Merge pull request #45842 from github/repo-sync

Repo sync

Author: docs-bot

.github/workflows/changelog-prompt.yml

@@ -0,0 +1,47 @@
+---
+title:  Automatic Dependabot access to {% data variables.product.github %}-hosted registries
+intro: 'Keep your private dependencies up to date reliably by granting {% data variables.product.prodname_dependabot %} automatic access to {% data variables.product.prodname_registry %} and {% data variables.product.prodname_container_registry %}, so you never need to create or rotate credentials for these registries.'
+versions:
+  feature: org-automatic-registry-access
+shortTitle: Automatic registry access
+allowTitleToDifferFromFilename: true
+contentType: concepts
+category:
+  - Secure your dependencies
+---
+
+## About automatic access to {% data variables.product.github %}-hosted registries
+ 
+{% data variables.product.prodname_dependabot %} can authenticate to private {% data variables.product.prodname_registry %} and {% data variables.product.prodname_container_registry %} packages using the same access grants that {% data variables.product.prodname_actions %} workflows use. If a package has granted your repository **Read** access in the package settings on {% data variables.product.github %}, {% data variables.product.prodname_dependabot %} can access that package automatically.
+ 
+This eliminates the need to:
+ 
+* Create and manage {% data variables.product.pat_generic_plural %} for registry access
+* Manually configure access to {% data variables.product.github %}-hosted registries in your `dependabot.yml` file 
+* Rotate credentials when tokens expire
+ 
+## How automatic access works
+ 
+{% data variables.product.prodname_dependabot %} uses its `GITHUB_TOKEN` to request `packages: read` permission when pulling from `*.pkg.github.com` and {% data variables.product.prodname_container_registry_namespace %}. Any package that has granted your repository access through "Manage Actions access" accepts this token, the same way it would for a regular {% data variables.product.prodname_actions %} workflow.
+
+Automatic {% data variables.product.prodname_registry %} credentials are used only as fallback authentication. Explicit registry credentials and normal registry routing take precedence.
+ 
+This works for every {% data variables.product.prodname_registry %} ecosystem that {% data variables.product.prodname_dependabot %} supports.
+ 
+## When to use automatic access
+ 
+Use automatic access to {% data variables.product.github %}-hosted registries when:
+ 
+* Your repositories depend on private packages stored in {% data variables.product.prodname_registry %} or {% data variables.product.prodname_container_registry %}.
+* You want to reduce credential management overhead.
+* You want to avoid silent update failures caused by expired {% data variables.product.pat_generic_plural %}.
+ 
+For third-party registries (such as Artifactory, Azure Artifacts, or Nexus), you can only use the `dependabot.yml` registry configuration or organization-level private registry settings. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries).
+ 
+## How to enable automatic access
+ 
+For each package that {% data variables.product.prodname_dependabot %} needs to read, you need to go to the package's settings page and add the repository that runs {% data variables.product.prodname_dependabot %} with **Read** access. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#configuring-private-github-hosted-registries).
+ 
+Once the repository has been granted access, {% data variables.product.prodname_dependabot %} can pull from that package automatically. You do not need to configure the `dependabot.yml` file, and you can remove any existing {% data variables.product.pat_generic %}-based registry entries you previously added for these packages.
+ 
+For more information about configuring package access, see [AUTOTITLE](/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility#ensuring-workflow-access-to-your-package).

.github/workflows/move-existing-issues-to-the-correct-repo.yml

@@ -8,7 +8,6 @@ versions:
 contentType: concepts
 redirect_from:
   - /code-security/supply-chain-security/understanding-your-software-supply-chain
-  - /code-security/concepts/supply-chain-security/automatic-dependabot-access-to-github-registries
 children:
   - supply-chain-security
   - open-source-license-compliance
@@ -24,6 +23,7 @@ children:
   - dependabot-pull-requests
   - multi-ecosystem-updates
   - about-the-dependabot-yml-file
+  - automatic-dependabot-access-to-github-registries
   - dependabot-auto-triage-rules
   - dependabot-on-actions
   - dependabot-job-logs

content/code-security/concepts/supply-chain-security/automatic-dependabot-access-to-github-registries.md

@@ -87,6 +87,19 @@ Any private registries used by the build must also be accessible to the workflow
 
 When you configure access to one or more private registries, {% data variables.product.prodname_dependabot %} can propose pull requests to upgrade a vulnerable dependency or to maintain a dependency, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries) and [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-private-registries).
 
+{% ifversion org-automatic-registry-access %}
+
+### Automatic access to {% data variables.product.github %}-hosted registries
+ 
+For packages stored in {% data variables.product.prodname_registry %} and {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} can authenticate automatically without {% data variables.product.pat_generic_plural %} or `dependabot.yml` registry configuration. 
+
+{% data variables.product.prodname_dependabot %} uses its `GITHUB_TOKEN` to request read access, reusing the same package access grants that {% data variables.product.prodname_actions %} workflows use.
+ 
+To enable this, grant the repository **Read** access to each package in the package settings. Once access is granted, {% data variables.product.prodname_dependabot %} can pull from those packages automatically, and you can remove any {% data variables.product.pat_generic %}-based registry entries you previously configured for them.
+ 
+See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#configuring-private-github-hosted-registries).
+{% endif %}
+
 {% ifversion org-private-registry-oidc %}
 
 ### Configuring OIDC authentication for a private registry

content/code-security/concepts/supply-chain-security/index.md

@@ -29,8 +29,41 @@ For specific ecosystems, you can configure {% data variables.product.prodname_de
 
 {% ifversion dependabot-on-actions-self-hosted %}To allow {% data variables.product.prodname_dependabot %} access to registries hosted privately or restricted to internal networks, configure {% data variables.product.prodname_dependabot %} to run on {% data variables.product.prodname_actions %} self-hosted runners. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-on-self-hosted-runners).{% endif %}
 
+{% ifversion org-automatic-registry-access %}
+
+## Configuring private {% data variables.product.github %}-hosted registries
+
+For packages stored in {% data variables.product.prodname_registry %} or {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} can authenticate automatically using its `GITHUB_TOKEN`. This uses the same "Manage Actions access" grants that {% data variables.product.prodname_actions %} workflows use. No {% data variables.product.pat_generic_plural %} or `dependabot.yml` registry entries are required.
+
+The `dependabot.yml` registry configuration using {% data variables.product.pat_generic_title_case %}-based registry entries and described in [Configuring private third-party registries](#configuring-private-third-party-registries) is still required for third-party private registries (such as Artifactory, Azure Artifacts, or Nexus).
+ 
+To grant {% data variables.product.prodname_dependabot %} access to a private package:
+
+ {% data reusables.package_registry.package-settings-from-org-level %}
+ {% data reusables.package_registry.package-settings-option %}
+ {% data reusables.package_registry.package-settings-actions-access %}
+ 1. {% data reusables.package_registry.package-settings-add-repo %}
+    Search for the repository where {% data variables.product.prodname_dependabot %} runs, and select it.
+ {% data reusables.package_registry.package-settings-actions-access-role-repo %}
+    Select **Read** as the access level. {% data variables.product.prodname_dependabot %} only needs read access to pull packages.
+
+You need to repeat these steps for each private package that you want {% data variables.product.prodname_dependabot %} to access.
+ 
+Once access is granted, {% data variables.product.prodname_dependabot %} can pull from those packages automatically. You can remove any {% data variables.product.pat_generic %}-based registry entries in `dependabot.yml` that you previously configured for these packages.
+ 
+> [!NOTE]
+> This method works for every {% data variables.product.prodname_registry %} ecosystem that {% data variables.product.prodname_dependabot %} supports, including container images in {% data variables.product.prodname_container_registry %}.
+ 
+For more information about how automatic access works, see [AUTOTITLE](/code-security/concepts/supply-chain-security/automatic-dependabot-access-to-github-registries). For more information about package access settings, see [AUTOTITLE](/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility#ensuring-workflow-access-to-your-package).
+
+## Configuring private third-party registries
+
+{% else %}
+
 ## Configuring private registries
 
+{% endif %}
+
 {% ifversion org-private-registry %}
 
 You can configure {% data variables.product.prodname_dependabot %}'s access to private registries at the org-level.

content/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries.md

@@ -109,6 +109,12 @@ The snippet below shows a `dependabot.yml` file configuration that uses a token.
 
 Docker supports using a username and password for registries. For more information, see `docker-registry` in [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#docker-registry).
 
+{% ifversion org-automatic-registry-access %}
+
+For images stored in {% data variables.product.prodname_container_registry %}, you can grant your repository **Read** access in the package settings instead of configuring credentials in your `dependabot.yml` file. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries#configuring-private-github-hosted-registries).
+
+{% endif %}
+
 Snippet of `dependabot.yml` file using a username and password.
 
 {% raw %}

content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries.md

@@ -14,6 +14,7 @@ redirect_from:
   - /early-access/copilot-metrics/dashboards/about-the-copilot-metrics-dashboard
   - /early-access/copilot-metrics/apis/rest-api-endpoints-for-copilot-enterprise-and-user-usage-metrics
   - /copilot/concepts/copilot-metrics
+  - /copilot/concepts/copilot-usage-metrics/copilot-metrics
 category:
   - Copilot usage metrics
   - Track Copilot usage

content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-private-registries.md

@@ -8,7 +8,7 @@ heroImage: /assets/images/banner-images/hero-4
 layout: bespoke-landing
 sidebarLink:
   text: All articles
-  href: /copilot/concepts/copilot-usage-metrics
+  href: /copilot/concepts/billing-and-usage/copilot-usage-metrics
 children:
   - /copilot-metrics
   - /content/copilot/how-tos/administer-copilot/view-usage-and-adoption
@@ -29,5 +29,6 @@ includedCategories:
   - View metrics
   - Understand available data
 contentType: concepts
+redirect_from:
+  - /copilot/concepts/copilot-usage-metrics
 ---
-

…copilot-usage-metrics/copilot-metrics.md …copilot-usage-metrics/copilot-metrics.mdcontent/copilot/concepts/copilot-usage-metrics/copilot-metrics.md renamed to content/copilot/concepts/billing-and-usage/copilot-usage-metrics/copilot-metrics.md content/copilot/concepts/copilot-usage-metrics/copilot-metrics.md renamed to content/copilot/concepts/billing-and-usage/copilot-usage-metrics/copilot-metrics.md

@@ -1,17 +1,17 @@
 ---
-title: GitHub Copilot billing
-shortTitle: Billing
-intro: Understand billing and usage for {% data variables.product.prodname_copilot %}.
+title: GitHub Copilot billing and usage
+shortTitle: Billing and usage
+intro: 'Understand billing and usage for {% data variables.product.prodname_copilot %}, whether you use it individually or manage it for an organization or enterprise.'
 versions:
   feature: copilot
 children:
-  - /usage-based-billing-for-individuals
   - /organizations-and-enterprises
-  - /budgets-for-usage-based-billing
+  - /individuals
+  - /copilot-usage-metrics
 redirect_from:
   - /managing-copilot/managing-copilot-as-an-individual-subscriber/billing-and-payments
   - /copilot/managing-copilot/understanding-and-managing-copilot-usage
   - /copilot/concepts/copilot-billing
+  - /copilot/concepts/billing
 contentType: concepts
 ---
-