Merge branch 'main' into codex/document-merge-group-branch-filters

Author: alan506302-lang

Dockerfile

@@ -10,7 +10,7 @@
 # ---------------------------------------------------------------
 # To update the sha:
 # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble
-FROM ghcr.io/github/gh-base-image/gh-base-noble:20260625-083609-gedf42de01@sha256:bf0a2f43957531d73dcb2abceabf2228560f1f67d14e23f5bb0c0ccbabd77dee AS base
+FROM ghcr.io/github/gh-base-image/gh-base-noble:20260630-205522-g4a33dc6bb@sha256:2b8edd7da1718e2e9c25b98fd31dae58e57e756ef19842eac212255765cf4ada AS base
 
 # Install curl for Node install and determining the early access branch
 # Install git for cloning docs-early-access & translations repos

assets/images/help/copilot/copilot-sdk/features-agent-loop-diagram-1.png

@@ -10,6 +10,7 @@ contentType: concepts
 children:
   - /secret-leakage-risks
   - /secret-scanning
+  - /public-monitoring
   - /push-protection
   - /secret-security-with-github
   - /about-alerts

assets/images/help/copilot/copilot-sdk/features-agent-loop-diagram-2.png

@@ -0,0 +1,41 @@
+---
+title: Public monitoring for secret scanning
+shortTitle: Public monitoring
+allowTitleToDifferFromFilename: true
+intro: 'Public monitoring detects credentials leaked by your enterprise members in public repositories across {% data variables.product.github %}, giving you visibility into secret exposure beyond your enterprise''s boundaries.'
+versions:
+  feature: secret-scanning-public-monitoring
+product: 'Public monitoring is available for enterprises on {% data variables.product.prodname_ghe_cloud %} with {% data variables.product.prodname_GH_advanced_security %} or {% data variables.product.prodname_GH_secret_protection %} enabled. Public monitoring is **not available for {% data variables.enterprise.data_residency %}**.'
+contentType: concepts
+category:
+  - Protect your secrets
+---
+
+{% data reusables.secret-scanning.public-monitoring-public-preview %}
+
+## About public monitoring
+
+{% data variables.product.github %} monitors for secrets leaked across {% data variables.product.github %} in real time. Public monitoring attributes publicly exposed secrets back to your enterprise, based on where your people commit.
+
+{% data variables.product.prodname_secret_scanning_caps %} detects secrets in repositories that your enterprise owns. Public monitoring extends this detection to secrets found in arbitrary public repos across {% data variables.product.github %}.com, regardless of whether or not your enterprise owns the repository where it was leaked.
+
+This gives enterprise security administrators visibility into credential exposure they wouldn't otherwise be aware of, helping identify potential risks and leaked secrets which could be exploited by bad actors.
+
+## How public monitoring works
+
+Public monitoring scans public repositories, including non-code content like issue and pull request comments across {% data variables.product.github %} for secrets associated with your enterprise. When a secret is detected, an alert is surfaced in the enterprise-level security overview.
+
+### Attribution methods
+
+Public monitoring uses two methods to associate detected secrets with your enterprise:
+
+* **Enterprise membership:** Secrets leaked by users who are members of your enterprise
+* **Verified domain matching:** Secrets leaked by users whose email address matches a verified domain of your enterprise, even if they are not direct enterprise members
+
+Both attribution methods are active when public monitoring is enabled.
+
+## Requirements
+
+To use public monitoring, your enterprise must:
+
+* Have {% data variables.product.prodname_GH_advanced_security %} or {% data variables.product.prodname_GH_secret_protection %} enabled

assets/images/help/copilot/copilot-sdk/setup-azure-managed-identity-diagram-0.png

@@ -77,3 +77,11 @@ Validity checks are separate from {% data variables.product.prodname_secret_scan
 ## How can I access this feature?
 
 {% data reusables.gated-features.secret-scanning %}
+
+{% ifversion secret-scanning-public-monitoring %}
+
+## Public monitoring
+
+In addition to scanning repositories your enterprise owns, you can enable public monitoring to detect secrets leaked by your enterprise members in public repositories across {% data variables.product.github %}. This extends {% data variables.product.prodname_secret_scanning %} beyond the repositories your enterprise owns to follow your members' activity across the platform. See [AUTOTITLE](/code-security/concepts/secret-security/public-monitoring).
+
+{% endif %}

assets/images/help/copilot/copilot-sdk/setup-choosing-a-setup-path-diagram-0.png

@@ -0,0 +1,27 @@
+---
+title: Enabling public monitoring for your enterprise
+shortTitle: Enable public monitoring
+intro: 'Start detecting secrets your enterprise members leak in public repositories outside your enterprise''s boundaries.'
+versions:
+  feature: secret-scanning-public-monitoring
+permissions: Enterprise owners can enable public monitoring for their enterprise.
+contentType: how-tos
+category:
+  - Secure at scale
+---
+
+{% data reusables.secret-scanning.public-monitoring-public-preview %}
+
+## Prerequisites
+
+Before enabling public monitoring, ensure your enterprise has:
+
+* {% data variables.product.prodname_GH_advanced_security %} or {% data variables.product.prodname_GH_secret_protection %} enabled
+* While not necessary, we recommend having at one verified domain configured (see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/verifying-or-approving-a-domain-for-your-enterprise)) in order to get the full value for the feature.
+
+## Enabling public monitoring
+
+{% data reusables.enterprise-accounts.access-enterprise %}
+{% data reusables.enterprise-accounts.settings-tab %}
+{% data reusables.enterprise-accounts.advanced-security-tab %}
+1. Under "Additional Settings," toggle **Public monitoring**.