You can now use the REST API to get global security advisories from the Advisory Database. This makes it easy to get access to the Advisory Database's free, open source list of actionable security advisories and CVEs which include machine readable mappings to the ecosystem, package name, and affected versions of impacted software.
Learn more about GitHub's global security advisories and the Advisory Database.
Today's Changelog brings you board swimlanes and the ability to create issues in repository groups!
You can now configure swimlanes on your boards by selecting a Group by field from the view configuration menu. This allows you to break up your items by different workstreams, team members, or priorities, similar to groups on tables and roadmaps. Drag and drop your items between columns and groups to quickly make adjustments, or add a new item directly.
You can now create issues when grouped by Repository on the table and roadmap layout. Click Create new issue or start typing the title to get started.
See how to use GitHub for project planning with GitHub Issues, check out what's on the roadmap, and learn more in the docs.
Questions or suggestions? Join the conversation in the community discussion.
CodeQL is the analysis engine that powers GitHub code scanning for over 100,000 repositories. We continuously improve our analysis capabilities, language support and performance to help open source developers and enterprises catch vulnerabilities before they make their way into production code. CodeQL is also an instrumental tool for the security researcher community and was used to identify 36 new CVE.
We release updates and improvements for CodeQL on a regular basis. We don’t get to call out all the improvements, but we want to highlight some of the most important updates we’ve shipped for CodeQL in the first half of the year:
These features have been shipped across multiple versions of CodeQL from 2.12.0 up to 2.14.0, which are shipped with GHES 3.9 and upcoming 3.10. All users of CodeQL code scanning on GitHub.com automatically benefit from the latest improvements.
Today, we are announcing public beta of the new experience for deployments across environments.
Developers and DevOps managers can now view and track the full history of deployments in a repository or filter them across environments to:
Learn more about viewing deployments in your repository through our documentation and watching this video.
For questions, visit the GitHub Actions community.
To see what’s next for Actions, visit our public roadmap.
Starting today, publishing with provenance is restricted to public source repositories only. Private source repositories are no longer supported for use with provenance for public packages.
As announced on July 11, 2023: npm will verify the linked source commit and repository when users view a package's provenance information on npmjs.com. If the linked source commit or repository cannot be found, an error will be displayed. This can occur if a repository is deleted or if it is made private.
Read more about viewing npm provenance and publishing with provenance.
GitHub Codespaces has introduced new access and ownership settings, providing organizations more granular control over which members and outside collaborators are able to create codespaces on organization-owned private and internal repositories.
Owners of organizations on the Team or Enterprise plan can now select which of their organization's members or collaborators are allowed to use GitHub Codespaces on organization-owned private and internal repositories. In order to use GitHub Codespaces, an organization member or collaborator will need explicit access to GitHub Codespaces and either write or fork permissions on the repository.
Any members or collaborators not explicitly granted access will not be allowed to use GitHub Codespaces within the organization's private or internal repositories. Those members or collaborators may still use codespaces on public repositories owned by the organization, like any other GitHub user.
Additionally, organization administrators can select whether member or collaborator codespaces fall under organization or user ownership. Codespaces ownership dictates who pays for a codespace, which policies are applied, and where audit logs from codespace usage are sent. For organization owned codespaces, the organization pays for the codespace, organization policies apply, and the logs are sent to the organization. For an organization to own any codespaces, the organization administrator will need to set a spending limit in order to enable GitHub Codespaces within their organization. Enterprise Managed Users are not able to create user owned codespaces because their usage must be paid for by the enterprise.
On October 11, 2022, we annouced plans to deprecate the save-state and set-output workflow commands on May 31, 2023. We have since decided to postpone the removal given the amount of usage we are still seeing with these commands.
Workflows using save-state or set-output in their workflows will continue to work as expected, however, a warning will appear under annotations indicating the planned deprecation. We recommend customers using these commands to upgrade their workflows to use environment files.
For more information on environment files, please check out our documentation. To see what's next for Actions, visit our public roadmap.
Repository rules are now generally available on GitHub.com.
Repository rules allow you to easily govern protections for branches and tags on your repositories. Repository collaborators also gain access to see what rules are in place via the Web, git client, and the GitHub CLI.
For GitHub Enterprise Cloud customer, you gain the ability to enforce branch and tag protections across repositories in your organization. As well as insights on rule enforcement, evaluation mode to test rules before enforcing them and governance around commit messages.
Check out the blog post to learn more about repository rules. And if you have feedback, please share and let us know in our feedback discussion.
Today's Changelog includes updates to project templates, a pinned item side panel, and pull request support in tasklists!
Since we announced the public beta of project templates for organizations, we've made improvements to what is included in a template. Any configured workflows (other than the Auto-add to project workflow), project insights, and custom fields for draft items are now included when you use a project template or make a copy of a project.
Select a template when creating a new project to see a preview of what is included.
As we continue to build out more functionality for project templates we would love your feedback and to hear more about your experiences and requests. Check out the documentation for more details.
You can now pin the item side panel in your project by selecting the pin icon in the top right corner. This allows for triage mode where you can interact with the project view while an item remains open in the side panel.
Tasklists now support pull requests as items and you can create tasklists inside of pull requests! If you have already been putting tasklists into pull requests only to have them fail on you, failure no more. ✨
We've also made the following improvements to tasklists:
Tracked byYou can now reorder your custom fields in the project settings by dragging and dropping them in the list to update the order that they appear in the item side panel and on the issue page. Once you've rearranged your fields, open an issue in the side panel to see your changes!
See how to use GitHub for project planning with GitHub Issues, check out what's on the roadmap, and learn more in the docs.
You now have the option to select either the "Extended" or "Default" query suite when setting up code scanning with default setup for eligible repositories within your organization.
Code scanning's default query suite has been carefully designed to ensure that it looks for the security issues most relevant to developers, whilst also minimizing the occurrence of false positive results. However, if you and your developers are interested in seeing a wider range of alerts, you can enable the extended query suite. This suite includes everything from the default query suite, plus additional queries with slightly lower precision and severity.
The query suite selection can be made whenever you enable code scanning with default setup:
Previously, our system would automatically choose the default query suite when you enabled code scanning with default setup. Now, you can choose either the extended or default query suite.
Additionally, you can specify either the extended or default query suite as the preferred choice for your organization. This preference determines which query suite is "recommended" when a user is enabling code scanning setup with default setup.
These improvements have shipped to GitHub.com and will be available in GitHub Enterprise Server 3.11.
Learn more about configuring default setup for code scanning and send us your feedback
Learn more about GitHub Advanced Security
You can now use the REST API to add collaborators to your draft security advisory.
Learn more about the repository security advisories REST API
GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets, our scans help prevent data leaks and fraud.
We have partnered with Defined to scan for their tokens and help secure our mutual users on public repositories. Defined tokens allow users to access various administrative functions of their managed mesh networking offerings. GitHub will forward access tokens found in public repositories to Defined, which will then email the user. You can read more information about Defined's tokens here.
All users can scan for and block Defined's tokens from entering their public repositories for free with push protection. GitHub Advanced Security customers can also scan for and block Defined tokens in their private repositories.
At GitHub, we store multiple copies of every Git repository our customers push up. Every once in a while, one copy of a Git repository can wind up in a broken state. Usually, our maintenance processes fix the copy automatically, and no one ever notices the problem. Under very rare circumstances, the automation is unable to fix the problem, requiring manual intervention. To prevent further damage from accruing, the automation marks the repository "broken" and doesn't allow further changes (pushes or maintenance).
The GitHub web interface has long shown an informative message informing viewers that the repository is broken. With this change, the Git client will also receive a similar message. Previously, Git would report an unactionable, confusing, and very low-level error such as "fatal: bad tree object 3c8f2e6c8252929ce8334d52bd33b2bc358e7e4c".
Today, we're launching public beta support for Bitbucket Server and Bitbucket Data Center migrations in GitHub Enterprise Importer.
You can now easily use GitHub Enterprise Importer to migrate your source code, revision history, pull requests, reviews and comments when moving to GitHub from your self-hosted Bitbucket instance.
For a step-by-step guide on migrating from Bitbucket Server or Bitbucket Data Center, check out "Migrating repositories from Bitbucket Server to GitHub Enterprise Cloud" in the GitHub Docs.
We'd love to hear your feedback and questions; join us in the Community Discussion!
Node12 has been out of support since April 2022. As a result we started the deprecation process of Node12 for GitHub Actions by migrating all actions to run on Node16 on June 14th.
We have seen no major issues reported and a minimal number of people opted out of the forced upgrade to Node16. Given this, we will remove Node12 from the Actions runner on the 14th of August 2023.
For Actions maintainers: Update your actions to run on Node16 instead of Node12 (Actions configuration settings)
For Actions users: Update your workflows with latest versions of the actions which runs on Node16 (Using versions for Actions)
We continue our momentum with new capabilities for administrators and many improvements to Chat in our Visual Studio Code and Visual Studio extensions.
Note: This API is in Beta and is subject to change based on feedback.
Since the availability of GitHub Copilot for Business, we’ve heard feedback that assigning GitHub Copilot licenses to large sets of users through the UI can be tedious and time-consuming, particularly if you need to leverage Teams for your permissions management. Additionally, there has yet to be a way to routinely collect a list of stale users and revoke their access – forcing admins to spend precious time reviewing page after page of users’ last activity date and individually pruning access.
With the new User Management API for Copilot for Business, admins can list all Copilot-enabled organization members with their details and add/remove access for individuals and teams. This allows them to automate access at scale, fitting the company’s process and needs. Be sure to authenticate using an access token with the new manage_billing:copilot scope to get started.
Check out our documentation to try it out today and leave feedback for us in our Discussion post!
To help you create projects and notebooks and search for text in your workspace, we have introduced preview-only slash commands in the Chat view.
Note: To get access to the Chat view, inline chat, and slash commands (for example /search, /createWorkspace), sign up for the GitHub Copilot chat waitlist and install the Pre-Release version of the GitHub Copilot extension.
You can ask Copilot to create workspaces for popular project types with the /createWorkspace slash command. Copilot will first generate a directory structure for your request.
You can then use the Create Workspace button to create and open the project directory as a new workspace.
You can ask Copilot to create Jupyter notebooks based on your requirements with the /createNotebook slash command. Copilot will generate an outline of the notebook based on your needs.
You can then use the Create Notebook command to create the notebook and fill in the code cells based on the suggested outline.
We are introducing context-aware actions like documentation, explanation, and generating tests. These actions take the existing inline context and craft specific intents to provide an optimal and magical experience on those tasks.
When triggered, Copilot Chat will explain why the issue occurred and suggest a fix. These show up in the diagnostics experience. These require using preview versions of Visual Studio.
To learn more about Copilot and take full advantage of all of its power, visit our YouTube Copilot playlist. To sign up, see our Copilot features page.
Starting in August, Codespaces will be updating web client port forwarding to improve security, reliability, and performance for users. As part of this update, the URL for forwarded ports will change from https://*.preview.app.github.dev to https://*.app.github.dev.
To prepare for this change, replace any hardcoded references to preview.app.github.dev in your code with the GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variable by July 31 to avoid any disruptions. The environment variable value will be updated from preview.app.github.dev to app.github.dev when the migration completes. Learn more about environments variables here.
Today's Changelog brings you sorting improvements, the ability to select a template or form when creating a new issue from your project and adding a new option to a single select field from the side panel!
You can now sort items in a view using two different fields. Select Sort by in the view menu and select a primary sort field, and then hold down Alt (Option on MacOS) to select the secondary sort field.
When creating a new issue directly from a project, you can now choose an issue template or form to apply.
Simply use the + button in the project omnibar and select Create new issue to get started.
We've updated the side panel so that you can add a new option when editing a single-select field. Start typing and you'll be prompted to add a new option if the text doesn't match an existing option.
Export view data now includes the URL for issues and pull requestsAssignee information outside of a projectAssignee values on board itemsYour classic project link now has a working URL after completing migrationSee how to use GitHub for project planning with GitHub Issues, check out what's on the roadmap, and learn more in the docs.
We are excited to enhance the Issue creation experience for GitHub Mobile by introducing a comprehensive Property Bar. This feature allows you to conveniently add assignees, labels, milestones, and projects while creating Issues on GitHub Mobile.
This powerful addition ensures that you have the necessary tools at your fingertips to create your issues with all relevant metadata even quicker than before.
Read more about GitHub Mobile and send us your feedback to help us improve.