Skip to content

Commit

Permalink
Hack week 2025: remove unneeded FBV instances (6) - Actions & Audit l…
Browse files Browse the repository at this point in the history
…og (#53898)

Co-authored-by: Felicity Chapman <[email protected]>
  • Loading branch information
mchammer01 and felicitymay authored Jan 15, 2025
1 parent 5ced8c0 commit 29ce876
Show file tree
Hide file tree
Showing 18 changed files with 16 additions and 41 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,9 @@ Then,{% else %}First,{% endif %} decide whether you'll allow third-party actions

For more information, see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#managing-github-actions-permissions-for-your-repository), [AUTOTITLE](/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#managing-github-actions-permissions-for-your-organization), and [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-to-restrict-the-use-of-github-actions-in-your-enterprise).

{% ifversion ghec or ghes %}
Consider combining OpenID Connect (OIDC) with reusable workflows to enforce consistent deployments across your repository, organization, or enterprise. You can do this by defining trust conditions on cloud roles based on reusable workflows. For more information, see [AUTOTITLE](/actions/deployment/security-hardening-your-deployments/using-openid-connect-with-reusable-workflows).
{% endif %}

You can access information about activity related to {% data variables.product.prodname_actions %} in the audit logs for your enterprise. If your business needs require retaining this information longer than audit log data is retained, plan how you'll export and store this data outside of {% data variables.product.prodname_dotcom %}. For more information, see {% ifversion ghec %}[AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise) and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise).{% else %}{% ifversion audit-log-streaming %}[AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise) and {% endif %}[AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/exploring-user-activity/log-forwarding).{% endif %}
You can access information about activity related to {% data variables.product.prodname_actions %} in the audit logs for your enterprise. If your business needs require retaining this information longer than audit log data is retained, plan how you'll export and store this data outside of {% data variables.product.prodname_dotcom %}. For more information, see {% ifversion ghec %}[AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise) and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise).{% else %}[AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise) and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/exploring-user-activity/log-forwarding).{% endif %}

{% ifversion custom-org-roles %}You can practice the principle of least privilege by administering custom organization roles for access to settings in your {% data variables.product.prodname_actions %} CI/CD pipeline. For more information about custom organization roles, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles).{% endif %}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -43,14 +43,12 @@ In addition to viewing your audit log, you can monitor activity in your enterpri
As an enterprise owner{% ifversion ghes %} or site administrator{% endif %}, you can interact with the audit log data for your enterprise in several ways:
* You can view the audit log for your enterprise. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/accessing-the-audit-log-for-your-enterprise).
* You can search the audit log for specific events{% ifversion ghec %} and export audit log data{% endif %}. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/searching-the-audit-log-for-your-enterprise){% ifversion ghec %} and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise){% endif %}.{% ifversion token-audit-log %}
* You can identify all events that were performed by a specific access token. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token).{% endif %}{% ifversion audit-data-retention-tab %}
* You can identify all events that were performed by a specific access token. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token).{% endif %}{% ifversion ghes %}
* You can configure settings, such as the retention period for audit log events{% ifversion enable-git-events %} and whether Git events are included{% endif %}. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/configuring-the-audit-log-for-your-enterprise).{% endif %}
{%- ifversion enterprise-audit-log-ip-addresses %}
* You can display the IP address associated with events in the audit log. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/displaying-ip-addresses-in-the-audit-log-for-your-enterprise).
{%- endif %}
{%- ifversion audit-log-streaming %}
* You can stream audit and Git events data from {% data variables.product.prodname_dotcom %} to an external data management system. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise).
{%- endif %}
{%- ifversion ghes %}
* You can forward audit and system logs, from your enterprise to an third-party hosted monitoring system. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/exploring-user-activity/log-forwarding).
{%- endif %}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ intro: You can configure settings for your enterprise's audit log.
shortTitle: Configure audit logs
permissions: Enterprise owners can configure the audit log.
versions:
feature: audit-data-retention-tab
ghes: '*'
type: how_to
topics:
- Auditing
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
title: Streaming the audit log for your enterprise
intro: 'Learn how to stream audit and Git events data from {% data variables.product.prodname_dotcom %} to an external data management system.'
versions:
feature: audit-log-streaming
ghes: '*'
ghec: '*'
type: tutorial
topics:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ For a list of audit log events, see [AUTOTITLE](/admin/monitoring-activity-in-yo

For information on how to access the audit log for your enterprise or organization, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/accessing-the-audit-log-for-your-enterprise) and [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization).

{% ifversion audit-log-streaming %}
{% ifversion ghec or ghes %}

You can also stream audit data from {% data variables.product.prodname_dotcom %} to an external data management system, which enables you to analyze and collect data for internal charts. Enterprise owners can configure audit log streaming. For more information, see [Streaming the audit log for your enterprise](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise).

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -276,10 +276,6 @@ To avoid exceeding a rate limit, you should pause at least 1 second between muta

You should also subscribe to webhook events instead of polling the API for data. For more information, see [AUTOTITLE](/webhooks).

{% ifversion audit-log-streaming %}

You can also stream the audit log in order to view API requests. This can help you troubleshoot integrations that are exceeding the rate limit. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise).

{% endif %}

{% endif %}
Original file line number Diff line number Diff line change
Expand Up @@ -171,23 +171,19 @@ By default, when you create a new organization,{% ifversion ghec or ghes %} the
{% data reusables.actions.workflows.github-token-access %}
1. Click **Save** to apply the settings.

{% ifversion allow-actions-to-approve-pr %}

### Preventing {% data variables.product.prodname_actions %} from {% ifversion allow-actions-to-approve-pr-with-ent-repo %}creating or {% endif %}approving pull requests
### Preventing {% data variables.product.prodname_actions %} from creating or approving pull requests

{% data reusables.actions.workflow-pr-approval-permissions-intro %}

By default, when you create a new organization, workflows are not allowed to {% ifversion allow-actions-to-approve-pr-with-ent-repo %}create or {% endif %}approve pull requests.
By default, when you create a new organization, workflows are not allowed to create or approve pull requests.

{% data reusables.profile.access_profile %}
{% data reusables.profile.access_org %}
{% data reusables.profile.org_settings %}
{% data reusables.organizations.settings-sidebar-actions-general %}
1. Under "Workflow permissions", use the **Allow GitHub Actions to {% ifversion allow-actions-to-approve-pr-with-ent-repo %}create and {% endif %}approve pull requests** setting to configure whether `GITHUB_TOKEN` can {% ifversion allow-actions-to-approve-pr-with-ent-repo %}create and {% endif %}approve pull requests.
1. Under "Workflow permissions", use the **Allow GitHub Actions to create and approve pull requests** setting to configure whether `GITHUB_TOKEN` can create and approve pull requests.
1. Click **Save** to apply the settings.

{% endif %}

## Managing {% data variables.product.prodname_actions %} cache storage for your organization

Organization administrators can view {% ifversion ghes %}and manage {% endif %}{% data variables.product.prodname_actions %} cache storage for all repositories in the organization.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ To perform any actions on {% data variables.product.product_name %}, such as cre

Within an organization, you can assign roles at the organization, team, and repository level. For more information about the different levels of roles, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization).

You can have more granular control over the permissions you grant at the repository level by creating up to {% ifversion authz-increased-custom-repo-roles %}five {% else %}three {% endif %} custom repository roles. {% data reusables.organizations.about-custom-repo-roles %} For more information, see [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization).
You can have more granular control over the permissions you grant at the repository level by creating up to five custom repository roles. {% data reusables.organizations.about-custom-repo-roles %} For more information, see [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-custom-repository-roles-for-an-organization).

After you create a custom role, anyone with admin access to a repository can assign the role to an individual or team. For more information, see [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-an-individuals-access-to-an-organization-repository) and [AUTOTITLE](/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/managing-team-access-to-an-organization-repository).

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -101,8 +101,6 @@ By default, when you create a new repository in your personal account, `GITHUB_T
{% data reusables.actions.workflows.github-token-access %}
1. Click **Save** to apply the settings.

{% ifversion allow-actions-to-approve-pr-with-ent-repo %}

### Preventing {% data variables.product.prodname_actions %} from creating or approving pull requests

{% data reusables.actions.workflow-pr-approval-permissions-intro %}
Expand All @@ -116,7 +114,6 @@ By default, when you create a new repository in your personal account, workflows
{% data reusables.repositories.settings-sidebar-actions-general %}
1. Under "Workflow permissions", use the **Allow GitHub Actions to create and approve pull requests** setting to configure whether `GITHUB_TOKEN` can create and approve pull requests.
1. Click **Save** to apply the settings.
{% endif %}

{% ifversion ghes or ghec %}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,11 @@ shortTitle: Configure autolinks

Anyone with admin permissions to a repository can configure autolink references to link issues, pull requests, commit messages, and release descriptions to external third-party services.

{% ifversion autolink-reference-alphanumeric %}
Autolink references can now accept alphanumeric characters. When originally introduced, custom autolinks were limited to external resources that used numeric identifiers. Custom autolinks now work with alphanumeric and numeric identifiers.

You define custom autolinks by specifying a reference prefix and a target URL.
* Reference prefixes cannot have overlapping names. For example, a repository cannot have two custom autolinks with prefixes such as `TICKET` and `TICK`, since both prefixes would match the string `TICKET123a`.
* Target URLs include a `<num>` variable which represents the reference identifier of the linked resource.
{% endif %}

## Configuring autolinks to reference external resources

Expand All @@ -37,9 +35,7 @@ This procedure demonstrates how to configure autolinks to reference external res
1. At the top right of the page, click **Add autolink reference**.

![Screenshot of the "autolink references" page. The "Add autolink reference" button is highlighted by a dark orange outline.](/assets/images/help/repository/add-autolink-reference-details.png)
{% ifversion autolink-reference-alphanumeric %}
1. Select the format of the reference identifier used in the external resource, either **Alphanumeric** or **Numeric**.
{% endif %}
1. Under "Reference prefix", type a short, meaningful prefix. Collaborators will use this text to generate autolinks for the external resource.
1. Under "Target URL", type the format of the link to the external system you want to create. Use the `<num>` variable as a placeholder for the reference identifier.
1. Review the preview and verify that the autolink and external reference are both correct, then click **Add autolink reference** to define the link.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ Continuing to make requests while you are rate limited may result in the banning

You should follow best practices to help you stay under the rate limits. See [AUTOTITLE](/rest/guides/best-practices-for-using-the-rest-api).

{% ifversion audit-log-streaming %}
{% ifversion ghec or ghes %}

You can also stream the audit log in order to view API requests. This can help you troubleshoot integrations that are exceeding the rate limit. See [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise).

Expand Down
2 changes: 1 addition & 1 deletion data/reusables/actions/actions-do-not-trigger-workflows.md
Original file line number Diff line number Diff line change
@@ -1 +1 @@
When you use the repository's `GITHUB_TOKEN` to perform tasks, events triggered by the `GITHUB_TOKEN`{% ifversion actions-token-updated-triggers %}, with the exception of `workflow_dispatch` and `repository_dispatch`,{% endif %} will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs. For example, if a workflow run pushes code using the repository's `GITHUB_TOKEN`, a new workflow will not run even when the repository contains a workflow configured to run when `push` events occur.
When you use the repository's `GITHUB_TOKEN` to perform tasks, events triggered by the `GITHUB_TOKEN`, with the exception of `workflow_dispatch` and `repository_dispatch`, will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs. For example, if a workflow run pushes code using the repository's `GITHUB_TOKEN`, a new workflow will not run even when the repository contains a workflow configured to run when `push` events occur.
4 changes: 0 additions & 4 deletions data/reusables/actions/inputs-vs-github-event-inputs.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,4 @@
{% ifversion actions-unified-inputs %}

> [!NOTE]
> * The workflow will also receive the inputs in the `github.event.inputs` context. The information in the `inputs` context and `github.event.inputs` context is identical except that the `inputs` context preserves Boolean values as Booleans instead of converting them to strings. The `choice` type resolves to a string and is a single selectable option.
> * The maximum number of top-level properties for `inputs` is 10.
> * The maximum payload for `inputs` is 65,535 characters.
{% endif %}
4 changes: 2 additions & 2 deletions data/reusables/actions/workflow-dispatch-inputs-example.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@ on:
jobs:
print-tag:
runs-on: ubuntu-latest
if: {% ifversion actions-unified-inputs %}{% raw %} ${{ inputs.print_tags }} {% endraw %}{% else %}{% raw %} ${{ github.event.inputs.print_tags == 'true' }} {% endraw %}{% endif %}
if:{% raw %} ${{ inputs.print_tags }} {% endraw %}
steps:
- name: Print the input tag to STDOUT
run: {% ifversion actions-unified-inputs %}echo {% raw %} The tags are ${{ inputs.tags }} {% endraw %}{% else %}echo {% raw %} The tags are ${{ github.event.inputs.tags }} {% endraw %}{% endif %}
run: echo {% raw %} The tags are ${{ inputs.tags }} {% endraw %}
```
2 changes: 1 addition & 1 deletion data/reusables/actions/workflow-dispatch-inputs.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
The triggered workflow receives the inputs in the {% ifversion actions-unified-inputs %}`inputs`{% else %}`github.event.inputs`{% endif %} context. For more information, see [Contexts]({% ifversion actions-unified-inputs %}/actions/learn-github-actions/contexts#inputs-context{% else %}/actions/learn-github-actions/contexts#github-context{% endif %}).
The triggered workflow receives the inputs in the `inputs` context. For more information, see [Contexts](/actions/learn-github-actions/contexts#inputs-context).

{% data reusables.actions.inputs-vs-github-event-inputs %}
Original file line number Diff line number Diff line change
@@ -1 +1 @@
You can choose to allow or prevent {% data variables.product.prodname_actions %} workflows from{% ifversion allow-actions-to-approve-pr-with-ent-repo %} creating or{% endif %} approving pull requests.
You can choose to allow or prevent {% data variables.product.prodname_actions %} workflows from creating or approving pull requests.
2 changes: 0 additions & 2 deletions data/reusables/audit_log/audit-log-action-categories.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,7 @@
| `advisory_credit` | Contains activities related to crediting a contributor for a security advisory in the {% data variables.product.prodname_advisory_database %}. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories). |
| {% endif %} |
| `artifact` | Contains activities related to {% data variables.product.prodname_actions %} workflow run artifacts. |
| {% ifversion audit-log-streaming %} |
| `audit_log_streaming` | Contains activities related to streaming audit logs for organizations in an enterprise account. |
| {% endif %} |
| {% ifversion fpt or ghec %} |
| `billing` | Contains activities related to an organization's billing. |
| {% endif %} |
Expand Down
Loading

0 comments on commit 29ce876

Please sign in to comment.