diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 0605be0399c1..e9645b9ec918 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -59,9 +59,6 @@ // Use 'postCreateCommand' to run commands after the container is created. "postCreateCommand": "npm ci", - // Use 'updateContentCommand' to run commands to be included in Codespace pre-builds - "updateContentCommand": "git clone https://github.com/github/rest-api-description.git", - // Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root. "remoteUser": "node", diff --git a/content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise.md b/content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise.md index 5031d0d9cd7f..96e2d57854d9 100644 --- a/content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise.md +++ b/content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise.md @@ -118,9 +118,9 @@ Across all of your enterprise's organizations, you can allow or disallow people {% ifversion secret-scanning-ai-generic-secret-detection %} -## Enforcing a policy to manage the use of generic secret detection for {% data variables.product.prodname_secret_scanning %} in your enterprise's repositories +## Enforcing a policy to manage the use of {% data variables.secret-scanning.generic-secret-detection %} for {% data variables.product.prodname_secret_scanning %} in your enterprise's repositories -Across all of your enterprise's organizations, you can allow or disallow people with admin access to repositories to manage and configure generic secret detection for {% data variables.product.prodname_secret_scanning %} for the repositories. {% data reusables.advanced-security.ghas-must-be-enabled %} +Across all of your enterprise's organizations, you can allow or disallow people with admin access to repositories to manage and configure AI detection in {% data variables.product.prodname_secret_scanning %} for the repositories. {% data reusables.advanced-security.ghas-must-be-enabled %} {% data reusables.enterprise-accounts.access-enterprise %} {% data reusables.enterprise-accounts.policies-tab %} diff --git a/content/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning.md b/content/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning.md index 9782190dcad1..e07aeb16b13d 100644 --- a/content/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning.md +++ b/content/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning.md @@ -29,7 +29,7 @@ If {% data variables.product.prodname_code_scanning %} finds a potential vulnera {% ifversion code-scanning-autofix %} -{% data variables.product.prodname_copilot_autofix %} will suggest fixes for alerts from {% data variables.product.prodname_codeql %} analysis in private repositories, allowing developers to prevent and reduce vulnerabilities with less effort. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." +{% data variables.product.prodname_copilot_autofix %} will suggest fixes for alerts from {% data variables.product.prodname_code_scanning %} analysis in private repositories, allowing developers to prevent and reduce vulnerabilities with less effort. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." {% endif %} diff --git a/content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md b/content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md index 67c417f6036e..ca48edcd627f 100644 --- a/content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md +++ b/content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md @@ -26,7 +26,7 @@ By default, {% data variables.product.prodname_code_scanning %} analyzes your co {% ifversion code-scanning-autofix %} -You can use {% data variables.product.prodname_copilot_autofix %} to generate fixes automatically for {% data variables.product.prodname_code_scanning %} alerts from {% data variables.product.prodname_codeql %} analysis. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts#generating-suggested-fixes-for-code-scanning-alerts)." +You can use {% data variables.product.prodname_copilot_autofix %} to generate fixes automatically for {% data variables.product.prodname_code_scanning %} alerts, including {% data variables.product.prodname_codeql %} alerts. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts#generating-suggested-fixes-for-code-scanning-alerts)." {% endif %} diff --git a/content/code-security/code-scanning/managing-code-scanning-alerts/disabling-autofix-for-code-scanning.md b/content/code-security/code-scanning/managing-code-scanning-alerts/disabling-autofix-for-code-scanning.md index b339f6a0426b..91bec61695c2 100644 --- a/content/code-security/code-scanning/managing-code-scanning-alerts/disabling-autofix-for-code-scanning.md +++ b/content/code-security/code-scanning/managing-code-scanning-alerts/disabling-autofix-for-code-scanning.md @@ -16,13 +16,13 @@ topics: ## About disabling {% data variables.product.prodname_copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} -{% data variables.product.prodname_copilot_autofix %} is a {% data variables.product.prodname_copilot %}-powered is an expansion of {% data variables.product.prodname_code_scanning %} that provides users with targeted recommendations to help them fix {% data variables.product.prodname_code_scanning %} alerts so they can avoid introducing new security vulnerabilities. To learn more about {% data variables.product.prodname_copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %}, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." +{% data variables.product.prodname_copilot_autofix %} is a {% data variables.product.prodname_copilot %}-powered expansion of {% data variables.product.prodname_code_scanning %}. It provides users with targeted recommendations to help them fix {% data variables.product.prodname_code_scanning %} alerts (including {% data variables.product.prodname_codeql %} alerts) so they can avoid introducing new security vulnerabilities. To learn more about {% data variables.product.prodname_copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %}, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." {% data reusables.rai.code-scanning.copilot-autofix-note %} {% data variables.product.prodname_copilot_autofix_short %} is allowed by default and enabled for every repository that uses {% data variables.product.prodname_codeql %}, regardless of whether it uses default or advanced setup for {% data variables.product.prodname_code_scanning %}. Administrators at the enterprise, organization and repository levels can choose to opt out and disable {% data variables.product.prodname_copilot_autofix_short %}. -Note that disabling {% data variables.product.prodname_copilot_autofix_short %} at any level will close all open {% data variables.product.prodname_copilot_autofix_short %} comments. If {% data variables.product.prodname_copilot_autofix_short %} is disabled and then subsequently enabled, {% data variables.product.prodname_copilot_autofix_short %} won't automatically suggest fixes for any pull requests that are already open. The suggestions will only be generated for any pull requests that are opened after {% data variables.product.prodname_copilot_autofix_short %} is enabled, or after re-running {% data variables.product.prodname_codeql %} analysis on existing pull requests. +Note that disabling {% data variables.product.prodname_copilot_autofix_short %} at any level will close all open {% data variables.product.prodname_copilot_autofix_short %} comments. If {% data variables.product.prodname_copilot_autofix_short %} is disabled and then subsequently enabled, {% data variables.product.prodname_copilot_autofix_short %} won't automatically suggest fixes for any pull requests that are already open. The suggestions will only be generated for any pull requests that are opened after {% data variables.product.prodname_copilot_autofix_short %} is enabled, or after re-running {% data variables.product.prodname_code_scanning %} analysis on existing pull requests. ## Blocking use of {% data variables.product.prodname_copilot_autofix_short %} for an enterprise @@ -46,7 +46,7 @@ Note that disabling {% data variables.product.prodname_copilot_autofix_short %} {% data reusables.profile.access_org %} {% data reusables.profile.org_settings %} 1. In the "Security" section of the sidebar, click **{% octicon "codescan" aria-hidden="true" %} Code security** then **Global settings**. -1. Under the "{% data variables.product.prodname_code_scanning_caps %}" section, deselect **{% data variables.product.prodname_copilot_autofix_short %}**. +1. Under the "{% data variables.product.prodname_code_scanning_caps %}" section, deselect **{% data variables.product.prodname_copilot_autofix_short %}** or **{% data variables.product.prodname_copilot_autofix_short %} for third-party tools**. For more information about configuring global {% data variables.product.prodname_code_scanning %} settings, see "[AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/configuring-global-security-settings-for-your-organization#configuring-global-code-scanning-settings)." @@ -57,4 +57,4 @@ If {% data variables.product.prodname_copilot_autofix_short %} is allowed at the {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-settings %} {% data reusables.user-settings.security-analysis %} -1. In the "{% data variables.product.prodname_code_scanning_caps %}" section, deselect **{% data variables.product.prodname_copilot_autofix_short %}**. +1. In the "{% data variables.product.prodname_code_scanning_caps %}" section, deselect **{% data variables.product.prodname_copilot_autofix_short %}** or **{% data variables.product.prodname_copilot_autofix_short %} for third-party tools**. diff --git a/content/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts.md b/content/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts.md index 52f82b373e88..12bb7d66c73b 100644 --- a/content/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts.md +++ b/content/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts.md @@ -36,7 +36,7 @@ With a {% data variables.product.prodname_copilot_enterprise %} license, you can ## Generating suggested fixes for {% data variables.product.prodname_code_scanning %} alerts -{% data variables.product.prodname_copilot_autofix %} can generate fixes for alerts from {% data variables.product.prodname_codeql %} analysis. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." +{% data variables.product.prodname_copilot_autofix %} can generate fixes for alerts identified by {% data variables.product.prodname_code_scanning %} analysis. Most {% data variables.product.prodname_codeql %} alert types are supported and also some alerts from third-party tools. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." {% data reusables.rai.code-scanning.copilot-autofix-note %} diff --git a/content/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning.md b/content/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning.md index 78ecd86ff4c0..9deb7be5755d 100644 --- a/content/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning.md +++ b/content/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning.md @@ -16,35 +16,35 @@ redirect_from: - /code-security/code-scanning/managing-code-scanning-alerts/about-autofix-for-codeql-code-scanning --- -## About {% data variables.product.prodname_copilot_autofix_short %} for {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} +## About {% data variables.product.prodname_copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} -{% data variables.product.prodname_copilot_autofix %} is an expansion of {% data variables.product.prodname_code_scanning %} that provides users with targeted recommendations to help them fix {% data variables.product.prodname_code_scanning %} alerts so they can avoid introducing new security vulnerabilities. The potential fixes are generated automatically by large language models (LLMs) using data from the codebase and from {% data variables.product.prodname_codeql %} analysis. +{% data variables.product.prodname_copilot_autofix %} is an expansion of {% data variables.product.prodname_code_scanning %} that provides users with targeted recommendations to help them fix {% data variables.product.prodname_code_scanning %} alerts so they can avoid introducing new security vulnerabilities. The potential fixes are generated automatically by large language models (LLMs) using data from the codebase and from {% data variables.product.prodname_code_scanning %} analysis. {% data variables.product.prodname_copilot_autofix %} is available for {% data variables.product.prodname_codeql %} analysis, and supports the third-party tool ESLint (third-party support is in {% data variables.release-phases.public_preview %} and subject to change). {% data reusables.rai.code-scanning.copilot-autofix-note %} {% data variables.product.prodname_copilot_autofix_short %} generates potential fixes that are relevant to the existing source code and translates the description and location of an alert into code changes that may fix the alert. {% data variables.product.prodname_copilot_autofix_short %} uses internal {% data variables.product.prodname_copilot %} APIs interfacing with the large language model GPT-4o from OpenAI, which has sufficient generative capabilities to produce both suggested fixes in code and explanatory text for those fixes. -While {% data variables.product.prodname_copilot_autofix_short %} is allowed by default and enabled for every repository using {% data variables.product.prodname_codeql %}, you can choose to opt out and disable {% data variables.product.prodname_copilot_autofix_short %}. To learn how to disable {% data variables.product.prodname_copilot_autofix_short %} at the enterprise, organization and repository levels, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/disabling-autofix-for-code-scanning)." +{% data variables.product.prodname_copilot_autofix_short %} is allowed by default and enabled for every repository using {% data variables.product.prodname_codeql %}, but you can choose to opt out and disable {% data variables.product.prodname_copilot_autofix_short %}. To learn how to disable {% data variables.product.prodname_copilot_autofix_short %} at the enterprise, organization and repository levels, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/disabling-autofix-for-code-scanning)." In an organization's security overview dashboard, you can view the total number of code suggestions generated on open and closed pull requests in the organization for a given time period. For more information, see "[AUTOTITLE](/enterprise-cloud@latest/code-security/security-overview/viewing-security-insights#autofix-suggestions)" in the {% data variables.product.prodname_ghe_cloud %} documentation. ## Developer experience -{% data variables.product.prodname_code_scanning_caps %} users can already see any security alerts detected by {% data variables.product.prodname_codeql %} to analyze their pull requests. However, developers often have little training in code security so fixing these alerts requires substantial effort. They must first read and understand the alert location and description, and then use that understanding to edit the source code to fix the vulnerability. +{% data variables.product.prodname_code_scanning_caps %} users can already see security alerts to analyze their pull requests. However, developers often have little training in code security so fixing these alerts requires substantial effort. They must first read and understand the alert location and description, and then use that understanding to edit the source code to fix the vulnerability. {% data variables.product.prodname_copilot_autofix_short %} lowers the barrier of entry to developers by combining information on best practices with details of the codebase and alert to suggest a potential fix to the developer. Instead of starting with a search for information about the vulnerability, the developer starts with a code suggestion that demonstrates a potential solution for their codebase. The developer evaluates the potential fix to determine whether it is the best solution for their codebase and to ensure that it maintains the intended behavior. After committing a suggested fix or modified fix, the developer should always verify that continuous integration testing (CI) for the codebase continues to pass and that the alert is shown as resolved before they merge their pull request. -## Supported languages +## Supported languages for {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} -{% data variables.product.prodname_copilot_autofix_short %} supports fix generation for a subset of queries included in the default and security-extended query suites for {% data variables.code-scanning.code_scanning_autofix_languages %}. For more information on these query suites, see "[AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites#built-in-codeql-query-suites)." +{% data variables.product.prodname_copilot_autofix_short %} supports fix generation for a subset of queries included in the default and security-extended {% data variables.product.prodname_codeql %} query suites for {% data variables.code-scanning.codeql_autofix_languages %}. For more information on these query suites, see "[AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites#built-in-codeql-query-suites)." ## Suggestion generation process -When {% data variables.product.prodname_copilot_autofix_short %} is enabled for a repository, {% data variables.product.prodname_code_scanning %} alerts that are identified by supported {% data variables.product.prodname_codeql %} queries send input to the LLM. If the LLM can generate a potential fix, the fix is shown as a suggestion. +When {% data variables.product.prodname_copilot_autofix_short %} is enabled for a repository, {% data variables.product.prodname_code_scanning %} alerts that are identified send input to the LLM. If the LLM can generate a potential fix, the fix is shown as a suggestion. -{% data variables.product.prodname_dotcom %} sends the LLM a variety of data from the {% data variables.product.prodname_codeql %} analysis. +{% data variables.product.prodname_dotcom %} sends the LLM a variety of data from the {% data variables.product.prodname_code_scanning %} analysis. For example: * {% data variables.product.prodname_codeql %} alert data in SARIF format. For more information, see “[AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning).” * Code from the current version of the branch. @@ -70,7 +70,7 @@ We test the effectiveness of suggestions by merging all suggested changes, unedi 1. Was the {% data variables.product.prodname_code_scanning %} alert fixed by the suggestion? 1. Did the fix introduce any new {% data variables.product.prodname_code_scanning %} alerts? -1. Did the fix introduce any syntax errors that {% data variables.product.prodname_codeql %} can detect? +1. Did the fix introduce any syntax errors that {% data variables.product.prodname_code_scanning %} can detect? 1. Has the fix changed the output of any of the repository tests? In addition, we spot check many of the successful suggestions and verify that they fix the alert without introducing new problems. When one or more of these checks failed, our manual triage showed that in many cases the proposed fix was nearly correct but needed some minor modifications that a user could identify and manually perform. diff --git a/content/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests.md b/content/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests.md index dd23b8fb6fae..c2db524293ae 100644 --- a/content/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests.md +++ b/content/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests.md @@ -41,7 +41,7 @@ If the lines of code changed in the pull request generate {% data variables.prod {% ifversion code-scanning-autofix %} -{% data variables.product.prodname_copilot_autofix %} will suggest fixes for alerts from {% data variables.product.prodname_codeql %} analysis in private repositories. For more information on working with suggestions from {% data variables.product.prodname_copilot_autofix_short %} in pull requests, see "[Working with {% data variables.product.prodname_copilot_autofix_short %} suggestions for alerts on a pull request](#working-with-copilot-autofix-suggestions-for-alerts-on-a-pull-request)." +{% data variables.product.prodname_copilot_autofix %} will suggest fixes for alerts from {% data variables.product.prodname_code_scanning %} analysis (including {% data variables.product.prodname_codeql %} analysis) in private repositories. For more information on working with suggestions from {% data variables.product.prodname_copilot_autofix_short %} in pull requests, see "[Working with {% data variables.product.prodname_copilot_autofix_short %} suggestions for alerts on a pull request](#working-with-copilot-autofix-suggestions-for-alerts-on-a-pull-request)." {% endif %} @@ -119,7 +119,7 @@ Anyone with push access to a pull request can fix a {% data variables.product.pr ## Working with {% data variables.product.prodname_copilot_autofix_short %} suggestions for alerts on a pull request -{% data variables.product.prodname_copilot_autofix %} is an expansion of {% data variables.product.prodname_code_scanning %} that provides you with targeted recommendations to help you fix {% data variables.product.prodname_code_scanning %} alerts in pull requests. The potential fixes are generated automatically by large language models (LLMs) using data from the codebase, the pull request, and from {% data variables.product.prodname_codeql %} analysis. +{% data variables.product.prodname_copilot_autofix %} is an expansion of {% data variables.product.prodname_code_scanning %} that provides you with targeted recommendations to help you fix {% data variables.product.prodname_code_scanning %} alerts (including {% data variables.product.prodname_codeql %} alerts) in pull requests. The potential fixes are generated automatically by large language models (LLMs) using data from the codebase, the pull request, and from {% data variables.product.prodname_code_scanning %} analysis. {% data reusables.rai.code-scanning.copilot-autofix-note %} @@ -127,7 +127,7 @@ Anyone with push access to a pull request can fix a {% data variables.product.pr ### Generating {% data variables.product.prodname_copilot_autofix_short %} suggestions and publishing to a pull request -When {% data variables.product.prodname_copilot_autofix_short %} is enabled for a repository, alerts are displayed in pull requests as normal and information from any alerts found by {% data variables.product.prodname_codeql %} is automatically sent to the LLM for processing. When LLM analysis is complete, any results are published as comments on relevant alerts. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." +When {% data variables.product.prodname_copilot_autofix_short %} is enabled for a repository, alerts are displayed in pull requests as normal and information from any alerts found by {% data variables.product.prodname_code_scanning %} is automatically sent to the LLM for processing. When LLM analysis is complete, any results are published as comments on relevant alerts. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." {% note %} @@ -144,7 +144,7 @@ Usually, when you suggest changes to a pull request, your comment contains chang ### Assessing and committing an {% data variables.product.prodname_copilot_autofix_short %} suggestion -Each {% data variables.product.prodname_copilot_autofix_short %} suggestion demonstrates a potential solution for a {% data variables.product.prodname_code_scanning %} alert in your codebase. You must assess the suggested changes to determine whether they are a good solution for your codebase and to ensure that they maintain the intended behavior. For information about the limitations of {% data variables.product.prodname_copilot_autofix_short %} suggestions, see "[Limitations of suggestions](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning#limitations-of-suggestions)" and "[Mitigating the limitations of suggestions](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning#mitigating-the-limitations-of-suggestions)" in "About {% data variables.product.prodname_copilot_autofix_short %} for {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}." +Each {% data variables.product.prodname_copilot_autofix_short %} suggestion demonstrates a potential solution for a {% data variables.product.prodname_code_scanning %} alert in your codebase. You must assess the suggested changes to determine whether they are a good solution for your codebase and to ensure that they maintain the intended behavior. For information about the limitations of {% data variables.product.prodname_copilot_autofix_short %} suggestions, see "[Limitations of suggestions](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning#limitations-of-suggestions)" and "[Mitigating the limitations of suggestions](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning#mitigating-the-limitations-of-suggestions)" in "Responsible use of {% data variables.product.prodname_copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %}." 1. Click **Edit** to display the editing options and select your preferred method. * Under **Edit with {% data variables.product.prodname_cli %}**, follow the instructions for checking out the pull request locally and applying the suggested fix. diff --git a/content/code-security/secret-scanning/copilot-secret-scanning/enabling-ai-powered-generic-secret-detection.md b/content/code-security/secret-scanning/copilot-secret-scanning/enabling-ai-powered-generic-secret-detection.md new file mode 100644 index 000000000000..5722404716c8 --- /dev/null +++ b/content/code-security/secret-scanning/copilot-secret-scanning/enabling-ai-powered-generic-secret-detection.md @@ -0,0 +1,48 @@ +--- +title: Enabling Copilot secret scanning's generic secret detection +shortTitle: Enable generic secret detection +intro: 'You can enable {% data variables.secret-scanning.generic-secret-detection %} for your repository or organization. Alerts for generic secrets, such as passwords, are displayed in a separate list on the {% data variables.product.prodname_secret_scanning %} alerts page.' +allowTitleToDifferFromFilename: true +versions: + feature: secret-scanning-ai-generic-secret-detection +product: '{% data reusables.gated-features.secret-scanning %}' +type: how_to +topics: + - Secret scanning + - Advanced Security + - AI + - Copilot +redirect_from: + - /code-security/secret-scanning/enabling-ai-powered-generic-secret-detection + - /code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/enabling-ai-powered-generic-secret-detection +--- + +## Enabling {% data variables.secret-scanning.generic-secret-detection %} + +{% data reusables.secret-scanning.generic-secret-detection-policy-note %} + +You can then enable {% data variables.secret-scanning.generic-secret-detection %} in the security settings page of your repository or organization. + +{% data reusables.secret-scanning.copilot-secret-scanning-generic-secrets-subscription-note %} + +### Enabling {% data variables.secret-scanning.generic-secret-detection %} for your repository + +{% data reusables.repositories.navigate-to-repo %} +{% data reusables.repositories.sidebar-settings %} +{% data reusables.repositories.navigate-to-code-security-and-analysis %} +{% data reusables.repositories.navigate-to-ghas-settings %} +1. Under "Secret scanning", select the checkbox next to "Scan for generic secrets". + +### Enabling {% data variables.secret-scanning.generic-secret-detection %} for your organization + +{% data reusables.profile.access_org %} +{% data reusables.profile.org_settings %} +1. In the "Security" section of the sidebar, click **{% octicon "codescan" aria-hidden="true" %} Code security** then **Global settings**. +1. Under "Secret scanning", select the checkbox next to "Scan for generic secrets". + +For information on how to view alerts for generic secrets that have been detected using AI, see "[AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning/viewing-alerts)." + +## Further reading + +* [AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets) +* [AUTOTITLE](/code-security/secret-scanning/introduction/about-secret-scanning) diff --git a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/generating-regular-expressions-for-custom-patterns-with-ai.md b/content/code-security/secret-scanning/copilot-secret-scanning/generating-regular-expressions-for-custom-patterns-with-ai.md similarity index 86% rename from content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/generating-regular-expressions-for-custom-patterns-with-ai.md rename to content/code-security/secret-scanning/copilot-secret-scanning/generating-regular-expressions-for-custom-patterns-with-ai.md index 81fa5b401ee5..c4bdabd015fa 100644 --- a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/generating-regular-expressions-for-custom-patterns-with-ai.md +++ b/content/code-security/secret-scanning/copilot-secret-scanning/generating-regular-expressions-for-custom-patterns-with-ai.md @@ -10,12 +10,16 @@ topics: - Advanced Security - Secret scanning - AI + - Copilot redirect_from: - /code-security/secret-scanning/generating-regular-expressions-for-custom-patterns-with-ai + - /code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/generating-regular-expressions-for-custom-patterns-with-ai --- ## Generating a regular expression for a repository with AI +{% data reusables.secret-scanning.copilot-secret-scanning-expression-generator-subscription-note %} + {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-settings %} {% data reusables.repositories.navigate-to-code-security-and-analysis %} @@ -44,4 +48,4 @@ redirect_from: ## Further reading -* "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/responsible-use-ai-regex-generator)" +* "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-use-ai-regex-generator)" diff --git a/content/code-security/secret-scanning/copilot-secret-scanning/index.md b/content/code-security/secret-scanning/copilot-secret-scanning/index.md new file mode 100644 index 000000000000..59f7fb74738d --- /dev/null +++ b/content/code-security/secret-scanning/copilot-secret-scanning/index.md @@ -0,0 +1,21 @@ +--- +title: Enhance your secret detection capabilities with Copilot secret scanning +shortTitle: Copilot secret scanning +allowTitleToDifferFromFilename: true +intro: 'Learn how {% data variables.product.prodname_secret_scanning %} uses AI to detect generic secrets in your code, and generate regular expressions for your custom patterns.' +product: '{% data reusables.gated-features.secret-scanning %}' +versions: + ghec: '*' +topics: + - Secret scanning + - Advanced Security + - Repositories + - Copilot +children: + - /responsible-ai-generic-secrets + - /enabling-ai-powered-generic-secret-detection + - /responsible-use-ai-regex-generator + - /generating-regular-expressions-for-custom-patterns-with-ai +redirect_from: + - /code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection +--- diff --git a/content/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets.md b/content/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets.md new file mode 100644 index 000000000000..a93b3f8d67f7 --- /dev/null +++ b/content/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets.md @@ -0,0 +1,101 @@ +--- +title: Responsible detection of generic secrets with Copilot secret scanning +shortTitle: Generic secret detection +intro: 'Learn how {% data variables.secret-scanning.copilot-secret-scanning %} uses AI responsibly to scan and create alerts for unstructured secrets, such as passwords.' +allowTitleToDifferFromFilename: true +versions: + feature: secret-scanning-ai-generic-secret-detection + fpt: '*' +type: rai +topics: + - Secret scanning + - Advanced Security + - AI + - Copilot +redirect_from: + - /code-security/secret-scanning/about-the-detection-of-generic-secrets-with-secret-scanning + - /code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/about-the-detection-of-generic-secrets-with-secret-scanning + - /code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/responsible-ai-generic-secrets +--- + + + +## About {% data variables.secret-scanning.generic-secret-detection %} with {% data variables.secret-scanning.copilot-secret-scanning %} + +{% data variables.secret-scanning.copilot-secret-scanning %}'s {% data variables.secret-scanning.generic-secret-detection %} is an AI-powered expansion of {% data variables.product.prodname_secret_scanning %} that identifies unstructured secrets (passwords) in your source code and then generates an alert. + +{% data reusables.rai.secret-scanning.copilot-secret-scanning-generic-secrets-subscription-note %} + +{% data variables.product.prodname_GH_advanced_security %} users can already receive {% data variables.secret-scanning.alerts %} for partner or custom patterns found in their source code, but unstructured secrets are not easily discoverable. {% data variables.secret-scanning.copilot-secret-scanning %} uses large language models (LLMs) to identify this type of secret. + +When a password is detected, an alert is displayed in the "Experimental" list of {% data variables.product.prodname_secret_scanning %} alerts (under the **Security** tab of the repository, organization, or enterprise), so that maintainers and security managers can review the alert and, where necessary, remove the credential or implement a fix. + +{% data reusables.rai.secret-scanning.generic-secret-detection-policy-note %} The feature must then be enabled for repositories and organizations. + +### Input processing + +Input is limited to text (typically code) that a user has checked into a repository. The system provides this text to the LLM along with a meta prompt asking the LLM to find passwords within the scope of the input. The user does not interact with the LLM directly. + +The system scans for passwords using the LLM. No additional data is collected by the system, other than what is already collected by the existing {% data variables.product.prodname_secret_scanning %} feature. + +### Output and display + +The LLM scans for strings that resemble passwords and verifies that the identified strings included in the response actually exist in the input. + +These detected strings are surfaced as alerts on the {% data variables.product.prodname_secret_scanning %} alerts page, but they are displayed in an additional list that is separate from regular {% data variables.secret-scanning.alerts %}. The intent is that this separate list is triaged with more scrutiny to verify the validity of the findings. Each alert notes that it was detected using AI. {% ifversion secret-scanning-ai-generic-secret-detection %}For information on how to view alerts for generic secrets, see "[AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning/viewing-alerts)."{% endif %} + +## Improving the performance of {% data variables.secret-scanning.generic-secret-detection %} + +To improve the performance of {% data variables.secret-scanning.generic-secret-detection %}, we recommend closing false positive alerts appropriately. + +### Verify the accuracy of alerts and close as appropriate + +Since {% data variables.secret-scanning.copilot-secret-scanning %}'s {% data variables.secret-scanning.generic-secret-detection %} may generate more false positives than the existing {% data variables.product.prodname_secret_scanning %} feature for partner patterns, it's important that you review the accuracy of these alerts. When you verify an alert to be a false positive, be sure to close the alert and mark the reason as "False positive" in the {% data variables.product.prodname_dotcom %} UI. The {% data variables.product.prodname_dotcom %} development team will use information on false positive volume and detection locations to improve the model. {% data variables.product.prodname_dotcom %} does not have access to the secret literals themselves. + +## Limitations of {% data variables.secret-scanning.generic-secret-detection %} + +When using {% data variables.secret-scanning.copilot-secret-scanning %}'s {% data variables.secret-scanning.generic-secret-detection %}, you should consider the following limitations. + +### Limited scope + +{% data variables.secret-scanning.generic-secret-detection-caps %} currently only looks for instances of passwords in git content. The feature does not look for other types of generic secrets, and it does not look for secrets in non-git content, such as {% data variables.product.prodname_github_issues %}. + +### Potential for false positive alerts + +{% data variables.secret-scanning.generic-secret-detection-caps %} may generate more false positive alerts when compared to the existing {% data variables.product.prodname_secret_scanning %} feature (which detects partner patterns, and which has a very low false positive rate). To mitigate this excess noise, alerts are grouped in a separate list from partner pattern alerts, and security managers and maintainers should triage each alert to verify its accuracy. + +### Potential for incomplete reporting + +{% data variables.secret-scanning.generic-secret-detection-caps %} may miss instances of credentials checked into a repository. The LLM will improve over time. You retain ultimate responsibility for ensuring the security of your code. + +### Limitations by design + +{% data variables.secret-scanning.generic-secret-detection-caps %} has the following limitations by design: + +* {% data variables.secret-scanning.copilot-secret-scanning %} will not detect secrets that are obviously fake or test passwords, or passwords with low entropy. +* {% data variables.secret-scanning.copilot-secret-scanning %} will only detect a maximum of 100 passwords per push. +* If five or more detected secrets within a single file are marked as false positive, {% data variables.secret-scanning.copilot-secret-scanning %} will stop generating new alerts for that file. +* {% data variables.secret-scanning.copilot-secret-scanning %} does not detect secrets in generated or vendored files. +* {% data variables.secret-scanning.copilot-secret-scanning %} does not detect secrets in encrypted files. +* {% data variables.secret-scanning.copilot-secret-scanning %} does not detect secrets in file types: SVG, PNG, JPEG, CSV, TXT, SQL, or ITEM. +* {% data variables.secret-scanning.copilot-secret-scanning %} does not detect secrets in test code. {% data variables.secret-scanning.copilot-secret-scanning %} skips detections where: + * The file path contains "test", "mock", or "spec". + * The file extension is `.cs`, `.go`, `.java`, `.js`, `.kt`, `.php`, `.py`, `.rb`, `.scala`, `.swift`, or `.ts`. + +## Evaluation of {% data variables.secret-scanning.generic-secret-detection %} + +{% data variables.secret-scanning.generic-secret-detection-caps %} has been subject to Responsible AI Red Teaming and {% data variables.product.prodname_dotcom %} will continue to monitor the efficacy and safety of the feature over time. + +{% ifversion secret-scanning-ai-generic-secret-detection %} + +## Next steps + +* [AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/enabling-ai-powered-generic-secret-detection) +* [AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning) + +{% endif %} + +## Further reading + +* [AUTOTITLE](/code-security/secret-scanning/introduction/about-secret-scanning){% ifversion ghec %} +* [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise#enforcing-a-policy-to-manage-the-use-of-generic-secret-detection-for-secret-scanning-in-your-enterprises-repositories){% endif %} diff --git a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/responsible-use-ai-regex-generator.md b/content/code-security/secret-scanning/copilot-secret-scanning/responsible-use-ai-regex-generator.md similarity index 94% rename from content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/responsible-use-ai-regex-generator.md rename to content/code-security/secret-scanning/copilot-secret-scanning/responsible-use-ai-regex-generator.md index 7d769deb386c..a314b18dc3e9 100644 --- a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/responsible-use-ai-regex-generator.md +++ b/content/code-security/secret-scanning/copilot-secret-scanning/responsible-use-ai-regex-generator.md @@ -12,10 +12,12 @@ topics: - Advanced Security - Secret scanning - AI + - Copilot redirect_from: - /code-security/secret-scanning/about-the-regular-expression-generator-for-custom-patterns - /code-security/secret-scanning/about-generating-regular-expressions-with-ai - /code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/about-generating-regular-expressions-with-ai + - /code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/responsible-use-ai-regex-generator --- @@ -24,6 +26,8 @@ redirect_from: {% data variables.product.prodname_secret_scanning_caps %} scans repositories for a predefined set of secrets from our partner program, as well as custom patterns that are user-defined. Custom patterns are formatted as regular expressions. +{% data reusables.rai.secret-scanning.copilot-secret-scanning-expression-generator-subscription-note %} + Regular expressions can be challenging for people to write. The {% data variables.secret-scanning.custom-pattern-regular-expression-generator %} makes it possible for you to define your custom patterns without knowledge of regular expressions. Within the existing custom pattern page, you can launch a generative AI experience where you input a text description of what pattern you would like to detect, include optional example strings that should be detected, and get matching regular expressions in return. ### Input processing @@ -60,7 +64,7 @@ Note that the {% data variables.secret-scanning.custom-pattern-regular-expressio ## Next steps -* [AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/generating-regular-expressions-for-custom-patterns-with-ai) +* [AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/generating-regular-expressions-for-custom-patterns-with-ai) * [AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning) {% endif %} diff --git a/content/code-security/secret-scanning/index.md b/content/code-security/secret-scanning/index.md index 28a7b0fd1453..fd5c26742b12 100644 --- a/content/code-security/secret-scanning/index.md +++ b/content/code-security/secret-scanning/index.md @@ -20,6 +20,7 @@ children: - /managing-alerts-from-secret-scanning - /working-with-secret-scanning-and-push-protection - /using-advanced-secret-scanning-and-push-protection-features + - /copilot-secret-scanning - /troubleshooting-secret-scanning-and-push-protection - /secret-scanning-partnership-program --- diff --git a/content/code-security/secret-scanning/introduction/about-secret-scanning.md b/content/code-security/secret-scanning/introduction/about-secret-scanning.md index 8514360667d6..e78e04c421e9 100644 --- a/content/code-security/secret-scanning/introduction/about-secret-scanning.md +++ b/content/code-security/secret-scanning/introduction/about-secret-scanning.md @@ -104,14 +104,6 @@ Scan for and detect secrets that are not specific to a service provider, such as {% endif %} -{% ifversion secret-scanning-ai-generic-secret-detection %} - -### Generic secret detection - -Leverage {% data variables.product.prodname_secret_scanning %}'s AI capabilities to detect unstructured secrets, such as passwords, in your repository. For more information, see "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/responsible-ai-generic-secrets)." - -{% endif %} - ### Performing validity checks Validity checks help you prioritize alerts by telling you which secrets are `active` or `inactive`. For more information, see{% ifversion secret-scanning-validity-check-partner-patterns %} "[AUTOTITLE](/code-security/secret-scanning/enabling-secret-scanning-features/enabling-validity-checks-for-your-repository)" and{% endif %} "[AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning/evaluating-alerts#checking-a-secrets-validity)." @@ -122,11 +114,14 @@ Validity checks help you prioritize alerts by telling you which secrets are `act Define your own patterns for secrets used by your organization that {% data variables.product.prodname_secret_scanning %} can scan for and detect. For more information, see "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/defining-custom-patterns-for-secret-scanning)." -{% ifversion secret-scanning-custom-pattern-ai-generated %} +{% endif %} -You can also leverage AI to generate regular expressions that will capture all your custom patterns. For more information, see "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/responsible-use-ai-regex-generator)." +{% ifversion secret-scanning-ai-generic-secret-detection %} -{% endif %} +### {% data variables.secret-scanning.copilot-secret-scanning %} + +* **{% data variables.secret-scanning.generic-secret-detection-caps %}**: Leverage {% data variables.product.prodname_secret_scanning %}'s AI capabilities to detect unstructured secrets, such as passwords, in your repository. For more information, see "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets)."{% ifversion secret-scanning-custom-pattern-ai-generated %} +* **{% data variables.secret-scanning.custom-pattern-regular-expression-generator-caps %}**: Leverage {% data variables.product.prodname_secret_scanning %}'s AI capabilities to generate regular expressions that will capture all your custom patterns. For more information, see "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-use-ai-regex-generator).{% endif %} {% endif %} diff --git a/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts.md b/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts.md index 33fa5f229734..720d48e0b5fb 100644 --- a/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts.md +++ b/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts.md @@ -66,4 +66,4 @@ Partner alerts are not sent to repository administrators, so you do not need to * "[AUTOTITLE](/code-security/secret-scanning/introduction/supported-secret-scanning-patterns){% ifversion ghec or ghes %} * "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/defining-custom-patterns-for-secret-scanning)"{% endif %}{% ifversion secret-scanning-non-provider-patterns %} * "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/non-provider-patterns/enabling-secret-scanning-for-non-provider-patterns)"{% endif %}{% ifversion secret-scanning-ai-generic-secret-detection %} -* "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/responsible-ai-generic-secrets)"{% endif %} +* "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets)"{% endif %} diff --git a/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/viewing-alerts.md b/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/viewing-alerts.md index 58571fa07ab9..2bdd119095cb 100644 --- a/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/viewing-alerts.md +++ b/content/code-security/secret-scanning/managing-alerts-from-secret-scanning/viewing-alerts.md @@ -65,7 +65,7 @@ In addition, alerts that fall into this category: * Are not shown in the summary views for security overview, only in the "{% data variables.product.prodname_secret_scanning_caps %}" view. * Only have the first five detected locations shown on {% data variables.product.prodname_dotcom %} for non-provider patterns{% ifversion secret-scanning-ai-generic-secret-detection %}, and only the first detected location shown for AI-detected generic secrets{% endif %}. -For {% data variables.product.company_short %} to scan for non-provider patterns{% ifversion secret-scanning-ai-generic-secret-detection %} and generic secrets{% endif %}, you must first enable the feature{% ifversion secret-scanning-ai-generic-secret-detection %}s{% endif %} for your repository or organization. For more information, see "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/non-provider-patterns/enabling-secret-scanning-for-non-provider-patterns){% ifversion secret-scanning-ai-generic-secret-detection %}" and "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/enabling-ai-powered-generic-secret-detection){% endif %}." +For {% data variables.product.company_short %} to scan for non-provider patterns{% ifversion secret-scanning-ai-generic-secret-detection %} and generic secrets{% endif %}, you must first enable the feature{% ifversion secret-scanning-ai-generic-secret-detection %}s{% endif %} for your repository or organization. For more information, see "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/non-provider-patterns/enabling-secret-scanning-for-non-provider-patterns){% ifversion secret-scanning-ai-generic-secret-detection %}" and "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/enabling-ai-powered-generic-secret-detection){% endif %}." {% ifversion secret-scanning-alert-experimental-list %} @@ -109,7 +109,7 @@ You can apply various filters to the alerts list to help you find the alerts you |`provider:PROVIDER-NAME`|Displays alerts for a specific provider, for example, `provider:github`. For a list of supported partners, see "[AUTOTITLE](/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets)."| | {% ifversion secret-scanning-non-provider-patterns %} | |{% ifversion secret-scanning-alert-experimental-list %}`results:default`{% else %}`confidence:high`{% endif %}| Displays alerts for {% ifversion secret-scanning-alert-experimental-list %}{% else %}high-confidence secrets, which relate to {% endif %}supported secrets and custom patterns. For a list of supported patterns, see "[AUTOTITLE](/code-security/secret-scanning/introduction/supported-secret-scanning-patterns)." | -|{% ifversion secret-scanning-alert-experimental-list %}`results:experimental`{% else %}`confidence:other`{% endif %}| Displays alerts for non-provider patterns, such as private keys{% ifversion secret-scanning-ai-generic-secret-detection %}, and AI-detected generic secrets, such as passwords{% endif %}. For a list of supported non-provider patterns, see "[AUTOTITLE](/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#non-provider-patterns)." {% ifversion secret-scanning-ai-generic-secret-detection %}For more information about AI-detected generic secrets, see "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/responsible-ai-generic-secrets)."{% endif %}| +|{% ifversion secret-scanning-alert-experimental-list %}`results:experimental`{% else %}`confidence:other`{% endif %}| Displays alerts for non-provider patterns, such as private keys{% ifversion secret-scanning-ai-generic-secret-detection %}, and AI-detected generic secrets, such as passwords{% endif %}. For a list of supported non-provider patterns, see "[AUTOTITLE](/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#non-provider-patterns)." {% ifversion secret-scanning-ai-generic-secret-detection %}For more information about AI-detected generic secrets, see "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets)."{% endif %}| | {% endif %} | ## Next steps diff --git a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/defining-custom-patterns-for-secret-scanning.md b/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/defining-custom-patterns-for-secret-scanning.md index 29e9da6a59c8..1b484cdd873c 100644 --- a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/defining-custom-patterns-for-secret-scanning.md +++ b/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/defining-custom-patterns-for-secret-scanning.md @@ -46,7 +46,7 @@ For simple tokens you will usually only need to specify a secret format. The oth ### Using the regular expression generator -{% data reusables.secret-scanning.regular-expression-generator-overview %} For more information, see "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/responsible-use-ai-regex-generator)" and "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/generating-regular-expressions-for-custom-patterns-with-ai)." +{% data reusables.secret-scanning.regular-expression-generator-overview %} For more information, see "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-use-ai-regex-generator)" and "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/generating-regular-expressions-for-custom-patterns-with-ai)." {% endif %} diff --git a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/index.md b/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/index.md index 49bf9b0940a6..d3dad9996c0c 100644 --- a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/index.md +++ b/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/index.md @@ -14,7 +14,6 @@ topics: children: - /defining-custom-patterns-for-secret-scanning - /managing-custom-patterns - - /responsible-use-ai-regex-generator - - /generating-regular-expressions-for-custom-patterns-with-ai - /metrics-for-custom-patterns --- + diff --git a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/enabling-ai-powered-generic-secret-detection.md b/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/enabling-ai-powered-generic-secret-detection.md deleted file mode 100644 index 2542acdf76d6..000000000000 --- a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/enabling-ai-powered-generic-secret-detection.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Enabling AI-powered generic secret detection -shortTitle: Enable generic secret detection -intro: 'You can enable AI-powered generic secret detection for your repository or organization. Alerts for generic secrets, such as passwords, are displayed in a separate list on the {% data variables.product.prodname_secret_scanning %} alerts page.' -versions: - feature: secret-scanning-ai-generic-secret-detection -type: how_to -topics: - - Secret scanning - - Advanced Security - - AI -redirect_from: - - /code-security/secret-scanning/enabling-ai-powered-generic-secret-detection ---- - -{% data reusables.secret-scanning.generic-secret-detection-ai %} - -## Enabling AI-powered generic secret detection for your repository - -To use generic secret detection, an enterprise owner must first set a policy at the enterprise level that controls whether repositories can enable or disable AI detection. This policy is set to "allowed" by default. - -You can then enable the feature in the "Code security and analysis" settings page of your repository. - -{% data reusables.repositories.navigate-to-repo %} -{% data reusables.repositories.sidebar-settings %} -{% data reusables.repositories.navigate-to-code-security-and-analysis %} -{% data reusables.repositories.navigate-to-ghas-settings %} -1. Under "Secret scanning", select the checkbox next to "Use AI detection to find additional secrets". - -## Enabling AI-powered generic secret detection for your organizations - -To use generic secret detection, an enterprise owner must first set a policy at the enterprise level that controls whether repositories in an organization can enable or disable AI detection. This policy is set to "allowed" by default. - -You can then enable the feature in the security settings page of your organization. - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -1. In the "Security" section of the sidebar, click **{% octicon "codescan" aria-hidden="true" %} Code security** then **Global settings**. -1. Under "Secret scanning", select the checkbox next to "Use AI detection to find additional secrets". - -For information on how to view alerts for generic secrets that have been detected using AI, see "[AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning/viewing-alerts)." - -## Further reading - -* [AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/responsible-ai-generic-secrets) -* [AUTOTITLE](/code-security/secret-scanning/introduction/about-secret-scanning) diff --git a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/index.md b/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/index.md deleted file mode 100644 index 73d0c0525152..000000000000 --- a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/index.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: Generic secret detection -shortTitle: Generic secret detection -allowTitleToDifferFromFilename: true -intro: 'You can use AI in combination with {% data variables.product.prodname_secret_scanning %} to detect unstructured passwords in git content.' -product: '{% data reusables.gated-features.secret-scanning %}' -versions: - feature: secret-scanning-ai-generic-secret-detection -topics: - - Secret scanning - - Advanced Security - - Repositories -children: - - /responsible-ai-generic-secrets - - /enabling-ai-powered-generic-secret-detection ---- diff --git a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/responsible-ai-generic-secrets.md b/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/responsible-ai-generic-secrets.md deleted file mode 100644 index 3ba29ecca3f1..000000000000 --- a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/responsible-ai-generic-secrets.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Responsible detection of generic secrets with AI -shortTitle: Generic secret detection -intro: 'Learn how {% data variables.product.prodname_secret_scanning %} uses AI responsibly to scan and create alerts for unstructured secrets, such as passwords.' -product: '{% data reusables.gated-features.secret-scanning %}' -allowTitleToDifferFromFilename: true -versions: - feature: secret-scanning-ai-generic-secret-detection - fpt: '*' -type: rai -topics: - - Secret scanning - - Advanced Security - - AI -redirect_from: - - /code-security/secret-scanning/about-the-detection-of-generic-secrets-with-secret-scanning - - /code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/about-the-detection-of-generic-secrets-with-secret-scanning ---- - - - -{% data reusables.rai.secret-scanning.generic-secret-detection-ai %} - -## About generic secret detection for {% data variables.product.prodname_secret_scanning %} - -Generic secret detection is an AI-powered expansion of {% data variables.product.prodname_secret_scanning %} that identifies unstructured secrets (passwords) in your source code and then generates an alert. - -{% data variables.product.prodname_GH_advanced_security %} users can already receive {% data variables.secret-scanning.alerts %} for partner or custom patterns found in their source code, but unstructured secrets are not easily discoverable. AI-powered generic secret detection uses large language models (LLMs) to identify this type of secret. - -When a password is detected, an alert is displayed in the list of {% data variables.product.prodname_secret_scanning %} alerts (under the **Security** tab of the repository, organization, or enterprise), so that maintainers and security managers can review the alert and, where necessary, remove the credential or implement a fix. - -To use the feature, an enterprise owner sets a policy at the enterprise level that controls whether repositories can enable or disable AI detection. This policy is set to "allowed" by default. The feature must then be enabled for repositories and organizations. - -### Input processing - -Input is limited to text (typically code) that a user has checked into a repository. The system provides this text to the LLM along with a meta prompt asking the LLM to find passwords within the scope of the input. The user does not interact with the LLM directly. - -The system scans for passwords using the LLM. No additional data is collected by the system, other than what is already collected by the existing {% data variables.product.prodname_secret_scanning %} feature. - -### Output and display - -The LLM scans for strings that resemble passwords and verifies that the identified strings included in the response actually exist in the input. - -These detected strings are surfaced as alerts on the {% data variables.product.prodname_secret_scanning %} alerts page, but they are displayed in an additional list that is separate from regular {% data variables.secret-scanning.alerts %}. The intent is that this separate list is triaged with more scrutiny to verify the validity of the findings. Each alert notes that it was detected using AI. {% ifversion secret-scanning-ai-generic-secret-detection %}For information on how to view alerts for generic secrets, see "[AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning/viewing-alerts)."{% endif %} - -## Improving the performance of generic secret detection - -To improve the performance of generic secret detection, we recommend closing false positive alerts appropriately and providing feedback when you encounter issues. - -### Verify the accuracy of alerts and close as appropriate - -Since AI-powered generic secret detection may generate more false positives than the existing {% data variables.product.prodname_secret_scanning %} feature for partner patterns, it's important that you review the accuracy of these alerts. When you verify an alert to be a false positive, be sure to close the alert and mark the reason as "False positive" in the {% data variables.product.prodname_dotcom %} UI. The {% data variables.product.prodname_dotcom %} development team will use this information to improve the model. - -### Provide feedback - -Generic secret detection is currently in {% data variables.release-phases.public_preview %}. If you encounter any issues or limitations with the feature, we recommend that you provide feedback through the **Give feedback** button listed under each detected secret in the list of alerts for the repository, organization, or enterprise. This can help the developers improve the tool and address any concerns or limitations. - -## Limitations of generic secret detection - -When using generic secret detection for {% data variables.product.prodname_secret_scanning %}, you should consider the following limitations. - -### Limited scope - -AI-powered generic secret detection currently only looks for instances of passwords in git content. The feature does not look for other types of generic secrets, and it does not look for secrets in non-git content, such as {% data variables.product.prodname_github_issues %}. - -### Potential for false positive alerts - -AI-powered generic secret detection may generate more false positive alerts when compared to the existing {% data variables.product.prodname_secret_scanning %} feature (which detects partner patterns, and which has a very low false positive rate). To mitigate this excess noise, alerts are grouped in a separate list from partner pattern alerts, and security managers and maintainers should triage each alert to verify its accuracy. - -### Potential for incomplete reporting - -AI-powered generic secret detection may miss instances of credentials checked into a repository. The LLM will improve over time. You retain ultimate responsibility for ensuring the security of your code. - -## Evaluation of generic secret detection - -Generic secret detection has been subject to Responsible AI Red Teaming and {% data variables.product.prodname_dotcom %} will continue to monitor the efficacy and safety of the feature over time. - -{% ifversion secret-scanning-ai-generic-secret-detection %} - -## Next steps - -* [AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/enabling-ai-powered-generic-secret-detection) -* [AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning) - -{% endif %} - -## Further reading - -* [AUTOTITLE](/code-security/secret-scanning/introduction/about-secret-scanning) -* [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise#enforcing-a-policy-to-manage-the-use-of-generic-secret-detection-for-secret-scanning-in-your-enterprises-repositories) diff --git a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/index.md b/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/index.md index 6ed5a0921dda..c60f9a7b4289 100644 --- a/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/index.md +++ b/content/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/index.md @@ -15,7 +15,6 @@ topics: children: - /excluding-folders-and-files-from-secret-scanning - /non-provider-patterns - - /generic-secret-detection - /custom-patterns - /delegated-bypass-for-push-protection --- diff --git a/content/code-security/securing-your-organization/enabling-security-features-in-your-organization/configuring-global-security-settings-for-your-organization.md b/content/code-security/securing-your-organization/enabling-security-features-in-your-organization/configuring-global-security-settings-for-your-organization.md index 3e35cee8b9d0..c5e14e273f17 100644 --- a/content/code-security/securing-your-organization/enabling-security-features-in-your-organization/configuring-global-security-settings-for-your-organization.md +++ b/content/code-security/securing-your-organization/enabling-security-features-in-your-organization/configuring-global-security-settings-for-your-organization.md @@ -70,7 +70,8 @@ To update private dependencies of repositories in your organization, {% data var You can customize several {% data variables.product.prodname_global_settings %} for {% data variables.product.prodname_code_scanning %}: * [Recommending the extended query suite for default setup](#recommending-the-extended-query-suite-for-default-setup){% ifversion code-scanning-autofix %} -* [Enabling {% data variables.product.prodname_copilot_autofix_short %} for {% data variables.product.prodname_codeql %}](#enabling-copilot-autofix-for-codeql) {% endif %} +* [Enabling {% data variables.product.prodname_copilot_autofix_short %} for {% data variables.product.prodname_codeql %}](#enabling-copilot-autofix-for-codeql) +* [Enabling {% data variables.product.prodname_copilot_autofix_short %} for third-party {% data variables.product.prodname_code_scanning %} tools](#enabling-copilot-autofix-for-third-party-code-scanning-tools) {% endif %} * [Setting a failure threshold for {% data variables.product.prodname_code_scanning %} checks in pull requests](#setting-a-failure-threshold-for-code-scanning-checks-in-pull-requests) ### Recommending the extended query suite for default setup @@ -83,6 +84,13 @@ You can customize several {% data variables.product.prodname_global_settings %} You can select **{% data variables.product.prodname_copilot_autofix_short %}** to enable {% data variables.product.prodname_copilot_autofix_short %} for all the repositories in your organization that use {% data variables.product.prodname_codeql %} default setup or {% data variables.product.prodname_codeql %} advanced setup. {% data variables.product.prodname_copilot_autofix_short %} is an expansion of {% data variables.product.prodname_code_scanning %} that suggests fixes for {% data variables.product.prodname_code_scanning %} alerts. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." +### Enabling {% data variables.product.prodname_copilot_autofix_short %} for third-party {% data variables.product.prodname_code_scanning %} tools + +>[!NOTE] +> Third-party {% data variables.product.prodname_code_scanning %} tool support is in {% data variables.release-phases.public_preview %}, and subject to change. Currently, the third-party tool ESLint is supported. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." + +You can select **{% data variables.product.prodname_copilot_autofix_short %} for third-party tools** to enable {% data variables.product.prodname_copilot_autofix_short %} for all the repositories in your organization that use third-party tools. {% data variables.product.prodname_copilot_autofix_short %} is an expansion of {% data variables.product.prodname_code_scanning %} that suggests fixes for {% data variables.product.prodname_code_scanning %} alerts. + {% endif %} ### Setting a failure threshold for {% data variables.product.prodname_code_scanning %} checks in pull requests @@ -97,7 +105,7 @@ You can customize several {% data variables.product.prodname_global_settings %} {% ifversion ghes < 3.15 %} * [Scanning for non-provider patterns](#scanning-for-non-provider-patterns){% endif %}{% ifversion secret-scanning-ai-generic-secret-detection %} -* [Generic secret detection](#generic-secret-detection){% endif %} +* [Generic secret detection with {% data variables.secret-scanning.copilot-secret-scanning %}](#generic-secret-detection-with-copilot-secret-scanning){% endif %} * [Adding a resource link for blocked commits](#adding-a-resource-link-for-blocked-commits){% ifversion ghec or ghes %} * [Defining custom patterns](#defining-custom-patterns){% endif %} @@ -113,11 +121,11 @@ You can choose to scan for non-provider patterns, such as private keys, to detec {% ifversion secret-scanning-ai-generic-secret-detection %} -### Generic secret detection +### {% data variables.secret-scanning.generic-secret-detection-caps %} with {% data variables.secret-scanning.copilot-secret-scanning %} -Generic secret detection is an AI-powered expansion of {% data variables.product.prodname_secret_scanning %} that scans and creates alerts for unstructured secrets, such as passwords. To enable these scans, select **Use AI detection to find additional secrets**. Be aware that generic secrets often have a higher rate of false positives than other types of alert. To learn more about generic secrets, see "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/generic-secret-detection/responsible-ai-generic-secrets)." +{% data variables.secret-scanning.copilot-secret-scanning %}'s {% data variables.secret-scanning.generic-secret-detection %} is an AI-powered expansion of {% data variables.product.prodname_secret_scanning %} that scans and creates alerts for unstructured secrets, such as passwords. To enable these scans, select **Scan for generic secrets**. Be aware that generic secrets often have a higher rate of false positives than other types of alert. To learn more about generic secrets, see "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets)." -{% data reusables.secret-scanning.generic-secret-detection-ai %} +{% data reusables.secret-scanning.copilot-secret-scanning-generic-secrets-subscription-note %} {% endif %} diff --git a/content/code-security/security-overview/viewing-security-insights.md b/content/code-security/security-overview/viewing-security-insights.md index dbcadacf9f44..062b9d949bd9 100644 --- a/content/code-security/security-overview/viewing-security-insights.md +++ b/content/code-security/security-overview/viewing-security-insights.md @@ -203,7 +203,7 @@ The "Vulnerabilities fixed in pull requests" metric shows the count of pull requ {% data variables.product.prodname_copilot_autofix %} for {% data variables.product.prodname_code_scanning %} is an expansion of {% data variables.product.prodname_code_scanning %} that provides you with targeted recommendations to help you fix {% data variables.product.prodname_code_scanning %} alerts. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." -The "Pull request alerts fixed with autofix suggestions" metric shows the ratio of accepted {% data variables.product.prodname_copilot_autofix_short %} suggestions to the total number of {% data variables.product.prodname_copilot_autofix_short %} suggestions on pull request alerts detected by {% data variables.product.prodname_codeql %}. +The "Pull request alerts fixed with autofix suggestions" metric shows the ratio of accepted {% data variables.product.prodname_copilot_autofix_short %} suggestions to the total number of {% data variables.product.prodname_copilot_autofix_short %} suggestions on pull request alerts detected by {% data variables.product.prodname_code_scanning %}. {% endif %} @@ -283,7 +283,7 @@ Alerts that are reopened and re-closed during the chosen time period are ignored ### {% data variables.product.prodname_copilot_autofix_short %} suggestions -{% data variables.product.prodname_copilot_autofix %} is an expansion of {% data variables.product.prodname_code_scanning %} that provides you with targeted recommendations to help you fix {% data variables.product.prodname_code_scanning %} alerts. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." +{% data variables.product.prodname_copilot_autofix %} is an expansion of {% data variables.product.prodname_code_scanning %} that provides you with targeted recommendations to help you fix {% data variables.product.prodname_code_scanning %} alerts (including {% data variables.product.prodname_codeql %} alerts). For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)." The "{% data variables.product.prodname_copilot_autofix_short %} suggestions" metric is the total number of {% data variables.product.prodname_copilot_autofix_short %} suggestions generated in open and closed pull requests during the chosen time period. diff --git a/content/contributing/style-guide-and-content-model/style-guide.md b/content/contributing/style-guide-and-content-model/style-guide.md index f6677ef84680..3f2520b5bcc9 100644 --- a/content/contributing/style-guide-and-content-model/style-guide.md +++ b/content/contributing/style-guide-and-content-model/style-guide.md @@ -332,19 +332,22 @@ Note that regardless of the identifier you use (letters, words), footnotes will ## Headers -Headers must adequately describe the content under them. Headers can either follow the guidelines for writing titles or can be written as questions. Use sentence casing for headers. Each header on a page must be unique. +Headers must adequately describe the content under them. Headers can either follow the [guidelines for writing titles](/contributing/style-guide-and-content-model/contents-of-a-github-docs-article#titles) or can be written as questions. Use sentence casing for headers. If an article has headers, the headers must start with an H2 level header. You can use H3 and H4 level headers to further organize content into related groups, but you cannot skip header levels. There must be text content between a header and subheader, such as an introduction. * **Use:** ```markdown ## HEADER (H2) + TEXT ### SUBHEADER (H3) + TEXT #### SUBHEADER (H4) + TEXT ``` @@ -356,10 +359,59 @@ If an article has headers, the headers must start with an H2 level header. You c #### SUBHEADER (H4) ``` -When referring to headers, surround the header name with quotation marks. -* **Use:** Under "User licenses," view your total licenses. +Each header at the same level on a page must be unique. + +* **Use:** + + ```markdown + ## Examples (H2) + + TEXT + + ### Prompts for writing code (H3) + + TEXT + + ### Prompts for writing tests (H3) + + TEXT + ``` + +* **Use:** + + ```markdown + ## Prompts for writing code (H2) + + TEXT + + ### Example (H3) + + TEXT + + ## Prompts for writing tests (H2) + + TEXT + + ### Example (H3) + + TEXT + ``` + +* **Avoid:** + + ```markdown + ## Example prompts (H2) + + TEXT -For more information, see the "[AUTOTITLE](/contributing/style-guide-and-content-model/contents-of-a-github-docs-article)." + ### Example (H3) + + TEXT + + ### Example (H3) + + TEXT + ``` ## Images diff --git a/data/reusables/advanced-security/secret-scanning-add-custom-pattern-details.md b/data/reusables/advanced-security/secret-scanning-add-custom-pattern-details.md index 8fb34723f3e0..82e5c7999e08 100644 --- a/data/reusables/advanced-security/secret-scanning-add-custom-pattern-details.md +++ b/data/reusables/advanced-security/secret-scanning-add-custom-pattern-details.md @@ -1,6 +1,6 @@ 1. Enter the details for your new custom pattern. You must at least provide the name for your pattern, and a regular expression for the format of your secret pattern. 1. In the "Pattern name" field, type a name for your pattern. - 1. In the "Secret format" field, type a regular expression for the format of your secret pattern.{% ifversion secret-scanning-custom-pattern-ai-generated %} Alternatively, you can use the generator to generate a regular expression for you. For more information, see "[AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/custom-patterns/generating-regular-expressions-for-custom-patterns-with-ai)."{% endif %} + 1. In the "Secret format" field, type a regular expression for the format of your secret pattern.{% ifversion secret-scanning-custom-pattern-ai-generated %} Alternatively, you can use the generator to generate a regular expression for you. For more information, see "[AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/generating-regular-expressions-for-custom-patterns-with-ai)."{% endif %} 1. You can click **More options {% octicon "chevron-down" aria-label="down" %}** to provide other surrounding content or additional match requirements for the secret format. 1. Provide a sample test string to make sure your configuration is matching the patterns you expect. diff --git a/data/reusables/rai/code-scanning/autofix-note.md b/data/reusables/rai/code-scanning/autofix-note.md index 7da858dcc0a7..f97fe439c02a 100644 --- a/data/reusables/rai/code-scanning/autofix-note.md +++ b/data/reusables/rai/code-scanning/autofix-note.md @@ -1,6 +1,6 @@ {% ifversion code-scanning-autofix or fpt %} > [!NOTE] -> {% data variables.product.prodname_copilot_autofix %} is restricted to alerts identified by {% data variables.product.prodname_codeql %} for private and internal repositories. If you have an enterprise account and use {% data variables.product.prodname_GH_advanced_security %}, your enterprise has access to {% data variables.product.prodname_copilot_autofix_short %}. +> {% data variables.product.prodname_copilot_autofix %} is restricted to alerts identified by {% data variables.product.prodname_code_scanning %} for private and internal repositories, including {% data variables.product.prodname_codeql %} alerts. If you have an enterprise account and use {% data variables.product.prodname_GH_advanced_security %}, your enterprise has access to {% data variables.product.prodname_copilot_autofix_short %}. {% endif %} diff --git a/data/reusables/rai/secret-scanning/copilot-secret-scanning-expression-generator-subscription-note.md b/data/reusables/rai/secret-scanning/copilot-secret-scanning-expression-generator-subscription-note.md new file mode 100644 index 000000000000..6ba1c7af141d --- /dev/null +++ b/data/reusables/rai/secret-scanning/copilot-secret-scanning-expression-generator-subscription-note.md @@ -0,0 +1,6 @@ +{% ifversion secret-scanning-custom-pattern-ai-generated %} + +> [!NOTE] +> You do not need a subscription to {% data variables.product.prodname_copilot %} to use {% data variables.secret-scanning.copilot-secret-scanning %}'s {% data variables.secret-scanning.custom-pattern-regular-expression-generator %}. {% data variables.secret-scanning.copilot-secret-scanning %} features are available to private repositories in {% data variables.product.prodname_ghe_cloud %} enterprises that have a license for {% data variables.product.prodname_GH_advanced_security %}. + +{% endif %} diff --git a/data/reusables/rai/secret-scanning/copilot-secret-scanning-generic-secrets-subscription-note.md b/data/reusables/rai/secret-scanning/copilot-secret-scanning-generic-secrets-subscription-note.md new file mode 100644 index 000000000000..6a1a04226bc1 --- /dev/null +++ b/data/reusables/rai/secret-scanning/copilot-secret-scanning-generic-secrets-subscription-note.md @@ -0,0 +1,6 @@ +{% ifversion secret-scanning-ai-generic-secret-detection %} + +> [!NOTE] +> You do not need a subscription to {% data variables.product.prodname_copilot %} to use {% data variables.secret-scanning.copilot-secret-scanning %}'s {% data variables.secret-scanning.generic-secret-detection %}. {% data variables.secret-scanning.copilot-secret-scanning %} features are available to private repositories in {% data variables.product.prodname_ghe_cloud %} enterprises that have a license for {% data variables.product.prodname_GH_advanced_security %}. + +{% endif %} diff --git a/data/reusables/rai/secret-scanning/generic-secret-detection-ai.md b/data/reusables/rai/secret-scanning/generic-secret-detection-ai.md index d6f62c34cb28..e69de29bb2d1 100644 --- a/data/reusables/rai/secret-scanning/generic-secret-detection-ai.md +++ b/data/reusables/rai/secret-scanning/generic-secret-detection-ai.md @@ -1,10 +0,0 @@ - -{% note %} - -**Note:** {% ifversion secret-scanning-ai-generic-secret-detection %} -Generic secret detection for {% data variables.product.prodname_secret_scanning %} is in {% data variables.release-phases.public_preview %}. Functionality and documentation are subject to change. During this phase, generic secret detection is limited to looking for passwords in source code. -{% elsif fpt %} -Generic secret detection for {% data variables.product.prodname_secret_scanning %} is in {% data variables.release-phases.public_preview %}. Functionality and documentation are subject to change. The feature is available for enterprise accounts that use {% data variables.product.prodname_GH_advanced_security %} on {% data variables.product.prodname_ghe_cloud %}. -{% endif %} - -{% endnote %} diff --git a/data/reusables/rai/secret-scanning/generic-secret-detection-policy-note.md b/data/reusables/rai/secret-scanning/generic-secret-detection-policy-note.md new file mode 100644 index 000000000000..513e1b31b6d7 --- /dev/null +++ b/data/reusables/rai/secret-scanning/generic-secret-detection-policy-note.md @@ -0,0 +1 @@ +To use {% data variables.secret-scanning.generic-secret-detection %}, an enterprise owner must first set a policy at the enterprise level that controls whether the feature can be enabled and disabled for repositories in an organization. This policy is set to "allowed" by default. diff --git a/data/reusables/secret-scanning/copilot-secret-scanning-expression-generator-subscription-note.md b/data/reusables/secret-scanning/copilot-secret-scanning-expression-generator-subscription-note.md new file mode 100644 index 000000000000..00ed525f3b2d --- /dev/null +++ b/data/reusables/secret-scanning/copilot-secret-scanning-expression-generator-subscription-note.md @@ -0,0 +1,6 @@ +{% ifversion secret-scanning-custom-pattern-ai-generated %} + +> [!NOTE] +> You do not need a subscription to {% data variables.product.prodname_copilot %} to use {% data variables.secret-scanning.copilot-secret-scanning %}'s {% data variables.secret-scanning.custom-pattern-regular-expression-generator %}. {% data variables.secret-scanning.copilot-secret-scanning %} features are available to private repositories in {% data variables.product.prodname_ghe_cloud %} enterprises with {% data variables.product.prodname_GH_advanced_security %} enabled. + +{% endif %} diff --git a/data/reusables/secret-scanning/copilot-secret-scanning-generic-secrets-subscription-note.md b/data/reusables/secret-scanning/copilot-secret-scanning-generic-secrets-subscription-note.md new file mode 100644 index 000000000000..1db50282c21e --- /dev/null +++ b/data/reusables/secret-scanning/copilot-secret-scanning-generic-secrets-subscription-note.md @@ -0,0 +1,6 @@ +{% ifversion secret-scanning-ai-generic-secret-detection %} + +> [!NOTE] +> You do not need a subscription to {% data variables.product.prodname_copilot %} to use {% data variables.secret-scanning.copilot-secret-scanning %}'s {% data variables.secret-scanning.generic-secret-detection %}. {% data variables.secret-scanning.copilot-secret-scanning %} features are available to private repositories in {% data variables.product.prodname_ghe_cloud %} enterprises that have {% data variables.product.prodname_GH_advanced_security %} enabled. + +{% endif %} diff --git a/data/reusables/secret-scanning/generic-secret-detection-ai.md b/data/reusables/secret-scanning/generic-secret-detection-ai.md deleted file mode 100644 index 460b8d76bee9..000000000000 --- a/data/reusables/secret-scanning/generic-secret-detection-ai.md +++ /dev/null @@ -1,10 +0,0 @@ - -{% note %} - -**Note:** {% ifversion secret-scanning-ai-generic-secret-detection %} -Generic secret detection for {% data variables.product.prodname_secret_scanning %} is in {% data variables.release-phases.public_preview %}. Functionality and documentation are subject to change. During this phase, generic secret detection is limited to looking for passwords in source code. -{% elsif fpt %} -Generic secret detection for {% data variables.product.prodname_secret_scanning %} is in {% data variables.release-phases.public_preview %}. Functionality and documentation are subject to change. The feature is available for enterprise accounts that use {% data variables.product.prodname_GH_advanced_security %} on {% data variables.product.prodname_ghe_cloud %}. -{% endif %} - -{% endnote %} diff --git a/data/reusables/secret-scanning/generic-secret-detection-policy-note.md b/data/reusables/secret-scanning/generic-secret-detection-policy-note.md new file mode 100644 index 000000000000..513e1b31b6d7 --- /dev/null +++ b/data/reusables/secret-scanning/generic-secret-detection-policy-note.md @@ -0,0 +1 @@ +To use {% data variables.secret-scanning.generic-secret-detection %}, an enterprise owner must first set a policy at the enterprise level that controls whether the feature can be enabled and disabled for repositories in an organization. This policy is set to "allowed" by default. diff --git a/data/variables/code-scanning.yml b/data/variables/code-scanning.yml index 0a8faa5e6c69..071be0285b00 100644 --- a/data/variables/code-scanning.yml +++ b/data/variables/code-scanning.yml @@ -19,4 +19,4 @@ codeql_model_packs_support: '{% ifversion fpt or ghec or ghes > 3.14 %}C#, Java/ code_scanning_threat_model_support: 'Java/Kotlin{% ifversion fpt or ghec or ghes > 3.12 %} and C#{% endif %}' # List of languages that Copilot Autofix Agent supports -code_scanning_autofix_languages: ' C#, C/C++, Go, Java/Kotlin, Swift, JavaScript/TypeScript, Python, and Ruby' +codeql_autofix_languages: ' C#, C/C++, Go, Java/Kotlin, Swift, JavaScript/TypeScript, Python, and Ruby' diff --git a/data/variables/secret-scanning.yml b/data/variables/secret-scanning.yml index 76576d8161df..c58fea818881 100644 --- a/data/variables/secret-scanning.yml +++ b/data/variables/secret-scanning.yml @@ -9,3 +9,7 @@ user_alerts_caps: >- alerts: 'secret scanning alerts' alerts_caps: 'Secret scanning alerts' custom-pattern-regular-expression-generator: 'regular expression generator' +custom-pattern-regular-expression-generator-caps: 'Regular expression generator' +copilot-secret-scanning: 'Copilot secret scanning' +generic-secret-detection: 'generic secret detection' +generic-secret-detection-caps: 'Generic secret detection'