You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 2d80e51
Browse filesBrowse the repository at this point in the historyBrowse files
FROM ghcr.io/github/gh-base-image/gh-base-noble:20261020-225427-g5ec2175c5@sha256:931ce7d43f6f3dbe28113cb12f5fac2206a0b08dad395172f6d73ce4f95f77f3 AS base
7
+
FROM ghcr.io/github/gh-base-image/gh-base-noble:20261022-141141-gfa3bc27f7@sha256:c1175f242e207eeaf679305e553b6f1a2f69d06fa7b3840b199c5c33da2de130 AS base
8
8
# Install curl for NodeSource setup.
9
9
# Install git for early-access and translation clones.
10
10
# Ubuntu's nodejs package lags the Node LTS release line.
Copy file name to clipboardExpand all lines: content/actions/reference/security/securely-using-pull_request_target.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -61,7 +61,7 @@ To help protect your workflows from untrusted pull requests, {% data variables.p
61
61
62
62
For public repositories that do not already have an applicable Actions event policy, GitHub adds a default policy that blocks workflows triggered by `pull_request_target`. For more information about policies, see [AUTOTITLE](/actions/concepts/about-actions-policies).
63
63
64
-
<!-- expires 2026-11-02 -->
64
+
<!-- expires 2026-12-02 -->
65
65
<!-- default policy flips to active -->
66
66
67
67
The default policy:
@@ -70,9 +70,9 @@ The default policy:
70
70
* Does not replace an applicable event policy that you have already configured.
71
71
* Currently runs in **evaluate** mode. In this mode, workflow runs continue, but you can use policy insights to identify runs that would be blocked after enforcement.
72
72
73
-
On November 2, 2026, GitHub will enforce the default policy for affected repositories that were using the default `pull_request_target` policy before general availability.
73
+
On December 2, 2026, GitHub will enforce the default policy for affected repositories that were using the default `pull_request_target` policy before general availability.
Copy file name to clipboardExpand all lines: content/apps/using-github-apps/installing-a-github-app-on-your-enterprise.md
+2-5Lines changed: 2 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,9 +13,6 @@ docsTeamMetrics:
13
13
- enterprise-onboarding
14
14
---
15
15
16
-
> [!NOTE]
17
-
> Enterprise-installed {% data variables.product.prodname_github_apps %} are in {% data variables.release-phases.public_preview %} and subject to change.
18
-
19
16
## About installing {% data variables.product.prodname_github_apps %} on your enterprise
20
17
21
18
Enterprise-installed {% data variables.product.prodname_github_apps %} are apps that request enterprise-level permissions and can perform operations on your enterprise account. Unlike organization or user installations, they do not have access to any organization or repository permissions—they only manage the enterprise itself.
@@ -54,11 +51,11 @@ The installation token for an enterprise-installed {% data variables.product.pro
54
51
55
52
## Current limitations
56
53
57
-
Enterprise-installed {% data variables.product.prodname_github_apps %} are currently in {% data variables.release-phases.public_preview %} with the following limitations.
54
+
Enterprise-installed {% data variables.product.prodname_github_apps %} have some limitations in what they're able to do.
58
55
59
56
### API support
60
57
61
-
Not all APIs support enterprise-installed {% data variables.product.prodname_github_apps %} yet. As more permissions are built and APIs updated, support will become broader. For more information about the APIs and permissions that support enterprise-installed {% data variables.product.prodname_github_apps %}, see [AUTOTITLE](/rest/authentication/permissions-required-for-github-apps).
58
+
Not all APIs support enterprise-installed {% data variables.product.prodname_github_apps %} yet. As more permissions are built and APIs updated, support will become broader. For more information about the APIs and permissions that support enterprise-installed {% data variables.product.prodname_github_apps %}, see [AUTOTITLE](/rest/authentication/permissions-required-for-github-apps) and [AUTOTITLE](/graphql/guides/managing-enterprise-accounts).
Copy file name to clipboardExpand all lines: content/code-security/how-tos/view-and-interpret-data/analyze-organization-data/viewing-public-monitoring-alerts.md
+29-3Lines changed: 29 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,8 @@
1
1
---
2
-
title: Viewing public monitoring alerts
3
-
shortTitle: View public monitoring alerts
2
+
title: Viewing and managing public monitoring alerts
3
+
shortTitle: View and manage public monitoring alerts
4
4
allowTitleToDifferFromFilename: true
5
-
intro: 'Find out which credentials your enterprise members have exposed in public repositories across {% data variables.product.github %}.'
5
+
intro: 'Find and manage alerts for credentials your enterprise members have exposed in public repositories across {% data variables.product.github %}.'
6
6
permissions: 'Enterprise owners can access the public monitoring page in security overview.'
7
7
versions:
8
8
feature: secret-scanning-public-monitoring
@@ -43,3 +43,29 @@ Public monitoring must be enabled for your enterprise. See [AUTOTITLE](/code-sec
43
43
* Attribution details, including the committer's username and email
44
44
* The file location where the secret was detected, with the secret highlighted in context
45
45
* A **Recommendations** tab with suggested remediation steps
46
+
47
+
## Dismissing and reopening alerts
48
+
49
+
When you have reviewed an alert, you can dismiss it to remove it from the list of open alerts. If you need to revisit a dismissed alert later, you can reopen it. When you dismiss or reopen an alert, you can add an optional comment to record the reason for your decision.
50
+
51
+
Dismissing alerts you have already triaged helps you manage a high volume of public monitoring alerts, keeping the active list focused on the exposures that still need attention.
52
+
53
+
### Dismissing an alert
54
+
55
+
{% data reusables.enterprise-accounts.access-enterprise %}
56
+
{% data reusables.enterprise-accounts.security-and-code-quality-tab %}
57
+
1. In the left sidebar, click **{% octicon "key" aria-hidden="true" aria-label="key" %} Public monitoring**.
58
+
1. Click the alert you want to dismiss.
59
+
1. Select the **Close as** dropdown menu, then click a reason for dismissing the alert.
60
+
1. Optionally, in the comment field, add a dismissal comment.
61
+
1. To confirm, click **Dismiss**.
62
+
63
+
### Reopening an alert
64
+
65
+
{% data reusables.enterprise-accounts.access-enterprise %}
66
+
{% data reusables.enterprise-accounts.security-and-code-quality-tab %}
67
+
1. In the left sidebar, click **{% octicon "key" aria-hidden="true" aria-label="key" %} Public monitoring**.
68
+
1. To view closed alerts, click **Closed**, then click the alert you want to reopen.
69
+
1. Click **Reopen alert**.
70
+
1. Optionally, in the comment field, type a reason for reopening the alert.
Copy file name to clipboardExpand all lines: content/code-security/reference/supply-chain-security/dependency-graph-supported-package-ecosystems.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -61,6 +61,7 @@ In the table below:
61
61
> * If you list your Python dependencies within a `setup.py` file, we may not be able to parse and list every dependency in your project.
62
62
> * {% data variables.product.prodname_actions %} workflows must be located in the `.github/workflows/` directory of a repository to be recognized as manifests. Any actions or workflows referenced using the syntax `jobs[*].steps[*].uses` or `jobs.<job_id>.uses` will be parsed as dependencies. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax).
63
63
> * {% data reusables.dependabot.dependabot-alert-actions-semver %} For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts) and [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-version-updates).
64
+
{% ifversion dependabot-npm12-pnpm11-pnpm12-bun14 %}> * When pnpm writes `pnpm-lock.yaml` as two YAML documents, the dependency graph does not detect the dependencies in that file. This is the default format for pnpm 12 projects that pin a pnpm version. For more information, see [AUTOTITLE](/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories#pnpm).{% endif %}
Copy file name to clipboardExpand all lines: content/copilot/concepts/billing-and-usage/copilot-usage-metrics/copilot-metrics.md
+45-1Lines changed: 45 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,6 +52,20 @@ The data **does not include** activity from other {% data variables.product.prod
52
52
53
53
License and seat management data are not included in {% data variables.product.prodname_copilot_short %} usage metrics reports. To view or manage license assignments, use the {% data variables.product.prodname_copilot_short %} user management API, which is the source of truth for license and seat information. See [AUTOTITLE](/rest/copilot/copilot-user-management).
54
54
55
+
### Troubleshooting missing usage data
56
+
57
+
Detailed breakdowns depend on client-side telemetry from the IDE or {% data variables.copilot.copilot_cli_short %}. This telemetry provides data about features, languages, models, accepted suggestions, and lines of code. Server-side telemetry can show that a user was active, but it can't observe what happens in the editor.
58
+
59
+
If client-side telemetry is missing, reports may contain lower numbers or empty breakdowns even when server-side data shows activity. Common causes include:
60
+
61
+
| Cause | Effect on your reports | What you can check |
62
+
|:--|:--|:--|
63
+
| Telemetry is turned off in the IDE, for example with the `telemetry.telemetryLevel` setting in {% data variables.product.prodname_vscode_shortname %}. | The IDE sends no detailed activity. The user may still be counted as active through server-side telemetry, but feature, language, and lines of code breakdowns are empty. | Confirm that IDE telemetry is enabled for your developers. |
64
+
| A network proxy, firewall, or VPN blocks the {% data variables.product.prodname_copilot_short %} telemetry endpoint. | Same as when telemetry is turned off. | Allow the {% data variables.product.prodname_copilot_short %} client telemetry endpoint. See [AUTOTITLE](/copilot/reference/copilot-allowlist-reference). |
65
+
| The client isn't a supported IDE and doesn't send {% data variables.product.prodname_copilot_short %} telemetry. | The user may be counted as active through server-side telemetry, but the client doesn't appear in `totals_by_ide` or detailed breakdowns. | Use a supported IDE for complete metrics. |
66
+
67
+
If a gap persists after you check the causes above, contact {% data variables.contact.contact_support %} and include the affected users, IDEs, versions, and dates.
68
+
55
69
## Why {% data variables.product.prodname_copilot_short %} usage metrics may differ across API resources
56
70
57
71
The following API resources expose {% data variables.product.prodname_copilot_short %}-related data, but they are not interchangeable and should not be compared directly. Each API resource is designed for a specific use case and data model, and differences in totals or coverage are expected. Use this table to understand which API resource best fits your reporting needs.
@@ -88,20 +102,48 @@ In short: users must be licensed somewhere in the enterprise to appear in its me
88
102
89
103
To be included in the {% data variables.product.prodname_copilot_short %} usage metrics, end users must use one of the following IDEs and {% data variables.copilot.copilot_chat_short %} extension versions.
90
104
105
+
Older versions may not send all the events that usage metrics rely on, or may attribute activity to the wrong IDE. Keep IDEs and {% data variables.product.prodname_copilot_short %} extensions current, and use device management tooling to enforce these minimum versions where possible.
106
+
91
107
| IDE | Minimum IDE version | Minimum {% data variables.copilot.copilot_chat_short %} extension version |
92
108
|:--|:--|:--|
93
109
| Eclipse | 4.31 | 0.9.3.202507240902 |
94
110
| JetBrains / IntelliJ | 2024.2.6 | 1.5.52-241 |
95
111
| {% data variables.product.prodname_vs %} | 17.14.13 | 18.0.471.29466 |
96
112
| {% data variables.product.prodname_vscode_shortname %} | 1.107.1 | 0.35.3 |
97
-
| Xcode | 13.2.1 | 0.40.0 |
113
+
| Xcode | 14.3.1 | 0.40.0 |
114
+
115
+
In per-user reports, each `totals_by_ide` entry includes `last_known_ide_version` and `last_known_plugin_version`. Use these fields to identify developers who need to update. See [AUTOTITLE](/copilot/reference/copilot-usage-metrics/copilot-usage-metrics).
116
+
117
+
### Version requirements for SDK-based agent activity
118
+
119
+
Some IDEs run {% data variables.product.prodname_copilot_short %} agent sessions through the {% data variables.product.prodname_copilot_short %} SDK. Some versions of these IDEs don't identify themselves when they send agent activity, so that activity is left out of usage metrics. This causes agent interactions and agent lines of code to be undercounted. To include this activity, end users must use one of the following versions or later:
120
+
121
+
| IDE | Minimum version for SDK-based agent activity | Affected versions |
122
+
|:--|:--|:--|
123
+
| {% data variables.product.prodname_vscode_shortname %} | 1.139.0 | 1.134 through 1.138, when using the agent window |
124
+
| {% data variables.product.prodname_copilot_short %} plugin for JetBrains IDEs | 1.20.0 | 1.15.0 through 1.19.x |
125
+
| {% data variables.product.prodname_vs %} | 18.12 | Insiders (preview) builds before 18.12 |
126
+
127
+
If you're planning IDE updates, move developers directly to these versions or later. Generally available versions of {% data variables.product.prodname_vs %} aren't affected.
128
+
129
+
For JetBrains IDEs, avoid {% data variables.product.prodname_copilot_short %} plugin versions 1.15.0 through 1.19.x.
130
+
131
+
Eclipse and Xcode don't run agent sessions through the {% data variables.product.prodname_copilot_short %} SDK, so they aren't affected.
132
+
133
+
Missing data can't be backfilled, because activity from affected versions doesn't identify which IDE it came from.
134
+
135
+
Some of this activity was counted as {% data variables.copilot.copilot_cli_short %} activity instead, which can inflate {% data variables.copilot.copilot_cli_short %} metrics. This clears up as developers update the affected IDEs, but earlier {% data variables.copilot.copilot_cli_short %} metrics can't be corrected. {% data variables.copilot.copilot_cli_short %} users don't need to update.
136
+
137
+
This issue affects only how activity is attributed in usage metrics. Billing is not affected.
98
138
99
139
## Data freshness
100
140
101
141
The data in the dashboards and API reports is updated on a regular schedule.
102
142
103
143
You can expect data to be available within **two full days**. This means that data for a given day is processed and made available within two full UTC days after that day closes.
104
144
145
+
Telemetry that is still being processed can make the most recent days appear incomplete. Wait for the processing window to close before investigating a gap.
146
+
105
147
## What does the data measure?
106
148
107
149
{% data variables.product.prodname_copilot_short %} usage metrics can be grouped into a few main categories: Adoption, engagement, acceptance rate, Lines of Code (LoC), and pull request lifecycle metrics.
@@ -116,6 +158,8 @@ You can expect data to be available within **two full days**. This means that da
116
158
117
159
**Pull request lifecycle metrics** measure how {% data variables.product.prodname_copilot_short %} activity relates to pull request outcomes and delivery flow. These metrics include pull request creation and merge counts, median time to merge, and review suggestion activity. By comparing overall pull request activity with pull requests created by {% data variables.product.prodname_copilot_short %}, you can evaluate how AI-assisted workflows influence throughput and cycle time at the organization or enterprise level.
118
160
161
+
Model breakdowns can include models that developers didn't select directly. For example, {% data variables.product.prodname_copilot_short %} can use other models for Auto model selection or for background tasks.
162
+
119
163
### Understanding adoption cohorts
120
164
121
165
Rather than measuring adoption as a single active-user count, {% data variables.product.prodname_copilot_short %} groups users into **adoption cohorts** based on how they engage with {% data variables.product.prodname_copilot_short %}, not just whether they engage at all. A flat active-user count treats someone who occasionally accepts a code completion the same as someone who orchestrates multiple agent-driven workflows throughout the day. Cohorting separates these two users, so you can see whether your organization's usage is deepening over time rather than plateauing at initial trial.
0 commit comments