Repo sync

.github/workflows/sync-openapi.yml

@@ -42,15 +42,6 @@ jobs:
           path: rest-api-description
           ref: ${{ inputs.SOURCE_BRANCH }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          # By default, only the most recent commit of the `main` branch
-          # will be checked out
-          repository: github/models-gateway
-          path: models-gateway
-          ref: main
-          token: ${{ secrets.DOCS_BOT_PAT_BASE }}
-
       - uses: ./.github/actions/node-npm-setup
 
       - name: Sync the REST, Webhooks, and GitHub Apps schemas
@@ -60,7 +51,7 @@ jobs:
           NODE_OPTIONS: '--max-old-space-size=8192'
         run: |
           npm run sync-rest -- \
-            --source-repos rest-api-description models-gateway \
+            --source-repos rest-api-description \
             --output rest github-apps webhooks rest-redirects
           git status
           echo "Deleting the cloned github/rest-api-description repo..."

Dockerfile

@@ -10,7 +10,7 @@
 # ---------------------------------------------------------------
 # To update the sha:
 # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble
-FROM ghcr.io/github/gh-base-image/gh-base-noble:20260727-152635-gd2e4a1fa6@sha256:22e3a406a3f0f9bf6d3544ce4189bb947e467330bbe7210af5ecc727232a569c AS base
+FROM ghcr.io/github/gh-base-image/gh-base-noble:20260729-114251-gd3f68777e@sha256:3bcf6ef4f1eb8e94d6c61c02b82a78140cc2d3c558ba83c68b8f168c5d678a16 AS base
 
 # Install curl for Node install and determining the early access branch
 # Install git for cloning docs-early-access & translations repos

content/actions/how-tos/manage-runners/larger-runners/manage-larger-runners.md

@@ -227,3 +227,38 @@ The number of available IP addresses in the assigned ranges does not restrict th
 {% data reusables.actions.select-a-larger-runner %}
 {% data reusables.actions.networking-for-larger-runners %}
 {% endif %}
+
+## Azure Storage firewall considerations
+
+### Virtual machines and storage accounts in the same region
+
+If you use Azure Storage accounts protected by network rules, be aware that traffic from {% data variables.actions.hosted_runner %}s' VMs to storage accounts in the same Azure region uses private Azure IP addresses rather than the {% data variables.actions.hosted_runner %}s' public IP range.
+
+As a result, Azure Storage firewall rules that rely only on runner public IP allowlists might not work as expected. This can cause connectivity failures that appear as 403 (AuthorizationFailure) responses, with an error message similar to:
+
+```text
+The request may be blocked by network rules of storage account. Please check network rule set using 'az storage account show -n accountname --query networkRuleSet'.
+  If you want to change the default action to apply when no rule matches, please use 'az storage account update'.
+```
+
+For more information see the Microsoft documentation for [Guidelines and limitations for the Azure Storage firewall](https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-limitations) and [Configure network routing preference for Azure Storage](https://learn.microsoft.com/en-us/azure/storage/common/configure-network-routing-preference?tabs=azure-portal&source=docs).
+
+> [!NOTE]
+> We don't recommend configuring Azure Storage firewall network rules for {% data variables.actions.hosted_runner %}s unless you use either `static public IP ranges` or an `Azure VNet`.
+> Public IP ranges can be dynamic, so allowlist-based rules may break and cause intermittent connectivity failures.
+> See [AUTOTITLE](/actions/reference/runners/larger-runners#networking-for-larger-runners)
+
+### Use Static IP Ranges and Service Endpoints
+
+One option for safely enabling Storage Account network rules is to use runners with static IPs and request support for configuring Azure Storage service endpoints for the virtual network hosting those static IPs. See [Azure virtual network service endpoints](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview) for more information.
+
+Contact GitHub Support to set up this configuration through the [GitHub Support portal](https://support.github.com/).
+
+### Configure Azure VNET
+
+Another option to safely connect to Azure Storage accounts is to enable Azure VNET with {% data variables.product.company_short %}-hosted runners.
+
+* [AUTOTITLE](/organizations/managing-organization-settings/about-azure-private-networking-for-github-hosted-runners-in-your-organization)
+{% ifversion ghec %}
+* [AUTOTITLE](/admin/configuring-settings/configuring-private-networking-for-hosted-compute-products/about-azure-private-networking-for-github-hosted-runners-in-your-enterprise)
+{% endif %}

content/admin/concepts/enterprise-fundamentals/teams-in-an-enterprise.md

@@ -7,7 +7,7 @@ shortTitle: Teams
 redirect_from:
   - /admin/overview/about-teams
   - /enterprise-onboarding/setting-up-organizations-and-teams/managing-organization-members
-  - /enterprise-onboarding/setting-up-organizations-and-teams/about-teams-in-an-enterprise  
+  - /enterprise-onboarding/setting-up-organizations-and-teams/about-teams-in-an-enterprise
 contentType: concepts
 category:
   - Get started with GitHub Enterprise
@@ -52,11 +52,13 @@ To simplify administration at scale, {% data variables.product.company_short %}
 
 You may need to create organization teams if the functionality you need is not covered by enterprise teams. The limitations listed below reflect the current capabilities of enterprise teams and may change over time.
 
+## What can enterprise teams do?
+
 {% data reusables.enterprise.enterprise-teams-can %}
 
 {%- ifversion enterprise-teams-ga %}
 
-To @-mention an enterprise team, or request a review from the team, use the team's slug in the format `@/ent:TEAM-SLUG`. {% data variables.product.github %} generates the slug from the team's name and adds the `ent:` prefix, so an enterprise team named `Platform SRE` has the slug `ent:platform-sre`. 
+To @-mention an enterprise team, or request a review from the team, use the team's slug in the format `@/ent:TEAM-SLUG`. {% data variables.product.github %} generates the slug from the team's name and adds the `ent:` prefix, so an enterprise team named `Platform SRE` has the slug `ent:platform-sre`.
 
 To mention the team from an organization it is assigned to, such as `octo-org`, use `@octo-org/ent:platform-sre`. You can mention an enterprise team from any organization the team is assigned to.
 

content/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/create-enterprise-teams.md

@@ -85,11 +85,11 @@ For example:
 
 {% else %}
 
-## 4. Assign licenses
+## 4. Grant access to {% data variables.product.prodname_copilot_short %}
 
-You can assign {% data variables.product.prodname_copilot %} licenses to an enterprise team. This allows you to manage {% data variables.product.prodname_copilot_short %} access through team membership, independent of organizations. Once you have assigned licenses to a team, users will gain or lose access to {% data variables.product.prodname_copilot_short %} when they are added or removed from the team.
+You can assign {% data variables.product.prodname_copilot %} licenses to an enterprise team. This allows you to manage {% data variables.product.prodname_copilot_short %} access through team membership, independent of organizations. Once you have assigned licenses to a team, users will gain or lose access to {% data variables.product.prodname_copilot_short %} when they are added or removed from the team. For instructions, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-access/grant-access#assigning-licenses-to-users-or-teams).
 
-For instructions, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-access/grant-access#assigning-licenses-to-users-or-teams).
+As an opt-in preview, you can also grant enterprise teams access to specific {% data variables.product.prodname_copilot_short %} models. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-availability-of-default-models).
 
 ## 5. Assign roles
 

content/admin/monitoring-and-managing-your-instance/configuring-clustering/replacing-a-cluster-node.md

@@ -207,12 +207,38 @@ If you need to allocate more resources to your primary MySQL (or MySQL and MSSQL
    /usr/local/share/enterprise/ghe-mssql-repl-promote
    ```
 
-    This will attempt to access the current primary MSSQL node and perform a graceful failover
+    This will attempt to access the current primary MSSQL node and perform a graceful failover.
+
+1. If the new node will also become the primary Redis node, confirm that the new node is a healthy, caught-up Redis replica before you continue. From any node in the cluster, run the following command.
+
+   ```shell copy
+   ghe-cluster-status-redis -v
+   ```
+
+   Confirm that the new node's entry reports `ok` and `Redis replication is in sync`, and that the current primary Redis node's entry also reports `ok`.
+
+   > [!WARNING]
+   > Do not set `redis-master` to a node that is not a caught-up replica. If you do, the cluster can reconfigure the current primary Redis node as a replica of the new node and discard any data that hasn't replicated yet.
+
+   `ghe-cluster-status-redis` reports sync freshness, not exact replication offsets. Immediately before you edit `redis-master` in the next step, look up the current primary Redis node's hostname. Because `mysql-master` and `redis-master` are configured independently, the current primary Redis node isn't necessarily the database node you're replacing.
+
+   ```shell copy
+   ghe-config cluster.redis-master
+   ```
+
+   Then compare offsets directly, replacing `NEW-NODE-HOSTNAME` with the hostname of the new node and `CURRENT-REDIS-MASTER-HOSTNAME` with the value from the previous command. Check the new node first, then the current primary Redis node, so that a match reflects the primary's most recent state.
+
+   ```shell copy
+   ghe-redis-cli --remote -h NEW-NODE-HOSTNAME INFO replication
+   ghe-redis-cli --remote -h CURRENT-REDIS-MASTER-HOSTNAME INFO replication
+   ```
+
+   Confirm that the new node's `slave_repl_offset` value matches the current primary Redis node's `master_repl_offset` value. If the values don't match, wait and check again. Do not continue until the offsets match.
 
 1. After the GTIDs on the primary and replica MySQL nodes match, update the cluster configuration by opening the cluster configuration file at `/data/user/common/cluster.conf` in a text editor.
 
    * Create a backup of the `cluster.conf` file before you edit the file.
-   * In the top-level `[cluster]` section, remove the hostname for the node you replaced from the `mysql-master` key-value pair, then assign the new node instead. If the new node is also a primary Redis node, adjust the `redis-master` key-value pair.
+   * In the top-level `[cluster]` section, remove the hostname for the node you replaced from the `mysql-master` key-value pair, then assign the new node instead. If the new node is also a primary Redis node, adjust the `redis-master` key-value pair only after the replication check in the previous step confirms the offsets match.
    * If {% data variables.product.prodname_actions %} is enabled in the cluster, you will have to include the `mssql-server = true` key-value pair as well.
 
    <pre>
@@ -233,5 +259,14 @@ If you need to allocate more resources to your primary MySQL (or MySQL and MSSQL
    /usr/local/share/enterprise/ghe-repl-post-failover-mssql
    ```
 
+1. If you changed `redis-master`, confirm that the new primary Redis node is serving traffic and that the former primary Redis node has reconfigured as a healthy replica. Run the following commands.
+
+   ```shell copy
+   ghe-redis-cli PING
+   ghe-cluster-status-redis -v
+   ```
+
+   Confirm that `ghe-redis-cli PING` returns `PONG` through the default HAProxy Redis endpoint, the new node's entry reports `ok`, and the former primary Redis node's entry reports `ok` and `Redis replication is in sync`.
+
 1. Check the status of the MySQL(or MySQL and MSSQL) replication from any node in the cluster by running `ghe-cluster-status -v`.
 1. When the MySQL(or MySQL and MSSQL) replication is finished, from any node in the cluster, disable maintenance mode. See [AUTOTITLE](/admin/administering-your-instance/configuring-maintenance-mode/enabling-and-scheduling-maintenance-mode#enabling-or-disabling-maintenance-mode-for-all-nodes-in-a-cluster-via-the-cli).

content/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens.md

@@ -142,7 +142,6 @@ Below are some example URLs that generate the tokens we see most often:
 
 * [Read repository contents](https://github.com/settings/personal-access-tokens/new?name=Repo-reading+token&description=Just+contents:read&contents=read)
 * [Push access to repositories](https://github.com/settings/personal-access-tokens/new?name=Repo-writing+token&description=Just+contents:write&contents=write)
-* [{% data variables.product.prodname_github_models %} access](https://github.com/settings/personal-access-tokens/new?name=GitHub+Models+token&description=Used%20to%20call%20GitHub%20Models%20APIs%20to%20easily%20run%20LLMs%3A%20https%3A%2F%2Fdocs.github.com%2Fgithub-models%2Fquickstart%23step-2-make-an-api-call&user_models=read)<!-- markdownlint-disable-line search-replace Custom rule -->
 * [Update code and open a pull request](https://github.com/settings/personal-access-tokens/new?name=Core-loop+token&description=Write%20code%20and%20push%20it%20to%20main%21%20Includes%20permission%20to%20edit%20workflow%20files%20for%20Actions%20-%20remove%20%60workflows%3Awrite%60%20if%20you%20don%27t%20need%20to%20do%20that&contents=write&pull_requests=write&workflows=write)
 * [Manage {% data variables.product.prodname_copilot_short %} licenses in an organization](https://github.com/settings/personal-access-tokens/new?name=Core-loop+token&description=Enable%20or%20disable%20copilot%20access%20for%20users%20with%20the%20Seat%20Management%20APIs%3A%20https%3A%2F%2Fdocs.github.com%2Frest%2Fcopilot%2Fcopilot-user-management%0ABe%20sure%20to%20select%20an%20organization%20for%20your%20resource%20owner%20below%21&organization_copilot_seat_management=write)<!-- markdownlint-disable-line search-replace Custom rule -->
 * [Make {% data variables.product.prodname_copilot_short %} requests](https://github.com/settings/personal-access-tokens/new?name=Copilot+requests+token&description=Make%20Copilot%20API%20requests%20on%20behalf%20of%20the%20user%2C%20consuming%20premium%20requests%3A%20https%3A%2F%2Fdocs.github.com%2Fcopilot%2Fconcepts%2Fbilling%2Fcopilot-requests&user_copilot_requests=read)<!-- markdownlint-disable-line search-replace Custom rule -->