Repo sync

.github/actions/node-npm-setup/action.yml

@@ -13,8 +13,7 @@ runs:
         SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
       with:
         path: node_modules
-        # The postinstall script applies patches/ during npm ci, so patch changes must miss the cache.
-        key: ${{ runner.os }}-node_modules-${{ hashFiles('package*.json', 'patches/**') }}-${{ hashFiles('.github/actions/node-npm-setup/action.yml') }}
+        key: ${{ runner.os }}-node_modules-${{ hashFiles('package*.json') }}-${{ hashFiles('.github/actions/node-npm-setup/action.yml') }}
 
     # The npm download cache only helps npm ci, so skip its 153 MB restore when node_modules hits.
     - name: Setup Node.js

.github/instructions/code.instructions.md

@@ -1,5 +1,5 @@
 ---
-applyTo: "src/**,.github/**,config/**,.devcontainer/**,**Dockerfile,package*.json"
+applyTo: "src/**,.github/**,config/**,.devcontainer/**,**Dockerfile,.dockerignore,package*.json"
 ---
 
 # Copilot code instructions for docs.github.com

.github/workflows/lint-entire-content-data-markdown.yml

@@ -34,13 +34,23 @@ jobs:
         run: npm run lint-content -- --paths content data --output-file /tmp/lint-results.json
 
       - name: Open issue in docs-content
-        if: ${{ always() && steps.linting-content-data.outcome == 'failure' }}
+        if: ${{ always() && steps.linting-content-data.outcome != 'skipped' }}
         env:
           GITHUB_TOKEN: ${{ secrets.DOCS_BOT_PAT_BASE }}
           REPORT_AUTHOR: docs-bot
           REPORT_LABEL: broken content markdown report
           REPORT_REPOSITORY: github/docs-content
-        run: npm run lint-report -- --path /tmp/lint-results.json
+          LINT_OUTCOME: ${{ steps.linting-content-data.outcome }}
+        # The linter exits 0 with warnings only, and writes no results file when the content is clean.
+        run: |
+          if [ -f /tmp/lint-results.json ]; then
+            npm run lint-report -- --path /tmp/lint-results.json
+          elif [ "$LINT_OUTCOME" != success ]; then
+            echo "Content linter failed without writing /tmp/lint-results.json"
+            exit 1
+          else
+            echo "No lint results to report"
+          fi
 
       - uses: ./.github/actions/create-workflow-failure-issue
         id: create-failure-issue

.github/workflows/reviewers-docs-engineering.yml

@@ -23,6 +23,7 @@ on:
       - 'config/**'
       - '.devcontainer/**'
       - '**Dockerfile'
+      - '.dockerignore'
       - 'package*.json'
       - .github/workflows/reviewers-docs-engineering.yml
 
@@ -85,7 +86,7 @@ jobs:
             exit 0
           fi
           lockfile=$(echo "$changed" | grep -c '^package-lock\.json$' || true)
-          other_eng=$(echo "$changed" | grep -cE '(\.tsx?$|\.scss$|^src/|^package\.json$|^\.github/|^config/|^\.devcontainer/|Dockerfile)' || true)
+          other_eng=$(echo "$changed" | grep -cE '(\.tsx?$|\.scss$|^src/|^package\.json$|^\.github/|^config/|^\.devcontainer/|Dockerfile|^\.dockerignore$)' || true)
           if [ "$lockfile" -gt 0 ] && [ "$other_eng" -eq 0 ]; then
             echo "lockfile_only=true" >> "$GITHUB_OUTPUT"
           else

Dockerfile

@@ -43,7 +43,6 @@ FROM base AS all_deps
 USER node:node
 WORKDIR $APP_HOME
 COPY --chown=node:node package.json package-lock.json ./
-COPY --chown=node:node patches patches/
 RUN npm ci --registry https://registry.npmjs.org/
 
 FROM all_deps AS prod_deps

content/billing/how-tos/products/view-productlicense-use.md

@@ -107,6 +107,8 @@ You can use the view to answer questions such as:
 
 For information about {% data variables.product.prodname_copilot_short %} allowances and how {% data variables.product.prodname_ai_credits_short %} are pooled across your enterprise, see [AUTOTITLE](/copilot/concepts/billing-and-usage/organizations-and-enterprises/billing).
 
+App attribution is not available in the **AI usage** view. To identify usage from a {% data variables.product.prodname_github_app %} installed on an organization, download an AI usage report. Use the “List app installations for an organization” REST API endpoint and match `app_client_id` in the report to `client_id` in the response. The response’s `app_slug` identifies the app, and `id` identifies the installation. See [AUTOTITLE](/rest/orgs/orgs#list-app-installations-for-an-organization). For report field definitions, see [AUTOTITLE](/billing/reference/billing-reports#usage-report-fields).
+
 For information about {% data variables.product.prodname_AS %} AI-credit billing, see [AUTOTITLE](/billing/concepts/product-billing/github-advanced-security#how-ai-feature-usage-is-billed).
 
 {% endif %}

content/billing/reference/billing-reports.md

@@ -68,6 +68,9 @@ The usage reports contain the following fields.
 | `net_amount`             | The billable amount of usage after applying the `discount_amount`. This is the amount that your account will be billed. `gross_amount - discount_amount = net_amount` |
 | `username`               | The user associated with the usage, if applicable. <br><br> Not included in the `Summarized usage report`. |
 | `organization`           | The organization associated with the usage, if applicable. |
+| {% ifversion copilot %} |
+| `app_client_id` | The client ID of the {% data variables.product.prodname_github_app %} associated with usage billed directly to an organization. Use this field with `organization` to identify an app installation. The field is empty for usage attributed to a user, {% data variables.product.prodname_actions %}, other {% data variables.product.company_short %}-owned apps, and usage from before app attribution was available. <br><br>Only available in the `AI usage report` |
+| {% endif %} |
 | `repository`             | The repository associated with the usage, if applicable. |
 | `workflow_path`          | The path of the {% data variables.product.prodname_actions %} workflow that generated the usage, if applicable. <br><br>Only available in the `Detailed usage report` |
 | `cost_center_name`       | The cost center associated with the usage, if applicable. |

content/copilot/concepts/billing-and-usage/organizations-and-enterprises/billing.md

@@ -29,6 +29,14 @@ The cost of an interaction depends on two things: the model and the number of to
 
 Code completions and {% data variables.copilot.next_edit_suggestions %} are **not** billed in {% data variables.product.prodname_ai_credits_short %}. They remain unlimited for all paid plans.
 
+## How is {% data variables.product.prodname_github_app %} usage billed?
+
+A {% data variables.product.prodname_github_app %} installed on an organization can use an installation access token to make {% data variables.product.prodname_copilot_short %} requests without a user signing in. The organization that owns the installation pays for the usage, and the organization’s model policies and spending controls apply.
+
+You cannot create a budget for an individual app or installation. This authentication method does not require the **Allow use of Copilot CLI billed to the organization** policy, which applies to a different authentication path.
+
+For information about approving access, identifying app usage, and blocking an app, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-organization/manage-app-copilot-access).
+
 ## How do {% data variables.product.prodname_ai_credits_short %} work?
 
 Each assigned {% data variables.product.prodname_copilot_short %} license comes with a monthly amount of **included {% data variables.product.prodname_ai_credits_short %}**:

content/copilot/concepts/billing-and-usage/organizations-and-enterprises/budgets.md

@@ -95,6 +95,8 @@ An organization budget caps metered charges for users who receive their {% data
 
 Organization budgets are the only budget option available to organization owners. They can only further restrict usage below any budget set by an enterprise admin, and they cannot override a higher-level budget.
 
+Usage billed directly to an organization from a {% data variables.product.prodname_github_app %} installation counts against the organization budget. You cannot create a budget for an individual app or installation. If **Stop usage when budget limit is reached** is not enabled, the budget only sends alerts and app spending continues after the limit is reached. For information about managing app access, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-organization/manage-app-copilot-access).
+
 If a user receives {% data variables.product.prodname_copilot_short %} licenses from multiple organizations, {% data variables.product.github %} picks one organization at random each billing cycle to bill the seat. This means the user's spend could count against a different organization's budget from month to month, making enforcement unpredictable. To avoid this, ensure each user has a single license through one organization, or use cost center budgets with direct user assignment.
 
 ### Enterprise budget

content/copilot/how-tos/administer-copilot/manage-for-organization/index.md

@@ -14,6 +14,7 @@ children:
   - /manage-plan
   - /manage-access
   - /manage-policies
+  - /manage-app-copilot-access
   - /add-copilot-cloud-agent
   - /configure-runner-for-coding-agent
   - /prepare-for-custom-agents
@@ -22,4 +23,3 @@ children:
   - /enable-custom-models
 contentType: how-tos
 ---
-

content/copilot/how-tos/administer-copilot/manage-for-organization/manage-app-copilot-access.md

@@ -0,0 +1,63 @@
+---
+title: Manage GitHub Apps that use your organization's Copilot
+shortTitle: Manage GitHub App access
+allowTitleToDifferFromFilename: true
+intro: "Control which {% data variables.product.prodname_github_apps %} can use your organization's {% data variables.product.prodname_copilot_short %} and attribute their spending."
+versions:
+  fpt: '*'
+  ghec: '*'
+permissions: Organization owners
+product: '{% data variables.copilot.copilot_enterprise_short %} or {% data variables.copilot.copilot_business_short %}'
+contentType: how-tos
+category:
+  - Manage Copilot for a team
+---
+
+> [!NOTE]
+> {% data reusables.copilot.org-app-s2s-preview %}
+
+A {% data variables.product.prodname_github_app %} installed on an organization can use its own installation access token to make {% data variables.product.prodname_copilot_short %} requests without a user signing in. The organization that owns the installation pays for the usage.
+
+## Understand access and billing
+
+The app must have the organization **{% data variables.product.prodname_copilot_short %} Requests** permission set to **Read-only**. In this context, **Read-only** does not mean that the app cannot incur costs. The permission authorizes the app to make requests that consume your organization’s {% data variables.product.prodname_ai_credits_short %}.
+
+This authentication method has the following boundaries:
+
+* It applies to apps installed on an organization. Personal account and enterprise installations cannot use this authentication method.
+* The app can use only models allowed by your organization’s {% data variables.product.prodname_copilot_short %} policies.
+* Your organization’s {% data variables.product.prodname_copilot_short %} billing and spending controls apply. You cannot create a budget for an individual app or installation.
+* You do not need to enable the **Allow use of {% data variables.copilot.copilot_cli_short %} billed to the organization** policy. That policy applies to a different authentication path.
+
+This method differs from user authorization, where requests use a user’s identity and are attributed according to that user’s {% data variables.product.prodname_copilot_short %} access. It also differs from {% data variables.product.prodname_actions %}, where workflows use the built-in `GITHUB_TOKEN` and {% data variables.product.prodname_actions %}-specific policies and budgets.
+
+## Review an app before approving access
+
+Only approve apps that you trust to spend your organization’s {% data variables.product.prodname_copilot_short %} usage.
+
+1. Confirm the app’s owner, purpose, and expected usage with the team requesting access.
+1. Review all requested organization and repository permissions. Confirm that **{% data variables.product.prodname_copilot_short %} Requests** is an organization permission set to **Read-only**.
+1. Review your organization’s model policies and spending controls. If a budget must stop additional usage, make sure **Stop usage when budget limit is reached** is enabled.
+1. Install the app or approve its updated permissions.
+
+For instructions on installing an app, see [AUTOTITLE](/apps/using-github-apps/installing-a-github-app-from-a-third-party). If an installed app adds the permission, see [AUTOTITLE](/apps/using-github-apps/approving-updated-permissions-for-a-github-app).
+
+## Identify app usage
+
+App attribution is available in CSV exports, not in the **AI usage** view on {% data variables.product.github %}.
+
+1. Download an AI usage report. See [AUTOTITLE](/billing/how-tos/products/view-productlicense-use#downloading-usage-reports).
+1. Find rows with your organization in the `organization` column and a value in `app_client_id`.
+1. Use the “List app installations for an organization” REST API endpoint and match `app_client_id` from the report to `client_id` in the response. The `app_slug` value identifies the app. See [AUTOTITLE](/rest/orgs/orgs#list-app-installations-for-an-organization).
+
+The `app_client_id` field is empty for usage attributed to a user, {% data variables.product.prodname_actions %}, other {% data variables.product.company_short %}-owned apps, and historical usage from before app attribution was available. For full field definitions, see [AUTOTITLE](/billing/reference/billing-reports#usage-report-fields).
+
+## Control app spending
+
+Usage from an organization-installed app counts against the organization’s {% data variables.product.prodname_copilot_short %} budget. A budget that only sends alerts does not stop spending. To block requests after the limit is reached, enable **Stop usage when budget limit is reached**.
+
+You cannot create a budget for one app or installation. For more information about organization-level controls, see [AUTOTITLE](/copilot/concepts/billing-and-usage/organizations-and-enterprises/budgets).
+
+## Block an app's access
+
+To stop requests from one app installation, suspend or uninstall it for your organization. This also blocks the installation's access to other organization resources. See [AUTOTITLE](/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access).

content/copilot/how-tos/copilot-sdk/auth/authenticate.md

@@ -462,7 +462,7 @@ For multi-user server mode, pass a per-session `gitHubToken` so each session run
 
 ## Disabling auto-login
 
-To prevent the SDK from automatically using stored credentials or `gh` CLI auth, configure it to disable logged-in-user fallback:
+To prevent the SDK from automatically using stored credentials or `gh` CLI auth, configure it to disable logged-in-user fallback. This also ignores environment variable tokens such as `COPILOT_GITHUB_TOKEN`, so you must pass a token through the SDK's explicit token option. The examples below show only the fallback setting:
 
 {% codetabs %}
 {% codetab dotnet %}