Merge branch 'github:main' into main

Author: Analyzesa

Dockerfile

@@ -10,7 +10,7 @@
 # ---------------------------------------------------------------
 # To update the sha:
 # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble
-FROM ghcr.io/github/gh-base-image/gh-base-noble:20260903-185405-g03e243e8e@sha256:d7ed0adc25b453b64b7ba7bfb9c81b786063d9d18d0161a81effbba2ba109873 AS base
+FROM ghcr.io/github/gh-base-image/gh-base-noble:20260914-014148-gb620b63bf@sha256:fe199dcd96e01f53c42d077dee87f428e8341379aab0987721e16b32462feb05 AS base
 
 # Install curl for Node install and determining the early access branch
 # Install git for cloning docs-early-access & translations repos

content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise.md

@@ -146,23 +146,34 @@ You can define how long custom image versions are retained and when they become
   * **Default**: 60 days
   * **Configurable range**: 7–90 days
 
-## {% ifversion ghes %}Artifact, log, and cache settings{% else %}Artifact and log retention{% endif %}
+<!-- Anchor to maintain the existing "#artifact-and-log-retention" link from other articles. -->
+<a name="artifact-and-log-retention"></a>
+## {% ifversion ghes %}Check, workflow run, status, artifact, log, and cache settings{% else %}Check, workflow run, status, artifact and log retention{% endif %}
 
 {% ifversion ghes %}
 
-These policies control storage of artifacts, logs, and caches.
+These policies control storage of checks, workflow runs, commit statuses, artifacts, logs, and caches.
 
-### Artifact and log retention
+### Check, workflow run, status, artifact and log retention
 
 {% endif %}
 
-By default, artifacts and log files generated by workflows are retained for 90 days. {% ifversion ghes %}You can change this retention period to anywhere between 1 and 400 days.{% else %}You can change the retention period.
+By default, checks, workflow runs, commit statuses, and the artifacts and log files generated by workflows are retained for 90 days. {% ifversion ghes %}You can change this retention period to anywhere between 1 and 400 days.{% else %}You can change the retention period.
 
 * For public repositories, you can configure a period between 1 and 90 days.
 * For private and internal repositories, you can configure a period between 1 and 400 days.
 {% endif %}
 
-Changes only apply to new artifacts and log files.
+{% ifversion ghec %}
+
+> [!IMPORTANT]
+> Starting October 1, 2026, these policies will apply to checks, workflow runs, and commit statuses in addition to artifacts and logs. Until then, checks, workflow runs, and commit statuses are retained for 400+ days regardless of your configured retention period. Make sure to review your retention setting and make any adjustments before October 1. For more information, see [the {% data variables.product.company_short %} changelog](https://github.blog/changelog/2026-07-17-actions-retention-will-cover-checks-workflow-runs-and-statuses/).
+
+{% endif %}
+
+{% data reusables.actions.checks-and-statuses-retention-scope %}
+
+Changes only apply to new checks, workflow runs, commit statuses, artifacts, and log files.
 
 {% ifversion ghec %}
 

content/billing/how-tos/set-up-budgets.md

@@ -159,6 +159,10 @@ For an individual user-level budget, you can also change or clear the expiration
 1. In the list of budgets, click {% octicon "kebab-horizontal" aria-label="View actions" %} next to the budget you want to edit, and click **{% octicon "pencil" aria-hidden="true" aria-label="pencil" %} Edit** or **{% octicon "trash" aria-hidden="true" aria-label="trash" %} Delete**.
 1. Follow the prompts.
 
+### Managing requests for additional budget
+
+When a member exhausts a {% data variables.product.prodname_copilot_short %} {% data variables.product.prodname_ai_credits_short %} budget, they can ask you to increase it. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-budget-requests).
+
 ### Controlling included usage for a cost center
 
 Budgets cap metered charges after the shared pool of {% data variables.product.prodname_ai_credits_short %} is exhausted. To cap how much of the pool a cost center can use **before** the metered phase, use an included usage control. {% data variables.product.github %} sets the cap automatically based on the licenses assigned to the cost center, and you choose whether members are blocked or roll into paid overage when the cap is reached. See [AUTOTITLE](/copilot/concepts/billing-and-usage/organizations-and-enterprises/budgets#included-usage-controls-for-cost-centers) and [AUTOTITLE](/billing/concepts/cost-centers).

content/billing/reference/billing-roles.md

@@ -39,6 +39,7 @@ You have full administrative access to your organization. You can:
 
 * View metered usage and budgets for your organization and its repositories.
 * Set budgets for the organization and its repositories.
+* Review requests from members for additional {% data variables.product.prodname_copilot_short %} budget.
 * Download CSV usage reports.
 * View promotions and discounts.
 * View spending for pre-purchased user licenses for {% data variables.product.prodname_AS %} based on your usage.
@@ -57,6 +58,7 @@ You can:
 * See enterprise usage, including costs for organizations and repositories.
 * Download CSV usage reports for products your enterprise is using.
 * Set budgets for your enterprise.
+* Review requests from members for additional {% data variables.product.prodname_copilot_short %} budget.
 * Create cost centers for all organizations within your enterprise.
 * View and manage user licenses.
 * Manage other billing settings, such as payment methods and billing contacts.

content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/create-custom-configuration.md

@@ -70,7 +70,7 @@ When creating a security configuration, keep in mind that:
 1. Optionally, in the "Policy" section, you can use additional options to control how the configuration is applied:
    * **Use as default for newly created repositories**. Select the **None** {% octicon "triangle-down" aria-hidden="true" aria-label="triangle-down" %} dropdown menu, then click **Public**, **Private and internal**, or **All repositories**.
         {% data reusables.security-configurations.default-configuration-exception-repo-transfers %}
-   * **Enforce configuration**. Block repository owners from changing features that are enabled or disabled by the configuration (features that are not set aren't enforced). Select **Enforce** from the dropdown menu.
+   * **Enforce configuration**. {% ifversion security-configuration-enterprise-organization-enforcement %}{% data reusables.permissions.security-configuration-enterprise-enable %} can block repository owners only, or both repository and organization owners, from changing features that are enabled or disabled by the configuration. Features that are not set aren't enforced. Select **Don't enforce**, **Enforce for repository owners**, or **Enforce for repository and organization owners** from the dropdown menu.{% else %}Block repository owners from changing features that are enabled or disabled by the configuration (features that are not set aren't enforced). Select **Enforce** from the dropdown menu.{% endif %}
 
     {% data reusables.code-scanning.security-configuration-enforcement-edge-cases %}
 
@@ -111,8 +111,7 @@ When creating a security configuration, keep in mind that:
 1. Optionally, in the "Policy" section, you can use additional options to control how the configuration is applied:
    * **Use as default for newly created repositories**. Select the **None** {% octicon "triangle-down" aria-hidden="true" aria-label="triangle-down" %} dropdown menu, then click **Public**, **Private and internal**, or **All repositories**.
         {% data reusables.security-configurations.default-configuration-exception-repo-transfers %}
-   * **Enforce configuration**. Block repository owners from changing features that are enabled or disabled by the configuration (features that are not set aren't enforced). Select **Enforce** from the dropdown menu.
-
+   * **Enforce configuration**. {% ifversion security-configuration-enterprise-organization-enforcement %}{% data reusables.permissions.security-configuration-enterprise-enable %} can block repository owners only, or both repository and organization owners, from changing features that are enabled or disabled by the configuration. Features that are not set aren't enforced. Select **Don't enforce**, **Enforce for repository owners**, or **Enforce for repository and organization owners** from the dropdown menu.{% else %}Block repository owners from changing features that are enabled or disabled by the configuration (features that are not set aren't enforced). Select **Enforce** from the dropdown menu.{% endif %}
     {% data reusables.code-scanning.security-configuration-enforcement-edge-cases %}
 
 {% data reusables.code-scanning.save-custom-configuration %}

content/code-security/how-tos/secure-at-scale/configure-enterprise-security/manage-your-coverage/edit-custom-configuration.md

@@ -25,7 +25,7 @@ After creating and applying a {% data variables.product.prodname_custom_security
 1. In the "Configurations" section, click the name of the {% data variables.product.prodname_custom_security_configuration %} you want to edit.
 1. Edit the name and description of your {% data variables.product.prodname_custom_security_configuration %} as desired.
 1. Edit the enablement settings of your {% data variables.product.prodname_custom_security_configuration %} as desired.
-1. In the "Policy" section, you can modify the configuration's enforcement status. Enforcing a configuration will block repository owners from changing features that are enabled or disabled by the configuration, but features that are not set aren't enforced. Next to "Enforce configuration", select **Enforce** or **Don't enforce** from the dropdown menu.
+1. In the "Policy" section, you can modify the configuration's enforcement status. {% ifversion security-configuration-enterprise-organization-enforcement %}{% data reusables.permissions.security-configuration-enterprise-enable %} can block repository owners only, or both repository and organization owners, from changing features that are enabled or disabled by the configuration. Features that are not set aren't enforced. Select **Don't enforce**, **Enforce for repository owners**, or **Enforce for repository and organization owners** from the dropdown menu.{% else %}Enforcing a configuration will block repository owners from changing features that are enabled or disabled by the configuration, but features that are not set aren't enforced. Next to "Enforce configuration", select **Enforce** or **Don't enforce** from the dropdown menu.{% endif %}
 
     {% data reusables.code-scanning.security-configuration-enforcement-edge-cases %}
 

content/code-security/reference/security-at-scale/configuration-enforcement.md

@@ -13,8 +13,18 @@ redirect_from:
   - /code-security/reference/security-at-scale/security-configuration-enforcement
 ---
 
+{% ifversion security-configuration-enterprise-organization-enforcement %}
+
+{% data variables.product.prodname_security_configurations_caps %} can be enforced at the organization{% ifversion security-configuration-enterprise-level %} or enterprise{% endif %} level to prevent owners from changing the enablement status of configured security features.
+{% data reusables.permissions.security-configuration-enterprise-enable %}
+* At the **organization** level, enforcement means repository owners cannot change the enablement status of features that are enabled or disabled by the configuration.
+* At the **enterprise** level,  you can enforce for repository owners only, or for both repository and organization owners. When enforcement applies to both, neither repository owners nor organization owners can change the enablement status of features that are enabled or disabled by the configuration.
+{% else %}
+
 {% data variables.product.prodname_security_configurations_caps %} can be enforced, meaning repository owners cannot change the enablement status of features that are enabled or disabled by the configuration.
 
+{% endif %}
+
 ## Situations that break enforcement
 
 Some situations can break the enforcement of {% data variables.product.prodname_security_configurations %}. For example, the enablement of {% data variables.product.prodname_code_scanning %} will not apply to a repository if:

content/copilot/concepts/billing-and-usage/individuals/billing.md

@@ -88,6 +88,9 @@ For guidance on how to optimize your usage and reduce spend, including how to se
 
 ## What happens if I exceed my included {% data variables.product.prodname_ai_credits_short %}?
 
+> [!NOTE]
+> This section applies to users who are on a {% data variables.copilot.copilot_individuals_short %} plan. {% data reusables.copilot.request-ai-credit-allocation-increase %}
+
 When your {% data variables.product.prodname_ai_credits_short %} are exhausted, you can:
 
 * **Upgrade your plan.** As you approach your usage limits, {% data variables.product.prodname_copilot_short %} prompts you to upgrade to the next tier. The upgrade cost is only the price difference between your current plan and the new plan, _not_ the full price of the new plan. Your usage from earlier in the billing cycle is counted within the new plan's larger allowance, so the additional credits are available to you immediately. You won't be charged for both plans for the same period.

content/copilot/concepts/billing-and-usage/organizations-and-enterprises/budgets.md

@@ -165,6 +165,7 @@ A blocked user remains blocked until one of the following happens:
 
 * The next billing cycle begins and monthly consumption resets.
 * An administrator increases the relevant budget.
+* The user requests additional budget and an administrator approves the request.
 
 ## Next steps
 

content/copilot/concepts/enterprise/agent-management.md

@@ -9,6 +9,8 @@ category:
   - Learn about Copilot
 redirect_from:
   - /copilot/concepts/agents/enterprise-management
+docsTeamMetrics:
+  - ai-governance
 ---
 
 ## Overview