prodname_dependabot_short %} raises a maximum of five pull requests to start bringing dependencies up to the latest version. If you merge some of these first pull requests before the next scheduled update, then further pull requests are opened up to a maximum of five (you can change this limit).
|
||||
To keep pull requests manageable and easy to review, {% data variables.product.prodname_dependabot %} raises a maximum of five pull requests to start bringing dependencies up to the latest version. If you merge some of these first pull requests before the next scheduled update, then further pull requests are opened up to a maximum of five (you can change this limit).
|
||||
|
|
|
@ -1 +1 @@
|
|||
Currently, {% data variables.product.prodname_dependabot_version_updates %} doesn't support manifest or lock files that contain any private git dependencies or private git registries. This is because, when running version updates, {% data variables.product.prodname_dependabot_short %} must be able to resolve all dependencies from their source to verify that version updates have been successful.
|
||||
Currently, {% data variables.product.prodname_dependabot_version_updates %} doesn't support manifest or lock files that contain any private git dependencies or private git registries. This is because, when running version updates, {% data variables.product.prodname_dependabot %} must be able to resolve all dependencies from their source to verify that version updates have been successful.
|
||||
|
|
|
@ -1 +1 @@
|
|||
{% data variables.product.prodname_dependabot %} raises pull requests to update dependencies. Depending on how your repository is configured, {% data variables.product.prodname_dependabot_short %} may raise pull requests for version updates and/or for security updates. You manage these pull requests in the same way as any other pull request, but there are also some extra commands available. For information about enabling {% data variables.product.prodname_dependabot %} dependency updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)" and "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
||||
{% data variables.product.prodname_dependabot %} raises pull requests to update dependencies. Depending on how your repository is configured, {% data variables.product.prodname_dependabot %} may raise pull requests for version updates and/or for security updates. You manage these pull requests in the same way as any other pull request, but there are also some extra commands available. For information about enabling {% data variables.product.prodname_dependabot %} dependency updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)" and "[Enabling and disabling version updates](/github/administering-a-repository/enabling-and-disabling-version-updates)."
|
|
@ -18,12 +18,12 @@ Terraform: `terraform` |
|
|||
|
||||
{% note %}
|
||||
|
||||
**Note**: {% data variables.product.prodname_dependabot_short %} also supports the following package managers:
|
||||
**Note**: {% data variables.product.prodname_dependabot %} also supports the following package managers:
|
||||
|
||||
-`yarn` (v1 only) (specify `npm`)
|
||||
|
||||
-`pipenv`, `pip-compile`, and `poetry` (specify `pip`)
|
||||
|
||||
For example, if you use `poetry` to manage your Python dependencies and want {% data variables.product.prodname_dependabot_short %} to monitor your dependency manifest file for new versions, use `package-ecosystem: "pip"` in your *dependabot.yml* file.
|
||||
For example, if you use `poetry` to manage your Python dependencies and want {% data variables.product.prodname_dependabot %} to monitor your dependency manifest file for new versions, use `package-ecosystem: "pip"` in your *dependabot.yml* file.
|
||||
|
||||
{% endnote %}
|
||||
|
|
|
@ -1 +1 @@
|
|||
You can also enable {% data variables.product.prodname_dependabot_version_updates %} for the actions that you add to your workflow. For more information, see "[Keeping your actions up to date with {% data variables.product.prodname_dependabot %}](/github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot)."
|
||||
You can also enable {% data variables.product.prodname_dependabot_version_updates %} for the actions that you add to your workflow. For more information, see "[Keeping your actions up to date with {% data variables.product.prodname_dependabot %}](/github/administering-a-repository/keeping-your-actions-up-to-date-with-dependabot)."
|
||||
|
|
|
@ -0,0 +1,2 @@
|
|||
You can re-request a review, for example, after you've made substantial changes to your pull request.
|
||||
To request a fresh review from a reviewer, in the sidebar of the **Conversation** tab, click the {% octicon "sync" aria-label="The sync icon" %} icon.
|
|
@ -1,3 +1,3 @@
|
|||
{% if enterpriseServerVersions contains currentVersion %}
|
||||
Your site administrator must enable {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %}security{% endif %} alerts for vulnerable dependencies for {% data variables.product.product_location %} before you can use this feature. For more information, see "[Enabling alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."
|
||||
Your site administrator must enable {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot %}{% else %}security{% endif %} alerts for vulnerable dependencies for {% data variables.product.product_location %} before you can use this feature. For more information, see "[Enabling alerts for vulnerable dependencies on {% data variables.product.prodname_ghe_server %}](/enterprise/{{ currentVersion }}/admin/configuration/enabling-alerts-for-vulnerable-dependencies-on-github-enterprise-server)."
|
||||
{% endif %}
|
||||
|
|
|
@ -1,2 +1,2 @@
|
|||
1. In the security sidebar, click **{% data variables.product.prodname_dependabot_short %} alerts**.
|
||||
![{% data variables.product.prodname_dependabot_short %} alerts tab](/assets/images/help/repository/dependabot-alerts-tab.png)
|
||||
1. In the security sidebar, click **{% data variables.product.prodname_dependabot_alerts %}**.
|
||||
![{% data variables.product.prodname_dependabot_alerts %} tab](/assets/images/help/repository/dependabot-alerts-tab.png)
|
||||
|
|
|
@ -26,8 +26,9 @@ homepage:
|
|||
version_picker: Version
|
||||
toc:
|
||||
getting_started: Getting started
|
||||
popular_articles: Popular articles
|
||||
popular_articles: Popular
|
||||
guides: Guides
|
||||
whats_new: What's new
|
||||
pages:
|
||||
article_version: "Article version:"
|
||||
miniToc: In this article
|
||||
|
@ -129,3 +130,6 @@ footer:
|
|||
careers: Careers
|
||||
press: Press
|
||||
shop: Shop
|
||||
product_landing:
|
||||
quick_start: Quickstart
|
||||
reference_guides: Reference guides
|
|
@ -150,11 +150,10 @@ prodname_vss_ghe: 'Visual Studio subscription with GitHub Enterprise'
|
|||
prodname_vss_admin_portal_with_url: 'the [administrator portal for Visual Studio subscriptions](https://visualstudio.microsoft.com/subscriptions-administration/)'
|
||||
|
||||
# GitHub Dependabot
|
||||
prodname_dependabot: 'GitHub Dependabot'
|
||||
prodname_dependabot_short: 'Dependabot'
|
||||
prodname_dependabot_alerts: 'GitHub Dependabot alerts'
|
||||
prodname_dependabot_security_updates: 'GitHub Dependabot security updates'
|
||||
prodname_dependabot_version_updates: 'GitHub Dependabot version updates'
|
||||
prodname_dependabot: 'Dependabot'
|
||||
prodname_dependabot_alerts: 'Dependabot alerts'
|
||||
prodname_dependabot_security_updates: 'Dependabot security updates'
|
||||
prodname_dependabot_version_updates: 'Dependabot version updates'
|
||||
|
||||
# GitHub Archive Program
|
||||
prodname_archive: 'GitHub Archive Program'
|
||||
|
|
|
@ -20,7 +20,7 @@
|
|||
<div class="col-6 col-sm-3 col-lg-2 mb-6 mb-md-2 pr-3 pr-md-0 pl-md-4">
|
||||
<h4 class="mb-3 text-mono text-gray-light text-normal">{% data ui.footer.platform.heading %}</h4>
|
||||
<ul class="list-style-none f5">
|
||||
<li class="lh-condensed mb-3"><a href="https://developer.github.com/" class="link-gray">{% data ui.footer.platform.links.developer_api %}</a></li>
|
||||
<li class="lh-condensed mb-3"><a href="/developers" class="link-gray">{% data ui.footer.platform.links.developer_api %}</a></li>
|
||||
<li class="lh-condensed mb-3"><a href="http://partner.github.com/" class="link-gray">{% data ui.footer.platform.links.partners %}</a></li>
|
||||
<li class="lh-condensed mb-3"><a href="https://atom.io" class="link-gray">{% data ui.footer.platform.links.atom %}</a></li>
|
||||
<li class="lh-condensed mb-3"><a href="http://electron.atom.io/" class="link-gray">{% data ui.footer.platform.links.electron %}</a></li>
|
||||
|
@ -87,4 +87,4 @@
|
|||
</div>
|
||||
</div>
|
||||
|
||||
<script src="/dist/index.js"></script>
|
||||
{% include scripts %}
|
||||
|
|
|
@ -122,9 +122,7 @@
|
|||
<li><a href="{{ restGitHubAppsLink }}">Works with GitHub Apps</a></li>
|
||||
{% endif %}
|
||||
{% for note in operation.notes %}
|
||||
{% unless note == '<a href="{{ restGitHubAppsLink }}">Works with GitHub Apps</a>' %}
|
||||
<li>{{ note }}</li>
|
||||
{% endunless %}
|
||||
<li>{{ note }}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
{% endif %}
|
||||
|
|
|
@ -0,0 +1 @@
|
|||
<script src="/dist/index.js"></script>
|
|
@ -0,0 +1,23 @@
|
|||
<footer class="py-6 text-small">
|
||||
<div class="container-xl d-flex px-3 px-md-6">
|
||||
<div class="d-flex text-gray mr-3">
|
||||
{% octicon "mark-github" height="20" class="mr-3" %}
|
||||
<span>{{ "now" | date: "%Y" }} GitHub, Inc.</span>
|
||||
</div>
|
||||
|
||||
<ul class="d-flex list-style-none">
|
||||
<li class="ml-3"><a href="/github/site-policy/github-terms-of-service">{% data ui.footer.terms %} </a></li>
|
||||
<li class="ml-3"><a href="/github/site-policy/github-privacy-statement">{% data ui.footer.privacy %} </a></li>
|
||||
<li class="ml-3"><a href="https://github.com/security">{% data ui.footer.product.links.security %}</a></li>
|
||||
<li class="ml-3"><a href="https://githubstatus.com/">{% data ui.footer.support.links.status %}</a></li>
|
||||
<li class="ml-3"><a href="/">{% data ui.footer.support.links.help %}</a></li>
|
||||
<li class="ml-3"><a href="https://support.github.com/contact">{% data ui.footer.support.links.contact_github %}</a></li>
|
||||
<li class="ml-3"><a href="https://github.com/pricing">{% data ui.footer.product.links.pricing %}</a></li>
|
||||
<li class="ml-3"><a href="/developers">{% data ui.footer.platform.links.developer_api %}</a></li>
|
||||
<li class="ml-3"><a href="https://services.github.com/">{% data ui.footer.support.links.training %}</a></li>
|
||||
<li class="ml-3"><a href="https://github.com/about">{% data ui.footer.company.links.about %}</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
{% include scripts %}
|
|
@ -5,8 +5,9 @@ const algoliasearch = require('algoliasearch')
|
|||
const searchWithYourKeyboard = require('search-with-your-keyboard')
|
||||
const querystring = require('querystring')
|
||||
const truncate = require('html-truncate')
|
||||
const patterns = require('../lib/patterns')
|
||||
const languages = require('../lib/languages')
|
||||
const allVersions = require('../lib/all-versions')
|
||||
const nonEnterpriseDefaultVersion = require('../lib/non-enterprise-default-version')
|
||||
|
||||
const languageCodes = Object.keys(languages)
|
||||
const maxContentLength = 300
|
||||
|
@ -272,11 +273,15 @@ function deriveLanguageCodeFromPath () {
|
|||
return languageCode
|
||||
}
|
||||
|
||||
// TODO use the new versions once we update the index names
|
||||
// note we can't use the old-versions-utils or path-utils
|
||||
// to derive these values because they require modules that use fs :/
|
||||
function deriveVersionFromPath () {
|
||||
const enterpriseRegex = patterns.getEnterpriseServerNumber
|
||||
const enterprise = location.pathname.match(enterpriseRegex)
|
||||
return enterprise ? enterprise[1] : 'dotcom'
|
||||
// fall back to the non-enterprise default version (FPT currently) on the homepage, 404 page, etc.
|
||||
const version = location.pathname.split('/')[2] || nonEnterpriseDefaultVersion
|
||||
const versionObject = allVersions[version] || allVersions[nonEnterpriseDefaultVersion]
|
||||
|
||||
// if GHES, returns the release number like 2.21, 2.22, etc.
|
||||
// if FPT, returns 'dotcom'
|
||||
// if GHAE, returns 'ghae'
|
||||
return versionObject.plan === 'enterprise-server'
|
||||
? versionObject.currentRelease
|
||||
: versionObject.miscBaseName
|
||||
}
|
||||
|
|
|
@ -14,7 +14,7 @@
|
|||
{% include article %}
|
||||
{% endif %}
|
||||
{% include support %}
|
||||
{% include footer %}
|
||||
{% include small-footer %}
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
@ -32,7 +32,7 @@
|
|||
|
||||
<!-- {{ content }} -->
|
||||
{% include support %}
|
||||
{% include footer %}
|
||||
{% include small-footer %}
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
@ -22,6 +22,6 @@
|
|||
|
||||
<!-- {{ content }} -->
|
||||
{% include support %}
|
||||
{% include footer %}
|
||||
{% include small-footer %}
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
@ -15,22 +15,67 @@
|
|||
<h1 class="mb-3 font-mktg">{{ page.shortTitle }}</h1>
|
||||
<div class="lead-mktg text-gray">{{ page.intro }}</div>
|
||||
|
||||
<a href="{{ page.introLinks.quickstart }}" class="btn btn-large f4 btn-blue mt-3">
|
||||
Quickstart
|
||||
<a href="{{ page.introLinks.quickstart }}" class="btn-mktg btn-large f4 mt-3">
|
||||
{% data ui.product_landing.quick_start %}
|
||||
</a>
|
||||
|
||||
<a href="{{ page.introLinks.learn }}" class="ml-3 btn btn-large f4 btn-outline mt-3">
|
||||
Learn {% data variables.product.prodname_actions %}
|
||||
<a href="{{ page.introLinks.reference }}" class="ml-3 btn-mktg btn-outline-mktg btn-large f4 mt-3">
|
||||
{% data ui.product_landing.reference_guides %}
|
||||
</a>
|
||||
</div>
|
||||
</header>
|
||||
|
||||
<!-- Article links -->
|
||||
<div class="d-lg-flex gutter my-6 py-6">
|
||||
<div class="col-12 col-lg-4 mb-4 mb-lg-0">
|
||||
<div class="featured-links-heading pb-3 mb-4 border-bottom">
|
||||
<h3 class="f5 text-normal text-mono text-uppercase color-gray-5">{% data ui.toc.guides %}</h3>
|
||||
</div>
|
||||
<ul class="list-style-none">
|
||||
{% for link in featuredLinks.guides %}
|
||||
<li class="Box px-3 py-1 mb-2">
|
||||
{% include featured-link %}
|
||||
</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<div class="col-12 col-lg-4 mb-4 mb-lg-0">
|
||||
<div class="featured-links-heading pb-3 mb-4 border-bottom">
|
||||
<h3 class="f5 text-normal text-mono text-uppercase color-gray-5">{% data ui.toc.popular_articles %}</h3>
|
||||
</div>
|
||||
<ul class="list-style-none">
|
||||
{% for link in featuredLinks.popular %}
|
||||
<li class="Box px-3 py-1 mb-2">
|
||||
{% include featured-link %}
|
||||
</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<div class="col-12 col-lg-4 mb-4 mb-lg-0">
|
||||
<div class="featured-links-heading pb-3 mb-4 border-bottom">
|
||||
<h3 class="f5 text-normal text-mono text-uppercase color-gray-5">{% data ui.toc.whats_new %}</h3>
|
||||
</div>
|
||||
<ul class="list-style-none">
|
||||
{% for link in page.changelog %}
|
||||
<li class="mb-2">
|
||||
<a href="{{ link.href }}" class="Box text-gray-dark Bump-link--hover p-3 d-flex flex-justify-between flex-items-center no-underline">
|
||||
<h4>{{ link.title }} <span class="Bump-link-symbol">→</span></h4>
|
||||
<span class="text-gray-light text-mono ml-2" style="white-space: nowrap">{{ link.date | date: "%B %d, %Y" }}</span>
|
||||
</a>
|
||||
</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{{ renderedPage }}
|
||||
</div>
|
||||
|
||||
|
||||
{% include support %}
|
||||
{% include footer %}
|
||||
<div class="border-top">
|
||||
{% include small-footer %}
|
||||
</div>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
@ -9,10 +9,7 @@ const findIndexablePages = require('./find-indexable-pages')
|
|||
const getRemoteIndexNames = require('./get-remote-index-names')
|
||||
const Index = require('./search-index')
|
||||
const cacheDir = path.join(process.cwd(), './.algolia-cache')
|
||||
const { getOldVersionFromNewVersion } = require('../old-versions-utils')
|
||||
|
||||
// TODO need to update this to the new versions in coordination with the index filenames
|
||||
const allVersions = Object.keys(require('../all-versions'))
|
||||
const allVersions = require('../all-versions')
|
||||
|
||||
// Build a search data file for every combination of product version and language
|
||||
// e.g. `github-docs-dotcom-en.json` and `github-docs-2.14-ja.json`
|
||||
|
@ -28,10 +25,16 @@ module.exports = async function syncAlgoliaIndices (opts = {}) {
|
|||
|
||||
// Build and validate all indices
|
||||
for (const languageCode in languages) {
|
||||
for (const pageVersion of allVersions) {
|
||||
// TODO update to new versions in coordination with the index filenames
|
||||
// For now, the index filename is still github-docs-dotcom-en, github-docs-2.22-en
|
||||
const indexName = `${Index.namePrefix}-${getOldVersionFromNewVersion(pageVersion)}-${languageCode}`
|
||||
for (const pageVersion in allVersions) {
|
||||
// if GHES, resolves to the release number like 2.21, 2.22, etc.
|
||||
// if FPT, resolves to 'dotcom'
|
||||
// if GHAE, resolves to 'ghae'
|
||||
const indexVersion = allVersions[pageVersion].plan === 'enterprise-server'
|
||||
? allVersions[pageVersion].currentRelease
|
||||
: allVersions[pageVersion].miscBaseName
|
||||
|
||||
// github-docs-dotcom-en, github-docs-2.22-en
|
||||
const indexName = `${Index.namePrefix}-${indexVersion}-${languageCode}`
|
||||
|
||||
// The page version will be the new version, e.g., free-pro-team@latest, enterprise-server@2.22
|
||||
const records = await buildRecords(indexName, indexablePages, pageVersion, languageCode)
|
||||
|
|
|
@ -59,7 +59,7 @@ const schema = {
|
|||
type: 'object',
|
||||
properties: {
|
||||
quickstart: { type: 'string' },
|
||||
learn: { type: 'string' }
|
||||
reference: { type: 'string' }
|
||||
}
|
||||
},
|
||||
featuredLinks: {
|
||||
|
@ -71,6 +71,18 @@ const schema = {
|
|||
items: { type: 'string' }
|
||||
}
|
||||
}
|
||||
},
|
||||
// Shown in `product-landing.html` "What's new" section
|
||||
changelog: {
|
||||
type: 'array',
|
||||
items: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
title: { type: 'string' },
|
||||
date: { type: 'string', format: 'date' },
|
||||
href: { type: 'string' }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -1,11 +1,11 @@
|
|||
const { v4: uuidv4 } = require('uuid')
|
||||
const { inRange } = require('lodash')
|
||||
|
||||
module.exports = function (req, res, next) {
|
||||
if (!req.hydro.maySend()) return next()
|
||||
|
||||
res.on('finish', async function recordRedirect () {
|
||||
if (!inRange(res.statusCode, 300, 400)) return
|
||||
// We definitely don't want 304
|
||||
if (![301, 302, 303, 307, 308].includes(res.statusCode)) return
|
||||
const schemaName = req.hydro.schemas.redirect
|
||||
const redirectEvent = {
|
||||
context: {
|
||||
|
|
|
@ -37,7 +37,7 @@ describe('algolia browser search', () => {
|
|||
expect(hits.length).toBeGreaterThan(5)
|
||||
})
|
||||
|
||||
it('sends the correct data to algolia', async () => {
|
||||
it('sends the correct data to algolia for Enterprise Server', async () => {
|
||||
const newPage = await browser.newPage()
|
||||
await newPage.goto('http://localhost:4001/ja/enterprise/2.22/admin/installation')
|
||||
|
||||
|
@ -60,6 +60,29 @@ describe('algolia browser search', () => {
|
|||
await newPage.type('#search-input-container input[type="search"]', 'test')
|
||||
})
|
||||
|
||||
it('sends the correct data to algolia for GHAE', async () => {
|
||||
const newPage = await browser.newPage()
|
||||
await newPage.goto('http://localhost:4001/en/github-ae@latest/admin/overview')
|
||||
|
||||
await newPage.setRequestInterception(true)
|
||||
newPage.on('request', interceptedRequest => {
|
||||
if (interceptedRequest.method() === 'POST' && /algolia/i.test(interceptedRequest.url())) {
|
||||
const data = JSON.parse(interceptedRequest.postData())
|
||||
const { indexName, params } = data.requests[0]
|
||||
const parsedParams = querystring.parse(params)
|
||||
const analyticsTags = JSON.parse(parsedParams.analyticsTags)
|
||||
expect(indexName).toBe('github-docs-ghae-en')
|
||||
expect(analyticsTags).toHaveLength(2)
|
||||
// browser tests are run against production build, so we are expecting env:production
|
||||
expect(analyticsTags).toEqual(expect.arrayContaining(['site:docs.github.com', 'env:production']))
|
||||
}
|
||||
interceptedRequest.continue()
|
||||
})
|
||||
|
||||
await newPage.click('#search-input-container input[type="search"]')
|
||||
await newPage.type('#search-input-container input[type="search"]', 'test')
|
||||
})
|
||||
|
||||
it('removes `algolia-query` query param after page load', async () => {
|
||||
await page.goto('http://localhost:4001/en?algolia-query=helpme')
|
||||
|
||||
|
|
|
@ -1,12 +1,13 @@
|
|||
const { getDOM } = require('../helpers')
|
||||
const enterpriseServerReleases = require('../../lib/enterprise-server-releases')
|
||||
const nonEnterpriseDefaultVersion = require('../../lib/non-enterprise-default-version')
|
||||
|
||||
describe('footer', () => {
|
||||
jest.setTimeout(10 * 60 * 1000)
|
||||
|
||||
describe('"contact us" link', () => {
|
||||
test('leads to dotcom support on dotcom pages', async () => {
|
||||
const $ = await getDOM('/en/actions')
|
||||
const $ = await getDOM(`/en/${nonEnterpriseDefaultVersion}/github`)
|
||||
expect($('a#contact-us').attr('href')).toBe('https://support.github.com/contact')
|
||||
})
|
||||
|
||||
|
|
|
@ -113,7 +113,7 @@ api.github.com
|
|||
*.actions.githubusercontent.com
|
||||
```
|
||||
|
||||
If you use an IP address allow list for your {% data variables.product.prodname_dotcom %} organization or enterprise account, you must add your self-hosted runner's IP address to the allow list. For more information, see "[Managing allowed IP addresses for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-allowed-ip-addresses-for-your-organization#using-github-actions-with-an-ip-allow-list)" or "[Enforcing security settings in your enterprise account](/github/setting-up-and-managing-your-enterprise-account/enforcing-security-settings-in-your-enterprise-account#using-github-actions-with-an-ip-allow-list)".
|
||||
If you use an IP address allow list for your {% data variables.product.prodname_dotcom %} organization or enterprise account, you must add your self-hosted runner's IP address to the allow list. For more information, see "[Managing allowed IP addresses for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-allowed-ip-addresses-for-your-organization#using-github-actions-with-an-ip-allow-list)" or "[Enforcing security settings in your enterprise account](/github/setting-up-and-managing-your-enterprise/enforcing-security-settings-in-your-enterprise-account#using-github-actions-with-an-ip-allow-list)".
|
||||
|
||||
{% else %}
|
||||
|
||||
|
|
|
@ -50,17 +50,12 @@ You can add self-hosted runners to an enterprise, where they can be assigned to
|
|||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
To add a self-hosted runner to an enterprise account, you must be an enterprise owner.
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21"%}
|
||||
{% elsif enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21"%}
|
||||
To add a self-hosted runner at the enterprise level of
|
||||
{% data variables.product.product_location %}, you must be a site administrator.
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21"%}
|
||||
{% data reusables.enterprise_site_admin_settings.access-settings %}
|
||||
{% data reusables.enterprise_site_admin_settings.business %}
|
||||
{% endif %}
|
||||
{% data reusables.enterprise-accounts.policies-tab %}
|
||||
{% data reusables.enterprise-accounts.actions-tab %}
|
||||
1. Click the **Self-hosted runners** tab.
|
||||
|
|
|
@ -54,12 +54,7 @@ Self-hosted runners are automatically assigned to the default group when created
|
|||
|
||||
When creating a group, you must choose a policy that grants access to all organizations in the enterprise or choose specific organizations.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21"%}
|
||||
{% data reusables.enterprise_site_admin_settings.access-settings %}
|
||||
{% data reusables.enterprise_site_admin_settings.business %}
|
||||
{% endif %}
|
||||
{% data reusables.enterprise-accounts.policies-tab %}
|
||||
{% data reusables.enterprise-accounts.actions-tab %}
|
||||
1. Click the **Self-hosted runners** tab.
|
||||
|
|
|
@ -62,19 +62,15 @@ Um einen selbst-gehosteten Runner aus einer Organisation zu entfernen, musst Du
|
|||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
To remove a self-hosted runner from an enterprise account, you must be an enterprise owner. We recommend that you also have access to the self-hosted runner machine.
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21"%}
|
||||
{% elsif enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21"%}
|
||||
To remove a self-hosted runner at the enterprise level of
|
||||
{% data variables.product.product_location %}, you must be a site administrator. We recommend that you also have access to the self-hosted runner machine.
|
||||
{% endif %}
|
||||
|
||||
{% data reusables.github-actions.self-hosted-runner-reusing %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
{% else if enterpriseServerVersions contains currentVersion and currentVersion ver_gt "enterprise-server@2.21"%}
|
||||
{% data reusables.enterprise_site_admin_settings.access-settings %}
|
||||
{% data reusables.enterprise_site_admin_settings.business %}
|
||||
{% endif %}
|
||||
{% data reusables.enterprise-accounts.policies-tab %}
|
||||
{% data reusables.enterprise-accounts.actions-tab %}
|
||||
{% data reusables.github-actions.self-hosted-runner-removing-a-runner %}
|
||||
|
|
|
@ -2,13 +2,16 @@
|
|||
title: Dokumentation zu GitHub Actions
|
||||
shortTitle: GitHub Actions
|
||||
intro: 'Mit {% data variables.product.prodname_actions %} kannst Du Deine Softwareentwicklungs-Workflows direkt in Ihrem Repository automatisieren, anpassen und ausführen. Du kannst Actions entdecken, erstellen und weitergeben, um beliebige Aufträge (einschließlich CI/CD) auszuführen. Du kannst auch Actions in einem vollständig angepassten Workflow kombinieren.'
|
||||
introLinks:
|
||||
quickstart: /actions/quickstart
|
||||
learn: /actions/learn-github-actions
|
||||
featuredLinks:
|
||||
gettingStarted:
|
||||
- /actions/quickstart
|
||||
- /actions/learn-github-actions
|
||||
guide:
|
||||
- /actions/managing-workflow-runs
|
||||
- /actions/hosting-your-own-runners
|
||||
guide:
|
||||
- /actions/guides/setting-up-continuous-integration-using-workflow-templates
|
||||
- /actions/guides/about-packaging-with-github-actions
|
||||
popular:
|
||||
- /actions/reference/workflow-syntax-for-github-actions
|
||||
- /actions/reference/events-that-trigger-workflows
|
||||
|
@ -40,7 +43,7 @@ versions:
|
|||
<h3 class="f5 text-normal text-mono underline-dashed color-gray-5">{% data ui.toc.guides %}</h3>
|
||||
</div>
|
||||
<ul class="list-style-none">
|
||||
{% for link in featuredLinks.gettingStarted %}
|
||||
{% for link in featuredLinks.guide %}
|
||||
<li>{% include featured-link %}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
|
@ -62,7 +65,7 @@ versions:
|
|||
<h3 class="f5 text-normal text-mono underline-dashed color-gray-5">Manage workflows</h3>
|
||||
</div>
|
||||
<ul class="list-style-none">
|
||||
{% for link in featuredLinks.guide %}
|
||||
{% for link in featuredLinks.gettingStarted %}
|
||||
<li>{% include featured-link %}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
|
|
|
@ -14,7 +14,7 @@ versions:
|
|||
|
||||
### Übersicht
|
||||
|
||||
If you need to share workflows and other {% data variables.product.prodname_actions %} features with your team, then consider collaborating within a {% data variables.product.prodname_dotcom %} organization. An organization allows you to centrally store and and manage secrets, artifacts, and self-hosted runners. You can also create workflow templates in the `.github` repository and share them with other users in your organization.
|
||||
If you need to share workflows and other {% data variables.product.prodname_actions %} features with your team, then consider collaborating within a {% data variables.product.prodname_dotcom %} organization. An organization allows you to centrally store and manage secrets, artifacts, and self-hosted runners. You can also create workflow templates in the `.github` repository and share them with other users in your organization.
|
||||
|
||||
### Erstellen einer Workflowvorlage
|
||||
|
||||
|
|
|
@ -39,7 +39,6 @@ Es wird dringend empfohlen, dass Aktionen Umgebungsvariablen verwenden, um auf d
|
|||
| Umgebungsvariable | Beschreibung |
|
||||
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `CI` | Immer auf `true` gesetzt. |
|
||||
| `HOME` | Pfad zum {% data variables.product.prodname_dotcom %}-Startverzeichnis, in dem die Benutzerdaten gespeichert werden. Beispiel: `/github/home`. |
|
||||
| `GITHUB_WORKFLOW` | Der Name des Workflows. |
|
||||
| `GITHUB_RUN_ID` | {% data reusables.github-actions.run_id_description %}
|
||||
| `GITHUB_RUN_NUMBER` | {% data reusables.github-actions.run_number_description %}
|
||||
|
|
|
@ -67,17 +67,17 @@ Weitere Informationen findest Du unter:
|
|||
|
||||
- [Configuring the retention period for {% data variables.product.prodname_actions %} for artifacts and logs in your repository](/github/administering-a-repository/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository)
|
||||
- [Configuring the retention period for {% data variables.product.prodname_actions %} for artifacts and logs in your organization](/github/setting-up-and-managing-organizations-and-teams/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization)
|
||||
- [Configuring the retention period for {% data variables.product.prodname_actions %} for artifacts and logs in your enterprise](/github/setting-up-and-managing-your-enterprise-account/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-enterprise-account)
|
||||
- [Configuring the retention period for {% data variables.product.prodname_actions %} for artifacts and logs in your enterprise](/github/setting-up-and-managing-your-enterprise/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-enterprise-account)
|
||||
{% endif %}
|
||||
|
||||
### Disabling or limiting {% data variables.product.prodname_actions %} for your repository or organization
|
||||
### {% data variables.product.prodname_actions %} für Dein Repository oder Deine Organisation deaktivieren oder beschränken
|
||||
|
||||
{% data reusables.github-actions.disabling-github-actions %}
|
||||
|
||||
Weitere Informationen findest Du unter:
|
||||
- "[Disabling or limiting {% data variables.product.prodname_actions %} for a repository](/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository)"
|
||||
- "[Disabling or limiting {% data variables.product.prodname_actions %} for your organization](/github/setting-up-and-managing-organizations-and-teams/disabling-or-limiting-github-actions-for-your-organization)"{% if currentVersion == "free-pro-team@latest" %}
|
||||
- "[Enforcing {% data variables.product.prodname_actions %} policies in your enterprise account](/github/setting-up-and-managing-your-enterprise-account/enforcing-github-actions-policies-in-your-enterprise-account)" for {% data variables.product.prodname_ghe_cloud %}{% endif %}
|
||||
- "[Enforcing {% data variables.product.prodname_actions %} policies in your enterprise account](/github/setting-up-and-managing-your-enterprise/enforcing-github-actions-policies-in-your-enterprise-account)" for {% data variables.product.prodname_ghe_cloud %}{% endif %}
|
||||
|
||||
### Disabling and enabling workflows
|
||||
|
||||
|
|
|
@ -0,0 +1,27 @@
|
|||
---
|
||||
title: About identity and access management for your enterprise
|
||||
shortTitle: About identity and access management
|
||||
intro: 'You can use {% if enterpriseServerVersions contains currentVersion %}{% data variables.product.prodname_ghe_server %}''s built-in authentication, or choose between CAS, LDAP, or SAML{% else %}SAML single sign-on (SSO) and System for Cross-domain Identity Management (SCIM){% endif %} to centrally manage access {% if currentVersion == "free-pro-team@latest" %}to organizations owned by your enterprise on {% data variables.product.prodname_dotcom_the_website %}{% endif %}{% if enterpriseServerVersions contains currentVersion or currentVersion == "github-ae@latest" %}to {% data variables.product.product_location %}{% endif %}.'
|
||||
product: '{% data reusables.gated-features.saml-sso %}'
|
||||
versions:
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
### About identity and access management for your enterprise
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% data reusables.saml.ae-uses-saml-sso %} {% data reusables.saml.ae-enable-saml-sso-during-bootstrapping %}
|
||||
|
||||
After you configure the application for {% data variables.product.product_name %} on your IdP, you can grant access to {% data variables.product.product_location %} by assigning the application to users on your IdP. For more information about SAML SSO for {% data variables.product.product_name %}, see "[Configuring SAML single sign-on for your enterprise](/admin/authentication/configuring-saml-single-sign-on-for-your-enterprise)."
|
||||
|
||||
{% data reusables.scim.after-you-configure-saml %} For more information, see "[Configuring user provisioning for your enterprise](/admin/authentication/configuring-user-provisioning-for-your-enterprise)."
|
||||
|
||||
To learn how to configure both authentication and user provisioning for {% data variables.product.product_location %} with your specific IdP, see "[Configuring authentication and provisioning with your identity provider](/admin/authentication/configuring-authentication-and-provisioning-with-your-identity-provider)."
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Weiterführende Informationen
|
||||
|
||||
- [SAML Wiki](https://wiki.oasis-open.org/security) on the OASIS website
|
||||
- [System for Cross-domain Identity Management: Protocol (RFC 7644)](https://tools.ietf.org/html/rfc7644) on the IETF website
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Benutzer für Ihre GitHub Enterprise Server-Instanz authentifizieren
|
||||
intro: 'Sie können die integrierte Authentifizierung von {% data variables.product.prodname_ghe_server %} verwenden oder zwischen CAS, LDAP oder SAML auswählen, um Ihre vorhandenen Konten zu integrieren und den Benutzerzugriff auf {% data variables.product.product_location_enterprise %} zentral zu verwalten.'
|
||||
intro: 'Sie können die integrierte Authentifizierung von {% data variables.product.prodname_ghe_server %} verwenden oder zwischen CAS, LDAP oder SAML auswählen, um Ihre vorhandenen Konten zu integrieren und den Benutzerzugriff auf {% data variables.product.product_location %} zentral zu verwalten.'
|
||||
redirect_from:
|
||||
- /enterprise/admin/categories/authentication/
|
||||
- /enterprise/admin/guides/installation/user-authentication/
|
||||
|
|
|
@ -8,7 +8,7 @@ versions:
|
|||
enterprise-server: '*'
|
||||
---
|
||||
|
||||
Wenn Sie die Authentifizierungsmethode ändern, werden die Benutzerkonten auf {% data variables.product.product_location_enterprise %} beibehalten, und Benutzer melden sich weiterhin beim selben Konto an, sofern ihr Benutzername nicht geändert wird.
|
||||
Wenn Sie die Authentifizierungsmethode ändern, werden die Benutzerkonten auf {% data variables.product.product_location %} beibehalten, und Benutzer melden sich weiterhin beim selben Konto an, sofern ihr Benutzername nicht geändert wird.
|
||||
|
||||
Wenn bei der neuen Authentifizierungsmethode Benutzernamen geändert werden, werden neue Konten erstellt. As an administrator, you can rename users through the site admin settings or by using [the User Administration API](/enterprise/{{currentVersion}}/v3/enterprise-admin/users/#rename-an-existing-user).
|
||||
|
||||
|
@ -30,4 +30,4 @@ Zudem sollten Sie die folgenden Issues in Betracht ziehen:
|
|||
|
||||
* **Zwei-Faktor-Authentifizierung:** {% data reusables.enterprise_user_management.external_auth_disables_2fa %}
|
||||
|
||||
* **Integrierte Authentifizierung für Benutzer außerhalb Ihres Identity Providers:** Sie können Benutzer einladen, sich bei {% data variables.product.product_location_enterprise %} zu authentifizieren, ohne sie zu Ihrem Identity Provider hinzuzufügen. Weitere Informationen finden Sie unter „[Integrierte Authentifizierung für Benutzer außerhalb Ihres Identity Providers zulassen](/enterprise/{{ currentVersion }}/admin/guides/user-management/allowing-built-in-authentication-for-users-outside-your-identity-provider)“.
|
||||
* **Integrierte Authentifizierung für Benutzer außerhalb Ihres Identity Providers:** Sie können Benutzer einladen, sich bei {% data variables.product.product_location %} zu authentifizieren, ohne sie zu Ihrem Identity Provider hinzuzufügen. Weitere Informationen finden Sie unter „[Integrierte Authentifizierung für Benutzer außerhalb Ihres Identity Providers zulassen](/enterprise/{{ currentVersion }}/admin/guides/user-management/allowing-built-in-authentication-for-users-outside-your-identity-provider)“.
|
||||
|
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
title: Configuring authentication and provisioning for your enterprise using Azure AD
|
||||
shortTitle: Configuring with Azure AD
|
||||
intro: You can use a tenant in Azure Active Directory (Azure AD) as an identity provider (IdP) to centrally manage authentication and user provisioning for {% data variables.product.product_location %}.
|
||||
permissions: Enterprise owners can configure authentication and provisioning for an enterprise on {% data variables.product.product_name %}.
|
||||
product: '{% data reusables.gated-features.saml-sso %}'
|
||||
versions:
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
### About authentication and user provisioning with Azure AD
|
||||
|
||||
Azure Active Directory (Azure AD) is a service from Microsoft that allows you to centrally manage user accounts and access to web applications. For more information, see [What is Azure Active Directory?](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis) in the Microsoft Docs.
|
||||
|
||||
To manage identity and access for {% data variables.product.product_name %}, you can use an Azure AD tenant as a SAML IdP for authentication. You can also configure Azure AD to automatically provision accounts and access with SCIM. This configuration allows you to assign or unassign the {% data variables.product.prodname_ghe_managed %} application for a user account in your Azure AD tenant to automatically create, grant access to, or deactivate a corresponding user account on {% data variables.product.product_name %}.
|
||||
|
||||
For more information about managing identity and access for your enterprise on {% data variables.product.product_location %}, see "[Managing identity and access for your enterprise](/admin/authentication/managing-identity-and-access-for-your-enterprise)."
|
||||
|
||||
### Vorrausetzungen
|
||||
|
||||
To configure authentication and user provisioning for {% data variables.product.product_name %} using Azure AD, you must have an Azure AD account and tenant. For more information, see the [Azure AD website](https://azure.microsoft.com/en-us/free/active-directory) and [Quickstart: Create an Azure Active Directory tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant) in the Microsoft Docs.
|
||||
|
||||
{% data reusables.saml.assert-the-administrator-attribute %} For more information about including the `administrator` attribute in the SAML claim from Azure AD, see [How to: customize claims issued in the SAML token for enterprise applications](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-saml-claims-customization) in the Microsoft Docs.
|
||||
|
||||
{% data reusables.saml.create-a-machine-user %}
|
||||
|
||||
### Configuring authentication and user provisioning with Azure AD
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
1. In Azure AD, add {% data variables.product.ae_azure_ad_app_link %} to your tenant and configure single sign-on.
|
||||
|
||||
| Value in Azure AD | Value from {% data variables.product.prodname_ghe_managed %}
|
||||
|:---------------------- |:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Identifier (Entity ID) | `https://<em>YOUR-GITHUB-AE-HOSTNAME</em><code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left">Reply URL</td>
|
||||
<td align="left"><code>https://<em>YOUR-GITHUB-AE-HOSTNAME</em>/saml/consume` |
|
||||
| Sign on URL | <code>https://<em>YOUR-GITHUB-AE-HOSTNAME</em>/sso</code> |
|
||||
|
||||
1. In {% data variables.product.prodname_ghe_managed %}, enter the details for your Azure AD tenant.
|
||||
|
||||
- {% data reusables.saml.ae-enable-saml-sso-during-bootstrapping %}
|
||||
|
||||
- If you've already configured SAML SSO for {% data variables.product.product_location %} using another IdP and you want to use Azure AD instead, you can edit your configuration. For more information, see "[Configuring SAML single sign-on for your enterprise](/admin/authentication/configuring-saml-single-sign-on-for-your-enterprise#editing-the-saml-sso-configuration)."
|
||||
|
||||
1. Enable user provisioning in {% data variables.product.product_name %} and configure user provisioning in Azure AD. For more information, see "[Configuring user provisioning for your enterprise](/admin/authentication/configuring-user-provisioning-for-your-enterprise#enabling-user-provisioning-for-your-enterprise)."
|
||||
|
||||
{% endif %}
|
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
title: Configuring authentication and provisioning with your identity provider
|
||||
intro: You can use an identity provider (IdP) that supports both SAML single sign-on (SSO) and System for Cross-domain Identity Management (SCIM) to configure authentication and user provisioning for {% data variables.product.product_location %}.
|
||||
mapTopic: true
|
||||
versions:
|
||||
github-ae: '*'
|
||||
---
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
---
|
||||
title: Configuring SAML single sign-on for your enterprise
|
||||
shortTitle: Configuring SAML SSO
|
||||
intro: You can configure SAML single sign-on (SSO) for your enterprise, which allows you to centrally control authentication for {% data variables.product.product_location %} using your identity provider (IdP).
|
||||
product: '{% data reusables.gated-features.saml-sso %}'
|
||||
permissions: Enterprise owners can configure SAML SSO for an enterprise on {% data variables.product.product_name %}.
|
||||
versions:
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
### Informationen zu SAML SSO
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
SAML SSO allows you to centrally control and secure access to {% data variables.product.product_location %} from your SAML IdP. When an unauthenticated user visits {% data variables.product.product_location %} in a browser, {% data variables.product.product_name %} will redirect the user to your SAML IdP to authenticate. After the user successfully authenticates with an account on the IdP, the IdP redirects the user back to {% data variables.product.product_location %}. {% data variables.product.product_name %} validates the response from your IdP, then grants access to the user.
|
||||
|
||||
After a user successfully authenticates on your IdP, the user's SAML session for {% data variables.product.product_location %} is active in the browser for 24 hours. After 24 hours, the user must authenticate again with your IdP.
|
||||
|
||||
{% data reusables.saml.assert-the-administrator-attribute %}
|
||||
|
||||
{% data reusables.scim.after-you-configure-saml %} For more information, see "[Configuring user provisioning for your enterprise](/admin/authentication/configuring-user-provisioning-for-your-enterprise)."
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Supported identity providers
|
||||
|
||||
{% data variables.product.product_name %} supports SAML SSO with IdPs that implement the SAML 2.0 standard. For more information, see the [SAML Wiki](https://wiki.oasis-open.org/security) on the OASIS website.
|
||||
|
||||
{% data variables.product.company_short %} has tested SAML SSO for {% data variables.product.product_name %} with the following IdPs.
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
- Azure AD
|
||||
{% endif %}
|
||||
|
||||
### Enabling SAML SSO
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% data reusables.saml.ae-enable-saml-sso-during-bootstrapping %}
|
||||
|
||||
During initialization for {% data variables.product.product_name %}, you must configure {% data variables.product.product_name %} as a SAML Service Provider (SP) on your IdP. You must enter several unique values on your IdP to configure {% data variables.product.product_name %} as a valid SP.
|
||||
|
||||
| Wert | Other names | Beschreibung | Beispiel |
|
||||
|:--------------------------------------- |:----------- |:-------------------------------------------------------------------------- |:------------------------- |
|
||||
| SP Entity ID | SP URL | Your top-level URL for {% data variables.product.prodname_ghe_managed %} | <code>https://<em>YOUR-GITHUB-AE-HOSTNAME</em></code> |
|
||||
| SP Assertion Consumer Service (ACS) URL | Reply URL | URL where IdP sends SAML responses | <code>https://<em>YOUR-GITHUB-AE-HOSTNAME</em>/saml/consume</code> |
|
||||
| SP Single Sign-On (SSO) URL | | URL where IdP begins SSO | <code>https://<em>YOUR-GITHUB-AE-HOSTNAME</em>/sso</code> |
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Editing the SAML SSO configuration
|
||||
|
||||
If the details for your IdP change, you'll need to edit the SAML SSO configuration for {% data variables.product.product_location %}. For example, if the certificate for your IdP expires, you can edit the value for the public certificate.
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% note %}
|
||||
|
||||
**Hinweis**: {% data reusables.saml.contact-support-if-your-idp-is-unavailable %}
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
{% data reusables.enterprise-accounts.settings-tab %}
|
||||
{% data reusables.enterprise-accounts.security-tab %}
|
||||
1. Under "SAML single sign-on", type the new details for your IdP. ![Text entry fields with IdP details for SAML SSO configuration for an enterprise](/assets/images/help/saml/ae-edit-idp-details.png)
|
||||
1. Optionally, click {% octicon "pencil" aria-label="The edit icon" %} to configure a new signature or digest method. ![Edit icon for changing signature and digest method](/assets/images/help/saml/ae-edit-idp-details-edit-signature-and-digest.png)
|
||||
|
||||
- Use the drop-down menus and choose the new signature or digest method. ![Drop-down menus for choosing a new signature or digest method](/assets/images/help/saml/ae-edit-idp-details-edit-signature-and-digest-drop-down-menus.png)
|
||||
1. To ensure that the information you've entered is correct, click **Test SAML configuration**. !["Test SAML configuration" button](/assets/images/help/saml/ae-edit-idp-details-test-saml-configuration.png)
|
||||
1. Klicke auf **Save** (Speichern). !["Save" button for SAML SSO configuration](/assets/images/help/saml/ae-edit-idp-details-save.png)
|
||||
1. Optionally, to automatically provision and deprovision user accounts for {% data variables.product.product_location %}, reconfigure user provisioning with SCIM. For more information, see "[Configuring user provisioning for your enterprise](/admin/authentication/configuring-user-provisioning-for-your-enterprise)."
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Disabling SAML SSO
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
{% warning %}
|
||||
|
||||
**Warning**: If you disable SAML SSO for {% data variables.product.product_location %}, users without existing SAML SSO sessions cannot sign into {% data variables.product.product_location %}. SAML SSO sessions on {% data variables.product.product_location %} end after 24 hours.
|
||||
|
||||
{% endwarning %}
|
||||
|
||||
{% note %}
|
||||
|
||||
**Hinweis**: {% data reusables.saml.contact-support-if-your-idp-is-unavailable %}
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
{% data reusables.enterprise-accounts.settings-tab %}
|
||||
{% data reusables.enterprise-accounts.security-tab %}
|
||||
1. Under "SAML single sign-on", unselect **Enable SAML authentication**. ![Checkbox for "Enable SAML authentication"](/assets/images/help/saml/ae-saml-disabled.png)
|
||||
1. To disable SAML SSO and require signing in with the built-in user account you created during initialization, click **Save**. !["Save" button for SAML SSO configuration](/assets/images/help/saml/ae-saml-disabled-save.png)
|
||||
|
||||
{% endif %}
|
|
@ -0,0 +1,72 @@
|
|||
---
|
||||
title: Configuring user provisioning for your enterprise
|
||||
shortTitle: Configuring user provisioning
|
||||
intro: You can configure System for Cross-domain Identity Management (SCIM) for your enterprise, which automatically provisions user accounts on {% data variables.product.product_location %} when you assign the application for {% data variables.product.product_location %} to a user on your identity provider (IdP).
|
||||
permissions: Enterprise owners can configure user provisioning for an enterprise on {% data variables.product.product_name %}.
|
||||
product: '{% data reusables.gated-features.saml-sso %}'
|
||||
versions:
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
### About user provisioning for your enterprise
|
||||
|
||||
{% data reusables.saml.ae-uses-saml-sso %} For more information, see "[Configuring SAML single sign-on for your enterprise](/admin/authentication/configuring-saml-single-sign-on-for-your-enterprise)."
|
||||
|
||||
{% data reusables.scim.after-you-configure-saml %} For more information about SCIM, see [System for Cross-domain Identity Management: Protocol (RFC 7644)](https://tools.ietf.org/html/rfc7644) on the IETF website.
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
Configuring provisioning allows your IdP to communicate with {% data variables.product.product_location %} when you assign or unassign the application for {% data variables.product.product_name %} to a user on your IdP. When you assign the application, your IdP will prompt {% data variables.product.product_location %} to create an account and send an onboarding email to the user. When you unassign the application, your IdP will communicate with {% data variables.product.product_name %} to invalidate any SAML sessions and disable the member's account.
|
||||
|
||||
To configure provisioning for your enterprise, you must enable provisioning on {% data variables.product.product_name %}, then install and configure a provisioning application on your IdP.
|
||||
|
||||
The provisioning application on your IdP communicates with {% data variables.product.product_name %} via our SCIM API for enterprises. For more information, see "[GitHub Enterprise administration](/rest/reference/enterprise-admin#scim)" in the {% data variables.product.prodname_dotcom %} REST API documentation.
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Supported identity providers
|
||||
|
||||
{% data reusables.scim.supported-idps %}
|
||||
|
||||
### Vorrausetzungen
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
To automatically provision and deprovision access to {% data variables.product.product_location %} from your IdP, you must first configure SAML SSO when you initialize {% data variables.product.product_name %}. For more information, see "[Initializing {% data variables.product.prodname_ghe_managed %}](/admin/configuration/initializing-github-ae)."
|
||||
|
||||
You must have administrative access on your IdP to configure the application for user provisioning for {% data variables.product.product_name %}.
|
||||
|
||||
{% endif %}
|
||||
|
||||
### Enabling user provisioning for your enterprise
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
|
||||
1. While signed into
|
||||
|
||||
{% data variables.product.product_location %} as an enterprise owner, create a personal access token with **admin:enterprise** scope. Weitere Informationen finden Sie unter "[Erstellen eines persönlichen Zugriffstokens](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
{% note %}
|
||||
|
||||
**Hinweise**:
|
||||
- To create the personal access token, we recommend using the account for the first enterprise owner that you created during initialization. For more information, see "[Initializing {% data variables.product.prodname_ghe_managed %}](/admin/configuration/initializing-github-ae)."
|
||||
- You'll need this personal access token to configure the application for SCIM on your IdP. Store the token securely in a password manager until you need the token again later in these instructions.
|
||||
|
||||
{% endnote %}
|
||||
{% warning %}
|
||||
|
||||
**Warning**: If the user account for the enterprise owner who creates the personal access token is deactivated or deprovisioned, your IdP will no longer provision and deprovision user accounts for your enterprise automatically. Another enterprise owner must create a new personal access token and reconfigure provisioning on the IdP.
|
||||
|
||||
{% endwarning %}
|
||||
{% data reusables.enterprise-accounts.access-enterprise %}
|
||||
{% data reusables.enterprise-accounts.settings-tab %}
|
||||
{% data reusables.enterprise-accounts.security-tab %}
|
||||
1. Under "SCIM User Provisioning", select **Require SCIM user provisioning**. ![Checkbox for "Require SCIM user provisioning" within enterprise security settings](/assets/images/help/enterprises/settings-require-scim-user-provisioning.png)
|
||||
1. Klicke auf **Save** (Speichern). ![Save button under "Require SCIM user provisioning" within enterprise security settings](/assets/images/help/enterprises/settings-scim-save.png)
|
||||
1. Configure user provisioning in the application for {% data variables.product.product_name %} on your IdP. The application on your IdP requires two values to provision or deprovision user accounts on {% data variables.product.product_location %}.
|
||||
|
||||
| Wert | Other names | Beschreibung | Beispiel |
|
||||
|:------------- |:----------------------------------- |:----------------------------------------------------------------------------------------------------------- |:------------------------------------------- |
|
||||
| URL | Tenant URL | URL to the SCIM provisioning API for your enterprise on {% data variables.product.prodname_ghe_managed %} | <code>https://<em>YOUR-GITHUB-AE-HOSTNAME</em>/scim/v2</code> |
|
||||
| Shared secret | Personal access token, secret token | Token for application on your IdP to perform provisioning tasks on behalf of an enterprise owner | Personal access token you created in step 1 |
|
||||
|
||||
{% endif %}
|
|
@ -1,10 +1,11 @@
|
|||
---
|
||||
title: Authentifizierung
|
||||
intro: 'Sie können die integrierte Authentifizierung von {% data variables.product.prodname_ghe_server %} verwenden oder zwischen CAS, LDAP oder SAML auswählen, um Ihre vorhandenen Konten zu integrieren und den Benutzerzugriff auf {% data variables.product.product_location_enterprise %} zentral zu verwalten.'
|
||||
intro: You can configure how users sign into {% data variables.product.product_name %}.
|
||||
redirect_from:
|
||||
- /enterprise/admin/authentication
|
||||
versions:
|
||||
enterprise-server: '*'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
|
||||
|
@ -18,5 +19,9 @@ versions:
|
|||
{% link_in_list /using-ldap %}
|
||||
{% link_in_list /allowing-built-in-authentication-for-users-outside-your-identity-provider %}
|
||||
{% link_in_list /changing-authentication-methods %}
|
||||
|
||||
|
||||
{% topic_link_in_list /managing-identity-and-access-for-your-enterprise %}
|
||||
{% link_in_list /about-identity-and-access-management-for-your-enterprise %}
|
||||
{% link_in_list /configuring-saml-single-sign-on-for-your-enterprise %}
|
||||
{% link_in_list /configuring-user-provisioning-for-your-enterprise %}
|
||||
{% topic_link_in_list /configuring-authentication-and-provisioning-with-your-identity-provider %}
|
||||
{% link_in_list /configuring-authentication-and-provisioning-for-your-enterprise-using-azure-ad %}
|
||||
|
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
title: Managing identity and access for your enterprise
|
||||
shortTitle: Managing identity and access
|
||||
intro: You can centrally manage accounts and access to {% data variables.product.product_location %}.
|
||||
mapTopic: true
|
||||
versions:
|
||||
github-ae: '*'
|
||||
---
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Integrierte Authentifizierung verwenden
|
||||
intro: 'Wenn Sie die standardmäßige Authentifizierungsmethode verwenden, werden alle Authentifizierungsdetails in {% data variables.product.product_location_enterprise %} gespeichert. Die integrierte Authentifizierung ist die Standardmethode, wenn Sie nicht bereits über einen etablierten Authentifizierungsanbieter wie LDAP, SAML oder CAS verfügen.'
|
||||
intro: 'Wenn Sie die standardmäßige Authentifizierungsmethode verwenden, werden alle Authentifizierungsdetails in {% data variables.product.product_location %} gespeichert. Die integrierte Authentifizierung ist die Standardmethode, wenn Sie nicht bereits über einen etablierten Authentifizierungsanbieter wie LDAP, SAML oder CAS verfügen.'
|
||||
redirect_from:
|
||||
- /enterprise/admin/user-management/using-built-in-authentication
|
||||
- /enterprise/admin/authentication/using-built-in-authentication
|
||||
|
|
|
@ -32,7 +32,7 @@ Die folgenden Attribute sind verfügbar.
|
|||
### CAS konfigurieren
|
||||
{% warning %}
|
||||
|
||||
**Warnung:** Bevor Sie CAS auf {% data variables.product.product_location_enterprise %} konfigurieren, sollten Sie beachten, dass Benutzer ihre CAS-Benutzernamen und -Passwörter nicht verwenden können, um API-Anforderungen oder Git-Vorgänge über HTTP/HTTPS zu authentifizieren. Stattdessen müssen sie ein [Zugriffstoken erstellen](/enterprise/{{ currentVersion }}/user/articles/creating-an-access-token-for-command-line-use).
|
||||
**Warnung:** Bevor Sie CAS auf {% data variables.product.product_location %} konfigurieren, sollten Sie beachten, dass Benutzer ihre CAS-Benutzernamen und -Passwörter nicht verwenden können, um API-Anforderungen oder Git-Vorgänge über HTTP/HTTPS zu authentifizieren. Stattdessen müssen sie ein [Zugriffstoken erstellen](/enterprise/{{ currentVersion }}/user/articles/creating-an-access-token-for-command-line-use).
|
||||
|
||||
{% endwarning %}
|
||||
|
||||
|
|
|
@ -35,7 +35,7 @@ versions:
|
|||
{% data reusables.enterprise_user_management.two_factor_auth_header %}
|
||||
{% data reusables.enterprise_user_management.2fa_is_available %}
|
||||
|
||||
### LDAP für {% data variables.product.product_location_enterprise %} konfigurieren
|
||||
### LDAP für {% data variables.product.product_location %} konfigurieren
|
||||
|
||||
Nach der Konfiguration von LDAP können sich Benutzer mit ihren LDAP-Anmeldeinformationen bei Ihrer Instanz anmelden. Wenn sich Benutzer erstmals anmelden, werden ihre Profilnamen, E-Mail-Adressen und SSH-Schlüssel mit den LDAP-Attributen aus Ihrem Verzeichnis festgelegt.
|
||||
|
||||
|
@ -43,7 +43,7 @@ Wenn Du LDAP-Zugriff für Benutzer über die {% data variables.enterprise.manage
|
|||
|
||||
{% warning %}
|
||||
|
||||
**Warnung:** Stellen Sie sicher, dass Ihr LDAP-Dienst seitenweise Ergebnisse unterstützt, bevor Sie LDAP auf {% data variables.product.product_location_enterprise %} konfigurieren.
|
||||
**Warnung:** Stellen Sie sicher, dass Ihr LDAP-Dienst seitenweise Ergebnisse unterstützt, bevor Sie LDAP auf {% data variables.product.product_location %} konfigurieren.
|
||||
|
||||
{% endwarning %}
|
||||
|
||||
|
@ -55,11 +55,11 @@ Wenn Du LDAP-Zugriff für Benutzer über die {% data variables.enterprise.manage
|
|||
5. Fügen Sie die gewünschten Konfigurationseinstellungen hinzu.
|
||||
|
||||
### LDAP-Attribute
|
||||
Verwenden Sie die folgenden Attribute, um die Konfiguration von LDAP für {% data variables.product.product_location_enterprise %} abzuschließen.
|
||||
Verwenden Sie die folgenden Attribute, um die Konfiguration von LDAP für {% data variables.product.product_location %} abzuschließen.
|
||||
|
||||
| Attributname | Typ | Beschreibung |
|
||||
| ------------------------------------------------ | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `Host` | Erforderlich | Der LDAP-Host, z. B. `ldap.example.com` oder `10.0.0.30`. Wenn der Hostnamen nur in Ihrem internen Netzwerk verfügbar ist, müssen Sie möglicherweise zunächst den DNS von {% data variables.product.product_location_enterprise %} konfigurieren, damit der Hostname mithilfe Ihrer internen Nameserver aufgelöst werden kann. |
|
||||
| `Host` | Erforderlich | Der LDAP-Host, z. B. `ldap.example.com` oder `10.0.0.30`. Wenn der Hostnamen nur in Ihrem internen Netzwerk verfügbar ist, müssen Sie möglicherweise zunächst den DNS von {% data variables.product.product_location %} konfigurieren, damit der Hostname mithilfe Ihrer internen Nameserver aufgelöst werden kann. |
|
||||
| `Port` | Erforderlich | Der Port, der von den LDAP-Diensten des Hosts überwacht wird. Beispiele: 389 und 636 (für LDAPS). |
|
||||
| `Encryption` | Erforderlich | Die Verschlüsselungsmethode, die verwendet wird, um Kommunikationen zum LDAP-Server zu schützen. Dazu zählen beispielsweise Nur-Text (keine Verschlüsselung), SSL/LDAPS (von Anfang an verschlüsselt) und StartTLS (Upgrade auf verschlüsselte Kommunikation nach dem Herstellen der Verbindung). |
|
||||
| `Domain search user` | Optional | Der LDAP-Benutzer, der Benutzernachschlagevorgänge durchführt, um andere Benutzer bei ihrer Anmeldung zu authentifizieren. In der Regel handelt es sich dabei um ein Dienstkonto, das speziell für Drittanbieterintegrationen erstellt wird. Verwenden Sie einen vollqualifizierten Namen, beispielsweise `cn=Administrator,cn=Users,dc=Example,dc=com`. Mit Active Directory können Sie zudem die Syntax `[DOMAIN]\[USERNAME]` (z. B. `WINDOWS\Administrator`) für den Benutzer der Domain-Suche mit Active Directory verwenden. |
|
||||
|
@ -190,7 +190,7 @@ Sofern die [LDAP-Synchronisierung nicht aktiviert ist](#enabling-ldap-sync), wer
|
|||
|
||||
You can also [use the API to trigger a manual sync](/enterprise/{{ currentVersion }}/user/rest/reference/enterprise-admin#ldap).
|
||||
|
||||
### Zugriff auf {% data variables.product.product_location_enterprise %} widerrufen
|
||||
### Zugriff auf {% data variables.product.product_location %} widerrufen
|
||||
|
||||
Bei [aktivierter LDAP-Synchronisierung](#enabling-ldap-sync) wird beim Entfernen der LDAP-Anmeldeinformationen eines Benutzers dessen Konto nach der nächsten Synchronisierungsausführung gesperrt.
|
||||
|
||||
|
|
|
@ -79,10 +79,10 @@ Die folgenden Attribute sind verfügbar. Mit Ausnahme der `administrator`-Attrib
|
|||
|
||||
{% endtip %}
|
||||
|
||||
5. Wählen Sie **Disable administrator demotion/promotion** (Hochstufen/Zurücksetzen des Administrators deaktivieren) aus, wenn Sie **nicht** möchten, dass Ihr SAML-Anbieter die Administratorrechte für Benutzer auf {% data variables.product.product_location_enterprise %} bestimmen kann. ![SAML-Konfiguration zum Deaktivieren der Administratoroption](/assets/images/enterprise/management-console/disable-admin-demotion-promotion.png)
|
||||
6. Geben Sie im Feld **Single sign-on URL** (Single Sign-On-URL) den HTTP- oder HTTPS-Endpunkt für Ihren IdP für Single Sign-On-Anforderungen ein. Dieser Wert wird durch Ihre IdP-Konfiguration angegeben. Wenn der Host in Ihrem internen Netzwerk nicht verfügbar ist, müssen Sie [{% data variables.product.product_location_enterprise %} ggf. zur Verwendung interner Nameserver konfigurieren](/enterprise/{{ currentVersion }}/admin/guides/installation/configuring-dns-nameservers/). ![SAML-Authentifizierung](/assets/images/enterprise/management-console/saml-single-sign-url.png)
|
||||
7. Gib optional im Feld **Issuer** (Aussteller) den Namen Deines SAML-Ausstellers ein. Dadurch wird die Authentizität von Nachrichten verifiziert, die an {% data variables.product.product_location_enterprise %} gesendet werden. ![SAML-Aussteller](/assets/images/enterprise/management-console/saml-issuer.png)
|
||||
8. Wählen Sie in den Dropdownmenüs **Signature Method** (Signaturmethode) und **Digest Method** (Digest-Methode) den von Ihrem SAML-Aussteller verwendeten Hashalgorithmus aus, um die Integrität der Anforderungen von {% data variables.product.product_location_enterprise %} zu verifizieren. Geben Sie das Format mit dem Dropdownmenü **Name Identifier Format** (Format für Namenskennzeichner) an. ![SAML-Methode](/assets/images/enterprise/management-console/saml-method.png)
|
||||
5. Wählen Sie **Disable administrator demotion/promotion** (Hochstufen/Zurücksetzen des Administrators deaktivieren) aus, wenn Sie **nicht** möchten, dass Ihr SAML-Anbieter die Administratorrechte für Benutzer auf {% data variables.product.product_location %} bestimmen kann. ![SAML-Konfiguration zum Deaktivieren der Administratoroption](/assets/images/enterprise/management-console/disable-admin-demotion-promotion.png)
|
||||
6. Geben Sie im Feld **Single sign-on URL** (Single Sign-On-URL) den HTTP- oder HTTPS-Endpunkt für Ihren IdP für Single Sign-On-Anforderungen ein. Dieser Wert wird durch Ihre IdP-Konfiguration angegeben. Wenn der Host in Ihrem internen Netzwerk nicht verfügbar ist, müssen Sie [{% data variables.product.product_location %} ggf. zur Verwendung interner Nameserver konfigurieren](/enterprise/{{ currentVersion }}/admin/guides/installation/configuring-dns-nameservers/). ![SAML-Authentifizierung](/assets/images/enterprise/management-console/saml-single-sign-url.png)
|
||||
7. Gib optional im Feld **Issuer** (Aussteller) den Namen Deines SAML-Ausstellers ein. Dadurch wird die Authentizität von Nachrichten verifiziert, die an {% data variables.product.product_location %} gesendet werden. ![SAML-Aussteller](/assets/images/enterprise/management-console/saml-issuer.png)
|
||||
8. Wählen Sie in den Dropdownmenüs **Signature Method** (Signaturmethode) und **Digest Method** (Digest-Methode) den von Ihrem SAML-Aussteller verwendeten Hashalgorithmus aus, um die Integrität der Anforderungen von {% data variables.product.product_location %} zu verifizieren. Geben Sie das Format mit dem Dropdownmenü **Name Identifier Format** (Format für Namenskennzeichner) an. ![SAML-Methode](/assets/images/enterprise/management-console/saml-method.png)
|
||||
9. Klicken Sie unter **Verification certificate** (Verifizierungszertifikat) auf **Choose File** (Datei auswählen), und wählen Sie ein Zertifikat aus, um Ihre SAML-Antworten vom IdP zu validieren. ![SAML-Authentifizierung](/assets/images/enterprise/management-console/saml-verification-cert.png)
|
||||
10. Ändern Sie die SAML-Attributnamen bei Bedarf so, dass sie mit Ihrem IdP übereinstimmen, oder akzeptieren Sie die Standardnamen.![SAML-Attributnamen](/assets/images/enterprise/management-console/saml-attributes.png)
|
||||
|
||||
|
@ -100,7 +100,7 @@ Die folgenden Attribute sind verfügbar. Mit Ausnahme der `administrator`-Attrib
|
|||
|
||||
{% endif %}
|
||||
|
||||
### Zugriff auf {% data variables.product.product_location_enterprise %} widerrufen
|
||||
### Zugriff auf {% data variables.product.product_location %} widerrufen
|
||||
|
||||
Wenn Sie einen Benutzer von Ihrem Identity Provider entfernen, müssen Sie ihn zudem manuell sperren. Andernfalls kann er sich weiterhin mithilfe der Zugriffstoken oder SSH-Schlüssel authentifizieren. Weitere Informationen finden Sie unter „[Benutzer sperren und entsperren](/enterprise/admin/guides/user-management/suspending-and-unsuspending-users)“.
|
||||
|
||||
|
|
|
@ -0,0 +1,31 @@
|
|||
---
|
||||
title: About enterprise configuration
|
||||
intro: 'You can use the site admin dashboard{% if enterpriseServerVersions contains currentVersion %}, {% data variables.enterprise.management_console %}, and administrative shell (SSH) {% elsif currentVersion == "github-ae@latest" %} and enterprise settings or contact support{% endif %} to manage your enterprise.'
|
||||
versions:
|
||||
enterprise-server: '*'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% if enterpriseServerVersions contains currentVersion %}
|
||||
{% data reusables.enterprise_site_admin_settings.about-the-site-admin-dashboard %} For more information, see "[Site admin dashboard](/admin/configuration/site-admin-dashboard)."
|
||||
|
||||
{% data reusables.enterprise_site_admin_settings.about-the-management-console %} For more information, see "[Accessing the management console](/admin/configuration/accessing-the-management-console)."
|
||||
|
||||
{% data reusables.enterprise_site_admin_settings.about-ssh-access %} For more information, see "[Accessing the administrative shell (SSH)](/admin/configuration/accessing-the-administrative-shell-ssh)."
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}
|
||||
The first time you access your enterprise, you will complete an initial configuration to get
|
||||
{% data variables.product.product_name %} ready to use. The initial configuration includes connecting your enterprise with an idP, authenticating with SAML SSO, and configuring policies for repositories and organizations in your enterprise. For more information, see "[Initializing {% data variables.product.prodname_ghe_managed %}](/admin/configuration/initializing-github-ae)."
|
||||
|
||||
For users to receive any emails from {% data variables.product.product_name %} after the initial configuration, you must ask {% data variables.contact.github_support %} to configure outbound email support with your SMTP server. For more information, see "[Configuring email for notifications](/admin/configuration/configuring-email-for-notifications)."
|
||||
|
||||
Later, you can use the site admin dashboard and enterprise settings to further configure your enterprise, manage users, organizations and repositories, and set policies that reduce risk and increase quality.
|
||||
|
||||
All enterprises are configured with subdomain isolation and support for TLS 1.2 and higher for encrypted traffic only.
|
||||
{% endif %}
|
||||
|
||||
### Weiterführende Informationen
|
||||
|
||||
- "[Managing users, organizations, and repositories](/admin/user-management)"
|
||||
- "[Setting policies for your enterprise](/admin/policies)"
|
|
@ -10,7 +10,7 @@ redirect_from:
|
|||
- /enterprise/admin/2.15/articles/troubleshooting-ssh-permission-denied-publickey/
|
||||
- /enterprise/admin/installation/accessing-the-administrative-shell-ssh
|
||||
- /enterprise/admin/configuration/accessing-the-administrative-shell-ssh
|
||||
intro: 'Der SSH-Zugriff ermöglicht Ihnen die Ausführung der {% data variables.product.prodname_ghe_server %}-Befehlszeilendienstprogramme und eignet sich zur Fehlerbehebung, zum Ausführen von Backups und zum Konfigurieren der Replikation.'
|
||||
intro: '{% data reusables.enterprise_site_admin_settings.about-ssh-access %}'
|
||||
versions:
|
||||
enterprise-server: '*'
|
||||
---
|
||||
|
@ -46,7 +46,7 @@ admin@github-example-com:~$ █
|
|||
|
||||
#### Fehlerbehebung bei SSH-Verbindungsproblemen
|
||||
|
||||
Wenn der Fehler `Permission denied (publickey)` (Berechtigung verweigert (öffentlicher Schlüssel)) angezeigt wird, wenn Sie versuchen, über SSH eine Verbindung zu {% data variables.product.product_location_enterprise %} herzustellen, sollten Sie bestätigen, dass Sie die Verbindung über Port 122 vornehmen. Möglicherweise müssen Sie explizit angeben, welcher private SSH-Schlüssel verwendet werden soll.
|
||||
Wenn der Fehler `Permission denied (publickey)` (Berechtigung verweigert (öffentlicher Schlüssel)) angezeigt wird, wenn Sie versuchen, über SSH eine Verbindung zu {% data variables.product.product_location %} herzustellen, sollten Sie bestätigen, dass Sie die Verbindung über Port 122 vornehmen. Möglicherweise müssen Sie explizit angeben, welcher private SSH-Schlüssel verwendet werden soll.
|
||||
|
||||
Führen Sie zum Angeben eines privaten SSH-Schlüssels an der Befehlszeile `ssh` mit dem Argument `-i` aus.
|
||||
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Accessing the management console
|
||||
intro: 'Mit der {% data variables.enterprise.management_console %} können Sie {% data variables.product.product_location %} einrichten und konfigurieren, Wartungsfenster planen, Fehler beheben und Ihre Lizenz verwalten.'
|
||||
intro: '{% data reusables.enterprise_site_admin_settings.about-the-management-console %}'
|
||||
redirect_from:
|
||||
- /enterprise/admin/articles/about-the-management-console/
|
||||
- /enterprise/admin/articles/management-console-for-emergency-recovery/
|
||||
|
@ -17,15 +17,15 @@ versions:
|
|||
### Informationen zur {% data variables.enterprise.management_console %}
|
||||
|
||||
{% data variables.enterprise.management_console %} für grundlegende Verwaltungsaktivitäten verwenden:
|
||||
- **Initial setup** (Ersteinrichtung): Durchlaufen Sie beim ersten Start von {% data variables.product.product_location_enterprise %} den Ersteinrichtungsprozess. Rufen Sie dazu in Ihrem Browser die IP-Adresse Ihrer {% data variables.product.product_location_enterprise %} auf.
|
||||
- **Initial setup** (Ersteinrichtung): Durchlaufen Sie beim ersten Start von {% data variables.product.product_location %} den Ersteinrichtungsprozess. Rufen Sie dazu in Ihrem Browser die IP-Adresse Ihrer {% data variables.product.product_location %} auf.
|
||||
- **Configuring basic settings for your instance** (Grundlegende Einstellungen für Ihre Instanz konfigurieren): Auf der Seite „Settings“ (Einstellungen) können Sie DNS, den Hostnamen, SSL, die Benutzerauthentifizierung, E-Mail, Überwachungsdienste und die Protokollweiterleitung konfigurieren.
|
||||
- **Scheduling maintenance windows** (Wartungsfenster planen): Nehmen Sie Ihre {% data variables.product.product_location_enterprise %} offline, während Sie eine Wartung mithilfe der {% data variables.enterprise.management_console %} oder der Verwaltungsshell durchführen.
|
||||
- **Scheduling maintenance windows** (Wartungsfenster planen): Nehmen Sie Ihre {% data variables.product.product_location %} offline, während Sie eine Wartung mithilfe der {% data variables.enterprise.management_console %} oder der Verwaltungsshell durchführen.
|
||||
- **Troubleshooting** (Fehlerbehebung): Generieren Sie ein Support-Bundle, oder zeigen Sie allgemeine Diagnoseinformationen an.
|
||||
- **License management** (Lizenzverwaltung): Zeigen Sie Ihre {% data variables.product.prodname_enterprise %}-Lizenz an, oder aktualisieren Sie sie.
|
||||
|
||||
Sie können jederzeit mithilfe der IP-Adresse von {% data variables.product.product_location_enterprise %} auf die {% data variables.enterprise.management_console %} zugreifen, selbst wenn sich die Instanz im Wartungsmodus befindet oder wenn ein kritischer Anwendungsfehler oder eine falsche Hostnamen- oder SSL-Konfiguration vorliegt.
|
||||
Sie können jederzeit mithilfe der IP-Adresse von {% data variables.product.product_location %} auf die {% data variables.enterprise.management_console %} zugreifen, selbst wenn sich die Instanz im Wartungsmodus befindet oder wenn ein kritischer Anwendungsfehler oder eine falsche Hostnamen- oder SSL-Konfiguration vorliegt.
|
||||
|
||||
Verwenden Sie das während der Ersteinrichtung von {% data variables.product.product_location_enterprise %} festgelegte Administratorpasswort, um auf die {% data variables.enterprise.management_console %} zuzugreifen. Zudem müssen Sie auf Port 8443 eine Verbindung zum Host der virtuellen Maschine herstellen können. Wenn Sie Probleme haben, auf {% data variables.enterprise.management_console %} zuzugreifen, sollten Sie die Konfigurationen für die Zwischenfirewall und für die Sicherheitsgruppe überprüfen.
|
||||
Verwenden Sie das während der Ersteinrichtung von {% data variables.product.product_location %} festgelegte Administratorpasswort, um auf die {% data variables.enterprise.management_console %} zuzugreifen. Zudem müssen Sie auf Port 8443 eine Verbindung zum Host der virtuellen Maschine herstellen können. Wenn Sie Probleme haben, auf {% data variables.enterprise.management_console %} zuzugreifen, sollten Sie die Konfigurationen für die Zwischenfirewall und für die Sicherheitsgruppe überprüfen.
|
||||
|
||||
### Auf die {% data variables.enterprise.management_console %} als ein Websiteadministrator zugreifen
|
||||
|
||||
|
|
Некоторые файлы не были показаны из-за слишком большого количества измененных файлов Показать больше
Загрузка…
Ссылка в новой задаче