Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/billing/concepts/budgets-and-alerts.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Budgets and alerts allow you to track spending on metered products for your ente

By setting a monthly budget, you can monitor your spending and receive notifications by email when your spending exceeds certain preset percentages of your budget threshold. This can help you stay within your budget and avoid overspending.

Many accounts already have default budgets for certain products. {% data reusables.billing.migrated-budgets %}
{% data reusables.billing.migrated-budgets %}

## Stopping usage

Expand Down
2 changes: 1 addition & 1 deletion content/billing/concepts/product-billing/github-copilot.md
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ If you run out of free Actions minutes or free premium requests, and you have se

If you run out of free minutes or premium requests, and you have _not_ set up billing, a message is displayed explaining why {% data variables.product.prodname_copilot_short %} cannot work on the task.

{% data reusables.copilot.zero-budget-changes %} See [AUTOTITLE](/copilot/how-tos/premium-requests/manage-for-enterprise).
{% data reusables.copilot.zero-budget-changes-link %}

### Monitoring your use of Actions minutes and premium requests

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ For detailed guidance, see [Prioritizing meaningful updates](/code-security/depe

{% ifversion dependabot-reviewers-deprecation %}

## Automatically adding assignees

Use `assignees` to automatically add individuals or teams as assignees to pull requests.

For detailed guidance, see [Automatically adding assignees](/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs#automatically-adding-assignees).

## Automatically adding reviewers

To ensure your project's security updates get addressed promptly by the appropriate team, you can automatically add reviewers to Dependabot pull requests using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).
Expand All @@ -50,8 +56,10 @@ To ensure your project's security updates get addressed promptly by the appropri

## Automatically adding reviewers and assignees

> [!NOTE]
> The `reviewers` property is closing down and will be removed in a future release of GitHub Enterprise Server.
> [!IMPORTANT]
> The `reviewers` property is closing down and will be removed in a future release of {% data variables.product.prodname_ghe_server %}.
>
> You can also automatically add reviewers and assignees using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).

To ensure your project's security updates get **addressed promptly** by the appropriate team, use `reviewers` and `assignees` to automatically add individuals or teams as **reviewers or assignees** to pull requests.

Expand Down Expand Up @@ -91,62 +99,13 @@ In this example, the `dependabot.yml` file:
* Is customized so that {% data variables.product.prodname_dependabot %} applies custom labels to the pull requests and automatically adds {% ifversion ghes < 3.19 %}reviewers and {% endif %}assignees.
* Groups security updates for golang dependencies into a single pull request.

{% ifversion dependabot-reviewers-deprecation %}

```yaml copy
# Example configuration file that:
# - Uses a private registry for npm updates
# - Ignores lodash dependency
# - Disables version-updates
# - Applies custom labels
# - Group security updates for golang dependencies into a single pull request

version: 2
registries:
# Define a private npm registry with the name `example`
example:
type: npm-registry
url: https://example.com
token: {% raw %}${{secrets.NPM_TOKEN}}{% endraw %}
updates:
- package-ecosystem: "npm"
directory: "/src/npm-project"
schedule:
interval: "daily"
# For Lodash, ignore all updates
ignore:
- dependency-name: "lodash"
# Disable version updates for npm dependencies
open-pull-requests-limit: 0
registries:
# Ask Dependabot to use the private registry for npm
- example
# Raise all npm pull requests for security updates with custom labels
labels:
- "npm dependencies"
- "triage-board"
# Raise all npm pull requests for security updates with assignees
assignees:
- "user-name"
- package-ecosystem: "gomod"
groups:
# Group security updates for golang dependencies
# into a single pull request
golang:
applies-to: security-updates
patterns:
- "golang.org*"
```

{% else %}

```yaml copy
# Example configuration file that:
# - Uses a private registry for npm updates
# - Ignores lodash dependency
# - Disables version-updates
# - Applies custom labels
# - Adds reviewers and assignees
# - Adds assignees
# - Group security updates for golang dependencies into a single pull request

version: 2
Expand All @@ -173,10 +132,6 @@ updates:
labels:
- "npm dependencies"
- "triage-board"
# Raise all npm pull requests for security updates with reviewers
reviewers:
- "my-org/team-name"
- "octocat"
# Raise all npm pull requests for security updates with assignees
assignees:
- "user-name"
Expand All @@ -190,12 +145,10 @@ updates:
- "golang.org*"
```

{% endif %}

## Example 2: configuration for version updates and security updates

In this example, the `dependabot.yml` file:
* Is customized so that {% data variables.product.prodname_dependabot %} adds reviewers and custom labels to both version updates and security updates.
* Is customized so that {% data variables.product.prodname_dependabot %} adds custom labels to both version updates and security updates.
* Uses the `groups` customization option to create two groups ("`angular`" and "`production-dependencies`") in order to group multiple updates into single pull requests.
* Specifies that the `groups` customization for `angular` applies to security updates only.
* Specifies that the `groups` customization for `production-dependencies` applies to version updates only.
Expand All @@ -212,10 +165,6 @@ updates:
labels:
- "npm dependencies"
- "triage-board"
# Raise all npm pull requests for security and version updates with reviewers
reviewers:
- "my-org/team-name"
- "octocat"
groups:
angular:
# Group security updates for Angular dependencies into a single pull request
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,37 +19,56 @@ shortTitle: Customize Dependabot PRs

There are various ways to customize your {% data variables.product.prodname_dependabot %} pull requests so that they better suit your own internal processes.

For example, to integrate {% data variables.product.prodname_dependabot %}'s pull requests into your CI/CD pipelines, it can apply **custom labels** to pull requests, which you can then use to trigger action workflows.

There are several different customization options which can all be used in combination, and tailored per package ecosystem.

{% ifversion dependabot-reviewers-deprecation %}

For example, to integrate {% data variables.product.prodname_dependabot %}'s pull requests into your CI/CD pipelines, it can apply **custom labels** to pull requests, which you can then use to trigger action workflows.
## Automatically adding assignees

{% else %}
By default, {% data variables.product.prodname_dependabot %} raises pull requests without any assignees.

For example:
* To maximize efficiency, {% data variables.product.prodname_dependabot %} can automatically add specific individuals or teams as **reviewers** to its pull requests for a particular package ecosystem.
* To integrate {% data variables.product.prodname_dependabot %}'s pull requests into your CI/CD pipelines, it can apply **custom labels** to pull requests, which you can then use to trigger action workflows.
To automatically assign pull requests to a designated security team, you can use `assignees` to set these values per package ecosystem.

{% endif %}
The example `dependabot.yml` file below changes the npm configuration so that all pull requests opened with version and security updates for npm have:
* An individual ("`user-name`") automatically assigned to the pull requests.

There are several different customization options which can all be used in combination, and tailored per package ecosystem.
```yaml copy
# `dependabot.yml` file with
# assignee for all npm pull requests

{% ifversion dependabot-reviewers-deprecation %}
version: 2
updates:
# Keep npm dependencies up to date
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
# Raise all npm pull requests with assignees
assignees:
- "user-name"
```

## Automatically adding reviewers

To ensure your project's security updates get addressed promptly by the appropriate team, you can automatically add reviewers to Dependabot pull requests using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).
By default, {% data variables.product.prodname_dependabot %} raises pull requests without any reviewers.

To ensure your project's security updates get addressed promptly by the appropriate team, you can automatically add reviewers to {% data variables.product.prodname_dependabot %} pull requests using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).

{% else %}

## Automatically adding reviewers and assignees

> [!IMPORTANT]
> The `reviewers` property is closing down and will be removed in a future release of {% data variables.product.prodname_ghe_server %}.
>
> You can also automatically add reviewers and assignees using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).

By default, {% data variables.product.prodname_dependabot %} raises pull requests without any reviewers or assignees.

However, you may want pull requests to be consistently reviewed or dealt with by a specific individual or team that has expertise in that package ecosystem, or automatically assigned to a designated security team. In which case, you can use `reviewers` and `assignees` to set these values per package ecosystem.

> [!NOTE]
> The `reviewers` property is closing down and will be removed in a future release of GitHub Enterprise Server.

The example `dependabot.yml` file below changes the npm configuration so that all pull requests opened with version and security updates for npm have:
* A team ("`my-org/team-name`") and an individual ("`octocat`") automatically added as reviewers to the pull requests.
* An individual ("`user-name`") automatically assigned to the pull requests.
Expand All @@ -74,10 +93,6 @@ updates:
- "user-name"
```

{% data reusables.dependabot.option-affects-security-updates %}

See also [`assignees`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#assignees--) and [`reviewers`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#reviewers--).

{% endif %}

## Labeling pull requests with custom labels
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ redirect_from:

You can use {% data variables.product.prodname_actions %} to perform automated tasks when {% data variables.product.prodname_dependabot %} creates pull requests to update dependencies. You may find this useful if you want to:

* Ensure that {% data variables.product.prodname_dependabot %} pull requests (version updates and security updates) are created with the right data for your work processes, including labels, names, and reviewers.
* Ensure that {% data variables.product.prodname_dependabot %} pull requests (version updates and security updates) are created with the right data for your work processes, including labels and names.

* Trigger workflows to send {% data variables.product.prodname_dependabot %} pull requests (version updates and security updates) into your review process or to merge automatically.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -574,8 +574,10 @@ Supported values: `REGISTRY_NAME` or `"*"`

## `reviewers` {% octicon "versions" aria-label="Version updates" height="24" %} {% octicon "shield-check" aria-label="Security updates" height="24" %}

> [!NOTE]
> The `reviewers` property is closing down and will be removed in a future release of GitHub Enterprise Server.
> [!IMPORTANT]
> The `reviewers` property is closing down and will be removed in a future release of {% data variables.product.prodname_ghe_server %}.
>
> You can also automatically add reviewers and assignees using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).

Specify individual reviewers, or teams of reviewers, for all pull requests raised for a package manager. For examples, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs).

Expand All @@ -590,9 +592,6 @@ When `reviewers` is defined:

Reviewers must have at least read access to the repository.

> [!NOTE]
> You can also automatically add reviewers and assignees using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).

{% endif %}

## `schedule` {% octicon "versions" aria-label="Version updates only" height="24" %}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ shortTitle: Manage Dependabot PRs
When {% data variables.product.prodname_dependabot %} raises a pull request, you're notified by your chosen method for the repository. Each pull request contains detailed information about the proposed change, taken from the package manager. These pull requests follow the normal checks and tests defined in your repository.
{% ifversion fpt or ghec %}In addition, where enough information is available, you'll see a compatibility score. This may also help you decide whether or not to merge the change. For information about this score, see [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates).{% endif %}

If you have many dependencies to manage, you may want to customize the configuration for each package manager so that pull requests have specific reviewers, assignees, and labels. You may also want to group sets of dependencies together, so that multiple dependencies are updated in a single pull request. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs) and [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#grouping-dependabot-updates-into-a-single-pull-request).
If you have many dependencies to manage, you may want to customize the configuration for each package manager so that pull requests have specific assignees and labels. You may also want to group sets of dependencies together, so that multiple dependencies are updated in a single pull request. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs) and [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#grouping-dependabot-updates-into-a-single-pull-request).

> [!NOTE]
> If you don't interact with {% data variables.product.prodname_dependabot %} pull requests for a repository during a 90-day time period, {% data variables.product.prodname_dependabot %} considers your repository as inactive, and will automatically pause {% data variables.product.prodname_dependabot_updates %}. For more information about inactivity criteria, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates#about-automatic-deactivation-of-dependabot-updates) and [AUTOTITLE](/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates#about-automatic-deactivation-of-dependabot-updates).
Expand Down
2 changes: 1 addition & 1 deletion content/copilot/concepts/billing/copilot-requests.md
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ If you need more premium requests beyond your monthly allowance:
* For an individual subscription, set a budget for additional premium requests or upgrade to a higher plan. See [AUTOTITLE](/billing/managing-your-billing/using-budgets-control-spending).
* If you're an enterprise or organization owner, ensure that the "Premium request paid usage" policy is enabled and that extra spending is not prevented by a budget. See [AUTOTITLE](/copilot/how-tos/premium-requests/manage-for-enterprise).

{% data reusables.copilot.zero-budget-changes %}
{% data reusables.copilot.zero-budget-changes-link %}

## Model multipliers

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ This report includes all premium request usage by user, both within and beyond t

Your organization or enterprise's policies and budgets determine whether users can use premium requests over their included allowance. See [AUTOTITLE](/copilot/how-tos/premium-requests/manage-for-enterprise).

{% data reusables.copilot.zero-budget-changes %}
{% data reusables.copilot.zero-budget-changes-link %}

## Mapping spending to groups of users

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ You can set a higher budget for premium requests over the allowance for specific
At a high level, the required steps are:

1. Ensure the "Premium request paid usage" policy is enabled. See [Setting a policy for paid usage](#setting-a-policy-for-paid-usage).
1. Delete the default $0 budget if it applies to your organization or enterprise.
1. If there is a $0 budget for premium requests set at your enterprise or organization account level, delete it.

1. Create a new budget for the users who need a higher allowance. For example, create an organization or cost center containing just these users, then create a Premium Request SKU budget for the organization or cost center.
1. Create a separate, more restrictive budget that covers every other {% data variables.product.prodname_copilot_short %} user in your enterprise. You will likely need to integrate with the API to ensure that this budget covers new users as they are added to your enterprise.
Original file line number Diff line number Diff line change
Expand Up @@ -85,16 +85,18 @@ You can use the following strategies to maximize the value of your premium reque

* **Choose the right model for the task**. Some models are better suited to different tasks. If you're using a premium request, you can strategically choose which model you use to get the best result from {% data variables.product.prodname_copilot_short %}. See [AUTOTITLE](/copilot/reference/ai-models/model-comparison).

* **Setting a budget**. Set a budget to track your overages and receive alerts when you reach 75%, 90%, or 100% of your budget. See [AUTOTITLE](/billing/managing-your-billing/preventing-overspending#managing-budgets-for-your-personal-account).
* **Define whether users can use premium requests over their included allowance**. Set a policy to control whether users can incur extra costs for premium requests when they use up their included allowance. See [AUTOTITLE](/copilot/how-tos/manage-and-track-spending/manage-request-allowances).

{% data reusables.copilot.zero-budget-changes %}
* **Setting a budget**. Set a budget to track your overages and receive alerts when you reach 75%, 90%, or 100% of your budget. See [AUTOTITLE](/billing/managing-your-billing/preventing-overspending#managing-budgets-for-your-personal-account).

* **Monitor your usage regularly**. Check your usage in your {% data variables.product.github %} account settings to see how many premium requests you’ve used. This helps you plan how much you can use for the rest of the month.

* **Upgrade if needed**. If you find yourself consistently hitting your monthly allowance, consider upgrading to a plan with more premium requests included.

* **Avoid retrying large prompts unnecessarily**. Submitting the same long or complex prompt multiple times may use more premium requests. Try rephrasing or simplifying your request when needed.

{% data reusables.copilot.zero-budget-changes-link %}

## Managing premium request billing with multiple {% data variables.product.prodname_copilot_short %} licenses

If you have {% data variables.product.prodname_copilot_short %} licenses from multiple standalone organizations or enterprises, you must define which entity is charged for your use of premium requests. Until you define a billing entity, all premium requests you make will be rejected.
Expand Down
Loading
Loading