Repo sync

Dockerfile

@@ -10,7 +10,7 @@
 # ---------------------------------------------------------------
 # To update the sha:
 # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble
-FROM ghcr.io/github/gh-base-image/gh-base-noble:20260902-091552-ga96e4354a@sha256:5075bf9763afa1fdf20995dfa0382974a2dfec8d34e7b119b614205d013801d7 AS base
+FROM ghcr.io/github/gh-base-image/gh-base-noble:20260903-185405-g03e243e8e@sha256:d7ed0adc25b453b64b7ba7bfb9c81b786063d9d18d0161a81effbba2ba109873 AS base
 
 # Install curl for Node install and determining the early access branch
 # Install git for cloning docs-early-access & translations repos

content/admin/administering-your-instance/administering-your-instance-from-the-command-line/command-line-utilities.md

@@ -423,56 +423,6 @@ Use this command to immediately unlock the {% data variables.enterprise.manageme
 ghe-reactivate-admin-login
 ```
 
-### ghe-saml-mapping-csv
-
-> [!NOTE]
-> This utility does not work with configurations that use SAML with SCIM provisioning. For the SCIM version of this tool, please refer to [`ghe-scim-identities-csv` utility](#ghe-scim-identities-csv).
-
-This utility allows administrators to output or update the SAML `NameID` mappings for users on an instance. The utility can output a CSV file that lists all existing mappings. You can also update mappings for users on your instance by editing the resulting file, then using the utility to assign new mappings from the file.
-
-To output a CSV file containing a list of all user SAML `NameID` mappings on the instance, run the following command.
-
-```shell
-ghe-saml-mapping-csv -d
-```
-
-By default, the utility writes the file to `/data/user/tmp`.
-
-If you plan to update mappings, to ensure that the utility can access the file, we recommend that you keep the file in the default location.
-
-To prepare to update mappings, edit the file and make the desired changes. To see the result of updating the mappings using the new values in your edited CSV file, perform a dry run. Run the following command, replacing /PATH/TO/FILE with the actual path to the file you edited.
-
-```shell
-ghe-saml-mapping-csv -u -n -f /PATH/TO/FILE
-```
-
-To update SAML mappings on the instance with new values from the file, run the following command, replacing /PATH/TO/FILE with the actual path to the file you edited.
-
-```shell
-ghe-saml-mapping-csv -u -f /PATH/TO/FILE
-```
-
-### ghe-scim-identities-csv
-
-> [!NOTE]
-> This utility only works with configurations that use SAML with SCIM provisioning. For the SAML only version of this tool, please refer to the [`ghe-saml-mapping-csv` utility](#ghe-saml-mapping-csv).
-
-This utility allows administrators to output the SCIM identities for users on an instance. The utility can output a CSV file that lists all existing identities and the groups they are members of.
-
-To output CSV data containing a list of all user SCIM identities on the instance, run the following command. This will create a file located at `/data/user/tmp/scim-identities-DATE.csv` containing your SCIM identities.
-
-```shell
-ghe-scim-identities-csv
-```
-
-Or, if you'd like to specify the file, run the following command.
-
-```shell
-ghe-scim-identities-csv -f /PATH/TO/FILE
-```
-
-We recommend writing to a file in `/data/user/tmp`.
-
 ### ghe-service-list
 
 This utility lists all of the services that have been started or stopped (are running or waiting) on your appliance.
@@ -648,6 +598,7 @@ SSL-Session:
 ```
 
 You can use these additional options with the utility:
+
 * The `-r` flag allows you to uninstall a CA certificate.
 * The `-h` flag displays more usage information.
 
@@ -715,6 +666,8 @@ To show all hook deliveries filtered by a given event and action:
 
 ```shell
 ghe-webhook-logs --event issues.opened
+```
+
 To show all failed hook deliveries in the past day:
 
 ```shell
@@ -1184,6 +1137,7 @@ Flag | Description
 
 > [!NOTE]
 > {% ifversion ghes > 3.17 %}* In an HA configuration, you can use this command to remove an additional node. You cannot use it to remove the HA primary or a replica.{% endif %}
+>
 > * The target node must report `ready` in `nomad node status` to complete removal. The `--no-evacuate` flag does not remove an offline node from the configuration.
 > * This command does not support parallel execution. To remove multiple nodes, you must wait until this command has finished before running it for another node.
 
@@ -1380,6 +1334,7 @@ ghe-actions-test-storage-with-oidc -p [PROVIDER] -cs ["CONNECTION-STRING"]
 This utility stops {% data variables.product.prodname_actions %} from running on {% data variables.location.product_location %}.
 
 > [!NOTE]
+>
 > * {% data reusables.enterprise_enterprise_support.support_will_ask_you_to_run_command %}
 > * In high availability configurations, run this command from the primary.
 
@@ -1388,6 +1343,7 @@ This utility stops {% data variables.product.prodname_actions %} from running on
 This utility starts {% data variables.product.prodname_actions %} on {% data variables.location.product_location %} after it has been previously stopped.
 
 > [!NOTE]
+>
 > * {% data reusables.enterprise_enterprise_support.support_will_ask_you_to_run_command %}
 > * In high availability configurations, run this command from the primary.
 
@@ -1889,10 +1845,9 @@ To install an upgrade package:
 ghe-upgrade UPGRADE-PACKAGE-FILENAME
 ```
 
-
 {% ifversion ghes > 3.20 %}
 
-Beginning with upgrades in version 3.21 operators may run many of the upgrade operations without requiring a maintenance window using phased execution. 
+Beginning with upgrades in version 3.21 operators may run many of the upgrade operations without requiring a maintenance window using phased execution.
 
 First run operations which do not require a maintenance window by triggering the pre-upgrade phase
 
@@ -1997,8 +1952,109 @@ This utility unsuspends the specified user, granting them access to login, push,
 ghe-user-unsuspend USERNAME
 ```
 
-## Database and storage
+## User management with SAML and SCIM
+
+These utilities help you troubleshoot SAML single sign-on (SSO) and manage SAML `NameID` mappings and SCIM identities on {% data variables.location.product_location %}, for both individual users and in bulk.
+
+### ghe-saml-debug
+
+This utility enables or disables SAML debug logging on {% data variables.location.product_location %}. When you enable debug logging, {% data variables.product.prodname_ghe_server %} writes verbose SAML request and response details to its logs, which can help you troubleshoot SSO. For more information, see [AUTOTITLE](/admin/managing-iam/using-saml-for-enterprise-iam/troubleshooting-saml-authentication).
+
+SAML debug logging is a global setting and is not scoped to a single user. The `USERNAME` argument must be an existing user and identifies the account that the change is attributed to in the audit log. It is not the subject of the logging.
+
+> [!WARNING]
+>
+> Only enable SAML debugging when requested by {% data variables.contact.github_support %}, and disable it immediately after troubleshooting. Leaving it enabled causes logs to grow much faster than usual, which can negatively impact the performance of {% data variables.product.prodname_ghe_server %}.
+
+To enable SAML debug logging, run the following command, replacing `USERNAME` with an existing user to attribute the change to.
+
+```shell
+ghe-saml-debug --enable USERNAME
+```
+
+To disable SAML debug logging, run the following command.
+
+```shell
+ghe-saml-debug --disable USERNAME
+```
+
+### ghe-saml-mapping-csv
+
+> [!NOTE]
+>
+> This utility does not work with configurations that use SAML with SCIM provisioning. For the SCIM version of this tool, please refer to [`ghe-scim-identities-csv` utility](#ghe-scim-identities-csv).
+
+This utility allows administrators to output or update the SAML `NameID` mappings for users on an instance. The utility can output a CSV file that lists all existing mappings. You can also update mappings for users on your instance by editing the resulting file, then using the utility to assign new mappings from the file.
+
+To output a CSV file containing a list of all user SAML `NameID` mappings on the instance, run the following command.
+
+```shell
+ghe-saml-mapping-csv --dump
+```
+
+By default, the utility writes the file to `/data/user/tmp`.
+
+If you plan to update mappings, to ensure that the utility can access the file, we recommend that you keep the file in the default location.
+
+To prepare to update mappings, edit the file and make the desired changes. To see the result of updating the mappings using the new values in your edited CSV file, perform a dry run. Run the following command, replacing `/PATH/TO/FILE` with the actual path to the file you edited.
+
+```shell
+ghe-saml-mapping-csv --update --dry-run --file /PATH/TO/FILE
+```
+
+To update SAML mappings on the instance with new values from the file, run the following command, replacing `/PATH/TO/FILE` with the actual path to the file you edited.
+
+```shell
+ghe-saml-mapping-csv --update --file /PATH/TO/FILE
+```
+
+### ghe-saml-mapping-destroy
+
+This utility permanently deletes the SAML mapping or mappings whose `NameID` matches a value that you specify. A SAML mapping links an external SAML identity (the `NameID`) to a user account. When you delete a mapping, the account must re-link its SAML identity the next time the user signs in. For more information, see [AUTOTITLE](/admin/managing-iam/using-saml-for-enterprise-iam/updating-a-users-saml-nameid).
+
+> [!WARNING]
+>
+> This action is destructive and cannot be undone. By default, the utility displays the matching mappings and prompts you to confirm before it deletes anything. To skip the confirmation prompt, use the `--yes` flag.
+
+To find and delete the SAML mappings for a `NameID`, run the following command, replacing `NAME-ID` with the `NameID` to match, such as an email address or URN. If the value contains spaces or shell metacharacters, enclose it in quotes.
+
+```shell
+ghe-saml-mapping-destroy NAME-ID
+```
+
+### ghe-saml-mapping-find
+
+This utility displays the SAML mapping for a single user. It is read-only and does not change {% data variables.location.product_location %}. For more information, see [AUTOTITLE](/admin/managing-iam/using-saml-for-enterprise-iam/updating-a-users-saml-nameid).
+
+To display the SAML mapping for a user, run the following command, replacing `USERNAME` with the username.
+
+```shell
+ghe-saml-mapping-find USERNAME
+```
+
+### ghe-scim-identities-csv
+
+> [!NOTE]
+>
+> This utility only works with configurations that use SAML with SCIM provisioning. For the SAML only version of this tool, please refer to the [`ghe-saml-mapping-csv` utility](#ghe-saml-mapping-csv).
+
+This utility allows administrators to output the SCIM identities for users on an instance. The utility can output a CSV file that lists all existing identities and the groups they are members of.
 
+To output CSV data containing a list of all user SCIM identities on the instance, run the following command. This will create a file located at `/data/user/tmp/scim-identities-DATE.csv` containing your SCIM identities.
+
+```shell
+ghe-scim-identities-csv
+```
+
+Or, if you'd like to specify the file, run the following command, replacing `/PATH/TO/FILE` with the path where you want to write the file.
+
+```shell
+ghe-scim-identities-csv --file /PATH/TO/FILE
+```
+
+We recommend writing to a file in `/data/user/tmp`.
+
+## Database and storage
 
 {% ifversion ghes > 3.17 %}
 
@@ -2056,7 +2112,6 @@ Flag | Description
 `-s/--summarize` | Display only a total.
 `-H/--human-readable` | Print sizes in human-readable format.
 
-
 ### ghe-mssql-console
 
 This utility opens a Microsoft SQL Server database session on {% data variables.location.product_location %}. The MSSQL database is used by {% data variables.product.prodname_actions %} services.
@@ -2098,7 +2153,6 @@ This utility runs checks on the state of the Microsoft SQL Server instance on {%
 ghe-mssql-health-check
 ```
 
-
 ## Dependencies
 
 ### ghe-dep-graph-enable

content/admin/data-residency/github-copilot-with-data-residency.md

@@ -65,15 +65,10 @@ The models available for {% data variables.product.prodname_copilot_short %} var
 * {% data variables.copilot.copilot_gpt_56_sol %}
 * {% data variables.copilot.copilot_gpt_56_terra %}
 * {% data variables.copilot.copilot_claude_haiku_45 %}
-* {% data variables.copilot.copilot_claude_opus_45 %}
-* {% data variables.copilot.copilot_claude_opus_46 %}
 * {% data variables.copilot.copilot_claude_opus_47 %}
 * {% data variables.copilot.copilot_claude_opus_48 %}
 * {% data variables.copilot.copilot_claude_opus_5 %}
-* {% data variables.copilot.copilot_claude_sonnet_45 %}
-* {% data variables.copilot.copilot_claude_sonnet_46 %}
 * {% data variables.copilot.copilot_claude_sonnet_5 %}
-* {% data variables.copilot.copilot_gemini_31_pro %}
 * {% data variables.copilot.copilot_gemini_35_flash %}
 * {% data variables.copilot.copilot_mai_code_1_flash %}
 

content/copilot/concepts/about-cloud-and-local-sandboxes.md

@@ -74,11 +74,30 @@ For more information, see [AUTOTITLE](/copilot/how-tos/cloud-and-local-sandboxes
 
 ### Cross-platform support
 
-Local sandboxing is available on macOS and Linux, and on Windows Insiders builds. Support and isolation behavior vary by platform because each operating system uses a different isolation backend:
+Local sandboxing is available on macOS, on Linux, and on recent Windows 11 builds. Each operating system uses a different isolation backend, so the requirements are different:
 
-* **macOS** uses the Seatbelt backend (`sandbox-exec`).
-* **Linux** uses the bubblewrap backend, which requires the `bwrap` command to be installed and available on your `PATH`. If `/sandbox` reports that sandboxing isn't supported on Linux, install bubblewrap.
-* **Windows** uses the ProcessContainer backend.
+* **macOS** uses the Seatbelt backend. {% data variables.copilot.copilot_cli_short %} applies a process-scoped profile to each sandboxed command. Use macOS 15 (Sequoia) or later. {% data variables.copilot.copilot_cli_short %} does not block an older macOS, but the backend is not tested there.
+* **Linux** uses the bubblewrap backend. Install bubblewrap 0.5.0 or later, and make sure `bwrap` is on your `PATH`. If `/sandbox` reports that your `bwrap` is too old, upgrade the package.
+* **Windows** uses the BaseContainer tier of the ProcessContainer backend. {% data variables.copilot.copilot_cli_short %} does not use the AppContainer fallback tiers. If your Windows build cannot supply BaseContainer, {% data variables.copilot.copilot_cli_short %} reports that sandboxing is not supported. To find the supported Windows versions, see [Windows OS support for Copilot sandboxing](https://aka.ms/ghcp-sandbox-os-support).
+
+#### Proxy support
+
+The sandbox proxy operates differently on each operating system:
+
+* **macOS**: {% data variables.copilot.copilot_cli_short %} does not give the proxy to Seatbelt. It sets `HTTP_PROXY`, `HTTPS_PROXY`, and `ALL_PROXY` in the sandboxed environment instead. Only programs that obey these variables use the proxy. A program that ignores them connects directly.
+* **Linux**: bubblewrap enforces the proxy. The sandbox gets a private network namespace, and only the proxy endpoint is permitted. This mode has more requirements. You must have:
+  * `slirp4netns` on your `PATH`.
+  * `unshare` and `nsenter` from util-linux 2.35 or later, with `--map-current-user` and `--keep-caps` support.
+  * `iptables` and `ip6tables`. Use the `nf_tables` backend. The legacy backend also operates, but only if you can write to `/run/xtables.lock`.
+
+  Two more limits apply on Linux. The proxy must have an IPv4 address, because {% data variables.copilot.copilot_cli_short %} refuses a proxy that only IPv6 can reach. The proxy URL must not contain credentials, so give the credentials to the proxy itself.
+
+  Also on Linux, bubblewrap cannot control local network access independently of outbound access. Your local network setting therefore does not have a separate effect there.
+* **Windows**: the proxy is not available. Do not use denied paths on Windows either. {% data variables.copilot.copilot_cli_short %} cannot enforce these settings, and the sandboxed command fails with an error.
+
+#### If your host does not support local sandboxing
+
+{% data variables.copilot.copilot_cli_short %} turns the sandbox off for the session and shows a notice. Shell commands and sandboxed services then run without a sandbox, and your `sandbox.enabled` setting does not change. If your enterprise enforces sandboxing through device-managed settings, the session fails closed instead: sandboxed commands do not run.
 
 ### Enterprise policy enforcement
 

content/copilot/concepts/agents/copilot-cli/fleet.md

@@ -29,7 +29,7 @@ When you use the `/fleet` command, the main {% data variables.product.prodname_c
 
 * **Specialization**: If you've defined custom agents that are specialized for certain types of work, these may be used by the subagents. This allows for specialization, with the subagents using the custom agents best suited to the specific subtask they are working on.
 
-  By default, subagents use a low-cost AI model. However, you can tell {% data variables.product.prodname_copilot_short %} to use a specific model for part of the work. For example, within a larger prompt, you could specify `... Use GPT-5.3-Codex, to create ... Use Claude Opus 4.5, to analyze ...`. If a subagent uses a custom agent profile that specifies a particular AI model, then that model will be used by the subagent. Using a specific model may produce better quality results for particular types of subtask.
+  By default, subagents use a low-cost AI model. However, you can tell {% data variables.product.prodname_copilot_short %} to use a specific model for part of the work. For example, within a larger prompt, you could specify `... Use GPT-5.3-Codex, to create ... Use Claude Opus 5, to analyze ...`. If a subagent uses a custom agent profile that specifies a particular AI model, then that model will be used by the subagent. Using a specific model may produce better quality results for particular types of subtask.
 
   If custom agents are available, {% data variables.product.prodname_copilot_short %} will decide whether to use one to complete a particular subtask. However, if you know that a specific custom agent is well-suited to a particular subtask, you can specify this in your prompt by using `@CUSTOM-AGENT-NAME`. For example, within a larger prompt: `... Use @test-writer to create comprehensive unit tests for ...`.