Repo sync

content/apps/creating-github-apps/registering-a-github-app/using-webhooks-with-github-apps.md

@@ -33,7 +33,7 @@ When you activate webhooks for your {% data variables.product.prodname_github_ap
 
 ### Choosing a webhook URL for development and testing
 
-While you develop and test your app, you can use a webhook payload delivery service like [Smee](https://smee.io/) to capture and forward webhook payloads to your local development environment. Never use Smee for an application in production, because Smee channels are not authenticated or secure. Alternatively, you can use a tool like [ngrok](https://ngrok.com/docs/getting-started/), [localtunnel](https://localtunnel.github.io/www/), or the [Hookdeck Console](https://console.hookdeck.com?provider=github) that exposes your local machine to the internet to receive the payloads.
+While you develop and test your app, you can use a webhook payload delivery service like [Smee](https://smee.io/) to capture and forward webhook payloads to your local development environment. Never use Smee for an application in production, because Smee channels are not authenticated or secure. Alternatively, you can use a tool like [ngrok](https://ngrok.com/docs/getting-started/), [localtunnel](https://localtunnel.github.io/www/), or the [Hookdeck CLI](https://hookdeck.com/docs/cli) that exposes your local machine to the internet to receive the payloads. To view payloads in your browser without running a server, use [Hookdeck Inspect](https://inspect.hookdeck.com/webhooks/github).
 
 #### Creating a webhook URL with Smee
 
@@ -47,7 +47,7 @@ You can use Smee to create a unique domain where {% data variables.product.prodn
 
 For an application in production that receives a low volume of webhook traffic, you can host it on any dynamic application server. The server-side code for handling the webhook can receive the event, deserialize its JSON payload, and decide what action to take, such as storing the data in a database or calling the {% data variables.product.prodname_dotcom %} API.
 
-To handle a higher volume of webhook traffic for a large app in production, consider using asynchronous webhook handling on a dedicated server. You can achieve this by employing a queue, where the webhook handler pushes data to the queue, and separate processes perform subsequent actions based on the events. Additionally, you can use cloud functions such as [Azure Functions](https://azure.microsoft.com/en-us/products/functions/), [AWS Lambda](https://aws.amazon.com/lambda/), or [Hookdeck](https://hookdeck.com) to help scale the app for handling large volumes of webhook events.
+To handle a higher volume of webhook traffic for a large app in production, consider using asynchronous webhook handling on a dedicated server. You can achieve this by employing a queue, where the webhook handler pushes data to the queue, and separate processes perform subsequent actions based on the events. Additionally, you can use cloud functions such as [Azure Functions](https://azure.microsoft.com/en-us/products/functions/), [AWS Lambda](https://aws.amazon.com/lambda/), or a webhook queuing service like [Hookdeck Event Gateway](https://hookdeck.com/event-gateway), to help scale the app for handling large volumes of webhook events.
 
 ## Securing your webhooks with a webhook secret
 

content/contributing/writing-for-github-docs/creating-reusable-content.md

@@ -30,20 +30,16 @@ Reusables can include Liquid conditionals to conditionally render content depend
 
 Variables are short strings of reusable text.
 
-We use YAML files for variables.
+We use YAML files for variables. Define each variable as a string value with a top-level key. You can organize the files in subdirectories.
 
 The path, filename, and keys within each YAML file determine what its path will be in the data object.
 
 For example, this YAML file, `{% raw %}data/variables/foo/bar.yml{% endraw %}`, contains two variables:
 
 ```yaml
 # the YAML file can contain multiple short strings in one file
-meaning_of_life: 42
-
-# the strings can also be nested if needed
-nested:
-  values:
-    too: Yes!
+meaning_of_life: '42'
+affirmation: 'Yes!'
 ```
 
-The values would be accessible as `{% raw %}{% data foo.bar.meaning_of_life %}{% endraw %}` and `{% raw %}{% data foo.bar.nested.values.too %}{% endraw %}`.
+The values would be accessible as `{% raw %}{% data variables.foo.bar.meaning_of_life %}{% endraw %}` and `{% raw %}{% data variables.foo.bar.affirmation %}{% endraw %}`.

content/copilot/how-tos/troubleshoot-copilot/troubleshoot-network-errors.md

@@ -42,6 +42,17 @@ If you're specifically having difficulty with {% data variables.copilot.copilot_
 
 If you're unable to connect and the `curl` requests don't help to identify the error, it may help to collect detailed diagnostic logs in your editor. If you're working with your company's IT department or {% data variables.contact.contact_support_page %}, sharing these diagnostics may help to resolve the error. Enabling debug logging in your editor will help you to share more specific information. For more information, see [AUTOTITLE](/copilot/how-tos/troubleshoot-copilot/view-logs).
 
+## Troubleshooting cloud-session WebSocket connections
+
+Cloud sessions in your browser use secure WebSocket connections to Azure Web PubSub. If a session fails to connect or stops showing updates, a firewall, proxy, VPN, or security tool may be blocking or interrupting that connection. A successful HTTPS request to a {% data variables.product.github %} endpoint doesn't test this separate connection.
+
+1. Open your browser's developer tools and use the network panel to inspect WebSocket requests while starting the affected session. Look for a request to a hostname ending in `.webpubsub.azure.com`. Record the hostname, the time of the failure, and any error message. Don't share the full connection URL, which can contain an access token. Before sharing error messages, screenshots, or network logs, remove access tokens, cookies, and URL query strings.
+1. Ask your network administrator to confirm that the required hostname is allowed, and that your proxy or firewall supports secure WebSocket traffic on TCP port 443 and ongoing messages in both directions. See [AUTOTITLE](/copilot/reference/copilot-allowlist-reference#websocket-connections-for-cloud-sessions).
+1. If your network uses TLS inspection, ask your network security team to check whether inspection is interfering with the connection. If they confirm interference, any inspection exception must follow your organization's security policy and be limited to the required hosts. Don't disable certificate validation.
+1. Retry the affected session and confirm that it connects and receives updates, because an HTTP `101 Switching Protocols` response only confirms the WebSocket upgrade.
+
+If the problem continues, contact {% data variables.contact.github_support %} with the session URL, the time of the failure, the WebSocket hostname, and any error messages. A network configuration change won't resolve every session-startup failure.
+
 ## Troubleshooting proxy errors
 
 If there is a problem with your proxy setup, you may see the following error: `{% data variables.product.prodname_copilot %} could not connect to server. Extension activation failed: "read ETIMEDOUT" or "read ECONNRESET"`. This error can be caused by a range of network issues.

content/copilot/how-tos/use-copilot-agents/use-code-review.md

@@ -147,7 +147,7 @@ To provide feedback on a review comment from {% data variables.product.prodname_
 You can request an initial review of a highlighted selection of code in {% data variables.product.prodname_vscode %}.
 
 1. In {% data variables.product.prodname_vscode %}, select the code you want to review.
-1. Right-click the selected code and choose **Generate Code** > **Review**.
+1. Right-click the selected code and choose **Review**.
 1. {% data variables.product.prodname_vscode_shortname %} creates review comments in the **Comments** panel and also shows them inline in the editor.
 
 ### Reviewing all uncommitted changes

content/copilot/reference/copilot-allowlist-reference.md

@@ -55,6 +55,13 @@ The following table lists specific domains required for {% data variables.produc
 | `https://copilot-reports.github.com`                        | {% data variables.product.prodname_copilot_short %} usage metrics report downloads | `*.github.com` |
 | `https://copilot-reports-*.b01.azurefd.net`                 | {% data variables.product.prodname_copilot_short %} usage metrics report downloads (fallback). Required for fallback scenarios where downloads bypass the custom domain and are served from an Azure Front Door CDN. | Not included |
 | `https://usagereports*.blob.core.windows.net`               | {% data variables.product.prodname_copilot_short %} usage metrics report downloads (fallback). Required for fallback scenarios where downloads bypass the Azure Front Door CDN and are served directly from Azure Blob Storage. | Not included |
+| `wss://production-copilot-host-centralus.webpubsub.azure.com` | Real-time WebSocket connection used by {% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} to stream events and updates. Allow secure WebSocket traffic over TCP port 443. | Not included |
+| `wss://production-copilot-host-centralus-02.webpubsub.azure.com` | Real-time WebSocket connection used by {% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} to stream events and updates. Allow secure WebSocket traffic over TCP port 443. | Not included |
+| `wss://production-copilot-host-eastasia.webpubsub.azure.com`  | Real-time WebSocket connection used by {% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} to stream events and updates. Allow secure WebSocket traffic over TCP port 443. | Not included |
+| `wss://production-copilot-host-austriaeast.webpubsub.azure.com` | Real-time WebSocket connection used by {% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} to stream events and updates. Allow secure WebSocket traffic over TCP port 443. | Not included |
+| `wss://production-copilot-host-westus.webpubsub.azure.com`    | Real-time WebSocket connection used by {% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} to stream events and updates. Allow secure WebSocket traffic over TCP port 443. | Not included |
+| `wss://production-copilot-host-westus3.webpubsub.azure.com`   | Real-time WebSocket connection used by {% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} to stream events and updates. Allow secure WebSocket traffic over TCP port 443. | Not included |
+| `wss://production-copilot-host.webpubsub.azure.com`         | Real-time WebSocket connection used by {% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} to stream events and updates. Allow secure WebSocket traffic over TCP port 443. | Not included |
 
 ## {% data variables.product.prodname_copilot_short %} on {% data variables.enterprise.data_residency_site %}
 
@@ -69,12 +76,22 @@ If you use {% data variables.enterprise.data_residency %}, your enterprise and {
 
 1. If you plan to use public code detection, allow access to `https://origin-tracker.githubusercontent.com`. This is required to check generated code against public code hosted on {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/copilot/concepts/copilot-surfaces/copilot-in-ides#references-to-matching-public-code).
 
+1. For cloud sessions in your browser, also allow the Azure Web PubSub hostname used by your enterprise. Find the exact hostname ending in `.webpubsub.azure.com` in the WebSocket request in your browser's developer tools while starting a session, or contact {% data variables.contact.github_support %} to confirm it. Allow secure WebSocket traffic over TCP port 443 to that hostname.
+
 All other domains that are required on {% data variables.product.prodname_dotcom_the_website %} are **not** required on {% data variables.enterprise.data_residency_site %}. For example:
 
 * Individual services have a dedicated endpoint on your subdomain (such as `https://copilot-proxy.SUBDOMAIN.ghe.com/`)
 * Client experimentation is disabled on {% data variables.enterprise.data_residency_site %}, so `https://default.exp-tas.com` is not required
 * Individual {% data variables.product.prodname_copilot_short %} plans are not available on {% data variables.enterprise.data_residency_site %}, so subscription-based network routing (such as `https://*.individual.githubcopilot.com`) is not supported
 
+## WebSocket connections for cloud sessions
+
+Cloud sessions in your browser use secure WebSocket connections to Azure Web PubSub to send and receive session events. In addition to allowing the applicable hostnames above, your proxy or firewall must support the WebSocket connection and ongoing messages in both directions. Allowing ordinary HTTPS requests alone doesn't confirm that WebSocket connections will work.
+
+Apply these rules to the network path between your browser and the service, including any proxy, VPN, or security software. These rules are separate from the firewall inside a {% data variables.product.prodname_copilot_short %} cloud environment.
+
+Use the required hostnames rather than allowing every Azure Web PubSub service with `*.webpubsub.azure.com`. For help diagnosing failed connections or interference from TLS inspection, see [AUTOTITLE](/copilot/how-tos/troubleshoot-copilot/troubleshoot-network-errors#troubleshooting-cloud-session-websocket-connections).
+
 ## Editor-specific requirements
 
 In addition to the URLs required to connect to {% data variables.product.prodname_copilot_short %}, you must ensure your network rules meet the requirements of the local client (for example, outbound requests to `vscode.dev` in {% data variables.product.prodname_vscode %}). Find the documentation for your chosen client, for example:

content/webhooks/testing-and-troubleshooting-webhooks/testing-webhooks.md

@@ -44,6 +44,8 @@ In order to test your webhook code locally on your computer or codespace, you ca
 
 The following sections demonstrate how to use smee.io to provide a webhook proxy URL and forward webhooks.
 
+Smee is intended for development and testing only. Smee channels are not authenticated or secure, so anyone with your webhook proxy URL can see the payloads sent to it. Alternatively, you can use a tool like [ngrok](https://ngrok.com/docs/getting-started/), [localtunnel](https://localtunnel.github.io/www/), or the [Hookdeck Console](https://console.hookdeck.com?provider=github) that exposes your local machine to the internet to receive the payloads. If you use one of these tools, use the public URL that it provides as your webhook URL, and skip the smee-specific steps in the following sections.
+
 For specific examples of code and testing steps, see [AUTOTITLE](/webhooks/using-webhooks/handling-webhook-deliveries).
 
 ### Get a webhook proxy URL

data/release-notes/enterprise-server/3-19/0-rc1.yml

@@ -239,7 +239,7 @@ sections:
     - |
       After a geo-replica is promoted to be a primary by running `ghe-repl-promote`, the actions workflow of a repository does not have any suggested workflows.
     - |
-      When publishing npm packages in a workflow after restoring from a backup to GitHub Enterprise Server 3.13.5.gm4 or 3.14.2.gm3, you may encounter a `401 Unauthorized` error from the GitHub Packages service. This can happen if the restore is from an N-1 or N-2 version and the workflow targets the npm endpoint on the backup instance. To avoid this issue, ensure the access token is valid and includes the correct scopes for publishing to GitHub Packages.
+      When publishing npm packages in a workflow after restoring from a backup to GitHub Enterprise Server, you may encounter a `401 Unauthorized` error from the GitHub Packages service. This can happen if the restore is from an N-1 or N-2 version and the workflow targets the npm endpoint on the backup instance. To avoid this issue, ensure the access token is valid and includes the correct scopes for publishing to GitHub Packages. [Updated: 2026-11-10]
     - |
       Users may see a mismatch between repository-level Dependabot alerts and the overall Security Risk dashboard metrics. This can be resolved by reloading the page.
     - |

data/release-notes/enterprise-server/3-19/0.yml

@@ -244,7 +244,7 @@ sections:
     - |
       After a geo-replica is promoted to be a primary by running `ghe-repl-promote`, the actions workflow of a repository does not have any suggested workflows.
     - |
-      When publishing npm packages in a workflow after restoring from a backup to GitHub Enterprise Server 3.13.5.gm4 or 3.14.2.gm3, you may encounter a `401 Unauthorized` error from the GitHub Packages service. This can happen if the restore is from an N-1 or N-2 version and the workflow targets the npm endpoint on the backup instance. To avoid this issue, ensure the access token is valid and includes the correct scopes for publishing to GitHub Packages.
+      When publishing npm packages in a workflow after restoring from a backup to GitHub Enterprise Server, you may encounter a `401 Unauthorized` error from the GitHub Packages service. This can happen if the restore is from an N-1 or N-2 version and the workflow targets the npm endpoint on the backup instance. To avoid this issue, ensure the access token is valid and includes the correct scopes for publishing to GitHub Packages. [Updated: 2026-11-10]
     - |
       Users may see a mismatch between repository-level Dependabot alerts and the overall Security Risk dashboard metrics. This can be resolved by reloading the page.
     - |

data/release-notes/enterprise-server/3-19/1.yml

@@ -90,7 +90,7 @@ sections:
     - |
       After a geo-replica is promoted to be a primary by running `ghe-repl-promote`, the actions workflow of a repository does not have any suggested workflows.
     - |
-      When publishing npm packages in a workflow after restoring from a backup to GitHub Enterprise Server 3.13.5.gm4 or 3.14.2.gm3, you may encounter a `401 Unauthorized` error from the GitHub Packages service. This can happen if the restore is from an N-1 or N-2 version and the workflow targets the npm endpoint on the backup instance. To avoid this issue, ensure the access token is valid and includes the correct scopes for publishing to GitHub Packages.
+      When publishing npm packages in a workflow after restoring from a backup to GitHub Enterprise Server, you may encounter a `401 Unauthorized` error from the GitHub Packages service. This can happen if the restore is from an N-1 or N-2 version and the workflow targets the npm endpoint on the backup instance. To avoid this issue, ensure the access token is valid and includes the correct scopes for publishing to GitHub Packages. [Updated: 2026-11-10]
     - |
       The setting to define private registries at the organization level for code scanning is only available if Dependabot is enabled for the instance.
     - |

data/release-notes/enterprise-server/3-19/10.yml

@@ -90,7 +90,7 @@ sections:
     - |
       After a geo-replica is promoted to be a primary by running `ghe-repl-promote`, the actions workflow of a repository does not have any suggested workflows.
     - |
-      When publishing npm packages in a workflow after restoring from a backup to GitHub Enterprise Server 3.13.5.gm4 or 3.14.2.gm3, you may encounter a `401 Unauthorized` error from the GitHub Packages service. This can happen if the restore is from an N-1 or N-2 version and the workflow targets the npm endpoint on the backup instance. To avoid this issue, ensure the access token is valid and includes the correct scopes for publishing to GitHub Packages.
+      When publishing npm packages in a workflow after restoring from a backup to GitHub Enterprise Server, you may encounter a `401 Unauthorized` error from the GitHub Packages service. This can happen if the restore is from an N-1 or N-2 version and the workflow targets the npm endpoint on the backup instance. To avoid this issue, ensure the access token is valid and includes the correct scopes for publishing to GitHub Packages. [Updated: 2026-11-10]
     - |
       The setting to define private registries at the organization level for code scanning is only available if Dependabot is also enabled for the instance.
     - |