github · docs-bot · Sep 9, 2026 · Sep 8, 2026 · Sep 9, 2026 · Sep 9, 2026
diff --git a/.github/workflows/check-for-spammy-prs.yml b/.github/workflows/check-for-spammy-prs.yml
@@ -41,8 +41,6 @@ jobs:
               const changedLines = (file.patch || '')
                 .split('\n')
                 .filter(line => /^[+-]/.test(line))
-                )
-
               return changedLines.length > 0 &&
                 changedLines.every(line => line.slice(1).trim() === '')
             })

diff --git a/...estoring-your-instance/about-the-backup-service-for-github-enterprise-server.md b/...estoring-your-instance/about-the-backup-service-for-github-enterprise-server.md
@@ -9,6 +9,7 @@ category:
   - Back up and upgrade your instance
 redirect_from:
   - /admin/backing-up-and-restoring-your-instance/backup-service-for-github-enterprise-server/about-the-backup-service-for-github-enterprise-server
+  - /admin/backing-up-and-restoring-your-instance/configuring-backups-on-your-instance
 ---
 
 {% ifversion ghes < 3.20 %}

diff --git a/...ow-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts.md b/...ow-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts.md
@@ -48,6 +48,12 @@ Once a secret has been committed to a repository, you should consider the secret
 > [!NOTE]
 >{% data variables.product.prodname_secret_scanning_caps %} doesn't automatically close alerts when the corresponding token has been removed from the repository. You must manually close these alerts in the alert list on {% data variables.product.prodname_dotcom %}.
 
+{% ifversion secret-scanning-merge-protection %}
+
+If a branch ruleset requires {% data variables.product.prodname_secret_scanning %} alerts to be resolved, an open alert introduced by a pull request can block merging. After fixing the exposed secret, close the alert using the following steps. After all blocking alerts are closed, the alerts no longer prevent merging. The rule can continue to block merging until a {% data variables.product.prodname_secret_scanning %} scan completes for the pull request's head commit.
+
+{% endif %}
+
 {% data reusables.repositories.navigate-to-repo %}
 {% data reusables.repositories.sidebar-security %}
 1. In the left sidebar, under "Vulnerability alerts", click **{% data variables.product.prodname_secret_scanning_caps %}**.

diff --git a/...y/how-tos/secure-your-secrets/prevent-future-leaks/block-merges-with-secrets.md b/...y/how-tos/secure-your-secrets/prevent-future-leaks/block-merges-with-secrets.md
@@ -0,0 +1,82 @@
+---
+title: Blocking pull request merges that contain secrets
+shortTitle: Block merges with secrets
+intro: Prevent exposed secrets from reaching protected branches by requiring contributors to resolve {% data variables.product.prodname_secret_scanning %} alerts before merging.
+permissions: '{% data reusables.permissions.security-org-enable %}{% ifversion enterprise-code-rulesets %}, and enterprise owners{% endif %}'
+product: '{% data reusables.gated-features.secret-protection %}'
+versions:
+  feature: secret-scanning-merge-protection
+contentType: how-tos
+category:
+  - Protect your secrets
+redirect_from:
+  - /code-security/how-tos/secure-your-secrets/prevent-future-leaks/block-pull-request-merges
+---
+
+> [!NOTE]
+> {% data reusables.secret-scanning.merge-protection-public-preview %}
+
+The **Require secret scanning alerts are resolved** rule is available for rulesets that target branches in repositories. You can use the rule to block a pull request from merging when either of these conditions applies:
+
+* A {% data variables.product.prodname_secret_scanning %} scan has not completed for the head commit of the pull request.
+* A commit in the pull request introduced an open {% data variables.product.prodname_secret_scanning %} alert that matches a secret type selected in the ruleset.
+
+The rule supports provider, custom, and generic patterns. It does not support AI-detected secrets.
+
+## Prerequisites
+
+The repositories that you want to protect must have:
+
+* Either {% data variables.product.prodname_GH_secret_protection %} or {% data variables.product.prodname_GHAS %} enabled
+* {% data variables.product.prodname_secret_scanning_caps %} enabled. See [AUTOTITLE](/code-security/how-tos/secure-your-secrets/detect-secret-leaks/enable-secret-scanning).
+
+## Creating a merge protection ruleset for a repository
+
+{% data reusables.repositories.navigate-to-repo %}
+{% data reusables.repositories.sidebar-settings %}
+{% data reusables.repositories.repo-rulesets-settings %}
+1. Click **New ruleset**.
+1. Click **New branch ruleset**.
+{% data reusables.repositories.rulesets-general-step %}
+{% data reusables.repositories.rulesets-target-branches %}
+{% data reusables.repositories.rulesets-require-secret-scanning-alerts-resolved %}
+{% data reusables.repositories.rulesets-create-and-insights-step %}
+
+For information about configuring bypass permissions and other ruleset settings, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository).
+
+## Creating a merge protection ruleset for repositories in an organization{% ifversion enterprise-code-rulesets %} or enterprise{% endif %}
+
+{% ifversion enterprise-code-rulesets %}You can create this ruleset for repositories in your organization, or create it for an enterprise to apply merge protection consistently across repositories in multiple organizations.
+
+### Accessing organization ruleset settings{% endif %}
+
+{% data reusables.profile.access_org %}
+{% data reusables.profile.org_settings %}
+{% data reusables.organizations.access-ruleset-settings %}
+
+{% ifversion enterprise-code-rulesets %}
+
+### Accessing enterprise ruleset settings
+
+{% data reusables.enterprise-accounts.access-enterprise %}
+{% data reusables.enterprise-accounts.policies-tab %}
+1. Under "Policies", click **Code**.
+
+### Configuring the ruleset{% endif %}
+
+1. Click **New ruleset**.
+1. Click **New branch ruleset**.
+{% data reusables.repositories.rulesets-general-step %}
+{% ifversion enterprise-code-rulesets %}
+1. If you are creating an enterprise-level ruleset, under "Target organizations", choose the organizations that the ruleset will apply to.
+{% endif %}
+1. Under "Target repositories", choose the repositories that the ruleset will apply to.
+{% data reusables.repositories.rulesets-target-branches %}
+{% data reusables.repositories.rulesets-require-secret-scanning-alerts-resolved %}
+{% data reusables.repositories.rulesets-create-and-insights-step %}
+
+For information about configuring bypass permissions and other ruleset settings, see [AUTOTITLE](/organizations/managing-organization-settings/creating-rulesets-for-repositories-in-your-organization){% ifversion enterprise-code-rulesets %} and [AUTOTITLE](/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance){% endif %}.
+
+## Unblocking a pull request
+
+When this rule blocks a pull request because of open alerts, you must resolve each alert that matches the secret types selected in the ruleset. See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts).
diff --git a/content/code-security/how-tos/secure-your-secrets/prevent-future-leaks/index.md b/content/code-security/how-tos/secure-your-secrets/prevent-future-leaks/index.md
@@ -1,7 +1,7 @@
 ---
 title: How-tos for leak prevention
 shortTitle: Prevent future leaks
-intro: Learn how to prevent future secret leaks with {% data variables.product.github %}'s push protection.
+intro: Prevent exposed secrets from reaching your repositories and protected branches.
 versions:
   fpt: '*'
   ghes: '*'
@@ -10,5 +10,5 @@ contentType: how-tos
 children:
   - /enable-push-protection
   - /manage-user-push-protection
+  - /block-merges-with-secrets
 ---
-
diff --git a/content/copilot/get-started/enterprise-ai-governance.md b/content/copilot/get-started/enterprise-ai-governance.md
@@ -22,15 +22,15 @@ journeyTracks:
     description: 'Use {% data variables.product.github %}''s governance features to stay in control of your codebase and compliance requirements.'
     guides:
       - href: '/copilot/tutorials/roll-out-at-scale/govern-at-scale/govern-for-adoption'
-      - href: '/copilot/concepts/policies'
+      - href: '/copilot/concepts/enterprise/policies'
       - href: '/copilot/tutorials/roll-out-at-scale/govern-at-scale/maintain-codebase-standards'
       - href: '/copilot/how-tos/administer-copilot/manage-for-enterprise/review-audit-logs'
   - id: 'adopting_agents'
     title: 'Preparing for agents'
     description: 'Learn what agents can do for your enterprise, and prepare to roll them out.'
     guides:
       - href: '/copilot/tutorials/roll-out-at-scale/enable-developers/integrate-ai-agents'
-      - href: '/copilot/concepts/agents/enterprise-management'
+      - href: '/copilot/concepts/enterprise/agent-management'
       - href: '/copilot/tutorials/cloud-agent/build-guardrails'
       - href: '/copilot/how-tos/administer-copilot/manage-mcp-usage/configure-enterprise-allowlist'
   - id: 'enable_agents'
@@ -47,6 +47,6 @@ journeyTracks:
     title: 'Adopting new features'
     description: 'Expand your capabilities by assessing and rolling out any new feature or model.'
     guides:
-      - href: '/copilot/concepts/learning-about-new-features-and-models'
+      - href: '/copilot/concepts/enterprise/learning-about-new-features-and-models'
       - href: '/copilot/tutorials/roll-out-at-scale/govern-at-scale/pilot-a-feature-or-model'
 ---
diff --git a/...copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings.md b/...copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings.md
@@ -20,6 +20,9 @@ docsTeamMetrics:
 
 You can use the `/sandbox` slash command to grant extra paths, adjust network access, or turn sandboxing on or off.
 
+> [!NOTE]
+> If you get your {% data variables.product.prodname_copilot_short %} license from an enterprise, some or all sandbox settings may be controlled by enterprise managed settings. A managed setting is labeled `(managed)` in the `/sandbox` interface and can't be changed.
+
 For a conceptual overview of cloud and local sandboxes for {% data variables.product.prodname_copilot_short %}, see [AUTOTITLE](/copilot/concepts/about-cloud-and-local-sandboxes).
 
 ## Opening the sandbox configuration

diff --git a/...-local-sandboxes/enabling-or-disabling-cloud-sandboxes-for-your-organization.md b/...-local-sandboxes/enabling-or-disabling-cloud-sandboxes-for-your-organization.md
@@ -48,3 +48,5 @@ Enterprise owners can control cloud sandbox access for all organizations in the
 
 * [AUTOTITLE](/copilot/concepts/about-cloud-and-local-sandboxes)
 * [AUTOTITLE](/billing/concepts/product-billing/cloud-and-local-sandboxes)
+* [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings#sandbox)
+
diff --git a/content/copilot/how-tos/set-up/set-up-for-self.md b/content/copilot/how-tos/set-up/set-up-for-self.md
@@ -23,7 +23,7 @@ There are a few ways that you can get access to {% data variables.product.prodna
 * **Sign up for a paid plan**. You can subscribe to one of these plans:
 
   * **{% data variables.copilot.copilot_pro_short %}**, which includes access to premium models and a monthly allowance of {% data variables.product.prodname_ai_credits_short %}. [Subscribe to {% data variables.copilot.copilot_pro_short %}](https://github.com/github-copilot/signup?ref_product=copilot&ref_type=purchase&ref_style=text&ref_plan=pro).
-  * **{% data variables.copilot.copilot_pro_plus_short %}**, which includes a higher monthly allowance of {% data variables.product.prodname_ai_credits_short %} and access to all available models. [Subscribe to {% data variables.copilot.copilot_pro_plus_short %}](https://github.com/github-copilot/signup?ref_product=copilot&ref_type=purchase&ref_style=text&ref_plan=pro).
+  * **{% data variables.copilot.copilot_pro_plus_short %}**, which includes a higher monthly allowance of {% data variables.product.prodname_ai_credits_short %} and access to all available models. [Subscribe to {% data variables.copilot.copilot_pro_plus_short %}](https://github.com/github-copilot/signup?ref_product=copilot&ref_type=purchase&ref_style=text&ref_plan=pro-plus).
   * **{% data variables.copilot.copilot_max_short %}**, which includes advanced AI models and our highest individual monthly allowance of {% data variables.product.prodname_ai_credits_short %}. [Subscribe to {% data variables.copilot.copilot_max_short %}](https://github.com/settings/billing/licensing?ref_product=copilot&ref_type=purchase&ref_style=text&ref_plan=max).
 
 * **Use {% data variables.product.prodname_copilot_short %} through your organization or enterprise**. If you're part of an organization or enterprise with a {% data variables.product.prodname_copilot_short %} plan, you can request access at [https://github.com/settings/copilot](https://github.com/settings/copilot) under "Get {% data variables.product.prodname_copilot_short %} from an organization."

diff --git a/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md b/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md
@@ -21,9 +21,9 @@ For instructions on creating the file, see [AUTOTITLE](/copilot/how-tos/administ
 | Key | Purpose | {% data variables.copilot.copilot_cli_short %} | {% data variables.product.prodname_vscode_shortname %} | {% data variables.copilot.github_copilot_app %} | {% data variables.copilot.copilot_cloud_agent %} | {% data variables.product.prodname_jetbrains_ides %} |
 | --- | --- | --- | --- | --- | --- | --- |
 | `permissions.disableBypassPermissionsMode` | Disables bypass or YOLO-style allow-all behavior | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} |
-| `permissions.deny` | Blocks specific operations | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
-| `permissions.ask` | Requires a fresh human approval before specific operations can proceed | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
-| `permissions.allow` | Permits specific operations to proceed without a prompt | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
+| `permissions.deny` | Blocks specific operations | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
+| `permissions.ask` | Requires a fresh human approval before specific operations can proceed | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
+| `permissions.allow` | Permits specific operations to proceed without a prompt | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} | {% octicon "x" aria-label="Not supported" %} |
 | `model` | Sets your preferred model as the default for new conversations | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "x" aria-label="Not supported" %} |
 | `enabledPlugins` | Enables or disables specific plugins by key | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} |
 | `extraKnownMarketplaces` | Adds plugin marketplaces that users can access | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} | {% octicon "check" aria-label="Supported" %} |
@@ -172,6 +172,8 @@ This key is overridable by enterprise team mapping. In your `{% data variables.c
 
 ### deny, ask, allow
 
+In {% data variables.product.prodname_vscode_shortname %}, these granular permission rules apply to {% data variables.product.prodname_copilot_short %} sessions that use Agent Host. The `permissions.disableBypassPermissionsMode` setting has broader {% data variables.product.prodname_vscode_shortname %} support and isn't limited to Agent Host.
+
 The `permissions.deny`, `permissions.ask`, and `permissions.allow` keys use **deny > ask > allow** precedence. If an MDM-managed, server-managed, or file-based source defines any permission rule—or if any applicable source declares an `allow` list—an unmatched supported operation defaults to requiring approval. Otherwise, it follows the ordinary permission flow.
 
 * `deny` blocks specific operations, regardless of whether they also match an `ask` or `allow` rule. A deny rule set by any managed settings source blocks the operation for all users regardless of rules in the other sources.

diff --git a/...and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets.md b/...and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets.md
@@ -211,6 +211,24 @@ Enabling force pushes will not override any other rules. For example, if a branc
 
 If a site administrator has blocked force pushes to the default branch only, you can still enable force pushes for any other branch or tag.{% endif %}
 
+{% ifversion secret-scanning-merge-protection %}
+
+## Require {% data variables.product.prodname_secret_scanning %} alerts are resolved
+
+> [!NOTE]
+> {% data reusables.secret-scanning.merge-protection-public-preview %}
+
+If your repositories use {% data variables.product.prodname_secret_scanning %}, you can prevent a pull request from merging when either of these conditions applies:
+
+* A {% data variables.product.prodname_secret_scanning %} scan has not completed for the head commit of the pull request.
+* A commit in the pull request introduced an open {% data variables.product.prodname_secret_scanning %} alert that matches a secret type selected in the ruleset.
+
+You can configure the rule for provider, custom, and generic patterns. AI-detected secrets are not supported.
+
+For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-secrets/prevent-future-leaks/block-merges-with-secrets).
+
+{% endif %}
+
 ## Require {% data variables.product.prodname_code_scanning %} results
 
 If your repositories are configured with {% data variables.product.prodname_code_scanning %}, you can use rulesets to prevent pull requests from being merged when one of the following conditions is met:

diff --git a/data/features/secret-scanning-merge-protection.yml b/data/features/secret-scanning-merge-protection.yml
@@ -0,0 +1,7 @@
+# Reference: https://github.com/github/docs-content/issues/24116
+# Public preview for requiring secret scanning alerts to be resolved before merging
+
+versions:
+  fpt: '*'
+  ghec: '*'
+  ghes: '>=3.24'
diff --git a/data/reusables/repositories/rulesets-require-secret-scanning-alerts-resolved.md b/data/reusables/repositories/rulesets-require-secret-scanning-alerts-resolved.md
@@ -0,0 +1,5 @@
+1. Under "Branch protections", select **Require {% data variables.product.prodname_secret_scanning %} alerts are resolved**.
+1. Under "Secret types", select one or more types of secrets that should block merging:
+    * **Provider patterns**
+    * **Custom patterns**
+    * **Generic patterns**
diff --git a/data/reusables/secret-scanning/merge-protection-public-preview.md b/data/reusables/secret-scanning/merge-protection-public-preview.md
@@ -0,0 +1 @@
+The rule to require {% data variables.product.prodname_secret_scanning %} alerts to be resolved before merging is in {% data variables.release-phases.public_preview %} and subject to change.
diff --git a/src/redirects/lib/static/redirect-exceptions.txt b/src/redirects/lib/static/redirect-exceptions.txt
@@ -48,8 +48,3 @@
 - /github-ae@latest/admin/overview/about-data-residency
 - /github-ae@latest/admin/overview/deploying-github-ae
 - /github-ae@latest/admin/overview/initializing-github-ae
-
-# The legacy backup-utils docs are deprecated from 3.22, but they still need to exist in previous supported versions
-# So we need to set up a redirect for every new GHES versions until 3.22 is the oldest supported versions
-/enterprise-server@3.22/admin/backing-up-and-restoring-your-instance/about-the-backup-service-for-github-enterprise-server
-- /enterprise-server@3.22/admin/backing-up-and-restoring-your-instance/configuring-backups-on-your-instance
diff --git a/src/workflows/unallowed-contribution-filters.yml b/src/workflows/unallowed-contribution-filters.yml
@@ -4,7 +4,6 @@ notAllowed:
   - '.github/**'
   - 'data/reusables/rai/**'
   - '.vscode/**'
-  - 'assets/**'
   - 'config/**'
   - 'contributing/**'
   - 'src/**'
Original file line number	Diff line number	Diff line change
Expand Up		@@ -48,3 +48,5 @@ Enterprise owners can control cloud sandbox access for all organizations in the

		* [AUTOTITLE](/copilot/concepts/about-cloud-and-local-sandboxes)
		* [AUTOTITLE](/billing/concepts/product-billing/cloud-and-local-sandboxes)
		* [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings#sandbox)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		The rule to require {% data variables.product.prodname_secret_scanning %} alerts to be resolved before merging is in {% data variables.release-phases.public_preview %} and subject to change.