Repo sync

.github/workflows/triage-unallowed-contributions.yml

@@ -40,13 +40,13 @@ jobs:
           filters: 'src/workflows/unallowed-contribution-filters.yml'
 
       - name: Set up Node and dependencies
-        if: ${{ steps.filter.outputs.notAllowed || steps.filter.outputs.contentTypes}}
+        if: ${{ steps.filter.outputs.notAllowed == 'true' || steps.filter.outputs.contentTypes == 'true' }}
         uses: ./.github/actions/node-npm-setup
 
       # When there are changes to files we can't accept, leave a comment
-      # explaining this to the PR author
+      # explaining this to the PR author, and why their PR will close
       - name: "Comment about changes we can't accept"
-        if: ${{ steps.filter.outputs.notAllowed || steps.filter.outputs.contentTypes}}
+        if: ${{ steps.filter.outputs.notAllowed == 'true' || steps.filter.outputs.contentTypes == 'true' }}
         run: npm run unallowed-contributions
         env:
           REPO_OWNER_AND_NAME: ${{ github.repository }}

content/actions/concepts/runners/support-for-arc.md

@@ -17,20 +17,20 @@ contentType: concepts
 
 ## Overview
 
-The Actions Runner Controller (ARC) project [was adopted by GitHub](https://github.com/actions/actions-runner-controller/discussions/2072) to release as a new GitHub product. As a result, there are currently two ARC releases: the legacy community-maintained ARC and GitHub's Autoscaling Runner Sets.
+The Actions Runner Controller (ARC) project [was adopted by GitHub](https://github.com/actions/actions-runner-controller/discussions/2072) to release as a new GitHub product. As a result, there are currently two ARC releases: the legacy community-maintained ARC and GitHub's Autoscaling Runner Sets. {% data variables.product.company_short %}'s Autoscaling Runner Sets work with both Kubernetes and OpenShift.
 
 GitHub only supports the latest Autoscaling Runner Sets version of ARC. Support for the legacy ARC is provided by the community in the [Actions Runner Controller](https://github.com/actions/actions-runner-controller) repository only.
 
 ## Scope of support for Actions Runner Controller
 
-To ensure a smooth adoption of Actions Runner Controller, we recommend that organizations have a Kubernetes expert on staff. Many aspects of ARC installation, including container orchestration, networking, policy application, and integration with managed Kubernetes providers, fall outside GitHub Support’s scope and require in-depth Kubernetes knowledge. If your support request is outside of the scope of what our team can help you with, we may recommend next steps to resolve your issue outside of {% data variables.contact.github_support %}. Your support request is out of {% data variables.contact.github_support %}'s scope if the request is primarily about:
+To ensure a smooth adoption of {% data variables.product.prodname_actions_runner_controller %}, we recommend that organizations have staff with expert-level knowledge of container orchestration. Many aspects of ARC installation, including orchestration, networking, policy application, and integration with managed cluster providers, fall outside {% data variables.contact.github_support %}'s scope and require in-depth knowledge of your clustering tools (i.e. Kubernetes or OpenShift). If your support request is outside of the scope of what our team can help you with, we may be able to recommend next steps to help resolve your issue or provide other guidance. Your support request is out of {% data variables.contact.github_support %}'s scope if the request is primarily about:
 
 * The legacy community-maintained version of ARC
 * Installing, configuring, or maintaining dependencies
 * Template spec customization
-* Container orchestration, such as Kubernetes setup, networking, building images in ARC (DinD), etc.
-* Applying Kubernetes policies
-* Managed Kubernetes providers or provider-specific configurations
+* Container orchestration, such as Kubernetes/OpenShift setup, networking, building images in ARC (DinD), etc.
+* Applying cluster policies
+* Managed container orchestration providers or provider-specific configurations
 * [Runner Container Hooks](https://github.com/actions/runner-container-hooks) in conjunction with ARC's `kubernetes` mode
 * Installation tooling other than Helm
 * Storage provisioners and PersistentVolumeClaims (PVCs)
@@ -44,7 +44,6 @@ While ARC may be deployed successfully with different tooling and configurations
 For more information about contacting {% data variables.contact.github_support %}, see [AUTOTITLE](/support/contacting-github-support).
 
 > [!NOTE]
-> * OpenShift clusters are in public preview. See guidance from [Red Hat](https://developers.redhat.com/articles/2025/02/17/how-securely-deploy-github-arc-openshift#arc_architecture) for configuration recommendations.
 > * ARC is only supported on GitHub Enterprise Server versions 3.9 and greater.
 
 ## Working with {% data variables.contact.github_support %} for Actions Runner Controller

content/admin/github-copilot/copilot-cli/index.md

@@ -0,0 +1,11 @@
+---
+title: GitHub Copilot CLI
+shortTitle: '{% data variables.copilot.copilot_cli_short %}'
+intro: Configure {% data variables.copilot.copilot_cli_short %} to work with {% data variables.product.prodname_ghe_server %}.
+versions:
+  feature: copilot-cli-ghes
+children:
+  - /set-up-and-use-copilot-cli
+docsTeamMetrics:
+  - copilot-cli
+---

content/admin/github-copilot/copilot-cli/set-up-and-use-copilot-cli.md

@@ -0,0 +1,158 @@
+---
+title: Set up and use GitHub Copilot CLI
+shortTitle: 'Set up and use {% data variables.copilot.copilot_cli_short %}'
+intro: Configure a model provider for your {% data variables.product.prodname_ghe_server %} instance, then connect {% data variables.copilot.copilot_cli_short %} clients to the instance.
+allowTitleToDifferFromFilename: true
+versions:
+  feature: copilot-cli-ghes
+contentType: how-tos
+category:
+  - Configure Copilot CLI
+docsTeamMetrics:
+  - copilot-cli
+---
+
+> [!NOTE]
+> This feature is in {% data variables.release-phases.technical_preview %} and subject to change.
+
+You can configure {% data variables.copilot.copilot_cli_short %} to work with {% data variables.product.prodname_ghe_server %} in disconnected or air-gapped environments without connectivity to {% data variables.product.github %} Cloud. An administrator configures a model provider for the instance, and users connect {% data variables.copilot.copilot_cli_short %} with their {% data variables.product.prodname_ghe_server %} credentials.
+
+Setting up this feature involves two roles:
+
+* **Administrator**: Configures the model provider on the {% data variables.product.prodname_ghe_server %} instance using `ghe-config`. This is a one-time setup that requires administrative SSH access.
+* **End user**: Sets environment variables on a local machine to connect {% data variables.copilot.copilot_cli_short %} to the instance.
+
+## Prerequisites
+
+* You have administrative SSH access to the {% data variables.product.prodname_ghe_server %} instance.
+* You have an API key from a supported LLM provider.
+* {% data variables.copilot.copilot_cli_short %} is installed on client machines. See [AUTOTITLE](/enterprise-cloud@latest/copilot/how-tos/copilot-cli/set-up-copilot-cli/install-copilot-cli).
+* {% data variables.product.prodname_cli %} (`gh`) is installed on client machines. See [{% data variables.product.prodname_cli %} manual](https://cli.github.com/manual/) in the {% data variables.product.prodname_cli %} documentation.
+
+For information about supported providers and model requirements, see [AUTOTITLE](/enterprise-cloud@latest/copilot/how-tos/copilot-cli/customize-copilot/use-byok-models).
+
+## Configuring your {% data variables.product.prodname_ghe_server %} instance
+
+This step is for the operator or administrator of the {% data variables.product.prodname_ghe_server %} instance.
+
+With administrative SSH access to the {% data variables.product.prodname_ghe_server %} instance, configure the model provider using the following `ghe-config` values. After configuring, run `ghe-config-apply` to apply the changes.
+
+| Variable name | Required | Options | Description |
+|---|---|---|---|
+| `app.copilot-proxy.enabled` | Yes | `true`, `false` | Enables or disables the feature. |
+| `app.copilot-proxy.endpoint-url` | Yes | URI | The full upstream base URL including any version prefix (for example, `https://api.openai.com/v1`). |
+| `secrets.copilot-proxy.endpoint-key` | Yes | String | The API key for the upstream provider. |
+| `app.copilot-proxy.provider-model-id` | Yes | String | The provider model ID that {% data variables.copilot.copilot_cli_short %} uses to look up the model internally. |
+| `app.copilot-proxy.provider-type` | Yes | `openai`, `azure`, `anthropic` | The provider type. OpenAI includes OpenAI, Ollama, vLLM, Foundry Local, and any other OpenAI Chat Completions API-compatible endpoint. |
+| `app.copilot-proxy.upstream-timeout` | No | Integer, in seconds | Read/send timeout in seconds for upstream requests. If not set, falls back to the default timeout. |
+| `app.copilot-proxy.provider-wire-api` | No | `completions`, `responses` | The wire API format for the provider. |
+| `app.copilot-proxy.provider-wire-model` | No | String | Overrides the model identifier sent to the upstream provider if it differs from the internal model ID. |
+| `app.copilot-proxy.enable-upstream-probe` | No | `true`, `false` | Enables or disables the startup upstream probe. Defaults to enabled. When disabled, the startup probe is skipped. |
+
+For example, the following commands configure an OpenAI provider.
+
+```shell
+ghe-config app.copilot-proxy.enabled true
+ghe-config app.copilot-proxy.endpoint-url 'https://api.openai.com/v1'
+ghe-config secrets.copilot-proxy.endpoint-key 'YOUR-API-KEY'
+ghe-config app.copilot-proxy.provider-model-id 'gpt-5.5'
+ghe-config app.copilot-proxy.provider-wire-model 'gpt-5.5'
+ghe-config app.copilot-proxy.provider-type openai
+ghe-config app.copilot-proxy.upstream-timeout 300
+ghe-config app.copilot-proxy.enable-upstream-probe false
+ghe-config-apply
+```
+
+Replace `YOUR-API-KEY` with the real API key before applying the configuration.
+
+## Configuring your {% data variables.copilot.copilot_cli_short %} client (end user)
+
+Configure {% data variables.copilot.copilot_cli_short %} to connect to your {% data variables.product.prodname_ghe_server %} instance by setting the following environment variables before starting {% data variables.copilot.copilot_cli_short %}.
+
+| Environment variable | Required | Description |
+|---|---|---|
+| `COPILOT_PROVIDER_GHES_HOST` | Yes | The hostname of your {% data variables.product.prodname_ghe_server %} instance. |
+| `COPILOT_PROVIDER_GHES_TOKEN` | Yes | A {% data variables.product.pat_generic %} for the {% data variables.product.prodname_ghe_server %} instance. This token authenticates requests to the instance. |
+| `COPILOT_OFFLINE` | Yes | Enables offline mode. The {% data variables.product.prodname_ghe_server %} provider is only active when offline mode is enabled. |
+
+## Understanding client (end user) tokens
+
+{% data variables.copilot.copilot_cli_short %} needs access to LLM inference, so `COPILOT_PROVIDER_GHES_TOKEN` is always required. You will also very likely want {% data variables.copilot.copilot_cli_short %} to perform {% data variables.product.github %} operations such as create issues, pull requests, and search repositories. Such operations can be done via the {% data variables.product.prodname_cli %}.
+
+It is recommended and preferred that you run `gh auth login --hostname YOUR-GHES-HOSTNAME`. After it succeeds, next step is to set `COPILOT_PROVIDER_GHES_TOKEN` to the token generated in `gh auth login --hostname YOUR-GHES-HOSTNAME`. It is more secure to retrieve the token dynamically rather than copying it from `~/.config/gh/hosts.yml`. You can do so by using `COPILOT_PROVIDER_GHES_TOKEN="$(gh auth token --hostname YOUR-GHES-HOSTNAME)"`. 
+
+Alternatively, you can generate a {% data variables.product.pat_generic %} on your {% data variables.product.prodname_ghe_server %} instance, set that token as `COPILOT_PROVIDER_GHES_TOKEN`, and use the same token when running `gh auth login --hostname YOUR-GHES-HOSTNAME`.
+
+The above approach works when you are using {% data variables.copilot.copilot_cli_short %} interactively. For automation, you need to do a few things differently:
+* Set `GH_ENTERPRISE_TOKEN` (or `GITHUB_ENTERPRISE_TOKEN`) to the {% data variables.product.pat_generic %}.
+* Set `GH_HOST` to your server's hostname.
+* When both `GH_ENTERPRISE_TOKEN` and `gh auth login` credentials exist for the same host, the environment variable takes precedence.
+
+## Recommended end user setup
+
+1. Authenticate {% data variables.product.prodname_cli %}.
+
+   ```shell
+   gh auth login --hostname YOUR-GHES-HOSTNAME
+   ```
+
+1. Set the environment variables required by {% data variables.copilot.copilot_cli_short %}.
+
+   ```shell
+   export COPILOT_PROVIDER_GHES_HOST=YOUR-GHES-HOSTNAME
+   export COPILOT_PROVIDER_GHES_TOKEN="$(gh auth token --hostname YOUR-GHES-HOSTNAME)"
+   export COPILOT_OFFLINE=true
+   ```
+
+   If you are authenticated with `gh auth login` to multiple accounts, you can set `GH_HOST` to your server's hostname and set `GH_ENTERPRISE_TOKEN` (or `GITHUB_ENTERPRISE_TOKEN`) to `"$(gh auth token --hostname YOUR-GHES-HOSTNAME)"`. This ensures {% data variables.product.prodname_cli %} targets your {% data variables.product.prodname_ghe_server %} instance.
+
+   ```shell
+   export GH_HOST=YOUR-GHES-HOSTNAME
+   export GH_ENTERPRISE_TOKEN="$(gh auth token --hostname YOUR-GHES-HOSTNAME)"
+   ```
+
+{% data reusables.copilot.copilot-cli.start-cli %}
+
+You can run this entire set-up as a script.
+
+## Examples
+
+If both {% data variables.product.prodname_ghe_server %} and your {% data variables.copilot.copilot_cli_short %} configurations are correct, then you should see responses like the following in your {% data variables.copilot.copilot_cli_short %} session.
+
+```shell
+     • fabric-core-mcp — disabled
+     • powerbi-mcp — disabled
+     • slack — connected
+
+ ● Current model: gpt-5.5
+
+ ❯ Hello                                                                   13:31
+
+ ● Hello!
+
+ ❯ what is going on in github/codeql-action repo?                          13:33
+
+ ● I’ll check recent repository activity on the GHES host: repo metadata, open 
+   PRs/issues, and latest commits.
+
+ $ Shell Fetch repo metadata 2 lines…                                         5s
+   gh api --hostname "$GH_HOST" repos/github/codeql-action --jq '{name_with_own…
+```
+
+## Supported capabilities on {% data variables.product.prodname_ghe_server %}
+
+For the most up-to-date information on {% data variables.copilot.copilot_cli_short %} features, refer to [AUTOTITLE](/enterprise-cloud@latest/copilot/how-tos/copilot-cli) as the primary source of truth. In general, any capability that relies on connectivity to {% data variables.product.github %} cloud services is not available in the {% data variables.product.prodname_ghe_server %} offline configuration.
+
+The following table provides a directional overview of what is available in {% data variables.product.prodname_ghe_server %} offering.
+
+| Capability | {% data variables.product.prodname_dotcom %} / {% data variables.product.prodname_ghe_cloud %} | {% data variables.product.prodname_ghe_server %} |
+|:---|:---:|:---:|
+| AI-assisted coding (prompts, code generation, debugging) | {% octicon "check" aria-label="Available" %} | {% octicon "check" aria-label="Available" %} |
+| Shell commands and file operations | {% octicon "check" aria-label="Available" %} | {% octicon "check" aria-label="Available" %} |
+| {% data variables.product.github %} operations (issues, PRs, repos) via `gh` CLI | {% octicon "check" aria-label="Available" %} | {% octicon "check" aria-label="Available" %} (requires `gh` CLI authenticated to the instance) |
+| {% data variables.product.github %} MCP server tools | {% octicon "check" aria-label="Available" %} | {% octicon "x" aria-label="Not available" %} |
+| Web search and web fetch | {% octicon "check" aria-label="Available" %} | {% octicon "x" aria-label="Not available" %} |
+| {% data variables.product.prodname_copilot_short %} model selection ({% data variables.product.github %}-hosted models) | {% octicon "check" aria-label="Available" %} | {% octicon "x" aria-label="Not available" %} |
+| Telemetry and usage reporting | {% octicon "check" aria-label="Available" %} | {% octicon "x" aria-label="Not available" %} |
+| Auto-update | {% octicon "check" aria-label="Available" %} | {% octicon "x" aria-label="Not available" %} |
+

content/admin/github-copilot/index.md

@@ -0,0 +1,8 @@
+---
+title: GitHub Copilot
+intro: Configure and use {% data variables.product.prodname_copilot %} with {% data variables.product.prodname_ghe_server %}.
+versions:
+  feature: copilot-cli-ghes
+children:
+  - /copilot-cli
+---

content/admin/index.md

@@ -106,10 +106,10 @@ children:
   - /enforcing-policies
   - /monitoring-activity-in-your-enterprise
   - /monitoring-and-managing-your-instance
+  - /github-copilot
   - /managing-github-apps-for-your-enterprise
   - /managing-github-actions-for-your-enterprise
   - /configuring-packages
   - /release-notes
   - /all-releases
 ---
-

content/communities/maintaining-your-safety-on-github/blocking-a-user-from-your-organization.md

@@ -12,7 +12,9 @@ category:
   - Block users and report abuse
 ---
 
-You can block non-members from within your organization's settings or from a specific comment made by a user. When you block a user in a comment, you can choose to send the user a notification explaining that they were blocked and why. Otherwise, the user is not directly notified that you've blocked them. Blocked users can still delete their existing content.
+You can block non-members from within your organization's settings or from content in the organization's repositories.
+
+When you block a user from a comment, you can choose to send the user a notification explaining that they were blocked and why. Otherwise, the user is not directly notified that you've blocked them. Blocked users can still delete their existing content.
 
 {% data reusables.organizations.blocking-a-user %}
 
@@ -26,6 +28,7 @@ At the time that you block a user from your organization:
 * The user is removed as a collaborator on your organization's repositories
 * The user's contributions to your organization's repositories are no longer counted as contributions for them
 * Any pending repository or organization invitations to the blocked user are canceled
+* The user's comments on repository security advisories are hidden
 
 After you've blocked a user from your organization, they cannot:
 * Cross-reference your organization's repositories in comments
@@ -35,12 +38,17 @@ In your organization's repositories, blocked users also cannot:
 * Open issues
 * Send, close, or merge pull requests
 * Comment on issues, pull requests, or commits
+* Comment on repository security advisories
 * Add or edit wiki pages
 
-## Blocking a user in a comment
+Blocking a user from a comment doesn't delete the original issue, pull request, or security advisory.
 
-1. Navigate to the comment whose author you would like to block.
-1. In the upper-right corner of the comment, click {% octicon "kebab-horizontal" aria-label="Show options" %}, then click **Block user**.
+## Blocking a user from repository content
+
+You must be an organization owner or moderator to block a user from a repository security advisory.
+
+1. Navigate to the issue, pull request, or repository security advisory that contains the description or comment whose author you would like to block.
+1. In the upper-right corner of the description or comment, click {% octicon "kebab-horizontal" aria-label="Show options" %}, then click **Block user**.
 
    ![Screenshot of a pull request comment by octo-user. Below an icon of three dots, a dropdown menu is expanded, and "Block user" is outlined in orange.](/assets/images/help/repository/comment-menu-block-user.png)