Repo sync

.github/instructions/all.instructions.md

@@ -6,6 +6,12 @@ applyTo: "**"
 
 This repository powers the GitHub Docs site (docs.github.com). It contains both the Next.js application code (TypeScript) and the documentation content (Markdown).
 
+## Choosing the pull request repository
+
+- For work by GitHub employees, create pull requests in `github/docs-internal` by default, even if the current clone or `origin` remote points to `github/docs`. Use `github/docs` only when the contribution is intentionally public, such as when collaborating with an external contributor or customer.
+- Treat work originating from an internal repository, issue, pull request, or discussion as internal.
+- Before pushing a branch or creating a pull request, verify the destination repository explicitly instead of inferring it from the current Git remote. If the intended destination is unclear, ask the user.
+
 ## Creating a pull request
 
 When you create a pull request:

content/actions/how-tos/manage-workflow-runs/remove-workflow-artifacts.md

@@ -36,7 +36,7 @@ contentType: how-tos
 
 ## Setting the retention period for an artifact
 
-Retention periods for artifacts and logs can be configured at the repository, organization, and enterprise level. For more information, see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-artifact-and-log-retention-period-for-a-repository) and [AUTOTITLE](/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization).
+Retention periods for artifacts and logs can be configured at the repository, organization, and enterprise level. For more information, see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-check-workflow-run-status-artifact-and-log-retention-period-for-a-repository) and [AUTOTITLE](/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization).
 
 You can also define a custom retention period for individual artifacts using the `actions/upload-artifact` action in a workflow. For more information, see [AUTOTITLE](/actions/tutorials/store-and-share-data#configuring-a-custom-artifact-retention-period).
 

content/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence.md

@@ -0,0 +1,52 @@
+---
+title: Configuring Proof of Presence
+shortTitle: Proof of Presence
+intro: 'Reduce the risk from compromised sessions by requiring people to reauthenticate with your identity provider before they perform high-impact actions in your enterprise.'
+product: 'Enterprise accounts on {% data variables.product.prodname_ghe_cloud %}'
+versions:
+  feature: proof-of-presence
+contentType: concepts
+---
+
+{% data reusables.public-preview.public-preview %}
+
+## About Proof of Presence
+
+Proof of Presence (PoP) adds an identity-provider challenge to sudo mode for enterprises. When a member attempts a protected high-impact action, {% data variables.product.github %} requires the member to reauthenticate through the enterprise's configured identity provider (IdP) before the action can proceed.
+
+PoP uses the same session and timeout model as sudo mode, and the same protected actions that trigger sudo mode will trigger a PoP challenge. After a member successfully reauthenticates, the member can perform protected actions until the sudo-mode session expires. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/sudo-mode).
+
+PoP can help you reduce the impact of a compromised session and meet compliance requirements for fresh authentication before sensitive operations. Before enabling PoP, make sure your IdP authentication policies provide the level of assurance that you require.
+
+## Supported identity providers
+
+{% data reusables.enterprise-accounts.proof-of-presence-supported-idps %}
+
+## What members experience
+
+When a member of your enterprise attempts a protected action and needs to reauthenticate, {% data variables.product.github %} redirects the member to the enterprise's IdP. The member follows the IdP prompts, including any required multi-factor authentication, then returns to {% data variables.product.github %} to complete the action.
+
+If a member cannot complete the challenge, they should contact the enterprise administrator or IdP administrator who manages authentication for the enterprise.
+
+## Prerequisites
+
+Before you use PoP, configure SSO between your enterprise and a supported IdP. The configuration depends on your account and deployment type:
+
+* For an enterprise that uses personal accounts, see [AUTOTITLE](/admin/managing-iam/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise).
+{% ifversion ghec %}
+* For an enterprise that uses {% data variables.product.prodname_emus %}, see [AUTOTITLE](/admin/managing-iam/understanding-iam-for-enterprises/getting-started-with-enterprise-managed-users#configure-authentication).
+{% endif %}
+
+## Enabling Proof of Presence
+
+When you enable Proof of Presence, this policy will apply across your enterprise.
+
+{% data reusables.enterprise-accounts.access-enterprise %}
+{% data reusables.enterprise-accounts.settings-tab %}
+1. Under {% octicon "gear" aria-hidden="true" aria-label="gear" %} **Settings**, click **Authentication security**.
+1. From the **Proof of presence** dropdown menu, select an authentication requirement.
+
+  Both options require the member to complete an authentication challenge through your IdP.
+
+  * **Re-authentication**: Requires the member to authenticate again. Depending on your enterprise's authentication policy, the member may be able to satisfy the challenge with password-based authentication.
+  * **MFA**: Requires the member to authenticate again and satisfy an additional multi-factor authentication challenge, such as using an authenticator app or biometric scan, as configured by your enterprise.

content/admin/configuring-settings/hardening-security-for-your-enterprise/index.md

@@ -6,6 +6,7 @@ versions:
   ghec: '*'
   ghes: '*'
 children:
+  - /configuring-proof-of-presence
   - /configuring-tls
   - /configuring-tls-and-ssh-ciphers
   - /troubleshooting-tls-errors

content/admin/managing-iam/configuring-authentication-for-enterprise-managed-users/configuring-oidc-for-enterprise-managed-users.md

@@ -65,3 +65,7 @@ After you enable OIDC SSO, enable provisioning. See [AUTOTITLE](/admin/managing-
 You can use the role of guest collaborator to grant limited access to vendors and contractors in your enterprise. Unlike enterprise members, guest collaborators only have access to internal repositories within organizations where they are a member.
 
 To use guest collaborators with OIDC authentication, you may need to update your settings in Entra ID. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators).
+
+## Enabling Proof of Presence
+
+After you configure OIDC SSO, your enterprise can use Proof of Presence to require reauthentication through your IdP before high-impact actions. {% data reusables.enterprise-accounts.proof-of-presence-supported-idps %} For more information, see [AUTOTITLE](/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence).

content/admin/managing-iam/configuring-authentication-for-enterprise-managed-users/configuring-saml-single-sign-on-for-enterprise-managed-users.md

@@ -133,3 +133,7 @@ After you enable SAML SSO, enable provisioning. For more information, see [AUTOT
 You can use the role of guest collaborator to grant limited access to vendors and contractors in your enterprise. Unlike enterprise members, guest collaborators only have access to internal repositories within organizations where they are a member.
 
 If you use Entra ID or Okta for SAML authentication, you may need to update your IdP application to use guest collaborators. For more information, see [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/enabling-guest-collaborators).
+
+### Enable Proof of Presence
+
+After you configure SAML SSO, your enterprise can use Proof of Presence to require reauthentication through your IdP before high-impact actions. {% data reusables.enterprise-accounts.proof-of-presence-supported-idps %} For more information, see [AUTOTITLE](/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence).

content/admin/managing-iam/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise.md

@@ -148,6 +148,14 @@ You can enable or disable SAML authentication for {% data variables.location.pro
 
 {% endif %}
 
+{% ifversion proof-of-presence %}
+
+## Enabling Proof of Presence
+
+After you configure SAML SSO, your enterprise can use Proof of Presence to require reauthentication through your IdP before high-impact actions. {% data reusables.enterprise-accounts.proof-of-presence-supported-idps %} For more information, see [AUTOTITLE](/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence).
+
+{% endif %}
+
 ## Further reading
 
 {%- ifversion ghec %}

content/authentication/keeping-your-account-and-data-secure/sudo-mode.md

@@ -1,6 +1,6 @@
 ---
 title: Sudo mode
-intro: 'To confirm access to your account before you perform a potentially sensitive action, {% data variables.location.product_location %} prompts for authentication.'
+intro: 'To confirm access to your account before you perform a protected high-impact action, {% data variables.location.product_location %} prompts for authentication.'
 redirect_from:
   - /articles/sudo-mode
   - /github/authenticating-to-github/sudo-mode
@@ -15,12 +15,16 @@ category:
 
 ## About sudo mode
 
-To maintain the security of your account when you perform a potentially sensitive action on {% data variables.location.product_location %}, you must authenticate even though you're already signed in. For example, {% data variables.product.company_short %} considers the following actions sensitive because each action could allow a new person or system to access your account.
+To maintain the security of your account when you perform a protected high-impact action on {% data variables.location.product_location %}, you must authenticate even though you're already signed in. {% data variables.product.company_short %} requires authentication for actions that can affect access to accounts and resources, including but not limited to:
 
-* Modification of an associated email address
-* Authorization of a third-party application
-* Addition of a new SSH key
-* Creation of a PAT or application
+* **Account**: Deleting your user account, modifying an associated email address, adding a new SSH key, or authorizing third-party applications
+* **Developer settings**: Generating or removing a client secret, creating {% data variables.product.pat_generic_plural %}, revoking all tokens, or transferring a {% data variables.product.prodname_oauth_app %}
+* **Webhooks**: Creating, viewing, editing, or deleting repository, organization, or enterprise webhooks; viewing or redelivering webhook deliveries
+* **Organization membership**: Sending or editing organization invitations, adding members directly, adding team members, or changing team roles
+* **Organization security**: Changing two-factor authentication enforcement or other organization security settings
+* **Enterprise settings**: Creating organizations in an enterprise or changing app access settings for an identity provider (IdP) IP allow list
+* **Rulesets**: Creating and modifying rulesets at organization and repository level.
+* **Recovery codes**: Viewing, downloading, printing, or regenerating authentication or SSO recovery codes
 
 After you authenticate to perform a sensitive action, your session is temporarily in "sudo mode." In sudo mode, you can perform sensitive actions without authentication. {% data variables.product.github %} has a two-hour session timeout period before prompting you for authentication again. During this time, any sensitive action that you perform will reset the timer.
 
@@ -37,6 +41,16 @@ After you authenticate to perform a sensitive action, your session is temporaril
 
 {% endif %}
 
+{% ifversion proof-of-presence %}
+
+## Proof of Presence for enterprise actions
+
+Enterprises can extend sudo mode with Proof of Presence (PoP). For protected high-impact actions, PoP requires you to reauthenticate through your enterprise's identity provider before the action can proceed. Follow the identity provider's prompts, including any required multi-factor authentication, then return to {% data variables.product.github %} to complete the action.
+
+{% data reusables.enterprise-accounts.proof-of-presence-supported-idps %} For more information, see [AUTOTITLE](/admin/configuring-settings/hardening-security-for-your-enterprise/configuring-proof-of-presence).
+
+{% endif %}
+
 ## Confirming access for sudo mode
 
 To confirm access for sudo mode, you can authenticate with your password. Optionally, you can use a different authentication method, like a passkey, {% ifversion fpt or ghec %}a security key, {% data variables.product.prodname_mobile %}, or a 2FA code{% elsif ghes %}a security key or a 2FA code{% endif %}.

content/copilot/concepts/agents/code-review.md

@@ -132,10 +132,12 @@ When {% data variables.copilot.copilot_code-review_short %} is enabled for these
 
 By default, {% data variables.product.prodname_copilot_short %} only reviews a pull request if you assign it to the pull request. However, you can configure automatic reviews.
 
-* **Individual users** on the {% data variables.copilot.copilot_pro_short %} or {% data variables.copilot.copilot_pro_plus_short %} plan can configure {% data variables.product.prodname_copilot_short %} to automatically review all pull requests they create.
+* **Users** can configure {% data variables.product.prodname_copilot_short %} to automatically review the pull requests they create. This is available on the {% data variables.copilot.copilot_pro_short %}, {% data variables.copilot.copilot_pro_plus_short %}, and {% data variables.copilot.copilot_max_short %} plans, and with a {% data variables.copilot.copilot_business_short %} or {% data variables.copilot.copilot_enterprise_short %} license. It is not available for {% data variables.enterprise.prodname_managed_users %}.
 * **Repository owners** can configure {% data variables.product.prodname_copilot_short %} to automatically review all pull requests in the repository that are created by people with access to {% data variables.product.prodname_copilot_short %}.
 * **Organization owners** can configure {% data variables.product.prodname_copilot_short %} to automatically review all pull requests in some or all of the repositories in the organization where the pull request is created by a {% data variables.product.prodname_copilot_short %} user.
 
+{% data variables.product.prodname_copilot_short %} evaluates pull requests against two separate configurations: a user's settings and any applicable ruleset. These configurations are not hierarchical; neither inherits from or overrides the other. A pull request is reviewed automatically when at least one configuration is enabled. If both configurations are enabled on a pull request, {% data variables.product.prodname_copilot_short %} still posts only one review.
+
 If your organization has enabled {% data variables.copilot.copilot_code-review_short %} without a {% data variables.product.prodname_copilot_short %} license, automatic reviews also apply to pull requests created by organization members without a license. This applies to repositories covered by a policy where automatic reviews are enabled. For more information, see [{% data variables.copilot.copilot_code-review_short %} without a {% data variables.product.prodname_copilot_short %} license](#copilot-code-review-without-a-copilot-license).
 
 
@@ -151,24 +153,37 @@ The triggers for automatic code review depend on the configuration settings.
 * Review draft pull requests:
   * Pull requests are automatically reviewed while they are still drafts, before you switch them to "Open".
 
+When a pull request qualifies for automatic review, **Review new pushes** and **Review draft pull requests** apply if either the author's settings or an applicable ruleset turns them on. You cannot use your own settings to turn off push or draft reviews that a ruleset has turned on.
+
 For full instructions, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review).
 
 > [!NOTE]
 > Unless {% data variables.product.prodname_copilot_short %} has been configured to review each push to a pull request, it will only review a pull request once. If you make changes to the pull request after it has been automatically reviewed and you want {% data variables.product.prodname_copilot_short %} to re-review it, you can request this manually. Click the {% octicon "sync" aria-label="Re-request review" %} button next to {% data variables.product.prodname_copilot_short %}'s name in the **Reviewers** menu.
 
 ## Review effort level
 
-{% data variables.copilot.copilot_code-review_short %} supports multiple review effort levels, so you can choose the level of thoroughness that matches the criticality of your code.
+{% data variables.copilot.copilot_code-review_short %} supports multiple {% data variables.product.prodname_copilot_short %} review effort levels, so you can choose the level of thoroughness that matches the criticality of your code.
 
 * **Lite**: Standard review. Provides fast, targeted feedback on common issues such as bugs, security vulnerabilities, and style inconsistencies (default).
 * **Balanced**: Routes pull requests to a higher-reasoning model for longer analysis of complex logic, security-sensitive code, and cross-service changes. Balanced reviews use more {% data variables.product.prodname_ai_credits_short %}, and may consume marginally more {% data variables.product.prodname_actions %} minutes, than Lite reviews.
 
 Use Balanced for security-sensitive code, multi-service pull requests, or repositories with strict quality standards. Use Lite for routine changes where fast feedback is more important than exhaustive analysis.
 
-You can select the review effort level when requesting a review in the pull request, under the **Reviewers** section where {% data variables.product.prodname_copilot_short %} appears as a reviewer. Organization owners can set a default review effort level for automatic code reviews in their organization. Repository administrators can override the organization default for a specific repository.
+You can select {% data variables.product.prodname_copilot_short %} review effort when requesting a review in the pull request, under the **Reviewers** section where {% data variables.product.prodname_copilot_short %} appears as a reviewer. You can also set a default {% data variables.product.prodname_copilot_short %} review effort in your {% data variables.copilot.copilot_code-review_short %} settings. Organization owners can set a default {% data variables.product.prodname_copilot_short %} review effort for automatic code reviews in their organization. Repository administrators can override the organization default for a specific repository.
+
+When {% data variables.product.prodname_copilot_short %} determines which review effort to use, it checks the following options in order and uses the first one that applies:
+
+1. A {% data variables.product.prodname_copilot_short %} review effort chosen when the review is requested
+1. A {% data variables.product.prodname_copilot_short %} review effort previously used on this pull request
+1. The requestor's {% data variables.product.prodname_copilot_short %} review effort. For a new pull request, the requestor is the author. When someone marks a draft ready for review, that person is the requestor.
+1. A {% data variables.product.prodname_copilot_short %} review effort set for the repository
+1. A {% data variables.product.prodname_copilot_short %} review effort set for the organization, or the repository owner's {% data variables.product.prodname_copilot_short %} review effort on a user-owned repository
+1. {% data variables.product.github %}'s built-in default, which is Lite. Some owners have Balanced as the built-in default.
 
 After {% data variables.copilot.copilot_code-review_short %} reviews a pull request, the pull request overview comment shows the effort level used for each review run.
 
+For configuration steps, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review).
+
 ## {% data variables.product.prodname_copilot_short %} approvals
 
 > [!NOTE]