Skip to content

Commit 0e2e86c

Browse files
authored
Merge pull request #45400 from github/repo-sync
Repo sync
2 parents 32e1370 + b3b8fb0 commit 0e2e86c

38 files changed

Lines changed: 1203 additions & 187 deletions

File tree

content/admin/data-residency/getting-started-with-data-residency-for-github-enterprise-cloud.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ To migrate existing data to your new enterprise on {% data variables.enterprise.
115115

116116
Optionally, you can migrate data to {% data variables.enterprise.data_residency_site %} during your trial. However, migrated organizations will count towards the limit of three new organizations during the trial.
117117

118-
* If you're migrating from {% data variables.product.prodname_dotcom_the_website %}, {% data variables.product.prodname_ghe_server %}, Azure DevOps, or Bitbucket Server, you can migrate source code history and metadata with {% data variables.product.prodname_importer_proper_name %}. See [AUTOTITLE](/migrations/using-github-enterprise-importer/understanding-github-enterprise-importer/about-github-enterprise-importer).
118+
* If you're migrating from {% data variables.product.prodname_dotcom_the_website %}, {% data variables.product.prodname_ghe_server %}, Azure DevOps, Bitbucket Server, or GitLab, you can migrate source code history and metadata with {% data variables.product.prodname_importer_proper_name %}. See [AUTOTITLE](/migrations/using-github-enterprise-importer/understanding-github-enterprise-importer/about-github-enterprise-importer).
119119
* For migrations from {% data variables.product.prodname_ghe_server %} 3.17 and later, you can use {% data variables.product.prodname_elm %}. This offers less downtime and better support for complex monorepos. See [AUTOTITLE](/migrations/elm/about-live-migrations).
120120
* If you're migrating from a different platform, see [AUTOTITLE](/migrations/overview/migration-paths-to-github#migrations-to-ghecom).
121121

content/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database.md

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -41,17 +41,17 @@ Both of these advisory types are public information about open source packages.
4141

4242
Generally, we name our supported ecosystems after the software programming language's associated package registry. We review advisories if they are for a vulnerability in a package that comes from a supported registry.
4343

44-
* Composer (registry: https://packagist.org/)
45-
* Erlang (registry: https://hex.pm/)
46-
* Go (registry: https://pkg.go.dev/)
47-
* GitHub Actions (https://github.com/marketplace?type=actions/)
48-
* Maven (registry: https://repo.maven.apache.org/maven2)
49-
* Npm (registry: https://www.npmjs.com/)
50-
* NuGet (registry: https://www.nuget.org/)
51-
* Pip (registry: https://pypi.org/)
52-
* Pub (registry: https://pub.dev/packages/registry)
53-
* RubyGems (registry: https://rubygems.org/)
54-
* Rust (registry: https://crates.io/)
44+
* Composer (registry: [https://packagist.org/](https://packagist.org/))
45+
* Erlang (registry: [https://hex.pm/](https://hex.pm/))
46+
* Go (registry: [https://pkg.go.dev/](https://pkg.go.dev/))
47+
* GitHub Actions ([https://github.com/marketplace?type=actions](https://github.com/marketplace?type=actions))
48+
* Maven (registry: [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2))
49+
* Npm (registry: [https://www.npmjs.com/](https://www.npmjs.com/))
50+
* NuGet (registry: [https://www.nuget.org/](https://www.nuget.org/))
51+
* Pip (registry: [https://pypi.org/](https://pypi.org/))
52+
* Pub (registry: [https://pub.dev/packages/registry](https://pub.dev/packages/registry))
53+
* RubyGems (registry: [https://rubygems.org/](https://rubygems.org/))
54+
* Rust (registry: [https://crates.io/](https://crates.io/))
5555
* Swift (registry: N/A)
5656

5757
If you have a suggestion for a new ecosystem we should support, please open an [issue](https://github.com/github/advisory-database/issues) for discussion.
@@ -68,7 +68,13 @@ If you enable {% data variables.product.prodname_dependabot_alerts %} for your r
6868

6969
{% data reusables.advisory-database.malware-overview %}
7070

71-
{% data variables.product.prodname_dependabot %} doesn't generate alerts when malware is detected as most of the vulnerabilities cannot be resolved by downstream users. You can view malware advisories by searching for `type:malware` in the {% data variables.product.prodname_advisory_database %}.
71+
{% ifversion dependabot-malware-alerts-multi-ecosystem %}
72+
73+
When malware alerts are enabled, {% data variables.product.prodname_dependabot %} generates an alert when malware is detected. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-malware-alerts).
74+
75+
{% endif %}
76+
77+
You can view malware advisories by searching for `type:malware` in the {% data variables.product.prodname_advisory_database %}.
7278

7379
Our malware advisories are mostly about substitution attacks. During this type of attack, an attacker publishes a package to the public registry with the same name as a dependency that users rely on from a third party or private registry, with the hope that the malicious version is consumed. {% data variables.product.prodname_dependabot %} doesn't look at project configurations to determine if the packages are coming from a private registry, so we can't determine whether you're using the malicious version or a non-malicious version that has the same name. Users who have their dependencies appropriately scoped should not be affected by malware.
7480

@@ -100,6 +106,7 @@ The {% data variables.product.prodname_advisory_database %} supports both CVSS v
100106
Each security advisory contains information about the vulnerability or malware, which may include the description, severity, affected package, package ecosystem, affected versions and patched versions, impact, and optional information such as references, workarounds, and credits. In addition, advisories from the National Vulnerability Database list contain a link to the CVE record, where you can read more details about the vulnerability, its CVSS scores, and its qualitative severity level. For more information, see the [National Vulnerability Database](https://nvd.nist.gov/) from the National Institute of Standards and Technology.
101107

102108
The severity level is one of four possible levels defined in the [Common Vulnerability Scoring System (CVSS), Section 5](https://www.first.org/cvss/specification-document).
109+
103110
* Low
104111
* Medium/Moderate
105112
* High
@@ -111,7 +118,7 @@ The {% data variables.product.prodname_advisory_database %} uses the CVSS levels
111118

112119
### EPSS scores
113120

114-
The Exploit Prediction Scoring System, or EPSS, is a system devised by the global Forum of Incident Response and Security Teams (FIRST) for quantifying the likelihood of vulnerability exploit. The model produces a probability score between 0 and 1 (0 and 100%), where the higher the score, the greater the probability that a vulnerability will be exploited. For more information about FIRST, see https://www.first.org/.
121+
The Exploit Prediction Scoring System, or EPSS, is a system devised by the global Forum of Incident Response and Security Teams (FIRST) for quantifying the likelihood of vulnerability exploit. The model produces a probability score between 0 and 1 (0 and 100%), where the higher the score, the greater the probability that a vulnerability will be exploited. For more information about FIRST, see [https://www.first.org/](https://www.first.org/).
115122

116123
The {% data variables.product.prodname_advisory_database %} includes EPSS scores from FIRST for advisories containing CVEs with corresponding EPSS data. {% data variables.product.company_short %} also displays the EPSS score percentile, which is the proportion of all scored vulnerabilities with the same or a lower EPSS score.
117124

content/code-security/reference/supply-chain-security/dependabot-options-reference.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -563,7 +563,7 @@ Package manager | YAML value | Supported versions |
563563
| {% ifversion dependabot-bazel-support %} |
564564
| Bazel | `bazel` | v7, v8, v9 |
565565
| {% endif %} |
566-
| Bun | `bun` | >=v1.2.5 |
566+
| Bun | `bun` | >=v1.1.39 |
567567
| Bundler | `bundler` | v2 |
568568
| Cargo | `cargo` | v1 |
569569
| Composer | `composer` | v2 |
@@ -593,14 +593,14 @@ Package manager | YAML value | Supported versions |
593593
| {% ifversion dependabot-nix-support %} |
594594
| Nix flakes | `nix` | Not applicable |
595595
| {% endif %} |
596-
| npm | `npm` | v7, v8, v9, v10 |
596+
| npm | `npm` | v7, v8, v9, v10, v11 |
597597
| NuGet | `nuget` | <=6.12.0 |
598598
| {% ifversion dependabot-opentofu-support %} |
599599
| OpenTofu | `opentofu` | Not applicable |
600600
| {% endif %} |
601-
| pip | `pip` | 24.2 |
601+
| pip | `pip` | 26.1.1 |
602602
| pip-compile | `pip` | 7.5.3 |
603-
| pipenv | `pip` | <= 2024.4.1 |
603+
| pipenv | `pip` | 2024.4.1 |
604604
| pnpm | `npm` | v7, v8, v9, v10 |
605605
| poetry | `pip` | v2 |
606606
| {% ifversion dependabot-pre-commit-support %} |
@@ -614,7 +614,7 @@ Package manager | YAML value | Supported versions |
614614
| sbt | `sbt` | Not applicable |
615615
| {% endif %} |
616616
| Swift | `swift` | v5 |
617-
| Terraform | `terraform` | >= 0.13, <= 1.10.x |
617+
| Terraform | `terraform` | >= 0.13, <= 1.15.x |
618618
| uv | `uv` | v0 |
619619
| {% ifversion dependabot-vcpkg-support %} |
620620
| vcpkg | `vcpkg` | Not applicable |

content/migrations/ado/follow-up-tasks.md

Lines changed: 1 addition & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -12,48 +12,7 @@ redirect_from:
1212
- /migrations/ado/phase-6-follow-up-tasks
1313
---
1414

15-
## Checking the migration status
16-
17-
First, check whether your migration succeeded or failed.
18-
19-
The way you check the status of your migration depends on how you ran the migration.
20-
21-
* If you ran the migration using the {% data variables.product.prodname_cli %}, by default, the process will display whether the migration succeeded or failed once the migration is complete. If the migration failed, you will see the reason for failure.
22-
23-
```text
24-
Migration completed (ID: RM_123)! State: SUCCEEDED
25-
```
26-
27-
* If you ran the migration using the {% data variables.product.prodname_cli %} with the optional `--queue-only` argument, the process will exit immediately after queueing the migration, and will not tell you if the migration succeeded or failed. You can check a migration's status using the `wait-for-migration` command, or by reviewing the migration log.
28-
29-
## Reviewing the migration log
30-
31-
You should review the migration log for each migrated repository. People with read access to a repository can access the migration log for the repository on {% data variables.product.prodname_dotcom %}.
32-
33-
1. Navigate to the migrated repository in your destination organization.
34-
{% data reusables.repositories.sidebar-issues %}
35-
1. Click the issue with the title "Migration Log."
36-
37-
For more information, see [AUTOTITLE](/migrations/using-github-enterprise-importer/completing-your-migration-with-github-enterprise-importer/accessing-your-migration-logs-for-github-enterprise-importer).
38-
39-
## Setting repository visibility
40-
41-
{% data reusables.enterprise-migration-tool.setting-repository-visibility %}
42-
43-
For example, replace YOUR_ORG with your organization name, and the command below will set all of the organization's repositories to internal visibility.
44-
45-
```bash copy
46-
export ORG=YOUR_ORG
47-
gh repo list "$ORG" --limit 100000 --json name -q '.[].name' | xargs -I{} gh repo edit "$ORG/{}" --visibility internal
48-
```
49-
50-
## Reclaiming mannequins
51-
52-
{% data reusables.enterprise-migration-tool.reclaiming-mannequins %}
53-
54-
## Configuring IP allow lists
55-
56-
If you added the IP ranges for {% data variables.product.prodname_importer_proper_name %} to the IP allow list for your destination organization, you can remove those entries. {% data reusables.enterprise-migration-tool.reenable-idp-ip-restrictions %}
15+
{% data reusables.enterprise-migration-tool.follow-up-tasks-common %}
5716

5817
## Configure Azure Pipelines and Azure Boards
5918

content/migrations/ado/understand-migrations-from-azure-devops-to-github.md

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -46,21 +46,4 @@ If you want to migrate Azure Pipelines to {% data variables.product.prodname_act
4646
* Attachments on pull requests
4747
* Branch policies for the repository (user-scoped branch policies and cross-repo branch policies are not included)
4848

49-
## Limitations on migrated data
50-
51-
There are limits to what {% data variables.product.prodname_importer_proper_name %} can migrate. Some are due to limitations of {% data variables.product.prodname_dotcom %}, while others are limitations of {% data variables.product.prodname_importer_proper_name %} itself.
52-
53-
### Limitations of {% data variables.product.prodname_dotcom %}
54-
55-
* **2 GiB size limit for a single Git commit:** No single commit in your Git repository can be larger than 2 GiB. If any of your commits are larger than 2 GiB, you will need to split the commit into smaller commits that are each 2 GiB or smaller.
56-
* **255 byte limit for Git references:** No single Git reference, commonly known as a "ref", can have a name larger than 255 bytes. Usually, this means that your references cannot be more than 255 characters long, but any non-ASCII characters, such as emojis, may consume more than one byte. If any of your Git references are too large, we'll return a clear error message.
57-
* **100 MiB file size limit:** After you complete your migration, no single file in your Git repository can be larger than 100 MiB. During repository migration this limit is increased to 400 MiB. Consider using {% data variables.large_files.product_name_short %} to store large files.
58-
59-
### Limitations of {% data variables.product.prodname_importer_proper_name %}
60-
61-
* {% data reusables.enterprise-migration-tool.git-repo-size-limit %}
62-
* **400 MiB file size limit:** When migrating a repository with {% data variables.product.prodname_importer_proper_name %}, no single file in your Git repository can be larger than 400 MiB. Consider using {% data variables.large_files.product_name_short %} for storing large files.
63-
* **{% data variables.large_files.product_name_short %} objects not migrated:** The {% data variables.product.prodname_importer_secondary_name %} can migrate repositories that use {% data variables.large_files.product_name_short %}, but the LFS objects themselves will not be migrated. They can be pushed to your migration destination as a follow-up task after the migration is complete.
64-
* **Delayed code search functionality:** Re-indexing the search index can take a few hours after a repository is migrated, and code searches may return unexpected results until re-indexing is complete.
65-
* **Rulesets configured for your organization can cause migrations to fail:** For example, if you configured a rule that requires email addresses for commit authors to end with `@monalisa.cat`, and the repository you're migrating contains commits that don't comply with this rule, your migration will fail.
66-
* **Mannequin content might not be searchable:** Mannequins are placeholder users to which imported content (such as issues, pull requests, comments, etc.) is associated. When you search for content associated with a mannequin, such as assigned issues, the issues may not be found. Once a mannequin is reclaimed, the content should be found via the new owner.
49+
{% data reusables.enterprise-migration-tool.migration-data-limitations %}

content/migrations/overview/migration-paths-to-github.md

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -101,10 +101,7 @@ Migrations from {% data variables.product.prodname_dotcom_the_website %} include
101101

102102
* **Scope:** Source, history, and metadata
103103
* **Tooling:** {% data variables.product.prodname_importer_proper_name %}
104-
* **More information:** [{% data variables.product.prodname_expert_services %}](https://github.com/services/) website
105-
* **Caveats:**
106-
* If you want to migrate GitLab repositories to GitHub using {% data variables.product.prodname_importer_proper_name %}, please contact our {% data variables.product.prodname_expert_services %} team.
107-
* {% data reusables.migrations.migration-instructions-for-any-git-repository-to-githubcom %}
104+
* **More information:** [AUTOTITLE]({% ifversion ghes %}/free-pro-team@latest{% endif %}/migrations/using-github-enterprise-importer/migrate-from-gitlab)
108105

109106
### Any Git repository to {% data variables.product.prodname_dotcom_the_website %}
110107

@@ -233,10 +230,8 @@ Follow a link below to review the scope and tooling for your migration to {% dat
233230
### GitLab to {% data variables.enterprise.data_residency_site %}
234231

235232
* **Scope:** Source, history, and metadata
236-
* **Tooling:** Contact {% data variables.product.prodname_expert_services %}
237-
* **More information:** [{% data variables.product.prodname_expert_services %}](https://github.com/services/) website
238-
* **Caveats:**
239-
* {% data reusables.migrations.migration-instructions-for-any-git-repository-to-ghecom %}
233+
* **Tooling:** {% data variables.product.prodname_importer_proper_name %}
234+
* **More information:** [AUTOTITLE]({% ifversion ghes %}/free-pro-team@latest{% endif %}/migrations/using-github-enterprise-importer/migrate-from-gitlab)
240235

241236
### Any Git repository to {% data variables.enterprise.data_residency_site %}
242237

content/migrations/using-github-enterprise-importer/completing-your-migration-with-github-enterprise-importer/reclaiming-mannequins-for-github-enterprise-importer.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,9 @@ The exact command you need to use depends on which extension of the {% data vari
3838
* [Reclaiming mannequins with the {% data variables.product.prodname_gei_cli_short %}](#reclaiming-mannequins-with-the-gei-extension)
3939
* [Reclaiming mannequins with the {% data variables.product.prodname_ado2gh_cli_short %}](#reclaiming-mannequins-with-the-ado2gh-extension)
4040
* [Reclaiming mannequins with the {% data variables.product.prodname_bbs2gh_cli_short %}](#reclaiming-mannequins-with-the-bbs2gh-extension)
41+
{%- ifversion fpt or ghec %}
42+
* [Reclaiming mannequins with the {% data variables.product.prodname_gl2gh_cli_short %}](#reclaiming-mannequins-with-the-gl2gh-extension)
43+
{%- endif %}
4144

4245
#### Reclaiming mannequins with the {% data variables.product.prodname_gei_cli_short %}
4346

@@ -141,6 +144,44 @@ If your migration source is Bitbucket Server, you can reclaim mannequins with th
141144

142145
{% data reusables.enterprise-migration-tool.mannequin-reclaim-must-accept %}
143146

147+
{% ifversion fpt or ghec %}
148+
149+
#### Reclaiming mannequins with the {% data variables.product.prodname_gl2gh_cli_short %}
150+
151+
If your migration source is GitLab, you can reclaim mannequins with the {% data variables.product.prodname_gl2gh_cli %}.
152+
153+
* If you don't already have a `GH_PAT` environment variable set for a {% data variables.product.pat_generic %} with access to the destination organization, add `--github-pat TOKEN` to each command below, replacing `TOKEN` with the {% data variables.product.pat_generic %}. For {% data variables.product.pat_generic %} requirements, see [AUTOTITLE](/migrations/using-github-enterprise-importer/migrate-from-gitlab/manage-access).
154+
* {% data reusables.enterprise-migration-tool.add-target-api-url %}
155+
156+
{% data reusables.enterprise-migration-tool.create-csv-mannequins %}
157+
158+
* To generate a CSV file with a list of mannequins for an organization, use the `gh gl2gh generate-mannequin-csv` command, replacing DESTINATION with the destination organization and FILENAME with a file name for the resulting CSV file.
159+
160+
{% data reusables.enterprise-migration-tool.include-reclaimed %}
161+
162+
```shell copy
163+
gh gl2gh generate-mannequin-csv --github-org DESTINATION --output FILENAME.csv
164+
```
165+
166+
{% data reusables.enterprise-migration-tool.edit-csv %}
167+
1. To reclaim mannequins, use the `gh gl2gh reclaim-mannequin` command.
168+
169+
{% data reusables.enterprise-migration-tool.reclaim-bulk-csv %}
170+
171+
```shell copy
172+
gh gl2gh reclaim-mannequin --github-org DESTINATION --csv FILENAME.csv
173+
```
174+
175+
{% data reusables.enterprise-migration-tool.reclaim-individual-mannequin %}
176+
177+
```shell copy
178+
gh gl2gh reclaim-mannequin --github-org DESTINATION --mannequin-user MANNEQUIN --target-user USERNAME
179+
```
180+
181+
{% data reusables.enterprise-migration-tool.mannequin-reclaim-must-accept %}
182+
183+
{% endif %}
184+
144185
### Reclaiming mannequins in your browser
145186
146187
{% data reusables.elm.reclaim-mannequins-in-browser %}

content/migrations/using-github-enterprise-importer/index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ children:
1010
- /understanding-github-enterprise-importer
1111
- /migrating-from-bitbucket-server-to-github-enterprise-cloud
1212
- /migrating-between-github-products
13+
- /migrate-from-gitlab
1314
- /completing-your-migration-with-github-enterprise-importer
1415
redirect_from:
1516
- /early-access/github/migrating-with-github-enterprise-importer

0 commit comments

Comments
 (0)