You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+6Lines changed: 6 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,11 @@
1
1
# Docs changelog
2
2
3
+
**8 January 2026**
4
+
5
+
We've added information about permissions to the article [Using GitHub Copilot CLI](https://docs.github.com/copilot/how-tos/use-copilot-agents/use-copilot-cli#permissions).
6
+
7
+
<hr>
8
+
3
9
**18 December 2025**
4
10
5
11
The documentation has been updated to reflect the general availability of direct organization billing for premium request usage in Copilot Code Review. Organization members without a Copilot plan can now use Copilot Code Review on GitHub.com, with premium request usage billed directly to their organization or enterprise. See [Copilot code review without a Copilot license](https://docs.github.com/en/copilot/concepts/agents/code-review#copilot-code-review-without-a-copilot-license).
Copy file name to clipboardExpand all lines: content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/control-offboarding.md
+7-4Lines changed: 7 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,14 +14,17 @@ type: how_to
14
14
15
15
By default, when a user loses access to all organizations in your enterprise, the user remains in your enterprise as an unaffiliated user. This can happen when you remove a user from organizations explicitly or remove an organization from your enterprise.
16
16
17
-
Unaffiliated users retain team membership, enterprise roles, and {% data variables.product.prodname_copilot %} licenses granted directly from the enterprise account.
17
+
Unaffiliated users retain enterprise-level team membership, enterprise roles, and {% data variables.product.prodname_copilot %} licenses granted directly from the enterprise account.
18
18
19
-
You can set a policy to instead remove users from the enterprise completely when they are removed from every organization. Removed users will lose all privileges and licenses granted from the enterprise. This is useful if you have an offboarding process that depends on removing users from organizations, for example using team synchronization from an identity provider.
19
+
You can set a policy to instead remove users from the enterprise completely when they are removed from every organization. Removed users will lose all privileges and licenses granted from the enterprise. This is useful if your enterprise offboarding process involves removing users from organizations, whether through organization-level SCIM deprovisioning, the GitHub web UI, or a non-SCIM REST API endpoint. For more information, see the link that corresponds to your use case:
-[Revoking the user's membership](/organizations/managing-membership-in-your-organization/removing-a-member-from-your-organization#revoking-the-users-membership)
22
+
-[Remove organization membership for a user](/rest/orgs/members?apiVersion=2022-11-28#remove-organization-membership-for-a-user) in the REST API documentation.
20
23
21
24
This policy:
22
25
23
-
* Applies regardless of how users lose their organization membership (through direct removal, a team, or removing an organization).
24
-
* Does **not** apply to users with the enterprise owner or enterprise billing manager role. These users remain in the enterprise regardless of their organization membership and the policy setting.
26
+
* Applies regardless of how users are removed from an organization.
27
+
* Does **not** apply to users with the enterprise owner or enterprise billing manager role. These users remain in the enterprise regardless of their organization membership and the policy setting. For more details on how to remove an enterprise owner or enterprise billing manager from the enterprise, see [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/removing-a-member-from-your-enterprise#removing-a-member-from-your-enterprise) and [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/inviting-people-to-manage-your-enterprise#removing-an-enterprise-administrator-from-your-enterprise-account).
Copy file name to clipboardExpand all lines: content/code-security/securing-your-organization/enabling-security-features-in-your-organization/configuring-global-security-settings-for-your-organization.md
+6-1Lines changed: 6 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -107,7 +107,8 @@ You can recommend that repositories in your organization use the "Extended" quer
107
107
You can customize several {% data variables.product.prodname_global_settings %} for {% data variables.product.prodname_code_scanning %}:
108
108
109
109
{% ifversion code-scanning-autofix %}*[Enabling {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_codeql %}](#enabling-copilot-autofix-for-codeql){% endif %}
110
-
*[Recommending the extended query suite for default setup](#recommending-the-extended-query-suite-for-default-setup){% ifversion ghes < 3.17 %}
110
+
*[Recommending the extended query suite for default setup](#recommending-the-extended-query-suite-for-default-setup)
*[Setting a failure threshold for {% data variables.product.prodname_code_scanning %} checks in pull requests](#setting-a-failure-threshold-for-code-scanning-checks-in-pull-requests).{% endif %}
112
113
113
114
{% endif %}
@@ -124,6 +125,10 @@ You can select **{% data variables.copilot.copilot_autofix_short %}** to enable
124
125
125
126
{% endif %}
126
127
128
+
### Expanding {% data variables.product.prodname_codeql %} analysis
129
+
130
+
You can expand {% data variables.product.prodname_codeql %} analysis coverage for all repositories in your organization that use default setup by configuring {% data variables.product.prodname_codeql %} model packs. Model packs extend the {% data variables.product.prodname_codeql %} analysis to recognize additional frameworks and libraries that are not included in the standard {% data variables.product.prodname_codeql %} libraries. This global configuration applies to repositories using default setup and allows you to specify model packs published via the container registry. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/editing-your-configuration-of-default-setup#extending-coverage-for-all-repositories-in-an-organization).
131
+
127
132
{% ifversion ghes < 3.17 %}
128
133
129
134
### Setting a failure threshold for {% data variables.product.prodname_code_scanning %} checks in pull requests
Copy file name to clipboardExpand all lines: content/copilot/how-tos/use-copilot-agents/use-copilot-cli.md
+34Lines changed: 34 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -74,6 +74,40 @@ Install {% data variables.copilot.copilot_cli_short %}. See [AUTOTITLE](/copilot
74
74
75
75
For example, if you ask {% data variables.product.prodname_copilot_short %} to create a bash script but you do not want to use the script {% data variables.product.prodname_copilot_short %} suggests, you can stop the current operation and enter a new prompt, such as: `Continue the previous task but include usage instructions in the script`.
76
76
77
+
## Permissions
78
+
79
+
{% data variables.copilot.copilot_cli_short %} uses a permissions system to control access to paths and URLs. At times, path and URL permission checks utilize heuristic-based detection, which has limitations to be aware of.
80
+
81
+
### Path permissions
82
+
83
+
Path permissions control which directories and files {% data variables.product.prodname_copilot_short %} can access. By default, {% data variables.copilot.copilot_cli_short %} can access the current working directory, its subdirectories, and the system temp directory.
84
+
85
+
Path permissions apply to shell commands, file operations (create, edit, view), and search tools (such as `grep` and glob patterns). For shell commands, paths are heuristically extracted by tokenizing command text and identifying tokens that look like paths.
86
+
87
+
> [!WARNING]
88
+
> Path detection for shell commands has limitations:
89
+
>
90
+
> * Paths embedded in complex shell constructs may not be detected.
91
+
> * Only a specific set of environment variables are expanded (`HOME`, `TMPDIR`, `PWD`, and similar). Custom variables like `$MY_PROJECT_DIR` are not expanded and may not be validated correctly.
92
+
> * Symlinks are resolved for existing files, but not for files being created.
93
+
94
+
To disable path verification, use the `--allow-all-paths` flag when starting {% data variables.copilot.copilot_cli_short %}.
95
+
96
+
### URL permissions
97
+
98
+
URL permissions control which external URLs {% data variables.product.prodname_copilot_short %} can access. By default, all URLs require approval before access is granted.
99
+
100
+
URL permissions apply to the `web_fetch` tool and a curated list of shell commands that access the network (such as `curl`, `wget`, and `fetch`). For shell commands, URLs are extracted using regex patterns.
101
+
102
+
> [!WARNING]
103
+
> URL detection for shell commands has limitations:
104
+
>
105
+
> * URLs in file contents, config files, or environment variables read by commands are not detected.
106
+
> * Obfuscated URLs (such as split strings or escape sequences) may not be detected.
107
+
> * HTTP and HTTPS are treated as different protocols and require separate approval.
108
+
109
+
To disable URL verification, use the `--allow-all-urls` flag. To pre-approve specific domains, use `--allow-url <domain>` (for example, `--allow-url github.com`).
110
+
77
111
## Tips
78
112
79
113
Optimize your experience with {% data variables.copilot.copilot_cli_short %} with the following tips.
0 commit comments