Repo sync

.github/workflows/test.yml

@@ -32,7 +32,6 @@ jobs:
         # Add new matrix suites to branch protection required checks too.
         name:
           # Lists every src directory. Commented-out entries have no suite-specific tests.
-          # - ai-tools
           # - app
           - archives
           - article-api

content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries.md

@@ -24,6 +24,9 @@ category:
 {% data variables.product.prodname_dependabot_version_updates %} keeps your dependencies up-to-date and {% data variables.product.prodname_dependabot_security_updates %} updates vulnerable dependencies. {% data variables.product.prodname_dependabot %} can access public registries. In addition, you can give {% data variables.product.prodname_dependabot %} access to private package registries and private {% data variables.product.github %} repositories so that you can keep your private and innersource dependencies as up-to-date and secure as your public dependencies.
 
 In most ecosystems, private dependencies are usually published to private package registries. These private registries are similar to their public equivalents, but they require authentication.
+{% ifversion dependabot-egress-allowlist %}
+Configuring a registry in `dependabot.yml` also allows {% data variables.product.prodname_dependabot %} to reach it over the network. Update jobs can connect only to hosts on an egress allowlist. Declare a registry under the top-level `registries` key even if it allows anonymous access, because defining it only in an ecosystem-native configuration file, such as `.npmrc` or `nuget.config`, does not allow its host. Add private registries to `dependabot.yml`, not to the shared defaults. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/resolve-a-blocked-host).
+{% endif %}
 
 For specific ecosystems, you can configure {% data variables.product.prodname_dependabot %} to access _only_ private registries by removing calls to public registries. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/remove-access-to-public-registries).
 

content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/index.md

@@ -23,6 +23,7 @@ children:
   - /re-run-dependabot-jobs
   - /list-configured-dependencies
   - /configure-private-registries
+  - /resolve-a-blocked-host
 redirect_from:
   - /code-security/dependabot/maintain-dependencies
   - /code-security/dependabot/dependabot-security-updates

content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/resolve-a-blocked-host.md

@@ -0,0 +1,60 @@
+---
+title: Resolving a blocked host in a Dependabot update job
+shortTitle: Resolve a blocked host
+intro: 'Diagnose an update job that fails because {% data variables.product.prodname_dependabot %} could not reach a host, and allow the host it needs.'
+versions:
+  feature: dependabot-egress-allowlist
+contentType: how-tos
+category:
+  - Secure your dependencies
+---
+
+Every {% data variables.product.prodname_dependabot %} update job runs behind an HTTP/HTTPS proxy. The proxy checks the host of every outbound request against an **egress allowlist**. It blocks requests to hosts that are not on it.
+
+This reduces the risk that a malicious dependency or build script can send repository contents or registry credentials to an unapproved destination. It does not prevent data from being sent to an allowed or compromised host.
+
+Most jobs are unaffected. The allowlist already covers public registries, mirrors, CDNs, and download hosts for supported ecosystems, as well as {% data variables.product.github %}'s infrastructure. Registries configured and referenced for a job are also allowed automatically.
+
+A registry counts as configured only when you declare it under the top-level `registries` key in your `dependabot.yml` file. Defining a registry solely in an ecosystem-native configuration file, such as `.npmrc`, `nuget.config`, `pip.conf`, or Maven's `settings.xml`, does not allow its host. The package manager reads the registry from that file and tries to reach it, but the proxy blocks the request.
+
+## Identifying a blocked request in job logs
+
+When the proxy blocks a request, it returns `403 Forbidden` to the update job. The failure usually surfaces as a network or authentication error from the package manager. Check the proxy lines in the job log to confirm the cause. For how to open job logs, see [AUTOTITLE](/code-security/how-tos/view-and-interpret-data/view-dependabot-logs).
+
+A blocked request looks like this:
+
+```text
+proxy | 2026/09/24 20:58:15 [052] GET https://packages.example.com:443/v2/my-package/tags/list
+proxy | 2026/09/24 20:58:15 [052] * egress not allowlisted packages.example.com
+proxy | 2026/09/24 20:58:15 [052] 403 https://packages.example.com:443/v2/my-package/tags/list
+proxy | 2026/09/24 20:58:15 [052] Remote response: Forbidden
+```
+
+Lines from the proxy are prefixed with `proxy |`, and `[052]` is the request number that groups the lines for a single request. The `egress not allowlisted` line names the exact host that failed the check. Use that host to decide what to do next.
+
+## How hosts are allowed
+
+Two independent sets of hosts are allowed for each job.
+
+**Default hosts** include public registries, mirrors, CDNs, and download hosts for supported ecosystems. They also include {% data variables.product.github %} and {% data variables.product.prodname_dependabot %} infrastructure. {% data variables.product.github %} maintains this list in the `dependabot/proxy` repository, and it applies to every job.
+
+**Per-job hosts** come from registries configured for a specific job. Declare a registry under the top-level `registries` key in your `dependabot.yml` file and reference it from an `updates` entry. The registry's host is then allowed for that job without a change to the defaults.
+
+Declare the registry even if it allows anonymous access. It is the declaration in `dependabot.yml`, not the presence of credentials, that makes the host reachable.
+
+This split determines where a blocked host belongs.
+
+* **A public registry or download host** that other users' jobs could legitimately need belongs in the defaults. See [Adding a host to the defaults](#adding-a-host-to-the-defaults).
+* **A private or organization-specific registry** belongs in your `dependabot.yml` file, never in the defaults. Configure it under `registries` so it is allowed only for the jobs that need it. See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries).
+
+## Adding a host to the defaults
+
+If a blocked host is a public registry, mirror, CDN, or download host, you can propose adding it by opening a pull request against [`dependabot/proxy`](https://github.com/dependabot/proxy). An accepted addition applies to every {% data variables.product.prodname_dependabot %} update job, not only to jobs in your organization.
+
+The repository provides an [agent skill](https://github.com/dependabot/proxy/blob/main/.github/skills/add-egress-allowlist-domain/SKILL.md) that walks {% data variables.product.prodname_copilot_short %} through this process, from checking whether the host belongs in the defaults to opening the pull request. Working in the `dependabot/proxy` repository, tell {% data variables.product.prodname_copilot_short %} that a host is blocked, ask it to allowlist a host, or paste the blocked lines from your job log. For example, "`repo.example.org` is blocked" or "please allowlist `foo.bar.com`". Otherwise, follow these steps.
+
+1. **Confirm the host belongs in the defaults.** It must be a public host that other users' jobs could legitimately need, not one that is specific to your organization. Confirm who controls the host and why a supported ecosystem requires access to it. If the host is specific to your organization, configure it in your `dependabot.yml` file instead.
+1. **Verify the host from your job logs.** Note the exact host named on the `egress not allowlisted` line. Registries often redirect downloads to a separate storage or CDN host, so check whether more than one host was blocked.
+1. **Open a pull request** to add the exact host to the appropriate section of `internal/handlers/egress_allowlist_defaults.yaml`. Include a short note explaining who controls the host and what it serves. Follow the comments in the file to choose the right section and apply its conventions. A maintainer will review the change.
+
+If you are not sure whether a blocked host should be added to the defaults or configured in your `dependabot.yml` file, ask in the `dependabot/proxy` repository.

content/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-errors.md

@@ -281,6 +281,21 @@ If {% data variables.product.prodname_dependabot %} attempts to check whether de
 
 **Version updates only:** {% data reusables.dependabot.private-dependencies-note %} Additionally, {% data variables.product.prodname_dependabot %} doesn't support private {% data variables.product.prodname_dotcom %} dependencies for all package managers. See [AUTOTITLE](/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories).
 
+{% ifversion dependabot-egress-allowlist %}
+
+### Request blocked by the network egress allowlist
+
+Update jobs can only reach hosts on {% data variables.product.prodname_dependabot %}'s network egress allowlist. When a request is blocked, the proxy returns `403 Forbidden` and the job log contains a line naming the host, for example `* egress not allowlisted packages.example.com`.
+
+**Resolution:** Choose the option that matches the blocked host:
+
+* For a private or organization-specific registry, define it under the top-level `registries` key in your `dependabot.yml` file. Reference it from the relevant `updates` entry to allow it for that job. Do this even if the registry allows anonymous access, and note that defining it only in a file such as `.npmrc` or `nuget.config` does not allow its host.
+* For a public registry or download host, propose adding it to the default allowlist.
+
+For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/resolve-a-blocked-host).
+
+{% endif %}
+
 ## Triggering a {% data variables.product.prodname_dependabot %} pull request manually
 
 If you unblock {% data variables.product.prodname_dependabot %}, you can manually trigger a fresh attempt to create a pull request.

content/copilot/get-started/quickstart-copilot-app.md

@@ -41,7 +41,9 @@ In this quickstart, you will:
 ## Opening the {% data variables.copilot.github_copilot_app %} for the first time
 
 1. Open the {% data variables.copilot.github_copilot_app %}.
-1. Click **Sign in to {% data variables.product.github %}** and follow the prompts to authenticate. If you use {% data variables.product.prodname_ghe_server %}, choose **Use GitHub Enterprise** and enter your server address when prompted.
+1. Click **Sign in to {% data variables.product.github %}** and follow the prompts to authenticate. 
+
+   If you use {% data variables.product.prodname_ghe_cloud %} with data residency, choose **Use GitHub Enterprise** and enter your `*.ghe.com` hostname when prompted. {% data variables.product.prodname_ghe_server %} is not supported by the {% data variables.copilot.github_copilot_app %}.
 1. If you do not have a {% data variables.product.prodname_copilot_short %} plan, choose whether to sign up for a plan or continue with your own model provider.
     * If you choose to use your own model provider, select a provider, enter any required credentials, then click **Save and continue**.
 1. When prompted, select one or more repositories based on your recent {% data variables.product.github %} activity. You can also add a local folder or repository, or skip this step and add projects later.

data/features/dependabot-egress-allowlist.yml

@@ -0,0 +1,6 @@
+# Reference: https://github.com/dependabot/proxy/pull/230
+# Dependabot update jobs enforce an outbound network egress allowlist.
+versions:
+  fpt: '*'
+  ghec: '*'
+  ghes: '>=3.23'

eslint.config.ts

@@ -188,7 +188,6 @@ export default [
   // Remove directories from this list as they are migrated
   {
     files: [
-      'src/ai-tools/**/*.{ts,js}',
       'src/article-api/**/*.{ts,js}',
       'src/audit-logs/**/*.{ts,js}',
       'src/color-schemes/**/*.{ts,js}',

package.json

@@ -12,7 +12,6 @@
   "exports": "./src/frame/server.ts",
   "scripts": {
     "add-content-type": "tsx src/content-render/scripts/add-content-type.ts",
-    "ai-tools": "tsx src/ai-tools/scripts/ai-tools.ts",
     "all-documents": "tsx src/content-render/scripts/all-documents/cli.ts",
     "analyze-text": "tsx src/search/scripts/analyze-text.ts",
     "analyze-comment": "tsx src/events/scripts/analyze-comment-cli.ts",