Repo sync

content/code-security/concepts/code-scanning/codeql/codeql-for-compiled-languages.md

@@ -2,7 +2,7 @@
 title: CodeQL code scanning for compiled languages
 shortTitle: CodeQL for compiled languages
 intro: Understand how {% data variables.product.prodname_codeql %} analyzes compiled languages, the build options available, and learn how you can customize the database generation process if you need to.
-permissions: '{% data reusables.permissions.code-scanning-all-alerts %} if [advanced setup](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning) is already enabled'
+permissions: '{% data reusables.permissions.code-scanning-all-alerts %} if [advanced setup](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning) is already enabled'
 product: '{% data reusables.gated-features.code-scanning %}'
 versions:
   fpt: '*'

content/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages.md

@@ -2,7 +2,7 @@
 title: CodeQL code scanning for compiled languages
 shortTitle: CodeQL for compiled languages
 intro: Understand how {% data variables.product.prodname_codeql %} analyzes compiled languages, the build options available, and learn how you can customize the database generation process if you need to.
-permissions: '{% data reusables.permissions.code-scanning-all-alerts %} if [advanced setup](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning) is already enabled'
+permissions: '{% data reusables.permissions.code-scanning-all-alerts %} if [advanced setup](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning) is already enabled'
 product: '{% data reusables.gated-features.code-scanning %}'
 redirect_from:
   - /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-for-compiled-languages

content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-secret-scanning.md

@@ -61,7 +61,7 @@ The SSSE3 set of instructions is required because {% data variables.product.prod
 
     Optionally, to allow your users to enable validity checks at the enterprise, organization, or repository level, configure validity checks for {% data variables.product.prodname_secret_scanning %}.
 
-1. Click **{% data variables.product.prodname_secret_scanning %} validity checks**. For information about validity checks, see [AUTOTITLE](/code-security/how-tos/secure-your-secrets/customize-leak-detection/enable-validity-checks#about-validity-checks).
+1. Click **{% data variables.product.prodname_secret_scanning %} validity checks**. For information about validity checks, see [AUTOTITLE](/code-security/how-tos/secure-your-secrets/customize-leak-detection/enable-validity-checks#enabling-validity-checks).
 
     > [!NOTE]
     > Enabling validity checks will send outbound requests to partner services to verify detected secrets. This means secret metadata will leave your instance. You need to ensure that this aligns with your enterprise's security and compliance policies before enabling.

content/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages.md

@@ -2,7 +2,7 @@
 title: CodeQL build options and steps for compiled languages
 shortTitle: Build options for compiled languages
 intro: Learn how {% data variables.product.prodname_codeql %} builds compiled languages, including available build modes and language-specific autobuild behavior for C/C++, C#, Go, Java, Kotlin, Rust, and Swift.
-permissions: '{% data reusables.permissions.code-scanning-all-alerts %} if [advanced setup](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning) is already enabled'
+permissions: '{% data reusables.permissions.code-scanning-all-alerts %} if [advanced setup](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning) is already enabled'
 product: '{% data reusables.gated-features.code-scanning %}'
 versions:
   fpt: '*'

content/code-security/reference/code-scanning/workflow-configuration-options.md

@@ -1,7 +1,7 @@
 ---
 title: Workflow configuration options for code scanning
 intro: Edit your workflow file to configure how advanced setup scans the code in your project for vulnerabilities and errors.
-permissions: '{% data reusables.permissions.code-scanning-all-alerts %} if [advanced setup](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning) is already enabled'
+permissions: '{% data reusables.permissions.code-scanning-all-alerts %} if [advanced setup](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning) is already enabled'
 redirect_from:
   - /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning
   - /code-security/secure-coding/configuring-code-scanning

content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/override-settings-for-teams.md

@@ -18,9 +18,9 @@ To make a key eligible for team overrides, you will mark it as `overridable` in
 
 ## Supported keys
 
-The `{ "overridable": <VALUE> }` syntax applies to the `model`, `permissions.disableBypassPermissionsMode`, `permissions.deny`, `permissions.ask`, `permissions.allow`, `allowedMcpServers`, and `deniedMcpServers` keys.
+The `{ "overridable": <VALUE> }` syntax applies to the `model`, `permissions.disableBypassPermissionsMode`, `permissions.deny`, `permissions.ask`, `permissions.allow`, `allowedMcpServers`, `deniedMcpServers`, `extraKnownMarketplaces`, `strictKnownMarketplaces`, and `sandbox` keys.
 
-`enabledPlugins` and `extraKnownMarketplaces` work additively. The enterprise `{% data variables.copilot.managed_setting_file %}` sets a baseline, and an enterprise team file can add more plugins and marketplaces on top of it.
+`enabledPlugins` works additively. The enterprise `{% data variables.copilot.managed_setting_file %}` sets a baseline, and an enterprise team file can add more plugins on top of it.
 
 For a full description of these keys and their syntax, see [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings).
 
@@ -64,7 +64,7 @@ You will use `copilot/{% data variables.copilot.team_mappings_file %}` and the `
     }
     ```
 
-1. Create the team settings file under `copilot/{% data variables.copilot.team_settings_directory %}`. You can include any keys you marked as overridable, plus the additive keys `enabledPlugins` and `extraKnownMarketplaces`. Every other key stays governed by your enterprise default.
+1. Create the team settings file under `copilot/{% data variables.copilot.team_settings_directory %}`. You can include any keys you marked as overridable, plus the additive key `enabledPlugins`. Every other key stays governed by your enterprise default.
 
    ```json
    {

content/copilot/how-tos/chat-with-copilot/chat-in-ide.md

@@ -441,7 +441,7 @@ By default, {% data variables.copilot.copilot_chat_short %} will reference the f
 
 Use {% data variables.copilot.copilot_edits_short %} to make changes across multiple files directly from a single {% data variables.copilot.copilot_chat_short %} prompt. {% data variables.copilot.copilot_edits_short %} has the following modes:
 
-* [Edit mode](#edit-mode-1) lets {% data variables.product.prodname_copilot_short %} make controlled edits to multiple files.
+* [Edit mode](#edit-mode) lets {% data variables.product.prodname_copilot_short %} make controlled edits to multiple files.
 * [Agent mode](#agent-mode-1) lets {% data variables.product.prodname_copilot_short %} autonomously accomplish a set task.
 
 ### Edit mode

content/copilot/how-tos/copilot-cli/use-copilot-cli/overview.md

@@ -34,15 +34,15 @@ Install {% data variables.copilot.copilot_cli_short %}. See [AUTOTITLE](/copilot
 
 1. Choose one of the options:
 
-   **1. Yes, proceed**:
+   **1. Yes**:
 
    {% data variables.product.prodname_copilot_short %} can work with the files in this location for this session only.
 
    **2. Yes, and remember this folder for future sessions**:
 
    You trust the files in this folder for this and future sessions. You won't be asked again when you start {% data variables.copilot.copilot_cli_short %} from this folder. Only choose this option if you are sure that it will always be safe for {% data variables.product.prodname_copilot_short %} to work with files in this location.
 
-   **3. No, exit (Esc)**:
+   **3. No (Esc)**:
 
    End your {% data variables.copilot.copilot_cli_short %} session.
 

content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md

@@ -144,6 +144,25 @@ The following source types are supported:
 
 See [AUTOTITLE](/copilot/concepts/enterprise/plugin-standards).
 
+For server-managed enterprise team overrides, wrap the complete marketplace map in `overridable`:
+
+```json
+{
+  "extraKnownMarketplaces": {
+    "overridable": {
+      "enterprise-plugins": {
+        "source": {
+          "source": "github",
+          "repo": "OWNER/REPO"
+        }
+      }
+    }
+  }
+}
+```
+
+A team file can then provide a regular marketplace map to replace this default. Include any default marketplaces that the team should retain. If the team omits the key, the enterprise default remains.
+
 ## strictKnownMarketplaces
 
 Restricts plugin installation to only the marketplaces explicitly defined by the enterprise. An empty array means complete lockdown. Each entry is a marketplace object with a `source` property indicating the source type. The following source types are supported:
@@ -157,6 +176,20 @@ Restricts plugin installation to only the marketplaces explicitly defined by the
 * `"hostPattern"` — requires `hostPattern` (regex matching marketplace hosts)
 * `"pathPattern"` — requires `pathPattern` (regex matching marketplace paths)
 
+This key is overridable for enterprise teams. Wrap the complete allowlist in `overridable` at the enterprise level:
+
+```json
+{
+  "strictKnownMarketplaces": {
+    "overridable": [
+      { "source": "github", "repo": "OWNER/REPO" }
+    ]
+  }
+}
+```
+
+Use a regular array in the team file to replace the default allowlist. Omitting the key retains the enterprise default. An explicit empty array, `[]`, means complete lockdown, not an unmanaged policy.
+
 ## model
 
 Sets your preferred model as the default for new conversations. This lets you choose the default model that best fits your enterprise's workflows. Users can still select a different model on a per-conversation basis.
@@ -288,6 +321,21 @@ The following sub-properties are supported:
 * `allowDevToolAccess`: `false` prevents automatic access to development-tool configuration, caches, registries, and toolchains. These locations can contain package registry credentials or tokens. Disabling access can cause package restoration, authenticated registry operations, or builds that use shared caches to fail unless you explicitly grant the required paths.
 * `userPolicy`: An object that configures filesystem, network, and macOS-specific Seatbelt restrictions. The supported properties are described in the following sections.
 
+For server-managed enterprise team overrides, wrap the entire sandbox object in `overridable`:
+
+```json
+{
+  "sandbox": {
+    "overridable": {
+      "enabled": true,
+      "allowBypass": false
+    }
+  }
+}
+```
+
+The wrapper must be the only property directly inside `sandbox`. Individual sub-properties, such as `sandbox.enabled`, cannot use their own `overridable` wrappers. A team file's regular sandbox object replaces the entire wrapped default, so include every restriction that should remain. Omitting `sandbox` retains the enterprise default.
+
 ### `sandbox.userPolicy.filesystem`
 
 Configures filesystem access for sandboxed processes. Paths should be absolute. Managed grant lists are matched against user-configured lists by exact path string, not by parent or child path coverage.