GitHub AE release notes

Enterprise owners can join organizations on GitHub AE as a member or owner from the enterprise account's Organizations page. For more information, see "Managing your role in an organization owned by your enterprise."

Custom repository roles are generally available. With custom repository roles, organization owners now have more granular control over the repository access permissions they can grant to users. Custom repository roles are also fully supported by the REST API. For more information, see "Managing custom repository roles for an organization" and "Organizations" in the REST API documentation.

Enterprise owners can prevent organization owners from inviting collaborators to GitHub AE repositories. For more information, see "Enforcing a policy for inviting collaborators to repositories."

Users can opt to receive a webhook event that triggers when someone enables or disables a code security or analysis feature for an organization or repository. For more information, see the following documentation.

• "Webhook events and payloads" in the webhook documentation
• "Managing security and analysis settings for your organization"
• "Managing security and analysis features for your repository"

Enterprise owners and users can view secret scanning alerts and bypasses of secret scanning's push protection in the enterprise and organization audit logs, and via the REST API. For more information, see the following documentation.

• "Protecting pushes with secret scanning"
• "Audit log events for your enterprise"
• "Reviewing the audit log for your organization"
• "Secret Scanning" in the REST API documentation

Organization owners can now configure two new permissions for secret scanning when managing custom repository roles.

• View secret scanning results
• Dismiss or reopen secret scanning results

For more information, see "Managing custom repository roles for an organization."

Users can execute a dry run of custom secret scanning patterns at the enterprise, organization, or repository level, depending on their access. Dry runs allow users to review and hone their patterns before publishing them and generating alerts. You can compose a pattern, then use Save and dry run to retrieve results. The scans typically take just a few seconds, but GitHub AE will also notify users via email when dry run results are ready. For more information, see "About secret scanning" and "Defining custom patterns for secret scanning."

Users can enable secret scanning for archived repositories using the UI or API. For more information, see "About secret scanning," "About archived repositories," and "Repositories" in the REST API documentation.

Secret scanning prevents the leak of secrets in the web editor. For more information, see "Protecting pushes with secret scanning."

Code scanning now detects a larger number of CWEs, and CodeQL code scanning fully supports the standard language features in the following language releases.

• C# 10 / .NET 6
• Python 3.10
• Java 17
• TypeScript 4.5

For more information, see the GitHub Blog.

Organization owners and security managers can view code scanning alerts in an organization's Security tab. For more information, see "About the security overview."

The code scanning alert page now always shows the alert status and information for the default branch. There is a new "Affected branches" panel in the sidebar where you can see the status of the alert in other branches. If the alert does not exist in your default branch, the alert page will show the status as "In branch" or "In pull request" for the location where the alert was last seen. This improvement makes it easier to understand the status of alerts which have been introduced into the code base. For more information, see "About code scanning alerts." The alert list page is not changed and can be filtered by branch. You can use the code scanning API to retrieve more detailed branch information for alerts. For more information, see "Code Scanning" in the REST API documentation.

Code scanning now shows the details of the analysis origin of an alert. If an alert has more than one analysis origin, it is shown in the "Affected branches" sidebar and in the alert timeline. Users can hover over the analysis origin icon in the "Affected branches" sidebar to see the alert status in each analysis origin. If an alert only has a single analysis origin, no information about analysis origins is displayed on the alert page. These improvements will make it easier to understand alerts. In particular, it will help users understand those that have multiple analysis origins. This is especially useful for setups with multiple analysis configurations, such as monorepos. For more information, see "About code scanning alerts."

Users can use sort and direction parameters in the REST API when retrieving secret scanning alerts, and sort based on the alert’s created or updated fields. The new parameters are available for all of your GitHub AE deployment, or for individual organizations or repositories. For more information, see the following documentation.

• "List secret scanning alerts for an enterprise"
• "List secret scanning alerts for an organization"
• "List secret scanning alerts for a repository"
• "Secret Scanning" in the REST API documentation

Users can opt to receive a webhook that triggers when a secret is detected in a new location. The secret_scanning_alert_location webhook event includes location details, like the commit SHA, and the associated alert for the detection. A location is created for every new file path containing the detected secret. For more information, see "Webhook events and payloads."

Users can optionally add a comment when dismissing a code scanning alert in the web UI or via the REST API. Dismissal comments appear in the event timeline. Users can also add or retrieve a dismissal comment via the REST API. For more information, see "Triaging code scanning alerts in pull requests" and "Code Scanning" in the REST API documentation.

Users can now retrieve code scanning alerts for an organization using the REST API. This new API endpoint supplements the existing endpoint for repositories. For more information, see "Code Scanning" in the REST API documentation.

The contents of the github/codeql-go repository have moved to the github/codeql repository, to live alongside similar libraries for all other programming languages supported by CodeQL. The open-source CodeQL queries, libraries, and extractor for analyzing codebases written in the Go programming language with GitHub's CodeQL code analysis tools can now be found in the new location. For more information, including guidance on migrating your existing workflows, see github/codeql-go#741.

Enterprise owners can see an overview of Dependabot alerts across the GitHub AE deployment, including a repository-centric view of application security risks, and an alert-centric view of all secret scanning and Dependabot alerts. The views are in beta and subject to change. For more information, see "Viewing the security overview."

Organization owners and security managers can view Dependabot alerts in an organization's Security tab. For more information, see "About the security overview."

Users can reopen a dismissed Dependabot alert using the web UI. This does not affect Dependabot pull requests or the GraphQL API. For more information, see "About Dependabot alerts."

Users can view fixed alerts from Dependabot with the GraphQL API. Users can also access and filter by state, as well as by unique numeric identifier, and filter by state on the vulnerability alert object. The following fields now exist for a RepositoryVulnerabilityAlert.

• number
• fixed_at
• fix_reason
• state

For more information, see "Objects" in the GraphQL API documentation.

Organization owners and security managers can use the security overview for an organization to view a repository-centric view of application security risks, or an alert-centric view of all code scanning, Dependabot, and secret scanning alerts for all repositories in an organization. For more information, see "About the security overview."

GitHub Actions can enforce dependency reviews on users' pull requests by scanning for dependencies, and will warn users about associated security vulnerabilities. The dependency-review-action action is supported by a new API endpoint that diffs the dependencies between any two revisions. For more information, see "About dependency review."

The dependency graph detects YAML files for GitHub Actions workflows. GitHub AE will display the workflow files within the Insights tab's dependency graph section. Repositories that publish actions will also be able to see the number of repositories that depend on that action from the "Used By" control on the repository homepage. For more information, see "About the dependency graph."

The dependency graph detects Cargo.toml and Cargo.lock files for Rust. These files will be displayed in the Dependency graph section of the Insights tab. Users will receive Dependabot alerts and updates for vulnerabilities associated with their Rust dependencies. Package metadata, including mapping packages to repositories, will be added at a later date. For more information, see "About the dependency graph."

If GitHub Connect is enabled for GitHub AE, users can contribute an improvement to a security advisory in the GitHub Advisory Database. To contribute, click Suggest improvements for this vulnerability while viewing an advisory's details. For more information, see the following articles.

• "Managing GitHub Connect"
• "Browsing security vulnerabilities in the GitHub Advisory Database" in the GitHub Enterprise Cloud documentation
• "About GitHub Security Advisories for repositories" in the GitHub Enterprise Cloud documentation
• "Editing security advisories in the GitHub Advisory Database" in the GitHub Enterprise Cloud documentation

People who maintain self-hosted runners now have more control over when the runners perform software updates. If you specify the --disableupdate flag to the runner, the runner will not try to perform an automatic software update if a newer version of the runner software is available. This allows updates to the self-hosted runner on a custom schedule, and is especially convenient if a self-hosted runner is in a container. For compatibility with the GitHub Actions service, runner software must be updated within 30 days of a new runner version being available. For more information about installation of the latest runner version, see the installation instructions for the latest release in actions/runner.

When using GitHub Actions, to reduce the risk of merging a change that was not reviewed by another person into a protected branch, enterprise owners and repository administrators can prevent Actions from creating pull requests. Organization owners could previously enable this restriction. For more information, see the following articles.

• "Enforcing policies for GitHub Actions in your enterprise"
• "Disabling or limiting GitHub Actions for your organization"
• "Managing GitHub Actions settings for a repository"

Organization owners can increase the security of CI/CD workflows on self-hosted runners by choosing which workflows can access a runner group. Previously, any workflow in a repository, such as an issue labeler, could access the self-hosted runners available to an organization. For more information, see "Managing access to self-hosted runners using groups" and the GitHub Blog.

Organization owners can control whether GitHub Actions can approve pull requests. This feature protects against a user using GitHub Actions to satisfy the "Required approvals" branch protection requirement and merging a change that was not reviewed by another user. To prevent breaking existing workflows, Allow GitHub Actions reviews to count towards required approval is enabled by default. Organization owners can disable the feature in the organization's GitHub Actions settings. For more information, see "Disabling or limiting GitHub Actions for your organization."

Users can write a single workflow triggered by workflow_dispatch and workflow_call, and use the inputs context to access input values. Previously, workflow_dispatch inputs were in the event payload, which increased difficulty for workflow authors who wanted to write one workflow that was both reusable and manually triggered. For workflows triggered by workflow_dispatch, inputs are still available in the github.event.inputs context to maintain compatibility. For more information, see "Contexts."

Users can now re-run only failed jobs or an individual job in a GitHub Actions workflow run. For more information, see "Re-running workflows and jobs."

To summarize the result of a job, users can generate Markdown and publish the contents as a job summary. For example, after running tests with GitHub Actions, a summary can provide an overview of passed, failed, or skipped tests, potentially reducing the need to review the full log output. For more information, see "Workflow commands for GitHub Actions."

To more easily diagnose job execution failures during a workflow re-run, users can enable debug logging, which outputs information about a job's execution and environment. For more information, see "Re-running workflows and jobs" and "Using workflow run logs."

If you manage self-hosted runners for GitHub Actions, you can ensure a consistent state on the runner itself before and after a workflow run by defining scripts to execute. By using scripts, you no longer need to require that users manually incorporate these steps into workflows. Pre- and post-job scripts are in beta and subject to change. For more information, see "Running scripts before or after a job."

Enterprise owners can configure a policy to control whether people's usernames or full names are displayed within internal repositories. For more information, see "Enforcing repository management policies in your enterprise."

Organization owners can pin a repository to an organization's profile directly from the repository via the new Pin repository dropdown.

While creating a fork, users can customize the fork's name. For more information, see "Fork a repo."

Users can delete a branch that's associated with an open pull request. For more information, see "Creating and deleting branches within your repository."

CODEOWNERS has received the following improvements.

• Syntax errors are now surfaced when viewing a CODEOWNERS file from the web UI. Previously, when a line in a CODEOWNERS file had a syntax error, the error would be ignored or in some cases cause the entire CODEOWNERS file to not load. GitHub Apps and Actions can access the same list of errors using new REST and GraphQL APIs. For more information, see "Repositories" in the REST API documentation or "Objects" in the GraphQL API documentation.
• After someone creates a new pull request or pushes new changes to a draft pull request, any code owners that will be requested for review are now listed in the pull request under "Reviewers". This feature gives you an early look at who will be requested to review once the pull request is marked ready for review.
• Comments in CODEOWNERS files can now appear at the end of a line, not just on dedicated lines.

For more information, see "About code owners."

When a user renames or moves a file to a new directory, if at least half of the file's contents are identical, the commit history indicates that the file was renamed, similar to git log --follow. For more information, see the GitHub Blog.

Users can require a successful deployment of a branch before anyone can merge the pull request associated with the branch. For more information, see "About protected branches" and "Managing a branch protection rule."

Repository administrators can now configure tag protection rules to protect a repository's tags. Once protected by a tag protection rule, tags matching a specified name pattern can only be created and deleted by users with maintain or admin access to the repository. For more information, see "Configuring tag protection rules."

Users can ignore revisions in the blame view by creating a .git-blame-ignore-revs file in the root of a repository. For more information, see "Viewing a file."

Users can grant exceptions to GitHub Apps for any branch protection rule that supports exceptions. For more information, see "About apps" and "Managing a branch protection rule."

For public GPG signing keys that are expired or revoked, GitHub AE verifies Git commit signatures and show commits as verified if the user made the commit while the key was still valid. Users can also upload expired or revoked GPG keys. For more information, see "About commit signature verification."

To affirm that a commit complies with the rules and licensing governing a repository, organization owners and repository administrators can now require developers to sign off on commits made through the web interface. For more information, see "Managing the commit signoff policy for your organization" and "Managing the commit signoff policy for your repository."

Using the file tree located in the Files changed tab of a pull request, users can navigate modified files, understand the size and scope of changes, and focus reviews. The file tree appears if a pull request modifies at least two files, and the browser window is sufficiently wide. For more information, see "Reviewing proposed changes in a pull request" and "Filtering files in a pull request."

Users can default to using pull requests titles as the commit message for all squash merges. For more information, see "Configuring commit squashing for pull requests."

The Update branch button on the pull request page lets users update a pull request's branch with the latest changes from the base branch. This is useful for verifying that the pull request's changes are compatible with the current version of the base branch before you merge. Two enhancements provide more ways to keep a branch up to date.

• When a pull request's topic branch is out of date with the base branch, users can update the branch by rebasing on the latest version of the base branch. Rebasing applies the changes from the topic branch onto the latest version of the base branch, resulting in a branch with a linear history since no merge commit is created. To update by rebasing, click the drop-down menu next to the Update Branch button, click Update with rebase, and then click Rebase branch. Previously, Update branch performed a traditional merge that always resulted in a merge commit in your pull request branch. This option is still available, but now users have the choice. For more information, see "Keeping your pull request in sync with the base branch."
• A new repository setting allows the Update branch button to always be available when a pull request's topic branch is not up to date with the base branch. Previously, this button was only available when the Require branches to be up to date before merging branch protection setting was enabled. People with admin or maintainer access can manage the Always suggest updating pull request branches setting from the Pull Requests section in repository settings. For more information, see "Managing suggestions to update pull request branches."

When viewing the details for a particular release, users can see the creation date for each release asset. For more information, see "Viewing your repository's releases and tags."

While creating a release with automatically generated release notes, users can see the tag identified as the previous release, then choose to select a different tag to specify as the previous release. For more information, see "Automatically generated release notes."

Gists now only show the 30 most recent comments when first displayed. Users can click Load earlier comments... to view more. This allows gists that have many comments to appear more quickly. For more information, see "Editing and sharing content with gists."

Editing Markdown in the web interface has been improved.

• After a user selects text and pastes a URL, the selected text will become a Markdown link to the pasted URL.
• When a user pastes spreadsheet cells or HTML tables, the resulting text will render as a table.
• When a user copies text containing links, the pasted text will include the link as a Markdown link.

For more information, see "Basic writing and formatting syntax."

When editing a Markdown file in the web interface, clicking the Preview tab will automatically scroll to the place in the preview that you were editing. The scroll location is based on the position of the cursor before clicking the Preview tab.

A light high-contrast theme, with greater contrast between foreground and background elements, is now available. For more information, see "Managing your theme settings."

Lists of repositories owned by a user or organization now have an additional filter option, "Templates", making it easier to find template repositories.

GitHub AE can display several common image formats, including PNG, JPG, GIF, PSD, and SVG, and provides several ways to compare differences between versions. When reviewing added or changed images in a pull request, previews of those images are now shown by default. Previously, users would see a message indicating that binary files could not be shown, and would need to toggle the "Display rich diff" option. For more information, see "Working with non-code files."

Settings pages for users, organizations, repositories, and teams have been redesigned, grouping similar settings pages into sections for improved information architecture and discoverability. For more information, see the GitHub Changelog.

Interactive elements in the web interface such as links and buttons show a visible outline when focused with a keyboard, to help users find the current position on a page. In addition, when focused, form fields have a higher contrast outline.

Focusing or hovering over a label now displays a tooltip with the label's description.

If a user refreshes the page while creating a new issue or pull request, the assignees, reviewers, labels, and projects will all be preserved.

To use the device authorization flow for OAuth and GitHub Apps, app authors must manually enable the feature. This change reduces the likelihood of apps being used in phishing attacks against GitHub AE users by ensuring integrators are aware of the risks and make a conscious choice to support this form of authentication. Users who own or manage an OAuth App or GitHub App and want to use the device flow can enable it for an app via the app's settings page. The device flow API endpoints will respond with status code 400 to apps that have not enabled this feature. For more information, see "Authorizing OAuth Apps."

Users with admin access to a repository can better understand who has access to the repository, see what level of access each user has, and more easily manage access to the repository. For example, users can accomplish the following tasks.

• Search all members, teams, and collaborators who have access to the repository.
• View when members have mixed role assignments, granted to them directly as individuals or indirectly via a team: a new "mixed roles" warning displays the highest level role the user is granted if their access is higher than their assigned role.

For more information, see "Managing teams and people with access to your repository."

Enterprise owners can now show additional links to enterprise members and collaborators in a custom footer. For more information, see "Configuring custom footers."

Users can reuse a workflow with a single line of configuration. Reusable workflows save time and maintenance by removing the need to copy and paste workflow definitions across repositories. Reusable workflows are in beta and subject to change. For more information, see "Reusing workflows."

The updated management experience for self-hosted runners simplifies management of runner groups and provides an improved overview of your runners. For more information, see "About self-hosted runners" and "Managing access to self-hosted runners using groups."

Dependabot now shares secrets with GitHub Actions when Dependabot triggers a workflow run, so users can now pull from private package registries within CI pipelines using Dependabot's secrets. For more information, see "Managing encrypted secrets for Dependabot."

Users can use an if conditional to prevent specific steps in a composite action from executing unless a condition is met. Like steps defined in workflows, you can use any supported context and expression to create a conditional. For more information about composite actions, see "Creating a composite action."

Users can provide a better experience to users of a workflow by specifying input types for manually triggered workflows. Workflows now support choice, boolean, and environment. For more information, see "Workflow syntax for GitHub Actions."

The first available matching runner at the repository, organization, or enterprise level will run each job in all cases, which means jobs are sent to self-hosted runners much faster, especially for organizations and enterprises with many self-hosted runners. Previously, when running a job that required a self-hosted runner, GitHub Actions would look for self-hosted runners in the repository, organization, and enterprise, in that order. For more information, see "Using self-hosted runners in a workflow."

Users can specify that a JavaScript action should run in Node.js 16 by specifying runs.using as node16. Node.js 16 support supplements the existing support for Node.js 12. Runners must have version 2.285.0 or later of the GitHub Actions Runner installed. For more information, see "Metadata syntax for GitHub Actions" and the actions/runner repository.

Users can add, list, and remove labels for self-hosted runners using the REST API. For more information, see "Self-hosted runners" in the REST API documentation.

Users can improve the security of services and tools created with Ruby using CodeQL code scanning. For all common Ruby versions up to and including 3.02, CodeQL can detect common issues such as SQL injection, ReDoS, OS command and argument injection, XML entity expansion, reflected cross-site scripting (XSS), stored XSS, unsafe deserialization, and hard-coded credentials. To enable Ruby analysis, users must update an existing CodeQL code scanning workflow file. Ruby support for CodeQL is in beta and subject to change. For more information, see "Configuring code scanning" and the CodeQL documentation. For more information about code scanning with CodeQL, see "About code scanning with CodeQL."

CodeQL's Python analysis supports additional frameworks and can detect more potential sources of untrusted user data, steps through which that data flows, and potentially dangerous sinks in which this data could end up. For more information, see "Supported languages and frameworks" in the CodeQL documentation.

Users can retrieve commit details of secrets detected in private repository scans using the REST API. The new endpoint will surface details of a secret's first detection within a file, including the secret's location and commit SHA. For more information, see "About secret scanning" and "Secret scanning" in the REST API documentation.

The code scanning API includes the following improvements.

• Alerts include the fixed_at timestamp, which is the first time that the alert was not detected in an analysis. Users can use this data to better understand when code scanning alerts are being fixed.
• Users can sort for the most important alert results using sort and direction on either created, updated, or number. For more information, see Code scanning in the REST API documentation.
• The alerts and alert endpoint response include a Last-Modified header. For more information, see Last-Modified in the Mozilla documentation.
• SARIF responses for code scanning analyses include relatedLocations, which may contain locations which are not the primary location of the alert. For an example, see the SARIF spec. For more information, see Code scanning in the REST API documentation.
• The webhook response alert rule object includes help and tags data. For more information, see "Webhook events and payloads."

Organization owners and security managers can retrieve private repositories' secret scanning results at the enterprise level using the REST API. For more information, see "About secret scanning" and "Secret scanning" in the REST API documentation.

Users can dismiss Dependabot alerts via the GraphQL API. For more information, see "Mutations" in the GraphQL API documentation.

Dependency graph detects Python dependencies in repositories that use the Poetry package manager. Dependencies will be detected from both pyproject.toml and poetry.lock manifest files. For more information, see "About the dependency graph."

Developers and security researchers can use CodeQL to build databases and analyze code on machines powered by Apple silicon chips, such as the M1. Both the CodeQL CLI and VS Code extension support Apple silicon. To use the CodeQL CLI or the VS Code extension on Apple silicon, users must install the Xcode command-line developer tools and Rosetta 2. CodeQL support for Apple silicon is in beta and subject to change.

• For more information about configuration of the CodeQL CLI on supported platforms, see "Using the CodeQL CLI" in the CodeQL documentation.
• For more information about CodeQL, see "About CodeQL" in the CodeQL documentation and "About code scanning."

Users of the CodeQL CLI versions 2.7.1 and later can include query help in SARIF files as Markdown, and the help text will appear in GitHub AE's code scanning UI. Users can include query help as a Markdown file with the same name as the corresponding query file. For example, if your query file is MyCustomQuery.ql, the name of the query help file would be MyCustomQuery.md. For more information about authorship of query help for custom CodeQL queries, see the query help style guide.

• Users who don't use GitHub Actions for CI/CD and code scanning must specify the addition of query help when running the codeql database analyze command by including the --sarif-add-query-help flag. For more information, see "Analyzing databases with the CodeQL CLI" in the CodeQL documentation.

Users can unsubscribe from all repositories owned by a given user or organization. For more information, see "Managing your subscriptions."

Organization owners can unsubscribe from email notifications when new deploy keys are added to repositories belonging to their organizations. For more information, see "Configuring notifications."

The subject line for email notifications for issues and pull requests includes "(Issue #NUMBER)" or "(PR #NUMBER)" to help users easily distinguish between the two notification types.

The View on GitHub link at the bottom of email notifications is no longer hidden by default in Gmail.

Organization members can now view a list of enterprise owners. Whenever an organization member encounters a prompt to contact an enterprise owner, a link will direct the user to the list. The list is also accessible using the GraphQL API's Organization object at the enterpriseOwners endpoint. For more information, see "Viewing people's roles in an organization."

Users with admin access to a repository can rename branches that are protected by branch protection rules. For more information, see "Renaming a branch" and "Managing a branch protection rule."

Instead of allowing all or no users to force push, people with admin access to a repository can choose who can force push to the repository. For more information, see "About protected branches" and "Managing a branch protection rule."

Users with admin access to a repository can require that all changes to a protected branch are made using a pull request, but without requiring reviews. For more information, see "About protected branches" and "Managing a branch protection rule."

Users with admin access to a repository can allow specific users and teams to bypass pull request requirements. For more information, see "Managing a branch protection rule."

Users can use single-character prefixes for custom autolinks. Autolink prefixes also allow ., -, _, +, =, :, /, and # characters, as well as alphanumerics. For more information, see "Configuring autolinks to reference external resources."

Users can enable Only notify requested team members independently of Enable auto assignment in the team's code review settings, allowing users to require the team for review, but without always notify