You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/actions/reference/security/secure-use.md
-1Lines changed: 0 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -117,7 +117,6 @@ For additional examples and guidance on the risks of untrusted code checkout, se
117
117
118
118
### Good practices
119
119
120
-
121
120
* Avoid using the `pull_request_target` workflow trigger if it's not necessary. For privilege separation between workflows, `workflow_run` is a better trigger. Only use these workflow triggers when the workflow actually needs the privileged context.
122
121
123
122
* Avoid using the `pull_request_target` and `workflow_run` workflow triggers with untrusted pull requests or code content. Workflows that use these triggers must not explicitly check out untrusted code, including from pull request forks or from repositories that are not under your control. Workflows triggered on `workflow_run` should treat artifacts uploaded from other workflows with caution.
Copy file name to clipboardExpand all lines: content/code-security/dependabot/troubleshooting-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -88,19 +88,19 @@ The {% data variables.product.prodname_dependabot_alerts %} count in {% data var
88
88
89
89
You can configure {% data variables.product.prodname_dependabot %} to ignore specific dependencies in the configuration file, which will prevent security and version updates for those dependencies. If you only wish to use security updates, you will need to override the default behavior with a configuration file. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#overriding-the-default-behavior-with-a-configuration-file) to prevent version updates from being activated. For information about ignoring dependencies, see [Ignoring specific dependencies](/code-security/dependabot/dependabot-version-updates/controlling-dependencies-updated#ignoring-specific-dependencies).
90
90
91
-
92
91
## Why does {% data variables.product.prodname_dependabot %} sometimes fail to detect or update {% data variables.product.prodname_actions %} versions in monorepos?
93
92
94
93
If your repository contains multiple {% data variables.product.prodname_actions %} (for example, in a monorepo), the tag format you use affects how {% data variables.product.prodname_dependabot %} detects and updates action versions.
95
94
96
-
-**Dash (`-`) separator** (for example, `@my-action-v0.1.0`):
97
-
- {% data variables.product.prodname_dependabot %} may group multiple actions under a single dependency entry or fail to detect new versions correctly. This occurs because {% data variables.product.prodname_dependabot %} relies on slash-based tag parsing to distinguish between actions.
98
-
-**Slash (`/`) separator** (for example, `@my-action/v0.1.0`):
99
-
- {% data variables.product.prodname_dependabot %} correctly detects and updates each action independently, as the slash creates a hierarchical tag structure that aligns with {% data variables.product.prodname_dependabot %}'s parsing logic.
95
+
***Dash (`-`) separator** (for example, `@my-action-v0.1.0`):
96
+
* {% data variables.product.prodname_dependabot %} may group multiple actions under a single dependency entry or fail to detect new versions correctly. This occurs because {% data variables.product.prodname_dependabot %} relies on slash-based tag parsing to distinguish between actions.
97
+
***Slash (`/`) separator** (for example, `@my-action/v0.1.0`):
98
+
* {% data variables.product.prodname_dependabot %} correctly detects and updates each action independently, as the slash creates a hierarchical tag structure that aligns with {% data variables.product.prodname_dependabot %}'s parsing logic.
100
99
101
100
**Recommendation:** For monorepos with multiple actions, use the `name/version` (slash) format for action tags. This ensures {% data variables.product.prodname_dependabot %} can parse the tag hierarchy correctly and update actions independently.
Copy file name to clipboardExpand all lines: content/copilot/how-tos/use-copilot-agents/coding-agent/create-a-pr.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -109,7 +109,7 @@ You can ask {% data variables.product.prodname_copilot_short %} to open a pull r
109
109
For example: `Create a pull request to ...`.
110
110
111
111
{% data variables.product.prodname_copilot_short %} responds with a brief summary of the task it will perform, asking for your confirmation before it proceeds.
112
-
112
+
113
113
1. Check that {% data variables.product.prodname_copilot_short %} has interpreted your prompt correctly, then tap **Accept** or **Dismiss**.
114
114
115
115
{% data variables.product.prodname_copilot_short %} creates a pull request and gives you a link to it. It will work on the task and push changes to the pull request, and then add you as a reviewer when it has finished, triggering a notification.
Copy file name to clipboardExpand all lines: content/copilot/how-tos/use-copilot-agents/coding-agent/extend-coding-agent-with-mcp.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -229,6 +229,7 @@ To use the Azure DevOps MCP server with {% data variables.copilot.copilot_coding
229
229
1. Setup access to Azure DevOps organization and projects for the application identity. See [Add organization users and manage access](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/add-organization-users).
230
230
1. Add a `.github/workflows/copilot-setup-steps.yml` Actions workflow file in your repository if you do not already have one.
231
231
1. Add an Azure login step to the `copilot-setup-steps` workflow job.
232
+
232
233
```yaml copy
233
234
on:
234
235
workflow_dispatch:
@@ -250,9 +251,11 @@ To use the Azure DevOps MCP server with {% data variables.copilot.copilot_coding
250
251
tenant-id: {% raw %}${{ secrets.AZURE_TENANT_ID }}{% endraw %}
251
252
allow-no-subscriptions: true
252
253
```
254
+
253
255
This configuration ensures the `azure/login` action is executed when {% data variables.copilot.copilot_coding_agent %} runs.
254
256
1. In your repository’s {% data variables.product.prodname_copilot_short %} environment, add secrets for your `AZURE_CLIENT_ID` and `AZURE_TENANT_ID`.
255
257
1. Configure the Azure DevOps MCP server by adding an `ado` object to your MCP configuration with defined tools you want {% data variables.copilot.copilot_coding_agent %} to use.
258
+
256
259
```json copy
257
260
{
258
261
"mcpServers": {
@@ -266,7 +269,6 @@ To use the Azure DevOps MCP server with {% data variables.copilot.copilot_coding
266
269
}
267
270
```
268
271
269
-
270
272
## Reusing your MCP configuration from {% data variables.product.prodname_vscode %}
271
273
272
274
If you have already configured MCP servers in {% data variables.product.prodname_vscode_shortname %}, you can leverage a similar configuration for {% data variables.copilot.copilot_coding_agent %}.
0 commit comments