Skip to content

Commit 4667ca2

Browse files
marcogarioshaikhul
andauthored
Remove beta notice for actions analysis (#55013)
Co-authored-by: Shaikhul Islam <[email protected]>
1 parent eb4f299 commit 4667ca2

File tree

4 files changed

+6
-9
lines changed

4 files changed

+6
-9
lines changed

content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,6 @@ With this approach, the value of the {% raw %}`${{ github.event.pull_request.tit
151151

152152
### Using workflow templates for {% data variables.product.prodname_code_scanning %}
153153

154-
{% data reusables.advanced-security.starter-workflows-beta %}
155154
{% data variables.product.prodname_code_scanning_caps %} allows you to find security vulnerabilities before they reach production. {% data variables.product.github %} provides workflow templates for {% data variables.product.prodname_code_scanning %}. You can use these suggested workflows to construct your {% data variables.product.prodname_code_scanning %} workflows, instead of starting from scratch. {% data variables.product.company_short %}'s workflow, the {% data variables.code-scanning.codeql_workflow %}, is powered by {% data variables.product.prodname_codeql %}. There are also third-party workflow templates available.
156155

157156
For more information, see [AUTOTITLE](/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning) and [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning#configuring-code-scanning-using-third-party-actions).
@@ -228,8 +227,6 @@ For more information on how to configure this setting, see {% ifversion ghes or
228227

229228
## Using {% data variables.product.prodname_code_scanning %} to secure workflows
230229

231-
{% data reusables.code-scanning.beta-actions-analysis %}
232-
233230
{% data variables.product.prodname_code_scanning_caps %} can automatically detect and suggest improvements for common vulnerable patterns used in {% data variables.product.prodname_actions %} workflows.
234231
For more information on how to enable {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning).
235232

@@ -347,6 +344,7 @@ For third-party images, such as the images for ARM-powered runners, you can find
347344
When a self-hosted runner is defined at the organization or enterprise level, {% data variables.product.github %} can schedule workflows from multiple repositories onto the same runner. Consequently, a security compromise of these environments can result in a wide impact. To help reduce the scope of a compromise, you can create boundaries by organizing your self-hosted runners into separate groups. You can restrict what {% ifversion ghec or ghes %}workflows, {% endif %}organizations and repositories can access runner groups. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups).
348345

349346
You should also consider the environment of the self-hosted runner machines:
347+
350348
* What sensitive information resides on the machine configured as a self-hosted runner? For example, private SSH keys, API access tokens, among others.
351349
* Does the machine have network access to sensitive services? For example, Azure or AWS metadata services. The amount of sensitive information in this environment should be kept to a minimum, and you should always be mindful that any user capable of invoking workflows has access to this environment.
352350

@@ -370,10 +368,12 @@ Once you have the config file from the REST API response, you can pass it to the
370368
A self-hosted runner can be added to various levels in your {% data variables.product.prodname_dotcom %} hierarchy: the enterprise, organization, or repository level. This placement determines who will be able to manage the runner:
371369

372370
**Centralized management:**
371+
373372
* If you plan to have a centralized team own the self-hosted runners, then the recommendation is to add your runners at the highest mutual organization or enterprise level. This gives your team a single location to view and manage your runners.
374373
* If you only have a single organization, then adding your runners at the organization level is effectively the same approach, but you might encounter difficulties if you add another organization in the future.
375374

376375
**Decentralized management:**
376+
377377
* If each team will manage their own self-hosted runners, then the recommendation is to add the runners at the highest level of team ownership. For example, if each team owns their own organization, then it will be simplest if the runners are added at the organization level too.
378378
* You could also add runners at the repository level, but this will add management overhead and also increases the numbers of runners you need, since you cannot share runners between repositories.
379379

content/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,6 @@ For information about {% data variables.product.prodname_code_scanning %} alerts
4949

5050
{% data reusables.code-scanning.codeql-languages-bullets %}
5151

52-
{% data reusables.code-scanning.beta-actions-analysis %}
53-
5452
## Modeling custom or niche frameworks
5553

5654
{% data variables.product.github %} experts, security researchers, and community contributors write libraries to model the flow of data in popular frameworks and libraries. If you use custom dependencies that aren't modeled, then you can use the {% data variables.product.prodname_codeql %} extension for {% data variables.product.prodname_vscode %} to create models for these dependencies and use them to extend your analysis. For more information, see [AUTOTITLE](/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/using-the-codeql-model-editor).

content/enterprise-onboarding/github-actions-for-your-enterprise/security-hardening-for-github-actions.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -208,8 +208,6 @@ For more information on how to configure this setting, see [AUTOTITLE](/enterpri
208208

209209
## Using {% data variables.product.prodname_code_scanning %} to secure workflows
210210

211-
{% data reusables.code-scanning.beta-actions-analysis %}
212-
213211
{% data variables.product.prodname_code_scanning_caps %} can automatically detect and suggest improvements for common vulnerable patterns used in {% data variables.product.prodname_actions %} workflows.
214212
For more information on how to enable {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning).
215213

@@ -311,6 +309,7 @@ As a result, self-hosted runners should almost [never be used for public reposit
311309
When a self-hosted runner is defined at the organization or enterprise level, {% data variables.product.github %} can schedule workflows from multiple repositories onto the same runner. Consequently, a security compromise of these environments can result in a wide impact. To help reduce the scope of a compromise, you can create boundaries by organizing your self-hosted runners into separate groups. You can restrict what workflows, organizations and repositories can access runner groups. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups).
312310

313311
You should also consider the environment of the self-hosted runner machines:
312+
314313
* What sensitive information resides on the machine configured as a self-hosted runner? For example, private SSH keys, API access tokens, among others.
315314
* Does the machine have network access to sensitive services? For example, Azure or AWS metadata services. The amount of sensitive information in this environment should be kept to a minimum, and you should always be mindful that any user capable of invoking workflows has access to this environment.
316315

@@ -334,10 +333,12 @@ Once you have the config file from the REST API response, you can pass it to the
334333
A self-hosted runner can be added to various levels in your {% data variables.product.prodname_dotcom %} hierarchy: the enterprise, organization, or repository level. This placement determines who will be able to manage the runner:
335334

336335
**Centralized management:**
336+
337337
* If you plan to have a centralized team own the self-hosted runners, then the recommendation is to add your runners at the highest mutual organization or enterprise level. This gives your team a single location to view and manage your runners.
338338
* If you only have a single organization, then adding your runners at the organization level is effectively the same approach, but you might encounter difficulties if you add another organization in the future.
339339

340340
**Decentralized management:**
341+
341342
* If each team will manage their own self-hosted runners, then the recommendation is to add the runners at the highest level of team ownership. For example, if each team owns their own organization, then it will be simplest if the runners are added at the organization level too.
342343
* You could also add runners at the repository level, but this will add management overhead and also increases the numbers of runners you need, since you cannot share runners between repositories.
343344

data/reusables/code-scanning/codeql-language-identifiers-table.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,5 @@
1313
{% data variables.product.prodname_actions %} workflows | `actions`
1414
| {% endif %}
1515

16-
{% data reusables.code-scanning.beta-actions-analysis %}
17-
1816
> [!NOTE]
1917
> If you specify one of the alternative identifiers, this is equivalent to using the standard language identifier. For example, specifying `javascript` instead of `javascript-typescript` will not exclude analysis of TypeScript code. You can do this in an advanced setup workflow with the `--paths-ignore` option. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan).

0 commit comments

Comments
 (0)