Merge branch 'main' into patch-1

Author: Sharra-writes

content/billing/concepts/product-billing/github-actions.md

@@ -112,7 +112,6 @@ The use of standard {% data variables.product.github %}-hosted runners is free:
 * In public repositories
 * For {% data variables.product.prodname_pages %}
 * For {% data variables.product.prodname_dependabot %}
-* For the agentic features ({% data variables.release-phases.public_preview %}) in {% data variables.copilot.copilot_code-review %}
 
 > [!NOTE]
 >

content/billing/concepts/product-billing/github-copilot-licenses.md

@@ -15,6 +15,12 @@ category:
   - Understand product costs
 ---
 
+<!-- expires 2026-06-01 -->
+
+{% data reusables.copilot.ubb-announcement-cfi-cb-ce %}
+
+<!-- end expires 2026-06-01 -->
+
 Usage of {% data variables.product.prodname_copilot %} is measured through a combination of licenses and monthly usage tracking. For more information about how usage costs in {% data variables.product.prodname_copilot_short %} work, see [AUTOTITLE](/billing/concepts/product-billing/github-copilot-premium-requests).
 
 ## Licenses for {% data variables.product.prodname_copilot_short %}

content/billing/concepts/product-billing/github-copilot-premium-requests.md

@@ -8,6 +8,12 @@ category:
   - Understand product costs
 ---
 
+<!-- expires 2026-06-01 -->
+
+{% data reusables.copilot.ubb-announcement-cfi-cb-ce %}
+
+<!-- end expires 2026-06-01 -->
+
 Usage of {% data variables.product.prodname_copilot_short %} is measured through a combination of licenses and monthly usage tracking. For more information about how license costs in {% data variables.product.prodname_copilot_short %} work, see [AUTOTITLE](/billing/concepts/product-billing/github-copilot-licenses).
 
 > [!IMPORTANT]

content/code-security/tutorials/remediate-leaked-secrets/assessing-ghsp-impact.md

@@ -0,0 +1,149 @@
+---
+title: Assessing the impact of GitHub Secret Protection
+intro: 'Measure how {% data variables.product.prodname_GH_secret_protection_always %} reduces secret exposure across your organization, so you can demonstrate value and identify areas to strengthen your security posture.'
+allowTitleToDifferFromFilename: true
+shortTitle: Assess GHSP impact
+versions:
+  fpt: '*'
+  ghec: '*'
+  ghes: '*'
+contentType: tutorials
+category:
+  - Protect your secrets
+---
+
+## Introduction
+
+After enabling {% data variables.product.prodname_GH_secret_protection_always %} (GHSP) for your organization, you'll want to assess its impact and understand how it's protecting your organization. This tutorial walks you through accessing secret-related data and interpreting the results to measure GHSP performance.
+
+ In this tutorial, you'll learn how to:
+ * Access your organization's security overview to view {% data variables.product.prodname_secret_scanning %} data
+ * Review the {% data variables.product.prodname_secret_risk_assessment %} (SRA) report
+ * Compare and analyze the data to assess GHSP's impact
+
+If you don't have a historic SRA report from before your GHSP rollout, you can still assess GHSP's effectiveness. Skip ahead to [Step 4: Analyze security overview data trends](#step-4-analyze-security-overview-data-trends).
+
+## Prerequisites
+
+* You need to have the organization owner or security manager role.
+* {% data variables.product.prodname_secret_protection %} must be enabled for your organization.
+
+## Step 1: Access the organization-level security overview
+
+The security overview provides real-time data about {% data variables.secret-scanning.alerts %} across your organization.
+
+{% data reusables.organizations.navigate-to-org %}
+{% data reusables.organizations.security-overview %}
+1. On the security overview page, click the **Risk** tab to view secret scanning data.
+   The overview shows:
+    * Total number of open {% data variables.secret-scanning.alerts %}
+    * Alert trends over time
+    * Breakdown by repository
+    * Alert severity distribution
+
+## Step 2: View your {% data variables.product.prodname_secret_risk_assessment %} report
+
+If you previously ran a SRA report, you can access the report to establish a baseline.
+
+{% data reusables.organizations.navigate-to-org %}
+{% data reusables.organizations.security-overview %}
+{% data reusables.security-overview.open-assessments-view %}
+1. Review the key metrics from the assessment, including:
+   * Number of exposed secrets detected
+   * Types of secrets found
+   * Repositories with the highest risk
+   * Recommended remediation actions
+
+> [!NOTE] The SRA report represents a point-in-time snapshot of your secret exposure before or during your GHSP implementation.
+
+## Step 3: Compare SRA data with current security overview
+
+The SRA report is a **point-in-time** snapshot taken before or during your GHSP rollout, while the security overview shows **real-time** data that updates as alerts are opened and resolved. To make a meaningful comparison, you need to ensure both datasets cover the same secret types.
+
+### Filter to comparable pattern types
+
+The SRA report only detects **provider patterns** and **generic patterns**. The security overview, however, may also include results from custom patterns you've configured since enabling GHSP. To ensure an accurate comparison, filter the security overview to the same pattern types the SRA covers.
+
+#### Using the UI
+
+In the security overview **Risk** tab, use the filter bar to narrow results to provider and generic patterns only, excluding any custom patterns.
+
+#### Using the API
+
+Alternatively, you can use the REST API to programmatically retrieve alerts filtered by secret type. For example, to list only default (provider) {% data variables.secret-scanning.alerts %} for a repository:
+
+```shell copy
+gh api \
+  -H "Accept: application/vnd.github+json" \
+  /orgs/ORG/secret-scanning/alerts --paginate
+```
+
+This returns alerts for default patterns only. To also include generic patterns in your results, pass the specific token names using the `secret_type` parameter.
+
+For more information, see [AUTOTITLE](/rest/secret-scanning/secret-scanning).
+
+### Build your comparison
+
+1. Using the filtered data, create a comparison table with these key metrics:
+
+   | Metric | SRA report (Baseline) | Current security overview (Filtered) | Change |
+   |--------|----------------------|--------------------------------------|--------|
+   | Total exposed secrets | [SRA number] | [Current number] | [Difference] |
+   | Critical alerts | [SRA number] | [Current number] | [Difference] |
+   | Affected repositories | [SRA number] | [Current number] | [Difference] |
+
+1. Calculate the percentage change for each metric:
+   * **Positive impact indicators:** Reduction in total exposed secrets, fewer critical alerts
+   * **Areas for improvement:** New alerts appearing, specific repositories with increasing trends
+
+1. Note any significant differences in:
+   * Secret types being detected
+   * Repository coverage
+   * Alert resolution rates
+
+## Step 4: Analyze security overview data trends
+
+Even without an SRA report, you can assess GHSP effectiveness by analyzing trends in the security overview.
+
+{% data reusables.organizations.navigate-to-org %}
+{% data reusables.organizations.security-overview %}
+1. In the security overview **Risk** tab, look at the trend graph showing {% data variables.secret-scanning.alerts %} over time.
+1. Identify patterns:
+   * **Declining trend:** Indicates successful remediation and prevention
+   * **Plateau:** May suggest steady state or need for increased awareness
+   * **Rising trend:** May indicate increased detection coverage or new secret introduction
+
+1. Click on individual repositories to drill down into specific alert details.
+1. Review the alert resolution rate:
+   * Navigate to the **{% data variables.product.prodname_security_and_quality_tab %}** tab for your organization.
+   * Under "Findings", Click **{% data variables.product.prodname_secret_scanning_caps %}**.
+   * Check how many alerts have been closed versus the number of alerts that remain open.
+   * Select the alert type you're interested in.
+   * Assess average time to resolution.
+
+## Step 5: Interpret the results and take action
+
+Based on your analysis, determine the next steps.
+
+### If you're seeing positive trends
+
+* Document the improvement to demonstrate GHSP value
+* Identify successful practices to replicate across other repositories
+* Consider expanding GHSP coverage to additional repositories or organizations
+
+### If you're seeing areas for improvement
+
+* Review repositories with increasing alerts or slow resolution times
+* Provide additional training to development teams
+* Assess whether custom patterns need to be configured
+* Check if push protection is enabled to prevent new secrets from being introduced
+
+### Ongoing monitoring
+
+* Schedule regular reviews (weekly or monthly) of the security overview
+* Set up notifications for new {% data variables.secret-scanning.alerts %}
+* Track metrics over time to demonstrate continuous improvement
+
+## Further reading
+
+* To understand {% data variables.product.prodname_secret_scanning %} metrics in detail, see [AUTOTITLE](/code-security/security-overview/viewing-security-insights).

content/code-security/tutorials/remediate-leaked-secrets/index.md

@@ -8,7 +8,7 @@ versions:
 contentType: tutorials
 children:
   - /calculating-the-cost-savings-of-push-protection
+  - /assessing-ghsp-impact
   - /evaluating-alerts
   - /remediating-a-leaked-secret
 ---
-

content/copilot/concepts/agents/about-agent-skills.md

@@ -25,7 +25,7 @@ You can also use `gh skill` in {% data variables.product.prodname_cli %} to disc
 {% data variables.product.prodname_copilot_short %} supports:
 
 * Project skills, stored in your repository (`.github/skills`, `.claude/skills`, or `.agents/skills`)
-* Personal skills, stored in your home directory and shared across projects (`~/.copilot/skills`, `~/.claude/skills`, or `~/.agents/skills`)
+* Personal skills, stored in your home directory and shared across projects (`~/.copilot/skills` or `~/.agents/skills`)
 
 Support for organization-level and enterprise-level skills is coming soon.
 

content/copilot/concepts/agents/code-review.md

@@ -15,6 +15,12 @@ category:
   - Learn about Copilot
 ---
 
+<!-- expires 2026-06-01 -->
+
+{% data reusables.copilot.code-review-actions-minutes-note %}
+
+<!-- end expires 2026-06-01 -->
+
 ## Introduction
 
 {% data variables.copilot.copilot_code-review_short %} reviews code written in any language, and provides feedback. It reviews your code from multiple angles to identify issues and suggest fixes. You can apply suggested changes with a couple of clicks.
@@ -98,17 +104,19 @@ If {% data variables.product.prodname_actions %} is unavailable or if Actions wo
 
 ### Usage of {% data variables.product.prodname_actions %} runners for agentic capabilities in code review
 
-{% data variables.copilot.copilot_code-review_short %} uses free minutes for {% data variables.product.prodname_actions %} to run the agentic capabilities, including full project context gathering and any capabilities in {% data variables.release-phases.public_preview %}. By default, {% data variables.copilot.copilot_code-review_short %} uses {% data variables.product.prodname_dotcom %}-hosted runners. You can also upgrade to larger {% data variables.product.prodname_dotcom %}-hosted runners for better performance.
+{% data variables.copilot.copilot_code-review_short %} uses {% data variables.product.prodname_actions %} to run the agentic capabilities, including full project context gathering and any capabilities in {% data variables.release-phases.public_preview %}. By default, {% data variables.copilot.copilot_code-review_short %} uses standard {% data variables.product.prodname_dotcom %}-hosted runners. You can also upgrade to larger {% data variables.product.prodname_dotcom %}-hosted runners for better performance, or use self-hosted runners.
 
 > [!NOTE]
-> Usage of larger {% data variables.product.prodname_dotcom %}-hosted runners is billed per-minute and may incur additional {% data variables.product.prodname_actions %} charges.
+> Usage of larger {% data variables.product.prodname_dotcom %}-hosted runners is billed at a higher per-minute rate. Self-hosted runners do not consume {% data variables.product.prodname_actions %} minutes.
 
 You do not need to have {% data variables.product.prodname_actions %} enabled in your organization or enterprise to use the agentic capabilities in code review.
 
 If your organization has disabled {% data variables.product.prodname_dotcom %}-hosted runners, the agentic capabilities will not be available. In this case, code reviews will fall back to a more limited review. Organizations in this situation can use self-hosted runners.
 
 For more information on configuring runners, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/set-up-copilot/configure-runners).
 
+You can view the {% data variables.product.prodname_actions %} minutes associated with {% data variables.copilot.copilot_code-review_short %} runs. For more information, see [{% data variables.product.prodname_actions %} minutes for code review](/copilot/reference/copilot-billing/models-and-pricing#github-actions-minutes-for-code-review).
+
 ## Code review monthly quota
 
 Each time {% data variables.product.prodname_copilot_short %} reviews a pull request or reviews code in your IDE, your monthly quota of {% data variables.product.prodname_copilot_short %} premium requests is reduced by one.

content/copilot/concepts/auto-model-selection.md

@@ -3,7 +3,7 @@ title: 'About {% data variables.product.prodname_copilot_short %} auto model sel
 allowTitleToDifferFromFilename: true
 shortTitle: 'Auto model selection'
 intro: 'Automatically select models for {% data variables.copilot.copilot_chat_short %}, {% data variables.copilot.copilot_cloud_agent %}, and third-party agents.'
-product: '{% data variables.copilot.copilot_auto_model_selection_short_cap_a %} for {% data variables.copilot.copilot_chat_short %} is available with all {% data variables.product.prodname_copilot %} plans. <br>{% data variables.copilot.copilot_auto_model_selection_short_cap_a %} for {% data variables.copilot.copilot_cloud_agent %} is available for {% data variables.copilot.copilot_pro %} and {% data variables.copilot.copilot_pro_plus %} plans.'
+product: '{% data variables.copilot.copilot_auto_model_selection_short_cap_a %} is available with all {% data variables.product.prodname_copilot %} plans.'
 versions:
   feature: copilot
 contentType: concepts

content/copilot/concepts/billing/billing-for-individuals.md

@@ -16,6 +16,12 @@ category:
   - Learn about Copilot
 ---
 
+<!-- expires 2026-06-01 -->
+
+{% data reusables.copilot.ubb-announcement-cfi %}
+
+<!-- end expires 2026-06-01 -->
+
 > [!IMPORTANT]
 > {% data reusables.copilot.plans.individual-plans-paused %} If you hit unexpected limits or these changes just don’t work for you, you can cancel your Pro or Pro+ subscription and receive a refund for the time remaining on your current subscription before May 20.
 > 1. To cancel and receive a refund for the time remaining, go to your [Billing settings](https://github.com/settings/billing/licensing).