diff --git a/.github/workflows/check-for-spammy-prs.yml b/.github/workflows/check-for-spammy-prs.yml index e03da545e0db..241fd9b9f369 100644 --- a/.github/workflows/check-for-spammy-prs.yml +++ b/.github/workflows/check-for-spammy-prs.yml @@ -37,13 +37,19 @@ jobs: const onlyDeletes = files.length > 0 && files.every(f => f.status === 'removed') const isEmptyCommit = !files.length const touchesTooMany = files.length > 10 - const totalChanges = files.reduce((sum, f) => sum + f.additions + f.deletions, 0) - const isOneLineAddition = files.every(f => f.status === 'added') && totalChanges <= 1 - const isBlankLineEdit = totalChanges <= 1 && files.every(f => f.status === 'modified') + const isBlankLineEdit = files.length > 0 && files.every(file => { + const changedLines = (file.patch || '') + .split('\n') + .filter(line => /^[+-]/.test(line)) + ) + + return changedLines.length > 0 && + changedLines.every(line => line.slice(1).trim() === '') + }) const onlyRenames = files.length > 0 && files.every(f => f.status === 'renamed') // Close the PR and add the invalid label - if (onlyDeletes || isEmptyCommit || touchesTooMany || isOneLineAddition || isBlankLineEdit || onlyRenames) { + if (onlyDeletes || isEmptyCommit || touchesTooMany || isBlankLineEdit || onlyRenames) { await github.rest.issues.update({ owner: owner, repo: repo, diff --git a/content/account-and-profile/tutorials/personalize-your-profile.md b/content/account-and-profile/tutorials/personalize-your-profile.md index b63377321bf0..c03da6333112 100644 --- a/content/account-and-profile/tutorials/personalize-your-profile.md +++ b/content/account-and-profile/tutorials/personalize-your-profile.md @@ -25,7 +25,7 @@ category: --- > [!NOTE] -> Your profile name for your is {% data variables.product.github %} account is **required**. All other profile information described in this article is **optional**. +> Your profile name for your {% data variables.product.github %} account is **required**. All other profile information described in this article is **optional**. ## Changing your profile picture diff --git a/content/actions/concepts/security/openid-connect.md b/content/actions/concepts/security/openid-connect.md index 140a46861367..37f2dc5911ef 100644 --- a/content/actions/concepts/security/openid-connect.md +++ b/content/actions/concepts/security/openid-connect.md @@ -99,6 +99,12 @@ To use OIDC in your workflows, you must establish a trust relationship between { Before granting an access token, your cloud provider checks that the [`subject`](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) and any other claims used to set conditions in its trust settings match those in the request's JSON Web Token (JWT). If the trust configuration matches, your cloud provider issues a temporary access token to the workflow. +{% ifversion dependabot-oidc-support %} + +OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs have an `event_name` claim of `dynamic`. If your trust policy is intended to authorize only {% data variables.product.prodname_actions %} workflows and your cloud provider supports conditions on `event_name`, allow only the event names expected by your workflows. + +{% endif %} + For steps and syntax for configuring OIDC trust and setting conditions for cloud providers, see [AUTOTITLE](/actions/reference/security/oidc#oidc-claims-used-to-define-trust-conditions-on-cloud-roles). ## Configuring OIDC on {% data variables.enterprise.data_residency_site %} diff --git a/content/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-jfrog.md b/content/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-jfrog.md index edf61b623941..1f12a985cf17 100644 --- a/content/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-jfrog.md +++ b/content/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-jfrog.md @@ -34,7 +34,7 @@ For an example {% data variables.product.prodname_actions %} workflow using the * To be secure, you need to set a Claims JSON in JFrog when configuring identity mappings. For more information, see [AUTOTITLE](https://jfrog.com/help/r/jfrog-platform-administration-documentation/configure-identity-mappings) and [AUTOTITLE](/actions/reference/security/oidc#customizing-the-token-claims). - For example, you can set `iss` to `https://token.actions.githubusercontent.com`, and the `repository` to something like "octo-org/octo-repo"`. This will ensure only Actions workflows from the specified repository will have access to your JFrog platform. The following is an example Claims JSON when configuring identity mappings. + For example, you can set `iss` to `https://token.actions.githubusercontent.com`, and the `repository` to something like `octo-org/octo-repo`.{% ifversion dependabot-oidc-support %} JFrog identity mappings match each claim against an exact value, so to ensure only {% data variables.product.prodname_actions %} workflows from the specified repository have access to your JFrog platform, also set `event_name` to the event that triggers your workflow, such as `push`. This prevents OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs, which have an `event_name` of `dynamic`, from matching the identity mapping. If your workflows are triggered by more than one event, create a separate identity mapping for each event name.{% endif %} The following is an example Claims JSON when configuring identity mappings. {% data reusables.actions.jfrog-json-configuring-identity-mappings %} diff --git a/content/actions/reference/security/oidc.md b/content/actions/reference/security/oidc.md index cba1290aeffc..9c3773dae3db 100644 --- a/content/actions/reference/security/oidc.md +++ b/content/actions/reference/security/oidc.md @@ -60,7 +60,7 @@ The OIDC token includes the following claims. | `enterprise_id`| The ID of the enterprise that contains the repository from where the workflow is running. | | {% endif %} | | `environment`| The name of the environment used by the job. If the `environment` claim is included (also via `include_claim_keys`), an environment is required and must be provided. | -| `event_name`| The name of the event that triggered the workflow run. | +| `event_name`| The name of the event that triggered the workflow run.{% ifversion dependabot-oidc-support %} OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs use `dynamic` as the value.{% endif %} | | `head_ref`| The source branch of the pull request in a workflow run. | | `job_workflow_ref`| For jobs using a reusable workflow, the ref path to the reusable workflow. For more information, see [AUTOTITLE](/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows). | | `job_workflow_sha`| For jobs using a reusable workflow, the commit SHA for the reusable workflow file. | @@ -107,6 +107,12 @@ If you need more granular trust conditions, you can customize the {% ifversion g There are also many additional claims supported in the OIDC token that can be used for setting these conditions. In addition, your cloud provider could allow you to assign a role to the access tokens, letting you specify even more granular permissions. +{% ifversion dependabot-oidc-support %} + +OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs have an `event_name` claim of `dynamic`. If your trust policy is intended to authorize only {% data variables.product.prodname_actions %} workflows and your cloud provider supports conditions on `event_name`, allow only the event names expected by your workflows. + +{% endif %} + > [!NOTE] > To control how your cloud provider issues access tokens, you **must** define at least one condition, so that untrusted repositories can’t request access tokens for your cloud resources. diff --git a/content/actions/tutorials/use-actions-runner-controller/get-started.md b/content/actions/tutorials/use-actions-runner-controller/get-started.md index 0be8667ca663..fb4db0392376 100644 --- a/content/actions/tutorials/use-actions-runner-controller/get-started.md +++ b/content/actions/tutorials/use-actions-runner-controller/get-started.md @@ -45,7 +45,7 @@ In order to use ARC, ensure you have the following. For additional Helm configuration options, see [`values.yaml`](https://github.com/actions/actions-runner-controller/blob/master/charts/gha-runner-scale-set-controller/values.yaml) in the ARC documentation. -1. To enable ARC to authenticate to {% data variables.product.company_short %}, generate a {% data variables.product.pat_v1 %}. For more information, see [AUTOTITLE](/actions/how-tos/manage-runners/use-actions-runner-controller/authenticate-to-the-api#authenticating-arc-with-a-personal-access-token-classic). +1. To enable ARC to authenticate to {% data variables.product.company_short %}, choose an authentication method for your runner scale set. If you are registering runners at the repository or organization level, we recommend authenticating with a {% data variables.product.prodname_github_app %}. Runner scale sets registered at the enterprise level require {% data variables.product.pat_v1 %} authentication. For more information, see [AUTOTITLE](/actions/how-tos/manage-runners/use-actions-runner-controller/authenticate-to-the-api). ## Configuring a runner scale set @@ -56,10 +56,11 @@ In order to use ARC, ensure you have the following. * Update the `INSTALLATION_NAME` value carefully. You will use the installation name as the value of `runs-on` in your workflows. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idruns-on). * Update the `NAMESPACE` value to the location you want the runner pods to be created. * Set `GITHUB_CONFIG_URL` to the URL of your repository, organization, or enterprise. This is the entity that the runners will belong to. + * This example uses a {% data variables.product.pat_v1 %} to keep the initial setup short. For repository or organization runner scale sets, use a {% data variables.product.prodname_github_app %} in production environments when possible. {% ifversion fpt %} - * Set `GITHUB_PAT` to a {% data variables.product.company_short %} {% data variables.product.pat_generic %} with the `repo` and `admin:org` scopes for repository and organization runners. + * Set `GITHUB_PAT` to a {% data variables.product.company_short %} {% data variables.product.pat_v1 %} with the `repo` and `admin:org` scopes for repository and organization runners. {% else %} - * Set `GITHUB_PAT` to a {% data variables.product.company_short %} {% data variables.product.pat_generic %} with the `repo` and `manage_runners:org` scopes for repository and organization runners, and the `manage_runners:enterprise` scope for enterprise runners. + * Set `GITHUB_PAT` to a {% data variables.product.company_short %} {% data variables.product.pat_v1 %} with the `repo` and `manage_runners:org` scopes for repository and organization runners, and the `manage_runners:enterprise` scope for enterprise runners. {% endif %} * This example command installs the latest version of the Helm chart. To install a specific version, you can pass the `--version` argument with the version of the chart you wish to install. You can find the list of releases in the [GitHub Container Registry](https://github.com/actions/actions-runner-controller/pkgs/container/actions-runner-controller-charts%2Fgha-runner-scale-set). diff --git a/content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization.md b/content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization.md index caeb5a661880..4131a90d751f 100644 --- a/content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization.md +++ b/content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization.md @@ -56,119 +56,13 @@ Some of the features listed below are limited to organizations using {% data var | Repository action | Read | Triage | Write | Maintain | Admin | |:---|:---:|:---:|:---:|:---:|:---:| -| Manage [individual](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-an-individuals-access-to-an-organization-repository), [team](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-team-access-to-an-organization-repository), and [outside collaborator](/organizations/managing-user-access-to-your-organizations-repositories/managing-outside-collaborators/adding-outside-collaborators-to-repositories-in-your-organization) access to the repository | ✗ | ✗ | ✗ | ✗ | ✓ | -| Pull from the person or team's assigned repositories | ✓ | ✓ | ✓ | ✓ | ✓ | -| Fork the person or team's assigned repositories | ✓ | ✓ | ✓ | ✓ | ✓ | -| Edit and delete their own comments | ✓ | ✓ | ✓ | ✓ | ✓ | -| Open issues | ✓ | ✓ | ✓ | ✓ | ✓ | -| Close issues they opened themselves | ✓ | ✓ | ✓ | ✓ | ✓ | -| Reopen issues they closed themselves | ✓ | ✓ | ✓ | ✓ | ✓ | -| Have an issue assigned to them | ✓ | ✓ | ✓ | ✓ | ✓ | -| Send pull requests from forks of the team's assigned repositories | ✓ | ✓ | ✓ | ✓ | ✓ | -| [Submit reviews on pull requests](/pull-requests/how-tos/review-pull-requests/reviewing-proposed-changes-in-a-pull-request) | ✓ | ✓ | ✓ | ✓ | ✓ | -| [Approve or request changes to a pull request with required reviews](/pull-requests/how-tos/review-pull-requests/approving-a-pull-request-with-required-reviews) | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Apply suggested changes](/pull-requests/how-tos/review-pull-requests/incorporating-feedback-in-your-pull-request) to pull requests | ✗ | ✗ | ✓ | ✓ | ✓ | -| View published releases | ✓ | ✓ | ✓ | ✓ | ✓ | -| {% ifversion fpt or ghec %} | -| View [GitHub Actions workflow runs](/actions/how-tos/manage-workflow-runs) | ✓ | ✓ | ✓ | ✓ | ✓ | -| {% endif %} | -| Edit wikis in public repositories | ✓ | ✓ | ✓ | ✓ | ✓ | -| Edit wikis in private repositories | ✗ | ✗ | ✓ | ✓ | ✓ | -| {% ifversion fpt or ghec %} | -| [Report abusive or spammy content](/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam) | ✓ | ✓ | ✓ | ✓ | ✓ | -| {% endif %} | -| Apply/dismiss labels | ✗ | ✓ | ✓ | ✓ | ✓ | -| Create, edit, delete labels | ✗ | ✗ | ✓ | ✓ | ✓ | -| Close, reopen, and assign all issues and pull requests | ✗ | ✓ | ✓ | ✓ | ✓ | -| [Enable and disable auto-merge on a pull request](/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository) | ✗ | ✗ | ✓ | ✓ | ✓ | -| Create, edit, delete milestones | ✗ | ✗ | ✓ | ✓ | ✓ | -| Apply milestones | ✗ | ✓ | ✓ | ✓ | ✓ | -| Mark [duplicate issues and pull requests](/issues/tracking-your-work-with-issues/administering-issues/marking-issues-or-pull-requests-as-a-duplicate)| ✗ | ✓ | ✓ | ✓ | ✓ | -| Request [pull request reviews](/pull-requests/how-tos/create-pull-requests/requesting-a-pull-request-review) | ✗ | ✓ | ✓ | ✓ | ✓ | -| Merge a [pull request](/pull-requests/reference/pull-request-merges) | ✗ | ✗ | ✓ | ✓ | ✓ | -| Push to (write) the person or team's assigned repositories | ✗ | ✗ | ✓ | ✓ | ✓ | -| Edit and delete anyone's comments on commits, pull requests, and issues | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Hide anyone's comments on discussions](/communities/moderating-comments-and-conversations/managing-disruptive-comments) | ✗ | ✓ | ✓ | ✓ | ✓ | -| [Hide anyone's comments on issues, pull requests, and commits](/communities/moderating-comments-and-conversations/managing-disruptive-comments) | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Lock conversations](/communities/moderating-comments-and-conversations/locking-conversations) | ✗ | ✗ | ✓ | ✓ | ✓ | -| Transfer issues (see [AUTOTITLE](/issues/tracking-your-work-with-issues/administering-issues/transferring-an-issue-to-another-repository) for details) | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Act as a designated code owner for a repository](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners) | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Mark a draft pull request as ready for review](/pull-requests/how-tos/create-pull-requests/changing-the-stage-of-a-pull-request) | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Convert a pull request to a draft](/pull-requests/how-tos/create-pull-requests/changing-the-stage-of-a-pull-request) | ✗ | ✗ | ✓ | ✓ | ✓ | -| Create [status checks](/pull-requests/reference/status-checks) | ✗ | ✗ | ✓ | ✓ | ✓ | -| {% ifversion fpt or ghec %} | -| Create, edit, run, re-run, and cancel [GitHub Actions workflows](/actions) | ✗ | ✗ | ✓ | ✓ | ✓ | -| {% endif %} | -| {% ifversion repo-ci-cd-admin %} | -| Create, update, and delete [GitHub Actions secrets](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets) on GitHub.com | ✗ | ✗ | ✓ | ✓ | ✓ | -| {% else %} | -| Create, update, and delete [GitHub Actions secrets](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets) on GitHub.com | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% endif %} | -| Create, update, and delete [GitHub Actions secrets](/rest/actions/secrets) using the REST API | ✗ | ✗ | ✓ | ✓ | ✓ | -| {% ifversion repo-ci-cd-admin %} | -| Create, update, and delete [GitHub Actions variables](/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables) on GitHub.com | ✗ | ✗ | ✓ | ✓ | ✓ | -| {% else %} | -| Create, update, and delete [GitHub Actions variables](/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables) on GitHub.com | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% endif %} | -| Create, update, and delete [GitHub Actions variables](/rest/actions/variables) using the REST API | ✗ | ✗ | ✓ | ✓ | ✓ | -| Create and edit releases | ✗ | ✗ | ✓ | ✓ | ✓ | -| View draft releases | ✗ | ✗ | ✓ | ✓ | ✓ | -| Edit a repository's description | ✗ | ✗ | ✗ | ✓ | ✓ | -| {% ifversion fpt or ghec %} | -| [View and install packages](/packages/learn-github-packages) | ✓ | ✓ | ✓ | ✓ | ✓ | -| [Publish packages](/packages/learn-github-packages/publishing-a-package) | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Delete and restore packages](/packages/learn-github-packages/deleting-and-restoring-a-package) | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% endif %} | -| Manage [topics](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics) | ✗ | ✗ | ✗ | ✓ | ✓ | -| Enable wikis and restrict wiki editors | ✗ | ✗ | ✗ | ✓ | ✓ | -| Configure [pull request merges](/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges) | ✗ | ✗ | ✗ | ✓ | ✓ | -| Configure [a publishing source for {% data variables.product.prodname_pages %}](/pages/getting-started-with-github-pages/configuring-a-publishing-source-for-your-github-pages-site) | ✗ | ✗ | ✗ | ✓ | ✓ | -| {% ifversion copilot %} | -| View [content exclusion settings](/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot) for {% data variables.product.prodname_copilot %} | ✗ | ✗ | ✗ | ✓ | ✓ | -| {% endif %} | -| Manage [branch protection rules](/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule) and [repository rulesets](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets) | ✗ | ✗ | ✗ | ✗ | ✓ | -| View [rulesets for a repository](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets) | ✓ | ✓ | ✓ | ✓ | ✓ | -| [Push to protected branches](/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches)
Doesn't apply to rulesets as these have a different bypass model. See [Granting bypass permissions for your branch or tag ruleset](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository#granting-bypass-permissions-for-your-branch-or-tag-ruleset). | ✗ | ✗ | ✗ | ✓ | ✓ | -| Merge pull requests on protected branches, even if there are no approving reviews | ✗ | ✗ | ✗ | ✗ | ✓ | -| [Create and edit repository social cards](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/customizing-your-repositorys-social-media-preview) | ✗ | ✗ | ✗ | ✓ | ✓ | -| {% ifversion fpt or ghec %} | -| Limit [interactions in a repository](/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository)| ✗ | ✗ | ✗ | ✓ | ✓ | -| {% endif %} | -| Delete an issue (see [AUTOTITLE](/issues/tracking-your-work-with-issues/administering-issues/deleting-an-issue)) | ✗ | ✗ | ✗ | ✗ | ✓ | -| [Define code owners for a repository](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners) | ✗ | ✗ | ✓ | ✓ | ✓ | -| Add a repository to a team (see [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-team-access-to-an-organization-repository#giving-a-team-access-to-a-repository) for details) | ✗ | ✗ | ✗ | ✗ | ✓ | -| [Manage outside collaborator access to a repository](/organizations/managing-user-access-to-your-organizations-repositories/managing-outside-collaborators/adding-outside-collaborators-to-repositories-in-your-organization) | ✗ | ✗ | ✗ | ✗ | ✓ | -| [Change a repository's visibility](/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization) | ✗ | ✗ | ✗ | ✗ | ✓ | -| Make a repository a template (see [AUTOTITLE](/repositories/creating-and-managing-repositories/creating-a-template-repository)) | ✗ | ✗ | ✗ | ✗ | ✓ | -| Change a repository's settings | ✗ | ✗ | ✗ | ✗ | ✓ | -| Manage team and collaborator access to the repository | ✗ | ✗ | ✗ | ✗ | ✓ | -| Edit the repository's default branch | ✗ | ✗ | ✗ | ✗ | ✓ | -| Rename the repository's default branch (see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch)) | ✗ | ✗ | ✗ | ✗ | ✓ | -| Rename a branch other than the repository's default branch (see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch)) | ✗ | ✗ | ✓ | ✓ | ✓ | -| Manage webhooks and deploy keys | ✗ | ✗ | ✗ | ✗ | ✓ | -| [Manage the forking policy for a repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-the-forking-policy-for-your-repository) | ✗ | ✗ | ✗ | ✗ | ✓ | -| [Transfer repositories into the organization](/organizations/managing-organization-settings/restricting-repository-creation-in-your-organization) | ✗ | ✗ | ✗ | ✗ | ✓ | -| [Delete or transfer repositories out of the organization](/organizations/managing-organization-settings/setting-permissions-for-deleting-or-transferring-repositories) | ✗ | ✗ | ✗ | ✗ | ✓ | -| [Archive repositories](/repositories/archiving-a-github-repository/archiving-repositories) | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% ifversion fpt or ghec %} | -| Display a sponsor button (see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository)) | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% endif %} | -| Create autolink references to external resources, like Jira or Zendesk (see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/configuring-autolinks-to-reference-external-resources)) | ✗ | ✗ | ✗ | ✗ | ✓ | -| [Enable {% data variables.product.prodname_discussions %}](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/enabling-or-disabling-github-discussions-for-a-repository) in a repository | ✗ | ✗ | ✗ | ✓ | ✓ | -| [Create and edit categories](/discussions/managing-discussions-for-your-community/managing-categories-for-discussions) for {% data variables.product.prodname_discussions %} | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Move a discussion to a different category](/discussions/managing-discussions-for-your-community/managing-discussions) | ✗ | ✓ | ✓ | ✓ | ✓ | -| [Transfer a discussion](/discussions/managing-discussions-for-your-community/managing-discussions) to a new repository| ✗ | ✗ | ✓ | ✓ | ✓ | -| [Manage pinned discussions](/discussions/managing-discussions-for-your-community/managing-discussions) | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Lock and unlock discussions](/discussions/managing-discussions-for-your-community/moderating-discussions) | ✗ | ✓ | ✓ | ✓ | ✓ | -| [Individually convert issues to discussions](/discussions/managing-discussions-for-your-community/moderating-discussions) | ✗ | ✓ | ✓ | ✓ | ✓ | -| [Create new discussions and comment on existing discussions](/discussions/collaborating-with-your-community-using-discussions/participating-in-a-discussion) | ✓ | ✓ | ✓ | ✓ | ✓ | -| [Delete a discussion](/discussions/managing-discussions-for-your-community/managing-discussions#deleting-a-discussion) | ✗ | ✓ | ✓ | ✓ | ✓ | -| {% ifversion fpt or ghec %} | -| [Create codespaces](/codespaces/developing-in-a-codespace/creating-a-codespace-for-a-repository?tool=webui) for private{% ifversion ghec %}/internal{% endif %} repositories | ✓ | ✓ | ✓ | ✓ | ✓ | -| [Create codespaces](/codespaces/developing-in-a-codespace/creating-a-codespace-for-a-repository?tool=webui) for private{% ifversion ghec %}/internal{% endif %} repositories with [Codespaces secrets access](/codespaces/managing-codespaces-for-your-organization/managing-development-environment-secrets-for-your-repository-or-organization?tool=webui) | {% octicon "check" aria-label="No" %} | {% octicon "check" aria-label="No" %} | ✓ | ✓ | ✓ | -| [Create codespaces](/codespaces/developing-in-a-codespace/creating-a-codespace-for-a-repository?tool=webui) for public repositories
(users with read-only access can only create codespaces at their own expense) | ✓ | ✓ | ✓ | ✓ | ✓ | -| {% endif %} | -| Edit the custom property values for the repository | ✗ | ✗ | ✗ | ✗ | ✓ | +{%- assign roleColumns = "read,triage,write,maintain,admin" | split: "," -%} +{%- for row in tables.repository-roles.permissions -%} +{%- assign show = row.versions | default: "show" | render_liquid -%} +{%- unless show == "" %} +| {{ row.action | render_liquid }}{% assign granted = row.roles | render_liquid | split: ", " %}{% for role in roleColumns %} | {% if granted contains role %}✓{% else %}✗{% endif %}{% endfor %} | +{%- endunless -%} +{%- endfor %} {% endrowheaders %} @@ -183,29 +77,13 @@ In this section, you can find the access required for security features, such as | Repository action | Read | Triage | Write | Maintain | Admin | |:---|:---:|:---:|:---:|:---:|:---:| -| Receive [{% data variables.product.prodname_dependabot_alerts %} for insecure dependencies](/code-security/concepts/supply-chain-security/dependabot-alerts) in a repository | ✗ | ✗ | ✓ | ✓ | ✓ | -| [Dismiss {% data variables.product.prodname_dependabot_alerts %}](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts) | ✗ | ✗ | ✓ | ✓ | ✓ | -| {% ifversion ghes or ghec %} | -| [Designate additional people or teams to receive security alerts](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts) | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% endif %} | -| {% ifversion fpt or ghec %} | -| Create [security advisories](/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories) | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% endif %} | -| Manage access to {% data variables.product.prodname_GHAS %} features (see [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization)) | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% ifversion fpt or ghec %} | -| [Enable the dependency graph](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/explore-dependencies) for a private repository | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% endif %} | -| {% ifversion ghes or ghec %} | -| [View dependency reviews](/code-security/concepts/supply-chain-security/dependency-review) | ✓ | ✓ | ✓ | ✓ | ✓ | -| {% endif %} | -| [View {% data variables.product.prodname_code_scanning %} alerts on pull requests](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests) | ✓ | ✓ | ✓ | ✓ | ✓ | -| [List, dismiss, and delete {% data variables.product.prodname_code_scanning %} alerts](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts) | ✗ | ✗ | ✓ | ✓ | ✓ | -| [View and dismiss {% data variables.secret-scanning.alerts %} in a repository](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts) | ✗ | ✗ | ✓ | ✓ | ✓ |{% ifversion ghes or ghec %} -| [Resolve, revoke, or re-open {% data variables.secret-scanning.alerts %}](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts) | ✗ | ✗ | ✓ | ✓ | ✓ | -| {% endif %} | -| {% ifversion ghes or ghec %} | -| [Designate additional people or teams to receive {% data variables.secret-scanning.alerts %}](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts) in repositories | ✗ | ✗ | ✗ | ✗ | ✓ | -| {% endif %} | +{%- assign roleColumns = "read,triage,write,maintain,admin" | split: "," -%} +{%- for row in tables.repository-roles.securityFeatures -%} +{%- assign show = row.versions | default: "show" | render_liquid -%} +{%- unless show == "" %} +| {{ row.action | render_liquid }}{% assign granted = row.roles | render_liquid | split: ", " %}{% for role in roleColumns %} | {% if granted contains role %}✓{% else %}✗{% endif %}{% endfor %} | +{%- endunless -%} +{%- endfor %} {% endrowheaders %} diff --git a/content/pull-requests/how-tos/commit-changes/managing-branches-within-your-repository.md b/content/pull-requests/how-tos/commit-changes/managing-branches-within-your-repository.md index ba67ee24169f..c6af1dc7a568 100644 --- a/content/pull-requests/how-tos/commit-changes/managing-branches-within-your-repository.md +++ b/content/pull-requests/how-tos/commit-changes/managing-branches-within-your-repository.md @@ -32,9 +32,9 @@ Create a branch for a separate place to work on changes before opening a pull re 1. Click **New branch**. ![Screenshot of the "Branches" page for a repository. A green button, labeled "New branch", is highlighted with an orange outline.](/assets/images/help/branches/new-branch-button.png) -1. Under "Branch name", type a name for the branch. -1. Under "Branch source", choose the repository and branch to base your new branch on. -1. Click **Create branch**. +1. Under "New branch name", type a name for the branch. +1. Under "Source", choose the branch to base your new branch on. +1. Click **Create new branch**. ### Creating a branch using the branch dropdown diff --git a/data/reusables/actions/jfrog-json-configuring-identity-mappings.md b/data/reusables/actions/jfrog-json-configuring-identity-mappings.md index 7706210c9c29..382f1bd56d01 100644 --- a/data/reusables/actions/jfrog-json-configuring-identity-mappings.md +++ b/data/reusables/actions/jfrog-json-configuring-identity-mappings.md @@ -1,6 +1,7 @@ ```json copy { "iss": "https://token.actions.githubusercontent.com", - "repository": "octo-org/octo-repo" + "repository": "octo-org/octo-repo"{% ifversion dependabot-oidc-support %}, + "event_name": "push"{% endif %} } ``` diff --git a/data/reusables/actions/oidc-security-notice.md b/data/reusables/actions/oidc-security-notice.md index ac3ad322e227..49a1d3db0402 100644 --- a/data/reusables/actions/oidc-security-notice.md +++ b/data/reusables/actions/oidc-security-notice.md @@ -1 +1,4 @@ * Before proceeding, you must plan your security strategy to ensure that access tokens are only allocated in a predictable way. To control how your cloud provider issues access tokens, you **must** define at least one condition, so that untrusted repositories can’t request access tokens for your cloud resources. For more information, see {% ifversion ghec %}[AUTOTITLE](/actions/concepts/security/openid-connect#establishing-oidc-trust-with-your-cloud-provider){% else %}[AUTOTITLE](/actions/reference/security/oidc#oidc-claims-used-to-define-trust-conditions-on-cloud-roles){% endif %}. +{% ifversion dependabot-oidc-support %} +* OIDC tokens requested for {% data variables.product.prodname_dependabot %} update jobs have an `event_name` claim of `dynamic`. If your trust policy is intended to authorize only {% data variables.product.prodname_actions %} workflows and your cloud provider supports conditions on `event_name`, allow only the event names expected by your workflows. For more information, see {% ifversion ghec %}[AUTOTITLE](/actions/concepts/security/openid-connect#establishing-oidc-trust-with-your-cloud-provider){% else %}[AUTOTITLE](/actions/reference/security/oidc#oidc-claims-used-to-define-trust-conditions-on-cloud-roles){% endif %}. +{% endif %} diff --git a/data/tables/repository-roles.yml b/data/tables/repository-roles.yml new file mode 100644 index 000000000000..998c69af2bf8 --- /dev/null +++ b/data/tables/repository-roles.yml @@ -0,0 +1,340 @@ +# Permissions for each repository role, rendered by: +# content/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization.md +# +# 'roles' lists the roles that CAN perform the action. Roles left out render as no. +# 'roles' and 'versions' may contain Liquid; it is rendered via the render_liquid filter. +# 'versions' shows the row only when it renders non-empty. + +permissions: + - action: 'Manage [individual](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-an-individuals-access-to-an-organization-repository), [team](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-team-access-to-an-organization-repository), and [outside collaborator](/organizations/managing-user-access-to-your-organizations-repositories/managing-outside-collaborators/adding-outside-collaborators-to-repositories-in-your-organization) access to the repository' + roles: 'admin' + + - action: "Pull from the person or team's assigned repositories" + roles: 'read, triage, write, maintain, admin' + + - action: "Fork the person or team's assigned repositories" + roles: 'read, triage, write, maintain, admin' + + - action: 'Edit and delete their own comments' + roles: 'read, triage, write, maintain, admin' + + - action: 'Open issues' + roles: 'read, triage, write, maintain, admin' + + - action: 'Close issues they opened themselves' + roles: 'read, triage, write, maintain, admin' + + - action: 'Reopen issues they closed themselves' + roles: 'read, triage, write, maintain, admin' + + - action: 'Have an issue assigned to them' + roles: 'read, triage, write, maintain, admin' + + - action: "Send pull requests from forks of the team's assigned repositories" + roles: 'read, triage, write, maintain, admin' + + - action: '[Submit reviews on pull requests](/pull-requests/how-tos/review-pull-requests/reviewing-proposed-changes-in-a-pull-request)' + roles: 'read, triage, write, maintain, admin' + + - action: '[Approve or request changes to a pull request with required reviews](/pull-requests/how-tos/review-pull-requests/approving-a-pull-request-with-required-reviews)' + roles: 'write, maintain, admin' + + - action: '[Apply suggested changes](/pull-requests/how-tos/review-pull-requests/incorporating-feedback-in-your-pull-request) to pull requests' + roles: 'write, maintain, admin' + + - action: 'View published releases' + roles: 'read, triage, write, maintain, admin' + + - action: 'View [{% data variables.product.prodname_actions %} workflow runs](/actions/how-tos/manage-workflow-runs)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'read, triage, write, maintain, admin' + + - action: 'Edit wikis in public repositories' + roles: 'read, triage, write, maintain, admin' + + - action: 'Edit wikis in private repositories' + roles: 'write, maintain, admin' + + - action: '[Report abusive or spammy content](/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'read, triage, write, maintain, admin' + + - action: 'Apply/dismiss labels' + roles: 'triage, write, maintain, admin' + + - action: 'Create, edit, delete labels' + roles: 'write, maintain, admin' + + - action: 'Close, reopen, and assign all issues and pull requests' + roles: 'triage, write, maintain, admin' + + - action: '[Enable and disable auto-merge on a pull request](/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository)' + roles: 'write, maintain, admin' + + - action: 'Create, edit, delete milestones' + roles: 'write, maintain, admin' + + - action: 'Apply milestones' + roles: 'triage, write, maintain, admin' + + - action: 'Mark [duplicate issues and pull requests](/issues/tracking-your-work-with-issues/administering-issues/marking-issues-or-pull-requests-as-a-duplicate)' + roles: 'triage, write, maintain, admin' + + - action: 'Request [pull request reviews](/pull-requests/how-tos/create-pull-requests/requesting-a-pull-request-review)' + roles: 'triage, write, maintain, admin' + + - action: 'Merge a [pull request](/pull-requests/reference/pull-request-merges)' + roles: 'write, maintain, admin' + + - action: "Push to (write) the person or team's assigned repositories" + roles: 'write, maintain, admin' + + - action: "Edit and delete anyone's comments on commits, pull requests, and issues" + roles: 'write, maintain, admin' + + - action: "[Hide anyone's comments on discussions](/communities/moderating-comments-and-conversations/managing-disruptive-comments)" + roles: 'triage, write, maintain, admin' + + - action: "[Hide anyone's comments on issues, pull requests, and commits](/communities/moderating-comments-and-conversations/managing-disruptive-comments)" + roles: 'write, maintain, admin' + + - action: '[Lock conversations](/communities/moderating-comments-and-conversations/locking-conversations)' + roles: 'write, maintain, admin' + + - action: 'Transfer issues (see [AUTOTITLE](/issues/tracking-your-work-with-issues/administering-issues/transferring-an-issue-to-another-repository) for details)' + roles: 'write, maintain, admin' + + - action: '[Act as a designated code owner for a repository](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners)' + roles: 'write, maintain, admin' + + - action: '[Mark a draft pull request as ready for review](/pull-requests/how-tos/create-pull-requests/changing-the-stage-of-a-pull-request)' + roles: 'write, maintain, admin' + + - action: '[Convert a pull request to a draft](/pull-requests/how-tos/create-pull-requests/changing-the-stage-of-a-pull-request)' + roles: 'write, maintain, admin' + + - action: 'Create [status checks](/pull-requests/reference/status-checks)' + roles: 'write, maintain, admin' + + - action: 'Create, edit, run, re-run, and cancel [{% data variables.product.prodname_actions %} workflows](/actions)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'write, maintain, admin' + + - action: 'Create, update, and delete [{% data variables.product.prodname_actions %} secrets](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets) on {% data variables.product.prodname_dotcom_the_website %}' + versions: '{% ifversion repo-ci-cd-admin %}show{% endif %}' + roles: 'write, maintain, admin' + + - action: 'Create, update, and delete [{% data variables.product.prodname_actions %} secrets](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets) on {% data variables.product.prodname_dotcom_the_website %}' + versions: '{% ifversion repo-ci-cd-admin %}{% else %}show{% endif %}' + roles: 'admin' + + - action: 'Create, update, and delete [{% data variables.product.prodname_actions %} secrets](/rest/actions/secrets) using the REST API' + roles: 'write, maintain, admin' + + - action: 'Create, update, and delete [{% data variables.product.prodname_actions %} variables](/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables) on {% data variables.product.prodname_dotcom_the_website %}' + versions: '{% ifversion repo-ci-cd-admin %}show{% endif %}' + roles: 'write, maintain, admin' + + - action: 'Create, update, and delete [{% data variables.product.prodname_actions %} variables](/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables) on {% data variables.product.prodname_dotcom_the_website %}' + versions: '{% ifversion repo-ci-cd-admin %}{% else %}show{% endif %}' + roles: 'admin' + + - action: 'Create, update, and delete [{% data variables.product.prodname_actions %} variables](/rest/actions/variables) using the REST API' + roles: 'write, maintain, admin' + + - action: 'Create and edit releases' + roles: 'write, maintain, admin' + + - action: 'View draft releases' + roles: 'write, maintain, admin' + + - action: "Edit a repository's description" + roles: 'maintain, admin' + + - action: '[View and install packages](/packages/learn-github-packages)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'read, triage, write, maintain, admin' + + - action: '[Publish packages](/packages/learn-github-packages/publishing-a-package)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'write, maintain, admin' + + - action: '[Delete and restore packages](/packages/learn-github-packages/deleting-and-restoring-a-package)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'admin' + + - action: 'Manage [topics](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics)' + roles: 'maintain, admin' + + - action: 'Enable wikis and restrict wiki editors' + roles: 'maintain, admin' + + - action: 'Configure [pull request merges](/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges)' + roles: 'maintain, admin' + + - action: 'Configure [a publishing source for {% data variables.product.prodname_pages %}](/pages/getting-started-with-github-pages/configuring-a-publishing-source-for-your-github-pages-site)' + roles: 'maintain, admin' + + - action: 'View [content exclusion settings](/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot) for {% data variables.product.prodname_copilot %}' + versions: '{% ifversion copilot %}show{% endif %}' + roles: 'maintain, admin' + + - action: 'Manage [branch protection rules](/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule) and [repository rulesets](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets)' + roles: 'admin' + + - action: 'View [rulesets for a repository](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets)' + roles: 'read, triage, write, maintain, admin' + + - action: "[Push to protected branches](/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches)
Doesn't apply to rulesets as these have a different bypass model. See [Granting bypass permissions for your branch or tag ruleset](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository#granting-bypass-permissions-for-your-branch-or-tag-ruleset)." + roles: 'maintain, admin' + + - action: 'Merge pull requests on protected branches, even if there are no approving reviews' + roles: 'admin' + + - action: '[Create and edit repository social cards](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/customizing-your-repositorys-social-media-preview)' + roles: 'maintain, admin' + + - action: 'Limit [interactions in a repository](/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'maintain, admin' + + - action: 'Delete an issue (see [AUTOTITLE](/issues/tracking-your-work-with-issues/administering-issues/deleting-an-issue))' + roles: 'admin' + + - action: '[Define code owners for a repository](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners)' + roles: 'write, maintain, admin' + + - action: 'Add a repository to a team (see [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-team-access-to-an-organization-repository#giving-a-team-access-to-a-repository) for details)' + roles: 'admin' + + - action: '[Manage outside collaborator access to a repository](/organizations/managing-user-access-to-your-organizations-repositories/managing-outside-collaborators/adding-outside-collaborators-to-repositories-in-your-organization)' + roles: 'admin' + + - action: "[Change a repository's visibility](/organizations/managing-organization-settings/restricting-repository-visibility-changes-in-your-organization)" + roles: 'admin' + + - action: 'Make a repository a template (see [AUTOTITLE](/repositories/creating-and-managing-repositories/creating-a-template-repository))' + roles: 'admin' + + - action: "Change a repository's settings" + roles: 'admin' + + - action: 'Manage team and collaborator access to the repository' + roles: 'admin' + + - action: "Edit the repository's default branch" + roles: 'admin' + + - action: "Rename the repository's default branch (see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch))" + roles: 'admin' + + - action: "Rename a branch other than the repository's default branch (see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch))" + roles: 'write, maintain, admin' + + - action: 'Manage webhooks and deploy keys' + roles: 'admin' + + - action: '[Manage the forking policy for a repository](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/managing-the-forking-policy-for-your-repository)' + roles: 'admin' + + - action: '[Transfer repositories into the organization](/organizations/managing-organization-settings/restricting-repository-creation-in-your-organization)' + roles: 'admin' + + - action: '[Delete or transfer repositories out of the organization](/organizations/managing-organization-settings/setting-permissions-for-deleting-or-transferring-repositories)' + roles: 'admin' + + - action: '[Archive repositories](/repositories/archiving-a-github-repository/archiving-repositories)' + roles: 'admin' + + - action: 'Display a sponsor button (see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository))' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'admin' + + - action: 'Create autolink references to external resources, like Jira or Zendesk (see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/configuring-autolinks-to-reference-external-resources))' + roles: 'admin' + + - action: '[Enable {% data variables.product.prodname_discussions %}](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/enabling-or-disabling-github-discussions-for-a-repository) in a repository' + roles: 'maintain, admin' + + - action: '[Create and edit categories](/discussions/managing-discussions-for-your-community/managing-categories-for-discussions) for {% data variables.product.prodname_discussions %}' + roles: 'write, maintain, admin' + + - action: '[Move a discussion to a different category](/discussions/managing-discussions-for-your-community/managing-discussions)' + roles: 'triage, write, maintain, admin' + + - action: '[Transfer a discussion](/discussions/managing-discussions-for-your-community/managing-discussions) to a new repository' + roles: 'write, maintain, admin' + + - action: '[Manage pinned discussions](/discussions/managing-discussions-for-your-community/managing-discussions)' + roles: 'write, maintain, admin' + + - action: '[Lock and unlock discussions](/discussions/managing-discussions-for-your-community/moderating-discussions)' + roles: 'triage, write, maintain, admin' + + - action: '[Individually convert issues to discussions](/discussions/managing-discussions-for-your-community/moderating-discussions)' + roles: 'triage, write, maintain, admin' + + - action: '[Create new discussions and comment on existing discussions](/discussions/collaborating-with-your-community-using-discussions/participating-in-a-discussion)' + roles: 'read, triage, write, maintain, admin' + + - action: '[Delete a discussion](/discussions/managing-discussions-for-your-community/managing-discussions#deleting-a-discussion)' + roles: 'triage, write, maintain, admin' + + - action: '[Create codespaces](/codespaces/developing-in-a-codespace/creating-a-codespace-for-a-repository?tool=webui) for private{% ifversion ghec %}/internal{% endif %} repositories' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'read, triage, write, maintain, admin' + + - action: '[Create codespaces](/codespaces/developing-in-a-codespace/creating-a-codespace-for-a-repository?tool=webui) for private{% ifversion ghec %}/internal{% endif %} repositories with [{% data variables.product.prodname_codespaces %} secrets access](/codespaces/managing-codespaces-for-your-organization/managing-development-environment-secrets-for-your-repository-or-organization?tool=webui)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'write, maintain, admin' + + - action: '[Create codespaces](/codespaces/developing-in-a-codespace/creating-a-codespace-for-a-repository?tool=webui) for public repositories
(users with read-only access can only create codespaces at their own expense)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'read, triage, write, maintain, admin' + + - action: 'Edit the custom property values for the repository' + roles: 'admin' + +securityFeatures: + - action: 'Receive [{% data variables.product.prodname_dependabot_alerts %} for insecure dependencies](/code-security/concepts/supply-chain-security/dependabot-alerts) in a repository' + roles: 'write, maintain, admin' + + - action: '[Dismiss {% data variables.product.prodname_dependabot_alerts %}](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts)' + roles: 'write, maintain, admin' + + - action: '[Designate additional people or teams to receive security alerts](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)' + versions: '{% ifversion ghes or ghec %}show{% endif %}' + roles: 'admin' + + - action: 'Create [security advisories](/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories)' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'admin' + + - action: 'Manage access to {% data variables.product.prodname_GHAS %} features (see [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization))' + roles: 'admin' + + - action: '[Enable the dependency graph](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/explore-dependencies) for a private repository ' + versions: '{% ifversion fpt or ghec %}show{% endif %}' + roles: 'admin' + + - action: '[View dependency reviews](/code-security/concepts/supply-chain-security/dependency-review)' + versions: '{% ifversion ghes or ghec %}show{% endif %}' + roles: 'read, triage, write, maintain, admin' + + - action: '[View {% data variables.product.prodname_code_scanning %} alerts on pull requests](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests)' + roles: 'read, triage, write, maintain, admin' + + - action: '[List, dismiss, and delete {% data variables.product.prodname_code_scanning %} alerts](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts)' + roles: 'write, maintain, admin' + + - action: '[View and dismiss {% data variables.secret-scanning.alerts %} in a repository](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts)' + roles: 'write, maintain, admin' + # Not available for FPT + + - action: '[Resolve, revoke, or re-open {% data variables.secret-scanning.alerts %}](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts)' + versions: '{% ifversion ghes or ghec %}show{% endif %}' + roles: 'write, maintain, admin' + + - action: '[Designate additional people or teams to receive {% data variables.secret-scanning.alerts %}](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts) in repositories' + versions: '{% ifversion ghes or ghec %}show{% endif %}' + roles: 'admin' diff --git a/src/content-render/liquid/engine.ts b/src/content-render/liquid/engine.ts index 034fa453ddf2..2d10036d94f8 100644 --- a/src/content-render/liquid/engine.ts +++ b/src/content-render/liquid/engine.ts @@ -55,6 +55,28 @@ engine.registerFilter('version_num', (input: string): string => { return input.split('@')[1] }) +/** + * Render a string that itself contains Liquid. + * + * Values interpolated with `{{ }}` are not given a second Liquid pass, so + * `{% data %}` or `{% ifversion %}` stored in a data file would otherwise be + * printed literally. This filter lets data files keep using Liquid instead of + * hardcoding product names or version logic. + * + * Usage: {{ row.action | render_liquid }} + */ +interface FilterScope { + context: { + environments: Record + } +} + +engine.registerFilter('render_liquid', function (this: FilterScope, input: unknown): unknown { + if (typeof input !== 'string') return input + if (!input.includes('{%') && !input.includes('{{')) return input + return engine.parseAndRender(input, this.context.environments) +}) + /** * Convert the input to a slug */ diff --git a/src/content-render/tests/render-liquid-filter.ts b/src/content-render/tests/render-liquid-filter.ts new file mode 100644 index 000000000000..d9273ebfbd23 --- /dev/null +++ b/src/content-render/tests/render-liquid-filter.ts @@ -0,0 +1,74 @@ +import { describe, expect, test } from 'vitest' + +import { liquid } from '@/content-render/index' +import shortVersionsMiddleware from '@/versions/middleware/short-versions' +import { allVersions } from '@/versions/lib/all-versions' +import enterpriseServerReleases from '@/versions/lib/enterprise-server-releases' +import type { Context, ExtendedRequest } from '@/types' + +function contextFor(currentVersion: string) { + const req = { language: 'en', query: {} } as ExtendedRequest + req.context = { + currentVersion, + currentLanguage: 'en', + allVersions, + enterpriseServerReleases, + } as Context + req.context!.currentVersionObj = allVersions[currentVersion] + shortVersionsMiddleware(req, null, () => {}) + return req.context! +} + +describe('render_liquid filter', () => { + test('leaves strings without Liquid untouched', async () => { + const context = contextFor('free-pro-team@latest') + const output = await liquid.parseAndRender('{{ value | render_liquid }}', { + ...context, + value: 'read, triage, write', + }) + expect(output).toBe('read, triage, write') + }) + + test('renders a data reference held in a variable', async () => { + const context = contextFor('free-pro-team@latest') + const output = await liquid.parseAndRender('{{ value | render_liquid }}', { + ...context, + value: '{% data variables.product.prodname_discussions %}', + }) + expect(output).toBe('GitHub Discussions') + }) + + test('renders ifversion held in a variable, matching an inline conditional', async () => { + const template = '{% ifversion ghes %}server{% else %}not server{% endif %}' + for (const version of [ + 'free-pro-team@latest', + `enterprise-server@${enterpriseServerReleases.latest}`, + ]) { + const context = contextFor(version) + const inline = await liquid.parseAndRender(template, context) + const viaFilter = await liquid.parseAndRender('{{ value | render_liquid }}', { + ...context, + value: template, + }) + expect(viaFilter).toBe(inline) + } + }) + + test('survives chaining into other filters', async () => { + const context = contextFor('free-pro-team@latest') + const output = await liquid.parseAndRender( + '{% assign roles = value | render_liquid | split: ", " %}{% if roles contains "write" %}yes{% else %}no{% endif %}', + { ...context, value: '{% ifversion fpt %}write, admin{% else %}admin{% endif %}' }, + ) + expect(output).toBe('yes') + }) + + test('passes through values that are not strings', async () => { + const context = contextFor('free-pro-team@latest') + const output = await liquid.parseAndRender('{{ value | render_liquid }}', { + ...context, + value: 42, + }) + expect(output).toBe('42') + }) +}) diff --git a/src/data-directory/lib/data-schemas/tables/repository-roles.ts b/src/data-directory/lib/data-schemas/tables/repository-roles.ts new file mode 100644 index 000000000000..6774b9739d4b --- /dev/null +++ b/src/data-directory/lib/data-schemas/tables/repository-roles.ts @@ -0,0 +1,39 @@ +// This schema enforces the structure in data/tables/repository-roles.yml + +const row = { + type: 'object', + additionalProperties: false, + required: ['action', 'roles'], + properties: { + action: { + type: 'string', + lintable: true, + }, + // Liquid that renders non-empty when the row should be shown. When omitted, + // the row is shown on every version. + versions: { + type: 'string', + }, + // Comma separated list of the roles that can perform the action. Roles left + // out render as no. May contain Liquid, so a single role can be conditional. + roles: { + type: 'string', + }, + }, +} + +export default { + type: 'object', + additionalProperties: false, + required: ['permissions', 'securityFeatures'], + properties: { + permissions: { + type: 'array', + items: row, + }, + securityFeatures: { + type: 'array', + items: row, + }, + }, +} diff --git a/src/languages/lib/correct-translation-content.ts b/src/languages/lib/correct-translation-content.ts index 93a68ae18934..01dd773c882b 100644 --- a/src/languages/lib/correct-translation-content.ts +++ b/src/languages/lib/correct-translation-content.ts @@ -100,6 +100,13 @@ export function correctTranslatedContentStrings( content = content.replace(/^\n[ \t]*/, '') } + // Translators sometimes dropped the space between `{%` and `data` when the + // tag references `variables.X` or `reusables.X`, e.g. `{%data variables.X %}` + // or `{%data reusables.X %}`. This corruption shows up across multiple + // languages (ja, pt, zh, ko, de), so fix it universally rather than + // duplicating the same rule per language. + content = content.replace(/\{%(-?)data (variables|reusables)\./g, '{%$1 data $2.') + // --- Per-language fixes (es, ja, pt, zh, ru, fr, ko, de) --- if (context.code === 'es') { @@ -1799,6 +1806,8 @@ export function correctTranslatedContentStrings( // `{% 데이터 재사용 ` (no period) — variant of `{% data reusables` content = content.replaceAll('{% 데이터 재사용가능항목.', '{% data reusables.') content = content.replaceAll('{% 데이터 재사용 가능 항목.', '{% data reusables.') + // `{% 데이터 재사용 가능항목.` — missing space between "가능" and "항목" (mixed variant) + content = content.replaceAll('{% 데이터 재사용 가능항목.', '{% data reusables.') content = content.replaceAll('{% 데이터 재사용.', '{% data reusables.') content = content.replaceAll('{% 데이터 재사용 ', '{% data reusables.') // `{% indented_data_reference 재사용...` — translated `reusables` path prefix diff --git a/src/languages/tests/correct-translation-content.ts b/src/languages/tests/correct-translation-content.ts index 3eec0f15b46f..05acc59e38c1 100644 --- a/src/languages/tests/correct-translation-content.ts +++ b/src/languages/tests/correct-translation-content.ts @@ -1316,6 +1316,15 @@ describe('correctTranslatedContentStrings', () => { ) }) + test('fixes 데이터 재사용 가능항목 (missing internal space) → data reusables', () => { + // Variant with a space before "재사용" but missing between "가능" and + // "항목", distinct from the already-handled fully-spaced and + // fully-fused variants. + expect(fix('{% 데이터 재사용 가능항목.webhooks.commit_comment_short_desc %}', 'ko')).toBe( + '{% data reusables.webhooks.commit_comment_short_desc %}', + ) + }) + test('fixes datavariable → data variables (via generic)', () => { expect(fix('{% datavariable.product.github %}', 'ko')).toBe( '{% data variables.product.github %}', @@ -1684,6 +1693,23 @@ describe('correctTranslatedContentStrings', () => { ) }) + test('fixes missing space between {% and data keyword', () => { + // Translators sometimes dropped the space between `{%` and `data`, + // producing `{%data variables.X %}` / `{%data reusables.X %}`, which + // breaks the Liquid parser. Confirmed across ja, pt, zh, ko, and de. + expect(fix('{%data variables.product.github %}', 'ja')).toBe( + '{% data variables.product.github %}', + ) + expect(fix('{%data reusables.foo.bar %}', 'pt')).toBe('{% data reusables.foo.bar %}') + expect(fix('{%-data variables.product.github %}', 'de')).toBe( + '{%- data variables.product.github %}', + ) + // Already-correct input is left unchanged. + expect(fix('{% data variables.product.github %}', 'zh')).toBe( + '{% data variables.product.github %}', + ) + }) + test('fixes leading dot in {% data paths', () => { // `{% data .variables.X %}` — translator inserted a stray dot expect(fix('{% data .variables.product.prodname_ghe_server %}', 'ja')).toBe( diff --git a/src/workflows/unallowed-contribution-filters.yml b/src/workflows/unallowed-contribution-filters.yml index 55c0ba50b393..e6bd35f29e01 100644 --- a/src/workflows/unallowed-contribution-filters.yml +++ b/src/workflows/unallowed-contribution-filters.yml @@ -3,7 +3,12 @@ notAllowed: - '.devcontainer/**' - '.github/**' - 'data/reusables/rai/**' + - '.vscode/**' + - 'assets/**' + - 'config/**' + - 'contributing/**' - 'src/**' + - 'patches/**' - 'content/actions/how-tos/secure-your-work/security-harden-deployments/**' contentTypes: - 'content/**'