From 3a8150f92aba598cdb7c2e49318d331802989432 Mon Sep 17 00:00:00 2001 From: mc <42146119+mchammer01@users.noreply.github.com> Date: Thu, 3 Sep 2026 06:15:48 +0000 Subject: [PATCH 1/8] Clarify agent app usage metrics guidance (#62854) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 002086f0-e37d-4e13-a8dc-4e98cea0a326 Copilot-Session: c0df9265-d4b1-4744-b5c3-65f6b201aaf9 Copilot-Session: 7540a06e-bc5e-4ad1-87f1-876b8b632720 --- .../concepts/copilot-usage-metrics/copilot-metrics.md | 2 ++ .../copilot-usage-metrics/copilot-usage-metrics.md | 11 ++++++++--- .../copilot-usage-metrics/team-level-metrics.md | 6 ++++++ 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/content/copilot/concepts/copilot-usage-metrics/copilot-metrics.md b/content/copilot/concepts/copilot-usage-metrics/copilot-metrics.md index 9631932b9b4d..91c0b428dfe1 100644 --- a/content/copilot/concepts/copilot-usage-metrics/copilot-metrics.md +++ b/content/copilot/concepts/copilot-usage-metrics/copilot-metrics.md @@ -38,6 +38,8 @@ Metrics are available through: {% data variables.product.prodname_copilot_short %} usage metrics are derived from telemetry across multiple {% data variables.product.prodname_copilot_short %} surfaces, including IDE, {% data variables.copilot.copilot_cli_short %}, and {% data variables.copilot.agent_apps %} activity. Most metrics come from client-side IDE telemetry, and **end users need telemetry enabled in their IDE** for the richest data in these metrics. +Individual {% data variables.copilot.agent_app %} metrics are available in the usage metrics APIs and NDJSON exports. They are not available in the usage metrics dashboards. Activity from {% data variables.copilot.agent_apps %} is already included in daily, weekly, and monthly active-user totals through server-side telemetry. The individual metrics provide a detailed breakdown but do not change these totals. + In addition, {% data variables.product.prodname_copilot_short %} usage metrics incorporate **server-side telemetry** to identify active users that client-side telemetry alone may miss. Network conditions, proxy configurations, and client settings can prevent client telemetry from reaching {% data variables.product.github %}, so server-side signals ensure those users still appear in your reports. Users surfaced through server-side telemetry are fully counted toward your active user totals (such as daily active users, `daily_active_users` ). When available, they may also appear in `totals_by_ide` (including the most recently detected IDE and {% data variables.product.prodname_copilot_short %} extension versions in per-user reports). However, other dimensional breakdowns—such as `totals_by_feature` and lines-of-code metrics—remain empty until richer telemetry is available for them. Top-level totals and breakdowns for users already captured by client telemetry are unchanged. diff --git a/content/copilot/reference/copilot-usage-metrics/copilot-usage-metrics.md b/content/copilot/reference/copilot-usage-metrics/copilot-usage-metrics.md index 8d71e2188000..7be1c16e1bf6 100644 --- a/content/copilot/reference/copilot-usage-metrics/copilot-usage-metrics.md +++ b/content/copilot/reference/copilot-usage-metrics/copilot-usage-metrics.md @@ -143,9 +143,9 @@ Active-user counts: | Field | Type | Nullable | Description | |:--|:--|:--|:--| -| `daily_active_users` | `integer` | No | Number of unique users who used {% data variables.product.prodname_copilot_short %} on a given day, including users active only in the {% data variables.copilot.github_copilot_app_short %}. | -| `weekly_active_users` | `integer` | No | Number of unique users who used {% data variables.product.prodname_copilot_short %} during a trailing seven-day window, including users active only in the {% data variables.copilot.github_copilot_app_short %}. | -| `monthly_active_users` | `integer` | No | Number of unique users who used {% data variables.product.prodname_copilot_short %} during a trailing 28-day window, including users active only in the {% data variables.copilot.github_copilot_app_short %}. | +| `daily_active_users` | `integer` | No | Number of unique users who used {% data variables.product.prodname_copilot_short %} on a given day. | +| `weekly_active_users` | `integer` | No | Number of unique users who used {% data variables.product.prodname_copilot_short %} during a trailing seven-day window. | +| `monthly_active_users` | `integer` | No | Number of unique users who used {% data variables.product.prodname_copilot_short %} during a trailing 28-day window. | | `monthly_active_chat_users` | `integer` | No | Number of unique users who used chat during a trailing 28-day window. | | `monthly_active_agent_users` | `integer` | No | Number of unique users who used agent mode during a trailing 28-day window. | | `daily_active_copilot_cloud_agent_users` | `integer` | No | Number of unique users who used {% data variables.copilot.copilot_cloud_agent %} on a given day. | @@ -281,6 +281,9 @@ The `totals_by_copilot_app` object contains the following nested fields when {% ### {% data variables.copilot.agent_apps_caps %} metrics fields +> [!NOTE] +> {% data reusables.copilot.agent-apps-preview %} + The `totals_by_3rd_party_agent` array contains one entry for each recognized {% data variables.copilot.agent_app %} used during the reporting period. Entries are grouped by `agent_id`, and integrations that map to the same agent are combined. Use `agent_id` as the stable grouping key and `agent_name` for display. The array is omitted when no recognized {% data variables.copilot.agent_app %} activity is available during the reporting period. These metrics come from server-side job activity. The nested `user_initiated_interaction_count` counts {% data variables.copilot.agent_app %} job starts and is distinct from the top-level field with the same name, which counts explicit prompts from other supported telemetry. @@ -334,6 +337,8 @@ A user is classified into a phase based on the {% data variables.product.prodnam A user only needs to be engaged with a phase's own signals to reach that phase. A user doesn't need to independently meet Phase 1 criteria to reach Phase 2 or Phase 3, although in practice agent-surface usage often co-occurs with completions or agent edits. +Of the agent surfaces, only the first-party surfaces listed in the table affect a user's AI adoption phase. Activity from partner-built {% data variables.copilot.agent_apps %} doesn't affect the phase. The same classification logic applies to enterprise and organization reports, including 1-day and 28-day reports. + > [!NOTE] > Because classification uses feature-level engagement, some activity doesn't affect a user's phase on its own. Using IDE chat (`used_chat`) or agent mode (`used_agent`) doesn't qualify a user for Phase 1 unless it produces `code_completion` or `agent_edit` activity. > diff --git a/content/copilot/reference/copilot-usage-metrics/team-level-metrics.md b/content/copilot/reference/copilot-usage-metrics/team-level-metrics.md index f97e0fc75966..3a7edbc47895 100644 --- a/content/copilot/reference/copilot-usage-metrics/team-level-metrics.md +++ b/content/copilot/reference/copilot-usage-metrics/team-level-metrics.md @@ -159,6 +159,12 @@ The join is an inner join: a team appears in the result for a given day only if Per-dimension breakdowns live in array fields on each per-user row (`totals_by_ide`, `totals_by_language_feature`, `totals_by_language_model`, `totals_by_model_feature`). To group by a dimension, expand the relevant array as part of the join, add the dimension columns to your grouping, and aggregate the per-element counters scoped to that dimension. `language` and `ide` live in separate arrays, so a team-level `(language × ide)` cross-tab takes two queries combined in your application. +### Cutting by {% data variables.copilot.agent_app %} + +Usage for each {% data variables.copilot.agent_app %} is in the `totals_by_3rd_party_agent` array on each per-user row. To create team-level {% data variables.copilot.agent_app %} metrics, expand the array after joining the reports, group by `team_id` and `agent_id`, and sum the nested `user_initiated_interaction_count`. Use `agent_id` as the stable grouping key and `agent_name` for display. + +Per-user {% data variables.copilot.agent_app %} entries do not include `session_count`, so you cannot derive team-level session counts from the user-teams join. + ### Building rolling-window team reports To produce a rolling-window team report (for example, a 28-day rollup): From 084ea2fd880a3611fdbbc60509a3f7b72c6f5c77 Mon Sep 17 00:00:00 2001 From: mc <42146119+mchammer01@users.noreply.github.com> Date: Thu, 3 Sep 2026 06:22:44 +0000 Subject: [PATCH 2/8] Link security incident guidance to malware alert availability (#63012) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../secure-your-organization/respond-to-a-security-incident.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/code-security/tutorials/secure-your-organization/respond-to-a-security-incident.md b/content/code-security/tutorials/secure-your-organization/respond-to-a-security-incident.md index eb900ce30e87..d1c407bbbb09 100644 --- a/content/code-security/tutorials/secure-your-organization/respond-to-a-security-incident.md +++ b/content/code-security/tutorials/secure-your-organization/respond-to-a-security-incident.md @@ -226,7 +226,8 @@ This includes, but isn't limited to, checking for things like: Compromised dependencies can serve as an attack vector. Make sure you undertake a full audit of your dependencies and reinstall them from trusted sources. -* Review {% data variables.product.prodname_dependabot %} alerts for vulnerable dependencies and, where available, {% data variables.product.prodname_dependabot_malware_alerts %} for malicious packages. ({% data variables.product.prodname_dependabot_malware_alerts %} are currently available for the npm ecosystem.) To investigate additional malware advisories, search for `type:malware` in the {% data variables.product.prodname_advisory_database %} and audit your dependency graph for matches. +* Review {% data variables.product.prodname_dependabot %} alerts for vulnerable dependencies and, where available, {% data variables.product.prodname_dependabot_malware_alerts %} for malicious packages.{% ifversion dependabot-malware-alerts %} For the current list of supported ecosystems, see [AUTOTITLE](/code-security/concepts/supply-chain-security/malware-alerts#availability){% else %} {% data variables.product.prodname_dependabot_malware_alerts %} are currently available for the npm ecosystem only{% endif %}. +* To investigate additional malware advisories, search for `type:malware` in the {% data variables.product.prodname_advisory_database %} and audit your dependency graph for matches. * Pin dependencies to known-good versions or commit SHAs, and reinstall from your package registry. ### Verify remediation From c06c0f5dc01c85571d372b6a8ebcc16a018b71d2 Mon Sep 17 00:00:00 2001 From: Daniel Dunn Date: Thu, 3 Sep 2026 08:23:32 +0000 Subject: [PATCH 3/8] Gate AI generic secret detection docs for GHES 3.23 (#63031) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mchammer01 <42146119+mchammer01@users.noreply.github.com> --- .../concepts/secret-security/secret-scanning.md | 5 ++++- .../getting-started/github-security-features.md | 2 +- .../manage-secret-scanning-alerts/viewing-alerts.md | 2 +- .../create-custom-configuration.md | 4 ++-- .../create-custom-configuration.md | 4 ++-- .../enabling-secret-scanning-for-ai-detected-secrets.md | 4 ++++ .../secret-security/supported-secret-scanning-patterns.md | 2 +- .../features/secret-scanning-ai-generic-secret-detection.yml | 1 + 8 files changed, 16 insertions(+), 8 deletions(-) diff --git a/content/code-security/concepts/secret-security/secret-scanning.md b/content/code-security/concepts/secret-security/secret-scanning.md index 489eee30496c..7746028dab8e 100644 --- a/content/code-security/concepts/secret-security/secret-scanning.md +++ b/content/code-security/concepts/secret-security/secret-scanning.md @@ -61,7 +61,10 @@ Beyond the default detection of partner and provider secrets, you can expand and * **Custom patterns.** Define your own regular expressions to detect organization-specific secrets that aren't covered by default patterns. * **Validity checks.** Prioritize remediation by checking whether detected secrets are still active. {% ifversion secret-scanning-ai-generic-secret-detection %} -* **{% data variables.secret-scanning.ai-detected-secrets-caps %}.** Use AI to detect unstructured secrets like passwords, or to generate regular expressions for custom patterns. +* **{% data variables.secret-scanning.ai-detected-secrets-caps %}.** Use AI to detect unstructured secrets like passwords. +{% endif %} +{% ifversion secret-scanning-custom-pattern-ai-generated %} +* **AI-generated regular expressions.** Use AI to generate regular expressions for custom patterns. {% endif %} {% ifversion secret-scanning-validity-check-partner-patterns %} diff --git a/content/code-security/getting-started/github-security-features.md b/content/code-security/getting-started/github-security-features.md index a18c2d910ebe..fb43ea3d8f64 100644 --- a/content/code-security/getting-started/github-security-features.md +++ b/content/code-security/getting-started/github-security-features.md @@ -138,7 +138,7 @@ Automatically detect hardcoded credentials that have been checked into a reposit ### {% data variables.secret-scanning.ai-detected-secrets-caps %} -{% data variables.secret-scanning.ai-detected-secrets-caps %}'s generic secret detection is an AI-powered expansion of {% data variables.product.prodname_secret_scanning %} that identifies unstructured secrets (passwords) in your source code and then generates an alert. For more information, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features). +{% data variables.secret-scanning.ai-detected-secrets-caps %}'s generic secret detection is an AI-powered expansion of {% data variables.product.prodname_secret_scanning %} that identifies unstructured secrets (passwords) in your source code and then generates an alert.{% ifversion fpt or ghec %} For more information, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %} {% endif %} diff --git a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md index 793b5e4a3568..c20d661e77f3 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md @@ -49,7 +49,7 @@ You can apply various filters to the alerts list to help you find the alerts you |{% ifversion fpt or ghec %}| |`results`|Display alerts for supported secrets and custom patterns (`default`), or for generic patterns (`generic`) such as private keys, and AI-detected generic secrets such as passwords. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns), and for more information about AI-detected generic secrets, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).| |{% elsif ghes %}| -|`results`|Display alerts for supported secrets and custom patterns (`default`), or generic patterns such as private keys (`generic`). See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns).| +|`results`|Display alerts for supported secrets and custom patterns (`default`), or generic patterns such as private keys (`generic`){% ifversion secret-scanning-ai-generic-secret-detection %}, and AI-detected generic secrets such as passwords{% endif %}. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns).| |{% endif %}| |`secret-type`|Display alerts for a specific secret type (`SECRET-NAME`), for example, `secret-type:github_personal_access_token`. For a list of supported secret types, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns).| |`sort`|Display alerts from newest to oldest (`created-desc`), oldest to newest (`created-asc`), most recently updated (`updated-desc`), or least recently updated (`updated-asc`).| diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/create-custom-configuration.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/create-custom-configuration.md index 0282adb3df4b..989de0ca97c7 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/create-custom-configuration.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/create-custom-configuration.md @@ -48,7 +48,7 @@ When creating a security configuration, keep in mind that: > [!NOTE] > You can only enable extended metadata checks if validity checks are enabled.{% endif %} * **Generic patterns**. To learn more about scanning for generic patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts).{% ifversion secret-scanning-ai-generic-secret-detection %} - * **Scan for AI-detected secrets**. To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %} + * **Scan for AI-detected secrets**. {% ifversion fpt or ghec %}To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}{% endif %} * **Push protection**. To learn about push protection, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection).{% ifversion push-protection-delegated-bypass-configurations-enterprise %} * **Bypass privileges**. By assigning bypass privileges{% ifversion push-protection-org-enterprise-exemptions %} or exemptions{% endif %}, selected actors can bypass{% ifversion push-protection-org-enterprise-exemptions %} or skip{% endif %} push protection. There is a review and approval process for all other contributors. See [AUTOTITLE](/code-security/concepts/secret-security/delegated-bypass).{% endif %} * **Prevent direct alert dismissals**. To learn more, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal). @@ -90,7 +90,7 @@ When creating a security configuration, keep in mind that: * **Alerts**. To learn about {% data variables.secret-scanning.alerts %}, see [AUTOTITLE](/code-security/concepts/secret-security/secret-scanning).{% endif %} {% ifversion secret-scanning-validity-check-partner-patterns %} * **Validity checks**. To learn more about validity checks for partner patterns, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#checking-a-secrets-validity).{% endif %} * **Generic patterns**. To learn more about scanning for generic patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts).{% ifversion secret-scanning-ai-generic-secret-detection %} - * **Scan for AI-detected secrets**. To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %} + * **Scan for AI-detected secrets**. {% ifversion fpt or ghec %}To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}{% endif %} * **Push protection**. To learn about push protection, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection). * **Prevent direct alert dismissals**. To learn more, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal). 1. In the "{% data variables.product.prodname_code_scanning_caps %}" table, choose whether you want to enable, disable, or keep the existing settings for {% data variables.product.prodname_code_scanning %} default setup. diff --git a/content/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration.md b/content/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration.md index 9144a1d235aa..94312dce266b 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration.md +++ b/content/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration.md @@ -56,7 +56,7 @@ When creating a security configuration, keep in mind that: > [!NOTE] > You can only enable extended metadata checks if validity checks are enabled.{% endif %} * **Generic patterns**. To learn more about scanning for generic patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts).{% ifversion secret-scanning-ai-generic-secret-detection %} - * **Scan for AI-detected secrets**. To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %} + * **Scan for AI-detected secrets**. {% ifversion fpt or ghec %}To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}{% endif %} * **Push protection**. To learn about push protection, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection). * **Bypass privileges**. By assigning bypass privileges{% ifversion push-protection-org-enterprise-exemptions %} or exemptions{% endif %}, selected actors can bypass{% ifversion push-protection-org-enterprise-exemptions %} or skip{% endif %} push protection. There is a review and approval process for all other contributors. See [AUTOTITLE](/code-security/concepts/secret-security/delegated-bypass). * **Prevent direct alert dismissals**. To learn more, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal). @@ -98,7 +98,7 @@ When creating a security configuration, keep in mind that: * **Alerts**. To learn about {% data variables.secret-scanning.alerts %}, see [AUTOTITLE](/code-security/concepts/secret-security/secret-scanning).{% endif %} {% ifversion secret-scanning-validity-check-partner-patterns %} * **Validity checks**. To learn more about validity checks for partner patterns, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#checking-a-secrets-validity).{% endif %} * **Generic patterns**. To learn more about scanning for generic patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts).{% ifversion secret-scanning-ai-generic-secret-detection %} - * **Scan for AI-detected secrets**. To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %} + * **Scan for AI-detected secrets**. {% ifversion fpt or ghec %}To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}{% endif %} * **Push protection**. To learn about push protection, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection). * **Bypass privileges**. By assigning bypass privileges{% ifversion push-protection-org-enterprise-exemptions %} or exemptions{% endif %}, selected actors can bypass{% ifversion push-protection-org-enterprise-exemptions %} or skip{% endif %} push protection. There is a review and approval process for all other contributors. See [AUTOTITLE](/code-security/concepts/secret-security/delegated-bypass). * **Prevent direct alert dismissals**. To learn more, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal). diff --git a/content/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-ai-detected-secrets.md b/content/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-ai-detected-secrets.md index 34fd10374510..7c64598c141f 100644 --- a/content/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-ai-detected-secrets.md +++ b/content/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enabling-secret-scanning-for-ai-detected-secrets.md @@ -41,6 +41,10 @@ You must configure {% data variables.secret-scanning.generic-secret-detection %} For information on how to view alerts for generic secrets that have been detected with AI, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts). +{% ifversion fpt or ghec %} + ## Further reading * [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features) + +{% endif %} diff --git a/content/code-security/reference/secret-security/supported-secret-scanning-patterns.md b/content/code-security/reference/secret-security/supported-secret-scanning-patterns.md index aadf973b9b8b..c61ce8046687 100644 --- a/content/code-security/reference/secret-security/supported-secret-scanning-patterns.md +++ b/content/code-security/reference/secret-security/supported-secret-scanning-patterns.md @@ -101,7 +101,7 @@ Precision levels are estimated based on the pattern type's typical false positiv ## Supported AI-detected patterns -{% data variables.product.prodname_secret_scanning_caps %} uses {% data variables.product.prodname_copilot_short %} to detect generic secrets using AI. See [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features). +{% data variables.product.prodname_secret_scanning_caps %} uses {% data variables.product.prodname_copilot_short %} to detect generic secrets using AI.{% ifversion fpt or ghec %} See [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %} | Provider | Token | |----------|:--------------------| diff --git a/data/features/secret-scanning-ai-generic-secret-detection.yml b/data/features/secret-scanning-ai-generic-secret-detection.yml index 1a28d7a90dc7..24fc88aa6aa3 100644 --- a/data/features/secret-scanning-ai-generic-secret-detection.yml +++ b/data/features/secret-scanning-ai-generic-secret-detection.yml @@ -4,3 +4,4 @@ versions: fpt: '*' ghec: '*' + ghes: '>=3.23' From 369915f2bdac7f9a50d4041d10420c09bfe2274d Mon Sep 17 00:00:00 2001 From: Isaac Brown <101839405+isaacmbrown@users.noreply.github.com> Date: Thu, 3 Sep 2026 08:29:47 +0000 Subject: [PATCH 4/8] Remove sentence fragment from mcp-management.md (#63046) --- content/copilot/concepts/mcp-management.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/content/copilot/concepts/mcp-management.md b/content/copilot/concepts/mcp-management.md index 19b7d6d23791..bc5911064a4f 100644 --- a/content/copilot/concepts/mcp-management.md +++ b/content/copilot/concepts/mcp-management.md @@ -38,8 +38,6 @@ Alternatively, you can host your own MCP registry and restrict access to servers To configure an allowlist on {% data variables.product.github %}, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist). -If you create your own MCP registry, see - ## Further reading * [AUTOTITLE](/copilot/reference/supported-surfaces-for-policies) From 5e1cf5685d07cc6a389d98261651237dc8b765fc Mon Sep 17 00:00:00 2001 From: Isaac Brown <101839405+isaacmbrown@users.noreply.github.com> Date: Thu, 3 Sep 2026 09:01:37 +0000 Subject: [PATCH 5/8] Update enterprise-installed-apps.yml (#62946) Co-authored-by: Hirsch Singhal <1666363+hpsin@users.noreply.github.com> Co-authored-by: Hirsch Singhal --- .../choosing-permissions-for-a-github-app.md | 4 ++-- .../registering-a-github-app-using-url-parameters.md | 2 +- .../installing-a-github-app-from-a-third-party.md | 2 +- .../installing-a-github-app-on-your-enterprise.md | 4 ++-- data/features/enterprise-installed-apps.yml | 1 + 5 files changed, 7 insertions(+), 6 deletions(-) diff --git a/content/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app.md b/content/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app.md index ec294bcfbf5d..be2a81f05a95 100644 --- a/content/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app.md +++ b/content/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app.md @@ -35,9 +35,9 @@ App permissions are classified as repository, organization,{% ifversion fpt or e {% ifversion fpt or enterprise-installed-apps %} -Any user, organization, or enterprise can create an app using any of the permission types. An app with enterprise permissions must be `public` or `internal` to be installed on an enterprise account. A `public` app can be installed by any enterprise, while an `internal` app can only be installed by the enterprise that owns the app or the enterprise of the organization that owns the app. There are no additional restrictions on which organizations or personal accounts an app can be installed on. +Any user, organization, or enterprise can create an app using any of the permission types. An app with enterprise permissions must be `public` or `internal` to be installed on an enterprise account. {% ifversion fpt or ghec %}A `public` app can be installed by any enterprise, while an `internal` app can only be installed by the enterprise that owns the app or the enterprise of the organization that owns the app. There are no additional restrictions on which organizations or personal accounts an app can be installed on. -There is one exception to installing an app across enterprises. If an app requests the "Enterprise organization installations" or "Enterprise organization installation repositories" permissions, the only enterprise that can install it is the one that owns the app. You cannot install the app on another enterprise, and you cannot add either permission to an app that is already installed on an enterprise other than the one that owns it.{% endif %} +There is one exception to installing an app across enterprises. If an app requests the "Enterprise organization installations" or "Enterprise organization installation repositories" permissions, the only enterprise that can install it is the one that owns the app. You cannot install the app on another enterprise, and you cannot add either permission to an app that is already installed on an enterprise other than the one that owns it.{% endif %}{% endif %} When a user installs an app on their user account or organization, they see and grant the repository and organization permissions that the app requested.{% ifversion fpt or enterprise-installed-apps %} When they install it on their enterprise, they see and grant only the enterprise permissions that the app requested. {% endif %} They will also see a list of account permissions that the app can request for individual users. When a user authorizes an app to act on their behalf, they will see and grant the account permissions that the app requested. diff --git a/content/apps/sharing-github-apps/registering-a-github-app-using-url-parameters.md b/content/apps/sharing-github-apps/registering-a-github-app-using-url-parameters.md index 80ce6bcde2de..4df891dceb31 100644 --- a/content/apps/sharing-github-apps/registering-a-github-app-using-url-parameters.md +++ b/content/apps/sharing-github-apps/registering-a-github-app-using-url-parameters.md @@ -70,7 +70,7 @@ Parameter name | Type | Description You can use query parameters to select the permissions for the {% data variables.product.prodname_github_app %} registration. For the URL query parameter, use the permission name as the query parameter name, and set the query value to one of the possible values for that permission set. -For example, to select "Read & write" permissions in the user interface for `contents`, your query string would include `contents=write`. To select "Read-only" permissions in the user interface for `blocking`, your query string would include `blocking=read`. To select "No access" in the user interface for `checks`, your query string would not include the `checks` permission.{% ifversion enterprise-installed-apps %} +For example, to select "Read & write" permissions in the user interface for `contents`, your query string would include `contents=write`. To select "Read-only" permissions in the user interface for `blocking`, your query string would include `blocking=read`. To select "No access" in the user interface for `checks`, your query string would not include the `checks` permission.{% ifversion ghes < 3.23 %} If the owning account is not an enterprise or an enterprise-owned organization, it cannot request enterprise permissions.{% endif %} diff --git a/content/apps/using-github-apps/installing-a-github-app-from-a-third-party.md b/content/apps/using-github-apps/installing-a-github-app-from-a-third-party.md index d0960ae028a3..511d0cbc2bdf 100644 --- a/content/apps/using-github-apps/installing-a-github-app-from-a-third-party.md +++ b/content/apps/using-github-apps/installing-a-github-app-from-a-third-party.md @@ -36,7 +36,7 @@ Anyone can install {% data variables.product.prodname_github_apps %} on their pe Organization owners can install {% data variables.product.prodname_github_apps %} on their organization.{% ifversion enterprise-installed-apps %} -Enterprise owners can install {% data variables.product.prodname_github_apps %} on their enterprise accounts, if the application requests enterprise permissions. The app can be owned by the enterprise, an organization within the enterprise, or a third-party developer. Third-party apps must be public and cannot request the "Enterprise organization installations" or "Enterprise organization installation repositories" permissions. +Enterprise owners can install {% data variables.product.prodname_github_apps %} on their enterprise accounts, if the application requests enterprise permissions. The app can be owned by the enterprise{% ifversion ghes %} or organization{% else %}, an organization within the enterprise, or a third-party developer. Third-party apps must be public and cannot request the "Enterprise organization installations" or "Enterprise organization installation repositories" permissions{% endif %}. {% endif %} {% data reusables.apps.repo-admin-install-restriction %} diff --git a/content/apps/using-github-apps/installing-a-github-app-on-your-enterprise.md b/content/apps/using-github-apps/installing-a-github-app-on-your-enterprise.md index ca83156a11e0..696084ab2d33 100644 --- a/content/apps/using-github-apps/installing-a-github-app-on-your-enterprise.md +++ b/content/apps/using-github-apps/installing-a-github-app-on-your-enterprise.md @@ -24,10 +24,10 @@ When an enterprise owner installs a {% data variables.product.prodname_github_ap The {% data variables.product.prodname_github_app %} must request enterprise-level permissions. It can request other permissions as well, but only the enterprise permissions will be granted during installation. -The app can be owned by your enterprise, by an organization within your enterprise, or by a third-party developer. To install a public app from a third party, use the installation link that the app's developer provides. You cannot install a private app that is owned by an account outside your enterprise. +The app can be owned by your enterprise{% ifversion ghes %} or organization in your enterprise.{% else %}, by an organization within your enterprise, or by a third-party developer. To install a public app from a third party, use the installation link that the app's developer provides. You cannot install a private app that is owned by an account outside your enterprise. > [!NOTE] -> There is one exception to installing a third-party app across enterprises. If an app requests the "Enterprise organization installations" permission, it can only be installed on the enterprise that owns the app. You cannot install this app on your enterprise if it is owned outside your enterprise. In EMU enterprises and GHES, enterprise's users count as being within the enterprise, so their apps can be installed on the enterprise. +> There is one exception to installing a third-party app across enterprises. If an app requests the "Enterprise organization installations" permission, it can only be installed on the enterprise that owns the app. You cannot install this app on your enterprise if it is owned outside your enterprise. In EMU enterprises and GHES, enterprise's users count as being within the enterprise, so their apps can be installed on the enterprise.{% endif %}. ## Installing a {% data variables.product.prodname_github_app %} on your enterprise diff --git a/data/features/enterprise-installed-apps.yml b/data/features/enterprise-installed-apps.yml index 671504e538f0..d695ea403727 100644 --- a/data/features/enterprise-installed-apps.yml +++ b/data/features/enterprise-installed-apps.yml @@ -2,3 +2,4 @@ # GitHub Apps can now be installed at the enterprise level in addition to organizations versions: ghec: '*' + ghes: '>=3.19' From a4e23419965182fe7ee23cb207df26087c0279a3 Mon Sep 17 00:00:00 2001 From: hubwriter Date: Thu, 3 Sep 2026 10:20:12 +0000 Subject: [PATCH 6/8] Copilot CLI TUI Updates August 2026 - sidebar, tool management, etc [GA] (#62741) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../copilot-cli/use-copilot-cli/index.md | 1 + .../work-with-multiple-sessions.md | 200 ++++++++++++++++++ .../cli-command-reference.md | 101 +++++++++ data/reusables/copilot/close-session.md | 1 + 4 files changed, 303 insertions(+) create mode 100644 content/copilot/how-tos/copilot-cli/use-copilot-cli/work-with-multiple-sessions.md create mode 100644 data/reusables/copilot/close-session.md diff --git a/content/copilot/how-tos/copilot-cli/use-copilot-cli/index.md b/content/copilot/how-tos/copilot-cli/use-copilot-cli/index.md index 36964cbe9717..2972d9f58236 100644 --- a/content/copilot/how-tos/copilot-cli/use-copilot-cli/index.md +++ b/content/copilot/how-tos/copilot-cli/use-copilot-cli/index.md @@ -14,6 +14,7 @@ children: - /delegate-tasks-to-cca - /browse-issues-prs-gists - /roll-back-changes + - /work-with-multiple-sessions - /invoke-custom-agents - /steer-agents - /steer-remotely diff --git a/content/copilot/how-tos/copilot-cli/use-copilot-cli/work-with-multiple-sessions.md b/content/copilot/how-tos/copilot-cli/use-copilot-cli/work-with-multiple-sessions.md new file mode 100644 index 000000000000..3a8ac339f1bd --- /dev/null +++ b/content/copilot/how-tos/copilot-cli/use-copilot-cli/work-with-multiple-sessions.md @@ -0,0 +1,200 @@ +--- +title: Working with multiple {% data variables.copilot.copilot_cli %} sessions +shortTitle: Work with multiple sessions +allowTitleToDifferFromFilename: true +intro: "Run several {% data variables.copilot.copilot_cli_short %} sessions at once and use the sidebar to quickly move between them." +versions: + feature: copilot +contentType: how-tos +category: + - Author and optimize with Copilot # Copilot discovery page + - Build with Copilot CLI # Copilot CLI bespoke page +docsTeamMetrics: + - copilot-cli +--- + +## Introduction + +Each time you start {% data variables.copilot.copilot_cli_short %}, you begin or resume a **session**. You can think of a session as a conversation between you and {% data variables.product.prodname_copilot %}, which includes: + +* **Your prompts**: What you've asked {% data variables.product.prodname_copilot_short %} to do, and any replies you made when {% data variables.product.prodname_copilot_short %} asked you questions. +* **{% data variables.product.prodname_copilot_short %}'s responses**: Answers, explanations, commands, code changes, and so on. +* **Conversation context**: Information sent to the large language model to allow it to respond to your prompts appropriately. +* **Tool activity**: Files {% data variables.product.prodname_copilot_short %} has accessed, commands it has run, searches it has performed. +* **Session-specific state**: For example, the current working directory, filesystem permissions, access approvals, the current mode (interactive, plan, or autopilot). + +You're not limited to one session at a time. You can keep several running side by side and switch between them. This can be useful when you are: + +* **Working on two pieces of work at once**—for example, building a feature in one session while fixing an unrelated bug in another. +* **Waiting on a long-running task**—let one session compile, run your test suite, or work autonomously in autopilot while you plan the next change in another. +* **Handing work off**—delegate a task to the cloud and keep an eye on it while you carry on locally. + +There are three places where you can work with your sessions: + +* The **sessions sidebar**: a panel docked to the left of your current conversation for quickly switching between the sessions. This is the fastest way to move between active, or recently active, local sessions. +* The **Sessions tab**: a more complete list of your session history, including remote sessions. The list is searchable and is displayed in the main CLI area. +* The **session picker**: a command-line interface for switching between sessions, which you can invoke from any local session by entering `/resume` or `/continue`. + +The sessions sidebar is the main focus of this article. + +## The sessions sidebar + +The sidebar is a panel that opens alongside your current chat. Because it sits beside the conversation rather than replacing it, your conversation timeline and prompt input field remain visible while you are on the **Current** tab of the main CLI area. You can see your other sessions without leaving the session you are working in. + +### Opening and closing the sidebar + +From your conversation, while there is nothing in the prompt input field, press ← to open the sidebar and move focus into it. Press → to move focus back to the conversation, and again to close the sidebar. If you prefer Vim-style keys, h and l work the same way while the sidebar has focus. + +### Moving between sessions + +While the sidebar has focus, press ↑ and ↓ (or k and j) to move through your sessions. Press Enter to open the session you've chosen. Focus returns to the conversation, allowing you to immediately type a prompt. + +Press s to change the order in which sessions are listed, cycling through **Recent**, **Created**, **Name**, and **None** (unsorted). + +You can also switch to a session with the mouse. Both a single and a double click switch to a session. A single click returns the focus to the conversation (like pressing Enter), while a double click leaves the focus in the sidebar with that session selected, so you can keep moving through the session list. + +### Creating and closing sessions + +You can manage your sessions right from the sidebar: + +* Press n to start a **new** session. +* Press x twice to **close** the highlighted session. + + > [!NOTE] + > {% data reusables.copilot.close-session %} + +At the top of the sidebar are two header buttons: **←** (to close the sidebar) and **+** (to start a new session). Press ↑ past the top of the list to move onto this button row, then Tab to switch between the buttons and Enter to activate one. You can also click a button directly. + +### Reading session status at a glance + +Because the sidebar stays on screen while you work, it acts as a session status board. You can tell at a glance which sessions are: + +* Currently running (a solid circle icon: `●`). +* The current session displayed in the CLI's **Current** tab (highlighted). +* Recently used, but not currently running (a hollow circle icon: `○`). +* Busy processing a turn (a pulsing circle icon: `● ◉ ◎ ○`), or idle (a static icon). +* Awaiting your attention (`!` for a permission prompt, `?` for a question). +* In a particular mode (plan and autopilot modes use different colored text from the default mode). + +### Resizing and mouse control + +Beyond clicking a session to switch to it, you can drag the divider between the sidebar and your conversation to resize the panel, and hover the list and use the scroll wheel to move through longer lists of sessions. + +### Getting quick help + +Press ? while the sidebar is open to see a quick reference guide to the session sidebar. + +For the full sidebar reference, see [AUTOTITLE](/copilot/reference/copilot-cli-reference/cli-command-reference#the-sessions-sidebar). + +## The Sessions tab + +The **Sessions** tab is a full-screen view of your sessions. Use the Tab key to switch to this tab. Alternatively, enter `/session`. + +The **Sessions** tab offers several things you don't get in the sidebar: + +* **Search**: press / then start typing the name of a session you want to find. +* **Scope filter**: press a to cycle the list between **local**, **remote**, and **all** sessions. +* **Full history**: the tab scans your complete session store, not just the recent ones. +* **Cloud and remote sessions**: sessions that ran in the cloud appear here so you can resume them. + +## Choosing between the sidebar and the Sessions tab + +Both places list your sessions, but they are tuned for different jobs. The sidebar is a quick switcher for the sessions you are actively juggling. The **Sessions** tab is the full library and management surface. + +| | Sidebar | Sessions tab | +| --- | ------- | ------------ | +| **Layout** | Docked beside your conversation | Full-screen | +| **Your current chat** | Stays visible | Hidden while the tab is open | +| **Sessions shown** | Recent and live local sessions | Your complete history | +| **Cloud / remote sessions** | No | Yes | +| **Search** | No | Yes | +| **Scope (all / local / remote)** | No (just local) | Yes | +| **Best for** | Fast switching in context | Finding, browsing, and managing | + +Use the **sidebar** when you want to: + +* **Stay in your conversation.** The sidebar keeps your conversation timeline on screen while you see your other sessions. Opening the **Sessions** tab hides your current conversation entirely. +* **Switch fast, in place.** With the sidebar focused, you can quickly switch back and forth between sessions. +* **Keep an eye on status.** Because it stays on screen, the sidebar lets you see your sessions' status and attention markers—no need to navigate away to check on them. +* **Toggle without leaving your flow.** You can open, close, switch sessions with the arrow keys as part of your normal typing. + +Use the **Sessions tab** when you want to: + +* **Search** for a specific past session. +* **Resume a cloud or remote session**—these only appear in the tab. +* **Browse your full history**—older sessions that have dropped out of the sidebar's recent list are only reachable here. + +You don't give up much by staying in the sidebar for day-to-day work. You can do most session management in the sidebar without going to the **Sessions** tab. + +## Returning to a previous session + +Sessions are saved, so you can come back to work you started earlier—to continue a task, check what an agent did, or reuse the context you had already built up. + +* **From the sidebar**: recent sessions for your current directory appear as resumable rows (marked ○). Highlight one and press Enter to open it and start working there again. +* **From the Sessions tab**: search or browse your complete history, including cloud sessions, and open any of them. +* **With the session picker**: within a local session, enter `/resume` (or `/continue`) to display a picker listing your saved sessions. Use the arrow keys to navigate to a session, then press Enter to open it, or `d` to delete it. Press `s` to cycle through different sort orders for the list: **relevance** (how well it matches your current working directory), **last used**, **created**, and **name**. + +You can also pick a session when you start {% data variables.copilot.copilot_cli_short %} from the command line: + +```shell +# Resume the most recent session +copilot --continue + +# Choose a session to resume +copilot --resume + +# Resume a specific session by ID, ID prefix, or exact name +copilot --resume=SESSION-ID +copilot --resume="my feature" + +# Name a new session so it is easy to find later +copilot --name "checkout refactor" +``` + +## Active and inactive sessions + +At any moment, a session is one of two things: + +* **Active**: running right now inside {% data variables.copilot.copilot_cli_short %}, whether it's the session you're chatting with or one running in the background. When you switch away from a session it keeps running rather than stopping, so a long task carries on while you move to another. Active sessions are indicated with a filled circle (`●`). +* **Inactive**: saved to disk but not running. Inactive sessions are indicated with an empty circle (`○`). + +A local session stays active for as long as the {% data variables.copilot.copilot_cli_short %} process running it stays open. There's no inactivity timeout—a background session sitting idle isn't stopped automatically. When you quit {% data variables.copilot.copilot_cli_short %}, its local sessions stop and become inactive. They're still saved, so you can resume them next time. To stop your machine sleeping while a session is active, use `/keep-alive on`. + +Sessions can also run **remotely**. When you delegate a task with [`/delegate`](/copilot/how-tos/copilot-cli/cli-best-practices#the-delegate-command) (or by prefixing a prompt with `&`), {% data variables.product.prodname_copilot_short %} hands the work off to {% data variables.copilot.copilot_cloud_agent %} on {% data variables.product.github %}, which works in the background on your behalf—independently of your CLI. These cloud sessions appear in the **Sessions** tab, where you can resume them and steer locally. For more on hands-off work, see [AUTOTITLE](/copilot/how-tos/copilot-cli/use-copilot-cli/delegate-tasks-to-cca). + +### Stopping a session + +To stop the session you are currently working in, use the `/exit` slash command. Alternatively, you can stop a session from the sidebar by highlighting it and pressing x. This stops the session and removes it from the sidebar until you resume it. + +Stopping a session doesn't delete it. The session is saved and you can resume it later. + +You don't have to stop sessions. Leaving them running lets you switch back instantly with their full context. But you might stop one to halt work you no longer want: for example, a session running in autopilot mode, or a session running a prompt that you scheduled with `/every` or `/after`. You might also choose to stop a session to free up memory, or just to reduce clutter in the sidebar. + +## Session slash commands + +You can manage sessions with slash commands from inside any session: + +| Command | What it does | +| ------- | ------------ | +| `/new` | Start a new session. | +| `/resume [SESSION-ID]`, `/continue` | Switch to another session, choosing from the picker (or pass an ID). | +| `/rename [NAME]` | Rename the current session (a name is generated if you omit one). | +| `/session` | Open the **Sessions** tab. | +| `/session info` | Show details about the current session. | +| `/session id` | Show the current session ID and copy it to the clipboard. | +| `/session files` | List the files changed in this session. | +| `/session plan` | Show the current plan. | +| `/session checkpoints [N]` | Show the session's checkpoints. | +| `/session cleanup`, `/session prune` | Housekeeping for old or stale session data. | +| `/session delete [ID]`, `/session delete-all` | Delete a session, or all of them. | +| `/exit`, `/quit` | Close the current session. If others are open, the newest remaining one comes to the foreground. The CLI quits only when you close the last session. | + +## Customizing the sidebar + +The sidebar is available by default. You can turn off the ability to open it, or change various aspects of its behavior, by using the various `/settings sidebar.*` slash commands in an interactive session. For example, you can enable close buttons for each session in the sidebar, and you can have the current focus (conversation or sidebar) follow the mouse pointer position. + +For the full list of sidebar settings and their defaults, see [AUTOTITLE](/copilot/reference/copilot-cli-reference/cli-command-reference#sessions-sidebar-settings). + +Further reading: +* [AUTOTITLE](/copilot/concepts/agents/copilot-cli/chronicle) +* [AUTOTITLE](/copilot/reference/copilot-cli-reference/cli-command-reference#session-status-indicators) diff --git a/content/copilot/reference/copilot-cli-reference/cli-command-reference.md b/content/copilot/reference/copilot-cli-reference/cli-command-reference.md index 6a7706b2ca18..d4e58a2da4f5 100644 --- a/content/copilot/reference/copilot-cli-reference/cli-command-reference.md +++ b/content/copilot/reference/copilot-cli-reference/cli-command-reference.md @@ -174,6 +174,107 @@ copilot plugins remove spark@copilot-plugins With `--skill`, pass either a skill name or the path to a custom skill directory you added. A skill name deletes that skill's files; a custom directory path only unregisters the directory and leaves its files on disk. Only personal and project skills you added can be deleted—skills provided by a plugin or the builtin set can't be removed this way (disable them instead). Instruction sources are discovered from disk and can't be removed here. +## The sessions sidebar + +The sessions sidebar is a panel docked beside your current conversation that provides a quick way of working with your local {% data variables.copilot.copilot_cli %} sessions. + +When the sidebar has focus, the following keyboard shortcuts are available. + +| Shortcut | Purpose | +|----------|---------| +| ← | From the conversation, open the sidebar and move focus into it (Vim: `h`). | +| → | Move focus back to the conversation; press again to close the sidebar (Vim: `l`). | +| ↑/↓ | Move between sessions in the sidebar (also `k`/`j`). | +| Enter | Open the selected session and return focus to the conversation. | +| `n` | Start a new session. | +| `x` twice | Close the selected session. | +| ↑ then Tab | From the top of the sessions list, ↑ moves onto the header buttons (**←** close sidebar, **+** new session). Tab switches between them. | +| `?` | Show the sidebar help. | + +The sidebar also responds to the mouse. + +| Gesture | Purpose | +|---------|---------| +| Click a session | Switch to that session and return to the conversation. | +| Double-click a session | Switch to that session and stay in the sidebar. | +| Drag the divider | Resize the sidebar. | +| Hover the sidebar and scroll | Scroll the session list. | +| Click a header button | **←** to close the sidebar, **+** to start a new session. | +| Hover over the right side of a session | Show the close button (requires `sidebar.showCloseButton`). | + +### Session status indicators + +Each session in the sidebar shows an indicator of its current state. + +| Indicator | Meaning | +|-----------|---------| +| `●` steady | A running but idle session—waiting for your next prompt. | +| `●` pulsing | A running session. The agent is actively processing a turn. | +| `!` | The session needs permission to continue. | +| `?` | The session is waiting for you (a question or a choice). | +| `○` | A resumable session—saved, but not currently running. | + +The text of sessions in the default CLI chat mode uses the default text color. Different colors are used in plan mode and in autopilot mode. + +### Sessions sidebar settings + +Use the `/settings sidebar` slash command in an interactive CLI session to adjust these settings for the sessions sidebar. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
SettingDescriptionDefault
sidebar.enabledAllow the sessions sidebar to be displayed.On
sidebar.showResumableSessionsThe sidebar includes previous sessions that you can resume. When set to off, only active sessions are listed. Changes to this setting take effect the next time {% data variables.copilot.copilot_cli_short %} is started.On
sidebar.showHeaderButtonsShow the row of buttons at the top of the sidebar for collapsing it (←) and starting a new session (+).On
sidebar.showCloseButtonAs an alternative to clicking X, hovering the mouse towards the right of a session in the sidebar displays a close session button. Click this, then click again to confirm. {% data reusables.copilot.close-session %}Off
sidebar.hoverFocusThe focus changes from the main CLI tab to the sidebar depending on where the mouse pointer is.Off
sidebar.coloredHintsWhile the sidebar is open and your conversation is focused, show the use sidebar hint in the sidebar's accent color to call attention to it. When off, the same color as other hints is used. While the sidebar is closed, the same color as other hints is always used.On
sidebar.accentActiveSessionChange the session selection highlighting in the sidebar. When on, the session currently open in your conversation gets the main highlighting. When off the session selected with the keyboard up and down arrows (or with the mouse) gets the main highlighting.On
+ +For more information about the sessions sidebar, see [AUTOTITLE](/copilot/how-tos/copilot-cli/use-copilot-cli/work-with-multiple-sessions). + ## Global shortcuts in the interactive interface | Shortcut | Purpose | diff --git a/data/reusables/copilot/close-session.md b/data/reusables/copilot/close-session.md new file mode 100644 index 000000000000..e90b04ab328f --- /dev/null +++ b/data/reusables/copilot/close-session.md @@ -0,0 +1 @@ +Sessions that are running are ended, saved, and removed from the sidebar. Sessions that are not running are simply removed from the sidebar. Sessions you remove in this way are not displayed in the sidebar in future sessions unless you resume the session—for example, from the >/resume session picker. From 48bf9e9801a9f1957906c25905f5976d4e74ccca Mon Sep 17 00:00:00 2001 From: mc <42146119+mchammer01@users.noreply.github.com> Date: Thu, 3 Sep 2026 10:21:00 +0000 Subject: [PATCH 7/8] Clarify the Secret Protection adoption phases (#62969) Copilot-Session: 4dc7619e-c19c-4b1d-b272-5f1aedfba0cb --- .../code-security/tutorials/secret-protection-adoption-path.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/code-security/tutorials/secret-protection-adoption-path.md b/content/code-security/tutorials/secret-protection-adoption-path.md index 549c1aec3d8f..213fc91d8f54 100644 --- a/content/code-security/tutorials/secret-protection-adoption-path.md +++ b/content/code-security/tutorials/secret-protection-adoption-path.md @@ -2,7 +2,7 @@ title: Secure your secrets at scale with GitHub shortTitle: Secret protection allowTitleToDifferFromFilename: true -intro: 'Leaked credentials expose your organization to data breaches. GitHub Secret Protection detects and prevents secret leaks automatically. Follow this adoption path to assess risk, pilot the solution, and scale protection organization-wide.' +intro: 'Leaked credentials expose your organization to data breaches. {% data variables.product.prodname_GH_secret_protection %} detects and prevents secret leaks automatically. Follow this five-phase adoption path to assess your current risk, evaluate {% data variables.product.prodname_GH_secret_protection %}, run a pilot, monitor its value, and scale protection across your organization.' layout: journey-landing versions: feature: secret-risk-assessment From 841108d9f1518e1334358b1ea89894a64ca2b916 Mon Sep 17 00:00:00 2001 From: Logan Rosen Date: Thu, 3 Sep 2026 12:01:14 +0000 Subject: [PATCH 8/8] Document adding a code of conduct on GHES (#63003) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> Copilot-Session: e6c570c7-912d-463d-adc9-e83de49b99d4 --- .../release-and-maintain-actions.md | 4 +-- ...dding-a-code-of-conduct-to-your-project.md | 25 +++++++++++++------ ...reating-a-default-community-health-file.md | 2 +- .../managing-discussions.md | 2 +- .../moderating-discussions.md | 4 +-- content/discussions/quickstart.md | 2 +- .../using-github/communicating-on-github.md | 2 +- .../about-readmes.md | 2 +- data/reusables/repositories/about-READMEs.md | 2 +- 9 files changed, 27 insertions(+), 18 deletions(-) diff --git a/content/actions/how-tos/create-and-publish-actions/release-and-maintain-actions.md b/content/actions/how-tos/create-and-publish-actions/release-and-maintain-actions.md index bab028b815b4..06550fa6234d 100644 --- a/content/actions/how-tos/create-and-publish-actions/release-and-maintain-actions.md +++ b/content/actions/how-tos/create-and-publish-actions/release-and-maintain-actions.md @@ -89,8 +89,8 @@ Using semantic releases means that the users of your actions can pin their workf {% data variables.product.github %} provides tools and guides to help you work with the open source community. Here are a few tools we recommend setting up for healthy bidirectional communication. By providing the following signals to the community, you encourage others to use, modify, and contribute to your action: * Maintain a `README` with plenty of usage examples and guidance. For more information, see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes). -* Include a workflow status badge in your `README` file. For more information, see [AUTOTITLE](/actions/how-tos/monitor-workflows/add-a-status-badge). Also visit [shields.io](https://shields.io/) to learn about other badges that you can add.{% ifversion fpt or ghec %} -* Add community health files like `CODE_OF_CONDUCT`, `CONTRIBUTING`, and `SECURITY`. For more information, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file#supported-file-types).{% endif %} +* Include a workflow status badge in your `README` file. For more information, see [AUTOTITLE](/actions/how-tos/monitor-workflows/add-a-status-badge). Also visit [shields.io](https://shields.io/) to learn about other badges that you can add. +* Add community health files like `CODE_OF_CONDUCT`, `CONTRIBUTING`, and `SECURITY`. For more information, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file#supported-file-types). * Keep issues current by utilizing actions like [actions/stale](https://github.com/actions/stale).{% ifversion fpt or ghec %} * Use {% data variables.product.github %}'s security features to communicate about vulnerabilities and how to fix them. For more information, see [AUTOTITLE](/actions/reference/security/secure-use#protecting-actions-youve-created).{% endif %} diff --git a/content/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project.md b/content/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project.md index 661ba579860f..2c958ac8f8df 100644 --- a/content/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project.md +++ b/content/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project.md @@ -7,6 +7,7 @@ redirect_from: versions: fpt: '*' ghec: '*' + ghes: '*' shortTitle: Add a code of conduct category: - Set up your project for contributions @@ -19,13 +20,19 @@ Before adopting a code of conduct for your project: * Research different codes of conduct designed for open source projects. Choose one that reflects your community's standards. * Consider carefully whether you are willing and able to enforce it. -You can add a code of conduct to your project by using a template or manually creating a custom code of conduct. Your code of conduct will be available either way, but "Code of conduct" will only be marked as complete in your repository's community profile if you use a template. If you use a code of conduct written by another person or organization, be sure to follow any attribution guidelines from the source. For more information about community profiles, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/about-community-profiles-for-public-repositories). +{% ifversion fpt or ghec %} +You can add a code of conduct to your project by using a template or manually creating a custom code of conduct. Your code of conduct will be available either way. In a public repository's community profile, "Code of conduct" is marked as added if the file is not empty and does not state that the project has no code of conduct. If you use a code of conduct written by another person or organization, be sure to follow any attribution guidelines from the source. For more information about community profiles, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/about-community-profiles-for-public-repositories). +{% else %} +You can add a code of conduct to your project by manually creating a custom code of conduct file. If you use a code of conduct written by another person or organization, be sure to follow any attribution guidelines from the source. +{% endif %} -You can create a default code of conduct for your organization or personal account. For more information, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file). +You can create a default code of conduct for your organization{% ifversion ghec %} or, unless you are signed in with a {% data variables.enterprise.prodname_managed_user %}, for your personal account{% else %} or personal account{% endif %}. For more information, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file). + +{% ifversion fpt or ghec %} ## Adding a code of conduct using a template -{% data variables.product.github %} provides templates for common codes of conduct to help you quickly add a code of conduct to your project. +{% data variables.product.github %} provides templates for common codes of conduct to help you quickly add a code of conduct to your project. To use a template, you must have write access to the repository. {% data reusables.repositories.navigate-to-repo %} {% data reusables.files.add-file %} @@ -40,16 +47,18 @@ You can create a default code of conduct for your organization or personal accou {% data reusables.files.choose_commit_branch %} {% data reusables.files.propose_new_file %} +{% endif %} + ## Adding a code of conduct manually -If the code of conduct you want to use isn't available in the provided templates, you can manually add a code of conduct. +{% ifversion fpt or ghec %}If the code of conduct you want to use isn't available in the provided templates, you can manually add a code of conduct.{% else %}You can manually add a code of conduct to your project.{% endif %} {% data reusables.repositories.navigate-to-repo %} {% data reusables.files.add-file %} -1. In the file name field, type the name and extension for the file. - * To make your code of conduct visible in the repository's root directory, type _CODE_OF_CONDUCT_ in the file name field. - * To make your code of conduct visible in the repository's `docs` directory, type _docs/CODE_OF_CONDUCT_. - * To make your code of conduct visible in the repository's `.github` directory, type _.github/CODE_OF_CONDUCT_. +1. In the file name field, type the path and name for the file. {% data variables.product.github %} looks for a code of conduct in the `.github` directory, then the root of the repository, then the `docs` directory, and uses the first file it finds. + * To add your code of conduct to the repository's `.github` directory, type _.github/CODE_OF_CONDUCT.md_. + * To add your code of conduct to the repository's root directory, type _CODE_OF_CONDUCT.md_. + * To add your code of conduct to the repository's `docs` directory, type _docs/CODE_OF_CONDUCT.md_. 1. In the new file, add your custom code of conduct. {% data reusables.files.write_commit_message %} {% data reusables.files.choose_commit_branch %} diff --git a/content/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file.md b/content/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file.md index 007e0cc90b80..90040a636254 100644 --- a/content/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file.md +++ b/content/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file.md @@ -61,7 +61,7 @@ You can create defaults in your organization or personal account for the followi | Community health file | Description | | --- | --- | -| _CODE_OF_CONDUCT.md_ | A CODE_OF_CONDUCT file defines standards for how to engage in a community.{% ifversion fpt or ghec %} For more information, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project).{% endif %} | +| _CODE_OF_CONDUCT.md_ | A CODE_OF_CONDUCT file defines standards for how to engage in a community. For more information, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project). | | _CONTRIBUTING.md_ | A CONTRIBUTING file communicates how people should contribute to your project. For more information, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/setting-guidelines-for-repository-contributors). | | Discussion category forms | Discussion category forms customize the templates that are available for community members to use when they open new discussions in your repository. For more information, see [AUTOTITLE](/discussions/managing-discussions-for-your-community/creating-discussion-category-forms). | | {% ifversion fpt or ghec %} | diff --git a/content/discussions/managing-discussions-for-your-community/managing-discussions.md b/content/discussions/managing-discussions-for-your-community/managing-discussions.md index 92fbdd06d766..d0a3afc4c116 100644 --- a/content/discussions/managing-discussions-for-your-community/managing-discussions.md +++ b/content/discussions/managing-discussions-for-your-community/managing-discussions.md @@ -20,7 +20,7 @@ category: Organization owners can choose the permissions required to create a discussion in repositories owned by the organization. Similarly, to choose the permissions required to create an organization discussion, organization owners can change the permissions required in the source repository. For more information, see [AUTOTITLE](/organizations/managing-organization-settings/managing-discussion-creation-for-repositories-in-your-organization). -As a discussions maintainer, you can create community resources to encourage discussions that are aligned with the overall project goal and maintain a friendly open forum for collaborators. Creating{% ifversion fpt or ghec %} a code of conduct or{% endif %} contribution guidelines for collaborators to follow will help facilitate a collaborative and productive forum. For more information on creating community resources, see{% ifversion fpt or ghec %} [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project), and{% endif %} [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/setting-guidelines-for-repository-contributors). +As a discussions maintainer, you can create community resources to encourage discussions that are aligned with the overall project goal and maintain a friendly open forum for collaborators. Creating a code of conduct or contribution guidelines for collaborators to follow will help facilitate a collaborative and productive forum. For more information on creating community resources, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project) and [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/setting-guidelines-for-repository-contributors). When a discussion yields an idea or bug that is ready to be worked on, you can create a new issue from a discussion. For more information, see [AUTOTITLE](/issues/tracking-your-work-with-issues/using-issues/creating-an-issue#creating-an-issue-from-discussion). diff --git a/content/discussions/managing-discussions-for-your-community/moderating-discussions.md b/content/discussions/managing-discussions-for-your-community/moderating-discussions.md index 0d8d3668103f..6aa946dfd8dd 100644 --- a/content/discussions/managing-discussions-for-your-community/moderating-discussions.md +++ b/content/discussions/managing-discussions-for-your-community/moderating-discussions.md @@ -1,6 +1,6 @@ --- title: Moderating discussions -intro: 'You can promote healthy collaboration by marking comments as answers, locking or unlocking discussions, converting issues to discussions, and editing or deleting comments, discussions, and categories that don''t align with your{% ifversion fpt or ghec %} community''s code of conduct{% elsif ghes %} organization''s contribution guidelines{% endif %}.' +intro: 'You can promote healthy collaboration by marking comments as answers, locking or unlocking discussions, converting issues to discussions, and editing or deleting comments, discussions, and categories that don''t align with your community''s code of conduct.' permissions: People with triage access to a repository can moderate discussions in the repository. People with triage access to the source repository for organization discussions can moderate discussions in the organization. versions: fpt: '*' @@ -21,7 +21,7 @@ category: ## Locking discussions -It's appropriate to lock a conversation when the entire conversation is not constructive or violates your community's code of conduct or {% data variables.product.prodname_dotcom %}'s [Community Guidelines](/free-pro-team@latest/site-policy/github-terms/github-community-guidelines). You can also lock a conversation to prevent comments on a discussion you want to use as an announcement to the community. When you lock a conversation, people with write access to the repository, or source repository for organization discussions, will still be able to comment on the discussion. You can also allow emoji reactions to a locked discussion. +It's appropriate to lock a conversation when the entire conversation is not constructive or violates your community's code of conduct or {% data variables.product.prodname_dotcom %}'s [Community Guidelines](/site-policy/github-terms/github-community-guidelines). You can also lock a conversation to prevent comments on a discussion you want to use as an announcement to the community. When you lock a conversation, people with write access to the repository, or source repository for organization discussions, will still be able to comment on the discussion. You can also allow emoji reactions to a locked discussion. > [!NOTE] > You can also close a discussion. For more information, see [Closing a discussion](/discussions/managing-discussions-for-your-community/managing-discussions#closing-a-discussion). diff --git a/content/discussions/quickstart.md b/content/discussions/quickstart.md index 23936e0d6199..1b76966f0a4a 100644 --- a/content/discussions/quickstart.md +++ b/content/discussions/quickstart.md @@ -51,7 +51,7 @@ You can welcome your community and introduce a new way to communicate in a repos ## Setting up community guidelines for contributors -For repository discussions, you can set contributing guidelines to encourage collaborators to have meaningful, useful conversations that are relevant to the repository. You can also update the repository's README to communicate expectations on when collaborators should open an issue or discussion. For more information about providing guidelines for your project, see{% ifversion fpt or ghec %} [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project) and{% endif %} [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions). +For repository discussions, you can set contributing guidelines to encourage collaborators to have meaningful, useful conversations that are relevant to the repository. You can also update the repository's README to communicate expectations on when collaborators should open an issue or discussion. For more information about providing guidelines for your project, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project) and [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions). For organization discussions, you share information about how to engage with your organization by creating an organization profile README. For more information, see [AUTOTITLE](/organizations/collaborating-with-groups-in-organizations/customizing-your-organizations-profile). diff --git a/content/get-started/using-github/communicating-on-github.md b/content/get-started/using-github/communicating-on-github.md index 62d4d85a1a19..68cbb2b883f6 100644 --- a/content/get-started/using-github/communicating-on-github.md +++ b/content/get-started/using-github/communicating-on-github.md @@ -144,6 +144,6 @@ For issues, for example, you can tag issues with labels for quicker searching an For pull requests, you can create draft pull requests if your proposed changes are still a work in progress. Draft pull requests cannot be merged until they're marked as ready for review. For more information, see [AUTOTITLE](/pull-requests/reference/pull-requests#draft-pull-requests). -For {% data variables.product.prodname_discussions %}, you can{% ifversion fpt or ghec %} set up a code of conduct and{% endif %} pin discussions that contain important information for your community. For more information, see [AUTOTITLE](/discussions/collaborating-with-your-community-using-discussions/about-discussions). +For {% data variables.product.prodname_discussions %}, you can set up a code of conduct and pin discussions that contain important information for your community. For more information, see [AUTOTITLE](/discussions/collaborating-with-your-community-using-discussions/about-discussions). To learn some advanced formatting features that will help you communicate, see [AUTOTITLE](/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/quickstart-for-writing-on-github). diff --git a/content/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes.md b/content/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes.md index 0962b9712251..a41447a66934 100644 --- a/content/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes.md +++ b/content/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes.md @@ -19,7 +19,7 @@ category: {% data reusables.repositories.about-READMEs %} -For more information about providing guidelines for your project, see {% ifversion fpt or ghec %}[AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project) and {% endif %}[AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions). +For more information about providing guidelines for your project, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/adding-a-code-of-conduct-to-your-project) and [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions). A README is often the first item a visitor will see when visiting your repository. README files typically include information on: * What the project does diff --git a/data/reusables/repositories/about-READMEs.md b/data/reusables/repositories/about-READMEs.md index 18dfcd009dcf..a0c3385c0185 100644 --- a/data/reusables/repositories/about-READMEs.md +++ b/data/reusables/repositories/about-READMEs.md @@ -1 +1 @@ -You can add a README file to a repository to communicate important information about your project. A README, along with a repository license, citation file{% ifversion fpt or ghec %}, contribution guidelines, and a code of conduct{% elsif ghes %} and contribution guidelines{% endif %}, communicates expectations for your project and helps you manage contributions. +You can add a README file to a repository to communicate important information about your project. A README, along with a repository license, citation file, contribution guidelines, and a code of conduct, communicates expectations for your project and helps you manage contributions.