github · docs-bot · Aug 14, 2026 · Aug 13, 2026 · Aug 13, 2026 · Aug 13, 2026
diff --git a/Dockerfile b/Dockerfile
@@ -10,7 +10,7 @@
 # ---------------------------------------------------------------
 # To update the sha:
 # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble
-FROM ghcr.io/github/gh-base-image/gh-base-noble:20260811-222802-g1cf85b160@sha256:235f4854c8354b24fe8fefabf31fe57239723f2e4df4fb380d50f48844ab0737 AS base
+FROM ghcr.io/github/gh-base-image/gh-base-noble:20260813-231302-ge6a10052f@sha256:5b0e63cc812202f8b958afd73ad9d7409f78df895c724701fa9e17312d2dab90 AS base
 
 # Install curl for Node install and determining the early access branch
 # Install git for cloning docs-early-access & translations repos

diff --git a/content/actions/concepts/security/compromised-runners.md b/content/actions/concepts/security/compromised-runners.md
@@ -59,7 +59,7 @@ The attacker server can use the {% data variables.product.github %} API to [modi
 
 {% data variables.product.prodname_actions %} is intentionally scoped for a single repository at a time. The `GITHUB_TOKEN` grants the same level of access as a write-access user, because any write-access user can access this token by creating or modifying a workflow file, elevating the permissions of the `GITHUB_TOKEN` if necessary. Users have specific permissions for each repository, so allowing the `GITHUB_TOKEN` for one repository to grant access to another would impact the {% data variables.product.prodname_dotcom %} permission model if not implemented carefully. Similarly, caution must be taken when adding {% data variables.product.prodname_dotcom %} authentication tokens to a workflow, because this can also affect the {% data variables.product.prodname_dotcom %} permission model by inadvertently granting broad access to collaborators.
 
-If your organization is owned by an enterprise account, then you can share and reuse {% data variables.product.prodname_actions %} by storing them in internal repositories. For more information, see [AUTOTITLE](/actions/how-tos/reuse-automations/share-with-your-enterprise).
+If your organization is owned by an enterprise account, then you can share and reuse {% data variables.product.prodname_actions %} by storing them in internal repositories. For more information, see [AUTOTITLE]({% ifversion fpt %}/enterprise-cloud@latest{% endif %}/actions/how-tos/reuse-automations/share-with-your-enterprise).
 
 You can perform other privileged, cross-repository interactions by referencing a {% data variables.product.prodname_dotcom %} authentication token or SSH key as a secret within the workflow. Because many authentication token types do not allow for granular access to specific resources, there is significant risk in using the wrong token type, as it can grant much broader access than intended.
 

diff --git a/content/admin/concepts/enterprise-fundamentals/choose-an-enterprise-type.md b/content/admin/concepts/enterprise-fundamentals/choose-an-enterprise-type.md
@@ -91,4 +91,4 @@ The migration process may require time or cost from your team. Confirm that this
 
 ## Next steps
 
-When you have chosen an enterprise type, you're ready to create an enterprise account by starting a trial. See [AUTOTITLE](/enterprise-onboarding/getting-started-with-your-enterprise/setting-up-a-trial-of-github-enterprise).
+When you have chosen an enterprise type, you're ready to create an enterprise account by starting a trial. See [AUTOTITLE](/admin/overview/setting-up-a-trial-of-github-enterprise-cloud).
diff --git a/content/admin/concepts/identity-and-access-management/enterprise-managed-users.md b/content/admin/concepts/identity-and-access-management/enterprise-managed-users.md
@@ -35,7 +35,7 @@ With {% data variables.product.prodname_emus %}, you manage the lifecycle and au
 * If your enterprise uses OIDC SSO, {% data variables.product.prodname_dotcom %} will validate access to your enterprise and its resources using your IdP's **Conditional Access Policy (CAP)**. See [AUTOTITLE](/admin/managing-iam/configuring-authentication-for-enterprise-managed-users/about-support-for-your-idps-conditional-access-policy).
 * {% data variables.enterprise.prodname_managed_users_caps %} **cannot create public content** or collaborate outside your enterprise. See [AUTOTITLE](/admin/managing-iam/understanding-iam-for-enterprises/abilities-and-restrictions-of-managed-user-accounts).
 
-> [!NOTE] {% data variables.product.prodname_emus %} is not the best solution for every customer. To determine whether it's right for your enterprise, see [AUTOTITLE](/enterprise-onboarding/getting-started-with-your-enterprise/choose-an-enterprise-type).
+> [!NOTE] {% data variables.product.prodname_emus %} is not the best solution for every customer. To determine whether it's right for your enterprise, see [AUTOTITLE](/admin/concepts/enterprise-fundamentals/choose-an-enterprise-type).
 
 ## How does EMUs integrate with identity management systems?
 

diff --git a/...s/identity-and-access-management/identity-and-access-management-fundamentals.md b/...s/identity-and-access-management/identity-and-access-management-fundamentals.md
@@ -21,7 +21,7 @@ category:
 
 {% data reusables.enterprise-accounts.about-enterprise-types %}
 
-After learning more about authentication and provisioning for each of these options, to determine which method is best for your enterprise, see [AUTOTITLE](/enterprise-onboarding/getting-started-with-your-enterprise/choose-an-enterprise-type).
+After learning more about authentication and provisioning for each of these options, to determine which method is best for your enterprise, see [AUTOTITLE](/admin/concepts/enterprise-fundamentals/choose-an-enterprise-type).
 
 {% elsif ghes %}
 

diff --git a/...s/enforcing-policy-with-pre-receive-hooks/creating-a-pre-receive-hook-script.md b/...s/enforcing-policy-with-pre-receive-hooks/creating-a-pre-receive-hook-script.md
@@ -89,22 +89,22 @@ The `$GITHUB_VIA` variable is available in the pre-receive hook environment when
 | <pre>auto-merge deployment api</pre> | Automatic merge of the base branch via a deployment created with the API | [AUTOTITLE](/rest/deployments#create-a-deployment) |
 | <pre>blob#save</pre> | Change to a file's contents in the web interface | [AUTOTITLE](/repositories/working-with-files/managing-files/editing-files) |
 | <pre>branch merge api</pre> | Merge of a branch via the API | [AUTOTITLE](/rest/branches#merge-a-branch) |
-| <pre>branches page delete button</pre> | Deletion of a branch in the web interface | [AUTOTITLE](/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-and-deleting-branches-within-your-repository#deleting-a-branch) |
+| <pre>branches page delete button</pre> | Deletion of a branch in the web interface | [AUTOTITLE](/pull-requests/how-tos/commit-changes/managing-branches-within-your-repository#deleting-a-branch) |
 | <pre>git refs create api</pre> | Creation of a ref via the API | [AUTOTITLE](/rest/git/refs#create-a-reference) |
 | <pre>git refs delete api</pre> | Deletion of a ref via the API | [AUTOTITLE](/rest/git/refs#delete-a-reference) |
 | <pre>git refs update api</pre> | Update of a ref via the API | [AUTOTITLE](/rest/git/refs#update-a-reference) |
 | <pre>git repo contents api</pre> | Change to a file's contents via the API | [AUTOTITLE](/rest/repos/contents#create-or-update-file-contents) |
-| `merge` | Merge of a pull request using auto-merge | [AUTOTITLE](/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request) |
+| `merge` | Merge of a pull request using auto-merge | [AUTOTITLE](/pull-requests/how-tos/merge-and-close-pull-requests/automatically-merging-a-pull-request) |
 | <pre>merge base into head</pre> | Update of the topic branch from the base branch when the base branch requires strict status checks (via **Update branch** in a pull request, for example) | [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging) |
 | <pre>pull request branch delete button</pre> | Deletion of a topic branch from a pull request in the web interface | [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/deleting-and-restoring-branches-in-a-pull-request#deleting-a-branch-used-for-a-pull-request) |
 | <pre>pull request branch undo button</pre> | Restoration of a topic branch from a pull request in the web interface | [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/deleting-and-restoring-branches-in-a-pull-request#restoring-a-deleted-branch) |
 | <pre>pull request merge api</pre> | Merge of a pull request via the API | [AUTOTITLE](/rest/pulls/pulls#merge-a-pull-request) |
-| <pre>pull request merge button</pre> | Merge of a pull request in the web interface | [AUTOTITLE](/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request#merging-a-pull-request-on-github) |
-| <pre>pull request revert button</pre> | Revert of a pull request | [AUTOTITLE](/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/reverting-a-pull-request) |
+| <pre>pull request merge button</pre> | Merge of a pull request in the web interface | [AUTOTITLE](/pull-requests/how-tos/merge-and-close-pull-requests/merging-a-pull-request#merging-a-pull-request-on-github) |
+| <pre>pull request revert button</pre> | Revert of a pull request | [AUTOTITLE](/pull-requests/how-tos/merge-and-close-pull-requests/reverting-a-pull-request) |
 | <pre>releases delete button</pre> | Deletion of a release | [AUTOTITLE](/repositories/releasing-projects-on-github/managing-releases-in-a-repository#deleting-a-release) |
 | <pre>stafftools branch restore</pre> | Restoration of a branch from the site admin dashboard | [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-web-ui) |
 | <pre>tag create api</pre> | Creation of a tag via the API | [AUTOTITLE](/rest/git/tags#create-a-tag-object) |
-| <pre>web branch create</pre> | Creation of a branch via the web interface | [AUTOTITLE](/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-and-deleting-branches-within-your-repository#creating-a-branch) |
+| <pre>web branch create</pre> | Creation of a branch via the web interface | [AUTOTITLE](/pull-requests/how-tos/commit-changes/managing-branches-within-your-repository#creating-a-branch) |
 
 #### Available for pull request merges
 

diff --git a/...ing-accounts-and-repositories/managing-roles-in-your-enterprise/assign-roles.md b/...ing-accounts-and-repositories/managing-roles-in-your-enterprise/assign-roles.md
@@ -41,7 +41,7 @@ Before you assign a role, you may need to create a team. Teams are the best way
 ### Assigning to new users
 
 * If you {% ifversion ghes %}have enabled SCIM provisioning{% else %}use **{% data variables.product.prodname_emus %}**{% endif %}, roles are assigned from your IdP via the SCIM `roles` attribute.
-* Otherwise, you can invite someone as {% ifversion ghes %}an enterprise owner. See {% else %}a user or administrator. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/invite-users-directly) or {% endif %}[AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise).
+* Otherwise, you can invite someone as {% ifversion ghes %}an enterprise owner. See {% else %}a user or administrator. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/add-users) or {% endif %}[AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise).
 
 ### Assigning to existing administrators
 

diff --git a/...managing-iam/understanding-iam-for-enterprises/about-saml-for-enterprise-iam.md b/...managing-iam/understanding-iam-for-enterprises/about-saml-for-enterprise-iam.md
@@ -32,7 +32,7 @@ If your enterprise members manage their own user accounts on {% data variables.l
 
 {% data reusables.saml.about-saml-enterprise-accounts %} For more information, see [AUTOTITLE](/admin/concepts/identity-and-access-management/identity-and-access-management-fundamentals#considerations-for-enabling-saml-for-an-enterprise-or-organization) and [AUTOTITLE](/admin/managing-iam/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise).
 
-Alternatively, you can provision and manage the accounts of your enterprise members with {% data variables.product.prodname_emus %}. To help you determine whether SAML SSO or {% data variables.product.prodname_emus %} is better for your enterprise, see [AUTOTITLE](/enterprise-onboarding/getting-started-with-your-enterprise/choose-an-enterprise-type).
+Alternatively, you can provision and manage the accounts of your enterprise members with {% data variables.product.prodname_emus %}. To help you determine whether SAML SSO or {% data variables.product.prodname_emus %} is better for your enterprise, see [AUTOTITLE](/admin/concepts/enterprise-fundamentals/choose-an-enterprise-type).
 
 {% data reusables.enterprise-accounts.about-recovery-codes %} For more information, see [AUTOTITLE](/admin/managing-iam/managing-recovery-codes-for-your-enterprise).
 

diff --git a/...g-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise.md b/...g-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise.md
@@ -361,6 +361,6 @@ To restart streaming, click **Resume stream**.
 
 You can also retrieve {% data variables.product.prodname_copilot_short %} usage data through the REST API by selecting **Enabled everywhere** for "Copilot Usage Records API". See [AUTOTITLE](/rest/copilot/copilot-usage-metrics#get-copilot-usage-records-for-an-enterprise).
 
-For help interpreting the audit log events for agentic activity, see [AUTOTITLE](/copilot/reference/agentic-audit-log-events#streaming-audit-log-events).
+For help interpreting the audit log events for agentic activity, see [AUTOTITLE](/copilot/reference/enterprise-administrators/agentic-audit-log-events#streaming-audit-log-events).
 
 {% endif %}
diff --git a/...hub-apps/about-creating-github-apps/best-practices-for-creating-a-github-app.md b/...hub-apps/about-creating-github-apps/best-practices-for-creating-a-github-app.md
@@ -32,13 +32,13 @@ If you do hit a rate limit and need to retry an API request, use the `x-ratelimi
 
 You can generate a private key and client secret for your {% data variables.product.prodname_github_app %}. Private keys are used to generate installation access tokens, while client secrets are used to get user access tokens and refresh tokens. These tokens can be used to make API requests on behalf of an app installation or user.
 
-You must store private keys, tokens, and client secrets securely. However, the storage mechanism and its relative security depends on your integrations architecture and the platform that it runs on. In general, you should use a storage mechanism that is intended to store sensitive data on the platform that you are using.
+You must store private keys, tokens, and client secrets securely, when possible. However, the storage mechanism and its relative security depends on your integrations architecture and the platform that it runs on. In general, you should use a storage mechanism that is intended to store sensitive data on the platform that you are using.
 
 ### Private keys
 
 The private key for your {% data variables.product.prodname_github_app %} grants access to every account that the app is installed on. It **must** be stored securely and never shared broadly.
 
-Consider storing your {% data variables.product.prodname_github_app %}'s private key in a key vault, such as [Azure Key Vault](https://azure.microsoft.com/en-gb/products/key-vault), and making it sign-only.
+Consider storing your {% data variables.product.prodname_github_app %}'s private key in a key vault, such as [Azure Key Vault](https://azure.microsoft.com/products/key-vault), and making it sign-only.
 
 Alternatively, you can store the key as an environment variable. However, this is not as strong as storing the key in a key vault. If an attacker gains access to the environment, they can read the private key and gain persistent authentication as the {% data variables.product.prodname_github_app %}.
 
@@ -48,11 +48,11 @@ You should not generate more private keys than you need. You should delete priva
 
 ### Client secrets
 
-Client secrets are required to generate user access tokens for your app, unless your app uses the device flow. For more information, see [AUTOTITLE](/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app#using-the-device-flow-to-generate-a-user-access-token).
+Client secrets are required to generate user access tokens for your app from an authorization code.
 
 If your app is a confidential client, meaning it can safely keep the client secret secure, consider storing your client secret in a key vault, such as [Azure Key Vault](https://azure.microsoft.com/products/key-vault), or as an encrypted environment variable or secret on your server.
 
-If your app is a public client (a native app that runs on the user's device, CLI utility, or single-page web application), you cannot secure your client secret. You will have to ship the client secret in the application's code, and you should use PKCE to better secure the authentication flow. You should use caution if you plan to gate access to your own services based on tokens generated by your app because public clients are trivially spoofable - anyone can reuse your app's client ID to sign in.
+If your app is a public client (a native app that runs on the user's device, CLI utility, or single-page web application), you cannot secure your client secret. You do have to ship the client secret in the application's code, and you should use PKCE to better secure the authentication flow. You should use caution if you plan to gate access to your own services based on tokens generated by your app because public clients are trivially spoofable - anyone can reuse your app's client ID to sign in.
 
 #### Don't enable device flow without reason
 
@@ -78,6 +78,11 @@ An installation access token is restricted based on the {% data variables.produc
 
 Your app should never use a {% data variables.product.pat_generic %} or {% data variables.product.company_short %} password to authenticate.
 
+## Enable wildcard matching for callback URLs only when necessary
+
+> [!WARNING]
+> {% data reusables.apps.redirect-uri-wildcard-security-warning %}
+
 ## Check authorization thoroughly, durably, and often
 
 After signing in a user, app developers must take additional steps to ensure that the user is meant to have access to the data in your system. You must routinely check that their memberships, access, and their current SSO status all allow access to your application and the resources it protects.

diff --git a/...enticating-with-a-github-app/generating-a-user-access-token-for-a-github-app.md b/...enticating-with-a-github-app/generating-a-user-access-token-for-a-github-app.md
@@ -40,7 +40,7 @@ If your app runs in the browser, you should use the web application flow to gene
    Query parameter | Type | Required? | Description
    -----|------|------------|------
    `client_id` | `string` | Required | The client ID for your {% data variables.product.prodname_github_app %}. The client ID is different from the app ID. You can find the client ID on the settings page for your app. For more information about navigating to the settings page for your {% data variables.product.prodname_github_app %}, see [AUTOTITLE](/apps/maintaining-github-apps/modifying-a-github-app-registration#navigating-to-your-github-app-settings).
-   `redirect_uri` | `string` | Strongly recommended |  The URL in your application where users will be sent after authorization. This must be an exact match to one of the URLs you provided as a "Callback URL" in your app's settings and can't contain any additional parameters.
+   `redirect_uri` | `string` | Strongly recommended |  The URL in your application where users will be sent after authorization. This must be a match to one of the URLs you provided as a "Callback URL" in your app's settings and can't contain any additional parameters. For more information, see [AUTOTITLE](/apps/creating-github-apps/registering-a-github-app/about-the-user-authorization-callback-url).
    `state` | `string` | Strongly recommended |  When specified, the value should contain a random string to protect against forgery attacks, and it can also contain any other arbitrary data.
 {% ifversion pkce_support %}   `code_challenge` | `string` | Strongly recommended | Used to secure the authentication flow with PKCE (Proof Key for Code Exchange). Required if `code_challenge_method` is included. Must be a 43 character SHA-256 hash of a random string generated by the client. See the [PKCE RFC](https://datatracker.ietf.org/doc/html/rfc7636) for more details about this security extension.
    `code_challenge_method` | `string` | Strongly recommended | Used to secure the authentication flow with PKCE (Proof Key for Code Exchange). Required if `code_challenge` is included. Must be `S256` - the `plain` code challenge method is not supported.{% endif %}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -91,4 +91,4 @@ The migration process may require time or cost from your team. Confirm that this

		## Next steps

		When you have chosen an enterprise type, you're ready to create an enterprise account by starting a trial. See [AUTOTITLE](/enterprise-onboarding/getting-started-with-your-enterprise/setting-up-a-trial-of-github-enterprise).
		When you have chosen an enterprise type, you're ready to create an enterprise account by starting a trial. See [AUTOTITLE](/admin/overview/setting-up-a-trial-of-github-enterprise-cloud).