From 3f8ba081027f6c50196bbe994c820ef3a9947386 Mon Sep 17 00:00:00 2001 From: docubot <67483024+docubot@users.noreply.github.com> Date: Fri, 18 Mar 2022 14:36:16 -0700 Subject: [PATCH 1/2] New translation batch for cn (#26327) * Add crowdin translations * Run script/i18n/homogenize-frontmatter.js * Run script/i18n/lint-translation-files.js --check parsing * run script/i18n/reset-files-with-broken-liquid-tags.js --language=cn * run script/i18n/reset-known-broken-translation-files.js * Check in cn CSV report Co-authored-by: Robert Sese --- translations/log/cn-resets.csv | 20 +-- .../configuring-notifications.md | 2 +- .../managing-notifications-from-your-inbox.md | 4 +- ...analysis-settings-for-your-user-account.md | 2 +- ...on-levels-for-a-user-account-repository.md | 2 +- .../security-guides/encrypted-secrets.md | 4 + .../workflow-syntax-for-github-actions.md | 25 +++ ...ub-advanced-security-in-your-enterprise.md | 2 +- ...enabling-dependabot-for-your-enterprise.md | 4 +- ...orcing-team-policies-in-your-enterprise.md | 14 +- ...-a-users-saml-access-to-your-enterprise.md | 2 +- .../viewing-people-in-your-enterprise.md | 8 +- .../managing-global-webhooks.md | 20 +-- .../about-code-scanning-alerts.md | 8 + ...ode-scanning-alerts-for-your-repository.md | 26 ++- ...nning-alerts-in-issues-using-task-lists.md | 11 +- ...g-code-scanning-alerts-in-pull-requests.md | 9 +- .../about-dependabot-alerts.md} | 7 +- ...ilities-in-the-github-advisory-database.md | 5 +- ...ng-notifications-for-dependabot-alerts.md} | 7 +- ...isories-in-the-github-advisory-database.md | 1 + .../dependabot/dependabot-alerts/index.md | 24 +++ ...viewing-and-updating-dependabot-alerts.md} | 9 +- .../about-dependabot-security-updates.md | 3 +- ...configuring-dependabot-security-updates.md | 3 +- .../dependabot-security-updates/index.md | 20 +++ .../about-dependabot-version-updates.md | 5 +- ...on-options-for-the-dependabot.yml-file.md} | 12 +- ...configuring-dependabot-version-updates.md} | 9 +- .../customizing-dependency-updates.md | 5 +- .../dependabot-version-updates/index.md | 26 +++ ...ndencies-configured-for-version-updates.md | 3 +- .../content/code-security/dependabot/index.md | 23 +++ ...tomating-dependabot-with-github-actions.md | 2 + .../working-with-dependabot/index.md | 24 +++ ...your-actions-up-to-date-with-dependabot.md | 5 +- ...naging-encrypted-secrets-for-dependabot.md | 3 +- ...ng-pull-requests-for-dependency-updates.md | 5 +- .../troubleshooting-dependabot-errors.md | 129 +++++++++++++++ ...he-detection-of-vulnerable-dependencies.md | 61 ++----- .../github-security-features.md | 4 +- .../securing-your-organization.md | 6 +- .../securing-your-repository.md | 6 +- .../zh-CN/content/code-security/guides.md | 1 - .../zh-CN/content/code-security/index.md | 1 + .../about-the-security-overview.md | 16 +- .../supply-chain-security/index.md | 2 - .../index.md | 29 ---- .../about-managing-vulnerable-dependencies.md | 46 ------ .../index.md | 36 ---- .../troubleshooting-dependabot-errors.md | 127 -------------- .../about-dependency-review.md | 2 +- .../about-supply-chain-security.md | 156 ++++++++++++++++++ .../about-the-dependency-graph.md | 4 +- ...loring-the-dependencies-of-a-repository.md | 9 +- .../index.md | 6 +- .../troubleshooting-the-dependency-graph.md | 62 +++++++ ...ating-a-github-app-using-url-parameters.md | 38 ++--- .../creating-a-github-app.md | 2 +- ...g-and-authorizing-users-for-github-apps.md | 2 +- .../authorizing-oauth-apps.md | 6 +- .../creating-an-oauth-app.md | 2 +- .../modifying-a-github-app.md | 2 +- .../webhooks/webhook-events-and-payloads.md | 2 +- .../about-githubs-use-of-your-data.md | 4 +- ...se-settings-for-your-private-repository.md | 4 +- .../get-started/quickstart/hello-world.md | 38 ++--- ...-up-a-trial-of-github-enterprise-server.md | 2 +- .../creating-and-highlighting-code-blocks.md | 3 +- .../creating-diagrams.md | 127 +++++++++++++- ...analysis-settings-for-your-organization.md | 7 +- ...ing-the-audit-log-for-your-organization.md | 64 +++---- .../working-with-the-rubygems-registry.md | 2 +- .../zh-CN/content/pages/quickstart.md | 30 ++-- ...r-github-pages-site-locally-with-jekyll.md | 6 + .../searching-a-repositorys-releases.md | 30 ++-- ...anding-connections-between-repositories.md | 2 +- .../working-with-non-code-files.md | 57 ++++++- .../content/rest/reference/deploy_keys.md | 17 ++ .../content/rest/reference/deployments.md | 2 +- .../zh-CN/content/rest/reference/index.md | 1 + translations/zh-CN/data/features/mermaid.yml | 6 +- .../data/learning-tracks/code-security.yml | 38 ++--- .../code-security/code-examples.yml | 2 +- .../code-scanning/alert-default-branch.md | 1 + .../filter-non-default-branches.md | 1 + .../dependabot/private-dependencies-note.md | 2 +- .../dependabot/result-discrepancy.md | 1 + .../github-reviews-security-advisories.md | 2 +- .../security-alert-delivery-options.md | 2 +- .../keys.md => deploy_keys/deploy_keys.md} | 2 - ...pository_vulnerability_alert_short_desc.md | 2 +- 92 files changed, 1030 insertions(+), 546 deletions(-) rename translations/zh-CN/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md => dependabot/dependabot-alerts/about-dependabot-alerts.md} (94%) rename translations/zh-CN/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/dependabot-alerts}/browsing-security-vulnerabilities-in-the-github-advisory-database.md (95%) rename translations/zh-CN/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies.md => dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts.md} (90%) rename translations/zh-CN/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/dependabot-alerts}/editing-security-advisories-in-the-github-advisory-database.md (94%) create mode 100644 translations/zh-CN/content/code-security/dependabot/dependabot-alerts/index.md rename translations/zh-CN/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository.md => dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts.md} (94%) rename translations/zh-CN/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/dependabot-security-updates}/about-dependabot-security-updates.md (92%) rename translations/zh-CN/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/dependabot-security-updates}/configuring-dependabot-security-updates.md (95%) create mode 100644 translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/index.md rename translations/zh-CN/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/dependabot-version-updates}/about-dependabot-version-updates.md (87%) rename translations/zh-CN/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md => dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md} (96%) rename translations/zh-CN/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates.md => dependabot/dependabot-version-updates/configuring-dependabot-version-updates.md} (91%) rename translations/zh-CN/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/dependabot-version-updates}/customizing-dependency-updates.md (91%) create mode 100644 translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/index.md rename translations/zh-CN/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/dependabot-version-updates}/listing-dependencies-configured-for-version-updates.md (83%) create mode 100644 translations/zh-CN/content/code-security/dependabot/index.md rename translations/zh-CN/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/working-with-dependabot}/automating-dependabot-with-github-actions.md (99%) create mode 100644 translations/zh-CN/content/code-security/dependabot/working-with-dependabot/index.md rename translations/zh-CN/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/working-with-dependabot}/keeping-your-actions-up-to-date-with-dependabot.md (88%) rename translations/zh-CN/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/working-with-dependabot}/managing-encrypted-secrets-for-dependabot.md (93%) rename translations/zh-CN/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/working-with-dependabot}/managing-pull-requests-for-dependency-updates.md (91%) create mode 100644 translations/zh-CN/content/code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors.md rename translations/zh-CN/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/working-with-dependabot}/troubleshooting-the-detection-of-vulnerable-dependencies.md (70%) delete mode 100644 translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/index.md delete mode 100644 translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies.md delete mode 100644 translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/index.md delete mode 100644 translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors.md create mode 100644 translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md create mode 100644 translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md create mode 100644 translations/zh-CN/content/rest/reference/deploy_keys.md create mode 100644 translations/zh-CN/data/reusables/code-scanning/alert-default-branch.md create mode 100644 translations/zh-CN/data/reusables/code-scanning/filter-non-default-branches.md create mode 100644 translations/zh-CN/data/reusables/dependabot/result-discrepancy.md rename translations/zh-CN/data/reusables/rest-reference/{deployments/keys.md => deploy_keys/deploy_keys.md} (94%) diff --git a/translations/log/cn-resets.csv b/translations/log/cn-resets.csv index f00f9341da96..1e79aca6e734 100644 --- a/translations/log/cn-resets.csv +++ b/translations/log/cn-resets.csv @@ -118,22 +118,20 @@ translations/zh-CN/content/code-security/code-scanning/using-codeql-code-scannin translations/zh-CN/content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-cli-in-your-ci-system.md,broken liquid tags translations/zh-CN/content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system.md,broken liquid tags translations/zh-CN/content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/running-codeql-runner-in-your-ci-system.md,broken liquid tags +translations/zh-CN/content/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.md,parsing error +translations/zh-CN/content/code-security/dependabot/dependabot-alerts/browsing-security-vulnerabilities-in-the-github-advisory-database.md,broken liquid tags +translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates.md,broken liquid tags +translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates.md,broken liquid tags +translations/zh-CN/content/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions.md,broken liquid tags +translations/zh-CN/content/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot.md,broken liquid tags +translations/zh-CN/content/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md,broken liquid tags translations/zh-CN/content/code-security/getting-started/github-security-features.md,broken liquid tags translations/zh-CN/content/code-security/getting-started/securing-your-organization.md,broken liquid tags translations/zh-CN/content/code-security/getting-started/securing-your-repository.md,broken liquid tags translations/zh-CN/content/code-security/secret-scanning/about-secret-scanning.md,broken liquid tags -translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions.md,broken liquid tags -translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot.md,broken liquid tags -translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md,Listed in localization-support#489 -translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md,parsing error -translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates.md,broken liquid tags -translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database.md,broken liquid tags -translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates.md,broken liquid tags -translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/index.md,broken liquid tags -translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors.md,Listed in localization-support#489 -translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors.md,rendering error -translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies.md,broken liquid tags +translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md,broken liquid tags translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md,Listed in localization-support#489 +translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md,broken liquid tags translations/zh-CN/content/codespaces/customizing-your-codespace/personalizing-codespaces-for-your-account.md,broken liquid tags translations/zh-CN/content/codespaces/developing-in-codespaces/developing-in-a-codespace.md,broken liquid tags translations/zh-CN/content/codespaces/developing-in-codespaces/forwarding-ports-in-your-codespace.md,broken liquid tags diff --git a/translations/zh-CN/content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md b/translations/zh-CN/content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md index 286b7b089f5f..066ef4eb9706 100644 --- a/translations/zh-CN/content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md +++ b/translations/zh-CN/content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md @@ -134,7 +134,7 @@ Email notifications from {% data variables.product.product_location %} contain t | `To` field | This field connects directly to the thread.{% ifversion not ghae %} If you reply to the email, you'll add a new comment to the conversation.{% endif %} | | `Cc` address | {% data variables.product.product_name %} will `Cc` you if you're subscribed to a conversation. The second `Cc` email address matches the notification reason. The suffix for these notification reasons is {% data variables.notifications.cc_address %}. The possible notification reasons are: | | `mailing list` field | This field identifies the name of the repository and its owner. The format of this address is always `..{% data variables.command_line.backticks %}`. |{% ifversion fpt or ghes or ghae-issue-4864 or ghec %} -| `X-GitHub-Severity` field | {% data reusables.repositories.security-alerts-x-github-severity %} The possible severity levels are:
  • `low`
  • `moderate`
  • `high`
  • `critical`
For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." |{% endif %} +| `X-GitHub-Severity` field | {% data reusables.repositories.security-alerts-x-github-severity %} The possible severity levels are:
  • `low`
  • `moderate`
  • `high`
  • `critical`
For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." |{% endif %} ## Choosing your notification settings diff --git a/translations/zh-CN/content/account-and-profile/managing-subscriptions-and-notifications-on-github/viewing-and-triaging-notifications/managing-notifications-from-your-inbox.md b/translations/zh-CN/content/account-and-profile/managing-subscriptions-and-notifications-on-github/viewing-and-triaging-notifications/managing-notifications-from-your-inbox.md index f3324c43816e..0ed1b08711f3 100644 --- a/translations/zh-CN/content/account-and-profile/managing-subscriptions-and-notifications-on-github/viewing-and-triaging-notifications/managing-notifications-from-your-inbox.md +++ b/translations/zh-CN/content/account-and-profile/managing-subscriptions-and-notifications-on-github/viewing-and-triaging-notifications/managing-notifications-from-your-inbox.md @@ -174,7 +174,7 @@ shortTitle: 从收件箱管理 - `reason:security_alert`，显示 {% data variables.product.prodname_dependabot_alerts %} 的通知和安全更新拉取请求。 - `author:app/dependabot`，显示 {% data variables.product.prodname_dependabot %} 生成的通知。 这包括 {% data variables.product.prodname_dependabot_alerts %}、安全更新拉取请求和版本更新拉取请求。 -有关 {% data variables.product.prodname_dependabot %} 的更多信息，请参阅“[关于管理有漏洞的依赖项](/github/managing-security-vulnerabilities/about-managing-vulnerable-dependencies)”。 +有关 {% data variables.product.prodname_dependabot %} 的更多信息，请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)”。 {% endif %} {% ifversion ghes < 3.3 or ghae-issue-4864 %} @@ -183,7 +183,7 @@ shortTitle: 从收件箱管理 - `is:repository_vulnerability_alert` - `reason:security_alert` -有关 {% data variables.product.prodname_dependabot %} 的更多信息，请参阅“[关于有漏洞依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 +有关 {% data variables.product.prodname_dependabot %} 的更多信息，请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 {% endif %} {% endif %} diff --git a/translations/zh-CN/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account.md b/translations/zh-CN/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account.md index 5d837f51dabf..19419b8e5ca4 100644 --- a/translations/zh-CN/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account.md +++ b/translations/zh-CN/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account.md @@ -50,5 +50,5 @@ shortTitle: 管理安全和分析 ## 延伸阅读 - “[关于依赖关系图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)” -- "[管理项目依赖项中的漏洞](/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies)" +- "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)" - "[自动更新依赖项](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically)" diff --git a/translations/zh-CN/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/permission-levels-for-a-user-account-repository.md b/translations/zh-CN/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/permission-levels-for-a-user-account-repository.md index 2aab6abb3583..d6b0243b887d 100644 --- a/translations/zh-CN/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/permission-levels-for-a-user-account-repository.md +++ b/translations/zh-CN/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/permission-levels-for-a-user-account-repository.md @@ -49,7 +49,7 @@ shortTitle: 权限用户仓库 | 自定义仓库的社交媒体预览 | "[自定义仓库的社交媒体预览](/github/administering-a-repository/customizing-your-repositorys-social-media-preview)" | | 从仓库创建模板 | "[创建模板仓库](/github/creating-cloning-and-archiving-repositories/creating-a-template-repository)" |{% ifversion fpt or ghes or ghae-issue-4864 or ghec %} | 控制对易受攻击依赖项的 {% data variables.product.prodname_dependabot_alerts %} 访问 | "[管理仓库的安全和分析设置](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)" |{% endif %}{% ifversion fpt or ghec %} -| 忽略仓库中的 {% data variables.product.prodname_dependabot_alerts %} | "[查看和更新仓库中的漏洞依赖项](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" | +| 忽略仓库中的 {% data variables.product.prodname_dependabot_alerts %} | "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" | | 管理私有仓库的数据使用 | “[管理私有仓库的数据使用设置](/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository)” {% endif %} | 定义仓库的代码所有者 | "[关于代码所有者](/github/creating-cloning-and-archiving-repositories/about-code-owners)" | diff --git a/translations/zh-CN/content/actions/security-guides/encrypted-secrets.md b/translations/zh-CN/content/actions/security-guides/encrypted-secrets.md index 0af52dae703c..68eaff9bfe25 100644 --- a/translations/zh-CN/content/actions/security-guides/encrypted-secrets.md +++ b/translations/zh-CN/content/actions/security-guides/encrypted-secrets.md @@ -226,6 +226,10 @@ steps: ``` {% endraw %} +Secrets cannot be directly referenced in `if:` conditionals. Instead, consider setting secrets as job-level environment variables, then referencing the environment variables to conditionally run steps in the job. For more information, see "[Context availability](/actions/learn-github-actions/contexts#context-availability)" and [`jobs..steps[*].if`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsif). + +If a secret has not been set, the return value of an expression referencing the secret (such as {% raw %}`${{ secrets.SuperSecret }}`{% endraw %} in the example) will be an empty string. + 尽可能避免使用命令行在进程之间传递密码。 命令行进程可能对其他用户可见（使用 `ps` 命令）或通过[安全审计事件](https://docs.microsoft.com/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing)获取。 为帮助保护密码，请考虑使用环境变量 `STDIN` 或目标进程支持的其他机制。 如果必须在命令行中传递密码，则将它们包含在适当的引用规则中。 密码通常包含可能意外影响 shell 的特殊字符。 要转义这些特殊字符，请引用环境变量。 例如： diff --git a/translations/zh-CN/content/actions/using-workflows/workflow-syntax-for-github-actions.md b/translations/zh-CN/content/actions/using-workflows/workflow-syntax-for-github-actions.md index 7289ed76ec62..95e8f4ccc6e9 100644 --- a/translations/zh-CN/content/actions/using-workflows/workflow-syntax-for-github-actions.md +++ b/translations/zh-CN/content/actions/using-workflows/workflow-syntax-for-github-actions.md @@ -342,6 +342,31 @@ steps: uses: actions/heroku@1.0.0 ``` +#### Example: Using secrets + +Secrets cannot be directly referenced in `if:` conditionals. Instead, consider setting secrets as job-level environment variables, then referencing the environment variables to conditionally run steps in the job. + +If a secret has not been set, the return value of an expression referencing the secret (such as {% raw %}`${{ secrets.SuperSecret }}`{% endraw %} in the example) will be an empty string. + +{% raw %} +```yaml +name: Run a step if a secret has been set +on: push +jobs: + my-jobname: + runs-on: ubuntu-latest + env: + super_secret: ${{ secrets.SuperSecret }} + steps: + - if: ${{ env.super_secret != '' }} + run: echo 'This step will only run if the secret has a value set.' + - if: ${{ env.super_secret == '' }} + run: echo 'This step will only run if the secret does not have a value set.' +``` +{% endraw %} + +For more information, see "[Context availability](/actions/learn-github-actions/contexts#context-availability)" and "[Encrypted secrets](/actions/security-guides/encrypted-secrets)." + ### `jobs..steps[*].name` 步骤显示在 {% data variables.product.prodname_dotcom %} 上的名称。 diff --git a/translations/zh-CN/content/admin/code-security/managing-github-advanced-security-for-your-enterprise/deploying-github-advanced-security-in-your-enterprise.md b/translations/zh-CN/content/admin/code-security/managing-github-advanced-security-for-your-enterprise/deploying-github-advanced-security-in-your-enterprise.md index 107b9086cff4..8443e15311ac 100644 --- a/translations/zh-CN/content/admin/code-security/managing-github-advanced-security-for-your-enterprise/deploying-github-advanced-security-in-your-enterprise.md +++ b/translations/zh-CN/content/admin/code-security/managing-github-advanced-security-for-your-enterprise/deploying-github-advanced-security-in-your-enterprise.md @@ -271,7 +271,7 @@ GitHub helps you avoid using third-party software that contains known vulnerabil | Dependency Management Tool | 描述 | | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Dependabot Alerts | You can track your repository's dependencies and receive Dependabot alerts when your enterprise detects vulnerable dependencies. 更多信息请参阅“[关于易受攻击的依赖项的警报](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)”。 | +| Dependabot Alerts | You can track your repository's dependencies and receive Dependabot alerts when your enterprise detects vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)." | | Dependency Graph | 依赖项图是存储在仓库中的清单和锁定文件的摘要。 它显示您的代码库所依赖的生态系统和软件包（其依赖项）以及依赖于您的项目的仓库和包（其从属项）。 更多信息请参阅“[关于依赖关系图](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)”。 |{% ifversion ghes > 3.1 or ghec %} | Dependency Review | 如果拉取请求包含对依赖项的更改，您可以查看已更改内容摘要以及任何依赖项中是否存在已知漏洞。 For more information, see "[About dependency review](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review)" or "[Reviewing Dependency Changes in a Pull Request](/github/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request)." |{% endif %} {% ifversion ghec or ghes > 3.2 %} | Dependabot Security Updates | Dependabot can fix vulnerable dependencies for you by raising pull requests with security updates. For more information, see "[About Dependabot security updates](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)." | diff --git a/translations/zh-CN/content/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise.md b/translations/zh-CN/content/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise.md index 3bf9dfcfc665..d52c8ea9b51d 100644 --- a/translations/zh-CN/content/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise.md +++ b/translations/zh-CN/content/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise.md @@ -49,7 +49,7 @@ After you enable {% data variables.product.prodname_dependabot_alerts %} for you When {% data variables.product.product_location %} receives information about a vulnerability, it identifies repositories in {% data variables.product.product_location %} that use the affected version of the dependency and generates {% data variables.product.prodname_dependabot_alerts %}. You can choose whether or not to notify users automatically about new {% data variables.product.prodname_dependabot_alerts %}. -For repositories with {% data variables.product.prodname_dependabot_alerts %} enabled, scanning is triggered on any push to the default branch that contains a manifest file or lock file. Additionally, when a new vulnerability record is added to {% data variables.product.product_location %}, {% data variables.product.product_name %} scans all existing repositories on {% data variables.product.product_location %} and generates alerts for any repository that is vulnerable. 更多信息请参阅“[关于易受攻击的依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 +For repositories with {% data variables.product.prodname_dependabot_alerts %} enabled, scanning is triggered on any push to the default branch that contains a manifest file or lock file. Additionally, when a new vulnerability record is added to {% data variables.product.product_location %}, {% data variables.product.product_name %} scans all existing repositories on {% data variables.product.product_location %} and generates alerts for any repository that is vulnerable. 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 {% ifversion ghes > 3.2 %} ### 关于 {% data variables.product.prodname_dependabot_updates %} @@ -67,7 +67,7 @@ After you enable {% data variables.product.prodname_dependabot_alerts %}, you ca With {% data variables.product.prodname_dependabot_updates %}, {% data variables.product.company_short %} automatically creates pull requests to update dependencies in two ways. - **{% data variables.product.prodname_dependabot_version_updates %}**: Users add a {% data variables.product.prodname_dependabot %} configuration file to the repository to enable {% data variables.product.prodname_dependabot %} to create pull requests when a new version of a tracked dependency is released. 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_version_updates %}](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates)“。 -- **{% data variables.product.prodname_dependabot_security_updates %}**: Users toggle a repository setting to enable {% data variables.product.prodname_dependabot %} to create pull requests when {% data variables.product.prodname_dotcom %} detects a vulnerability in one of the dependencies of the dependency graph for the repository. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)." +- **{% data variables.product.prodname_dependabot_security_updates %}**: Users toggle a repository setting to enable {% data variables.product.prodname_dependabot %} to create pull requests when {% data variables.product.prodname_dotcom %} detects a vulnerability in one of the dependencies of the dependency graph for the repository. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)." {% endif %} ## 启用 {% data variables.product.prodname_dependabot_alerts %} diff --git a/translations/zh-CN/content/admin/policies/enforcing-policies-for-your-enterprise/enforcing-team-policies-in-your-enterprise.md b/translations/zh-CN/content/admin/policies/enforcing-policies-for-your-enterprise/enforcing-team-policies-in-your-enterprise.md index 02a4cf470045..03a1dea3dd7e 100644 --- a/translations/zh-CN/content/admin/policies/enforcing-policies-for-your-enterprise/enforcing-team-policies-in-your-enterprise.md +++ b/translations/zh-CN/content/admin/policies/enforcing-policies-for-your-enterprise/enforcing-team-policies-in-your-enterprise.md @@ -1,6 +1,6 @@ --- -title: Enforcing team policies in your enterprise -intro: 'You can enforce policies for teams in your enterprise''s organizations, or allow policies to be set in each organization.' +title: 在企业中实施团队策略 +intro: 您可以在企业组织中实施团队策略，或者允许在每个组织中设置策略。 permissions: Enterprise owners can enforce policies for teams in an enterprise. redirect_from: - /articles/enforcing-team-settings-for-organizations-in-your-business-account @@ -18,19 +18,19 @@ topics: - Enterprise - Policies - Teams -shortTitle: Team policies +shortTitle: 团队策略 --- -## About policies for teams in your enterprise +## 关于企业中团队的策略 -You can enforce policies to control how members of your enterprise on {% data variables.product.product_name %} manage teams. You can also allow organization owners to manage policies for teams. 更多信息请参阅“[关于团队](/organizations/organizing-members-into-teams/about-teams)”。 +您可以执行策略来控制企业在 {% data variables.product.product_name %} 上的企业成员如何管理团队。 您也可以允许组织所有者管理团队策略。 更多信息请参阅“[关于团队](/organizations/organizing-members-into-teams/about-teams)”。 ## 执行团队讨论策略 -Across all organizations owned by your enterprise, you can enable or disable team discussions, or allow owners to administer the setting on the organization level. 更多信息请参阅“[关于团队讨论](/organizations/collaborating-with-your-team/about-team-discussions/)”。 +在企业拥有的所有组织中，可以启用或禁用团队讨论，或允许所有者在组织级别管理设置。 更多信息请参阅“[关于团队讨论](/organizations/collaborating-with-your-team/about-team-discussions/)”。 {% data reusables.enterprise-accounts.access-enterprise %} {% data reusables.enterprise-accounts.policies-tab %} -3. 在左侧边栏中，单击 **Teams（团队）**。 ![Teams tab in the enterprise sidebar](/assets/images/help/business-accounts/settings-teams-tab.png) +3. 在左侧边栏中，单击 **Teams（团队）**。 ![企业边栏中的 Teams（团队）选项卡](/assets/images/help/business-accounts/settings-teams-tab.png) 4. 在“Team discussions”（团队讨论）下，审查有关更改设置的信息。 {% data reusables.enterprise-accounts.view-current-policy-config-orgs %} 5. 在“Team discussions”（团队讨论）下，使用下拉菜单并选择策略。 ![带有团队讨论策略按钮的下拉菜单](/assets/images/help/business-accounts/team-discussion-policy-drop-down.png) diff --git a/translations/zh-CN/content/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise.md b/translations/zh-CN/content/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise.md index cca3c9668bd5..a2e7b4f9994e 100644 --- a/translations/zh-CN/content/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise.md +++ b/translations/zh-CN/content/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise.md @@ -16,7 +16,7 @@ shortTitle: 查看和管理 SAML 访问 ## 关于对企业帐户的 SAML 访问 -When you enable SAML single sign-on for your enterprise account, each enterprise member can link their external identity on your identity provider (IdP) to their existing account on {% data variables.product.product_location %}. {% data reusables.saml.about-saml-access-enterprise-account %} +当您为企业帐户启用 SAML 单点登录时，每个企业成员都可以将其身份提供商 (IdP) 上的外部身份链接到 {% data variables.product.product_location %} 上的现有帐户。 {% data reusables.saml.about-saml-access-enterprise-account %} 如果您的企业使用 {% data variables.product.prodname_emus %}，成员将使用通过您的 IdP 预配的帐户。 {% data variables.product.prodname_managed_users_caps %} 将不会在 {% data variables.product.product_name %} 上使用他们现有的用户帐户。 更多信息请参阅“[关于 {% data variables.product.prodname_emus %}](/enterprise-cloud@latest/admin/authentication/managing-your-enterprise-users-with-your-identity-provider/about-enterprise-managed-users)”。 diff --git a/translations/zh-CN/content/admin/user-management/managing-users-in-your-enterprise/viewing-people-in-your-enterprise.md b/translations/zh-CN/content/admin/user-management/managing-users-in-your-enterprise/viewing-people-in-your-enterprise.md index 98bc1850e689..b8de2a9bd142 100644 --- a/translations/zh-CN/content/admin/user-management/managing-users-in-your-enterprise/viewing-people-in-your-enterprise.md +++ b/translations/zh-CN/content/admin/user-management/managing-users-in-your-enterprise/viewing-people-in-your-enterprise.md @@ -39,19 +39,19 @@ shortTitle: 查看企业中的人员 {% ifversion ghec %} -## Viewing suspended members in an {% data variables.product.prodname_emu_enterprise %} +## 在 {% data variables.product.prodname_emu_enterprise %} 中查看暂停的成员 -If your enterprise uses {% data variables.product.prodname_emus %}, you can also view suspended users. Suspended users are members who have been deprovisioned after being unassigned from the {% data variables.product.prodname_emu_idp_application %} application or deleted from the identity provider. 更多信息请参阅“[关于企业管理用户](/admin/identity-and-access-management/managing-iam-with-enterprise-managed-users/about-enterprise-managed-users)”。 +如果您的企业使用 {% data variables.product.prodname_emus %}，您还可以查看已暂停的用户。 暂停的用户是在从 {% data variables.product.prodname_emu_idp_application %} 应用程序取消分配或从身份提供商中删除后已取消预配的成员。 更多信息请参阅“[关于企业管理用户](/admin/identity-and-access-management/managing-iam-with-enterprise-managed-users/about-enterprise-managed-users)”。 {% data reusables.enterprise-accounts.access-enterprise %} {% data reusables.enterprise-accounts.people-tab %} -1. To view a list of suspended members, above the list of active members, click **Suspended**. ![Screenshot showing "Suspended" option](/assets/images/help/enterprises/view-suspended-members.png) +1. 要查看已暂停成员的列表，请在活动成员列表上方单击 **Suspended（已暂停）**。 ![显示"已暂停"选项的屏幕截图](/assets/images/help/enterprises/view-suspended-members.png) {% endif %} ## 查看休眠用户 -You can view a list of all dormant users {% ifversion ghes or ghae %} who have not been suspended and {% endif %}who are not site administrators. {% data reusables.enterprise-accounts.dormant-user-activity-threshold %} 更多信息请参阅“[管理休眠用户](/admin/user-management/managing-users-in-your-enterprise/managing-dormant-users)”。 +您可以查看{% ifversion ghes or ghae %}尚未暂停以及{% endif %}不是站点管理员的所有休眠用户列表。 {% data reusables.enterprise-accounts.dormant-user-activity-threshold %} 更多信息请参阅“[管理休眠用户](/admin/user-management/managing-users-in-your-enterprise/managing-dormant-users)”。 ## 延伸阅读 diff --git a/translations/zh-CN/content/admin/user-management/monitoring-activity-in-your-enterprise/managing-global-webhooks.md b/translations/zh-CN/content/admin/user-management/monitoring-activity-in-your-enterprise/managing-global-webhooks.md index 5b1ac3ed6413..831cc5fd5424 100644 --- a/translations/zh-CN/content/admin/user-management/monitoring-activity-in-your-enterprise/managing-global-webhooks.md +++ b/translations/zh-CN/content/admin/user-management/monitoring-activity-in-your-enterprise/managing-global-webhooks.md @@ -1,7 +1,7 @@ --- title: 管理全局 web 挂钩 -shortTitle: Manage global webhooks -intro: You can configure global webhooks to notify external web servers when events occur within your enterprise. +shortTitle: 管理全局 web 挂钩 +intro: 您可以配置全局 web 挂钩，以便在企业内部发生事件时通知外部 Web 服务器。 permissions: Enterprise owners can manage global webhooks for an enterprise account. redirect_from: - /enterprise/admin/user-management/about-global-webhooks @@ -25,9 +25,9 @@ topics: ## 关于全局 web 挂钩 -You can use global webhooks to notify an external web server when events occur within your enterprise. You can configure the server to receive the webhook's payload, then run an application or code that monitors, responds to, or enforces rules for user and organization management for your enterprise. 更多信息请参阅“[web 挂钩](/developers/webhooks-and-events/webhooks)”。 +当企业内部发生事件时，您可以使用全局 web 挂钩通知外部 Web 服务器。 您可以将服务器配置为接收 web 挂钩的有效负载，然后运行监控、响应或实施企业用户和组织管理规则的应用程序或代码。 更多信息请参阅“[web 挂钩](/developers/webhooks-and-events/webhooks)”。 -For example, you can configure {% data variables.product.product_location %} to send a webhook when someone creates, deletes, or modifies a repository or organization within your enterprise. You can configure the server to automatically perform a task after receiving the webhook. +例如，您可以将 {% data variables.product.product_location %} 配置为在有人创建、删除或修改企业内的存储库或组织时发送 web 挂钩。 您可以将服务器配置为在收到 web 挂钩后自动执行任务。 ![全局 web 挂钩列表](/assets/images/enterprise/site-admin-settings/list-of-global-webhooks.png) @@ -42,23 +42,23 @@ For example, you can configure {% data variables.product.product_location %} to 6. 输入您想要接收有效负载的 URL。![用于输入有效负载 URL 的字段](/assets/images/enterprise/site-admin-settings/add-global-webhook-payload-url.png) 7. 或者，使用 **Content type** 下拉菜单，并单击有效负载格式。 ![列出内容类型选项的下拉菜单](/assets/images/enterprise/site-admin-settings/add-global-webhook-content-type-dropdown.png) 8. 或者，在 **Secret** 字段中，输入用作 `secret` 密钥的字符串。 ![用于输入用作密钥的字符串的字段](/assets/images/enterprise/site-admin-settings/add-global-webhook-secret.png) -9. Optionally, if your payload URL is HTTPS and you would not like {% data variables.product.prodname_ghe_server %} to verify SSL certificates when delivering payloads, select **Disable SSL verification**. 阅读 SSL 验证的信息，然后单击 **I understand my webhooks may not be secure**。 ![Checkbox for disabling SSL verification](/assets/images/enterprise/site-admin-settings/add-global-webhook-disable-ssl-button.png) +9. （可选）如果有效负载 URL 为 HTTPS，并且您不希望 {% data variables.product.prodname_ghe_server %} 在交付有效负载时验证 SSL 证书，请选择 **Disable SSL verification（禁用 SSL 验证）**。 阅读 SSL 验证的信息，然后单击 **I understand my webhooks may not be secure**。 ![用于禁用 SSL 验证的复选框](/assets/images/enterprise/site-admin-settings/add-global-webhook-disable-ssl-button.png) {% warning %} **警告**：SSL 验证有助于确保安全投递挂钩有效负载。 我们不建议禁用 SSL 验证。 {% endwarning %} -10. Decide if you'd like this webhook to trigger for every event or for selected events. ![包含用于为每个事件或选定事件接收有效负载的选项的单选按钮](/assets/images/enterprise/site-admin-settings/add-global-webhook-select-events.png) +10. 确定您希望此 web 挂钩对每个事件还是选定事件触发。 ![包含用于为每个事件或选定事件接收有效负载的选项的单选按钮](/assets/images/enterprise/site-admin-settings/add-global-webhook-select-events.png) - 对于每个事件，请选择 **Send me everything**。 - 要选择特定事件，请选择 **Let me select individual events**。 -11. If you chose to select individual events, select the events that will trigger the webhook. +11. 如果选择单个事件，请选择将触发 web 挂钩的事件。 {% ifversion ghec %} - ![Checkboxes for individual global webhook events](/assets/images/enterprise/site-admin-settings/add-global-webhook-select-individual-events.png) + ![单个全局 web 挂钩事件的复选框](/assets/images/enterprise/site-admin-settings/add-global-webhook-select-individual-events.png) {% elsif ghes or ghae %} - ![Checkboxes for individual global webhook events](/assets/images/enterprise/site-admin-settings/add-global-webhook-select-individual-events-ghes-and-ae.png) + ![单个全局 web 挂钩事件的复选框](/assets/images/enterprise/site-admin-settings/add-global-webhook-select-individual-events-ghes-and-ae.png) {% endif %} -12. Confirm that the **Active** checkbox is selected. ![已选择 Active 复选框](/assets/images/help/business-accounts/webhook-active.png) +12. 确认选中了 **Active（活动）**复选框。 ![已选择 Active 复选框](/assets/images/help/business-accounts/webhook-active.png) 13. 单击 **Add webhook（添加 web 挂钩）**。 ## 编辑全局 web 挂钩 diff --git a/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts.md b/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts.md index 9d6c9f02dcff..a493254a8388 100644 --- a/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts.md +++ b/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts.md @@ -27,7 +27,15 @@ topics: 每个警报都会高亮显示代码的问题以及识别该问题的工具名称。 You can see the line of code that triggered the alert, as well as properties of the alert, such as the alert severity{% ifversion fpt or ghes > 3.1 or ghae or ghec %}, security severity,{% endif %} and the nature of the problem. 警报还会告知该问题第一次被引入的时间。 对于由 {% data variables.product.prodname_codeql %} 分析确定的警报，您还会看到如何解决问题的信息。 +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} +{% data reusables.code-scanning.alert-default-branch %} +{% endif %} + +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![来自 {% data variables.product.prodname_code_scanning %} 的警报示例](/assets/images/help/repository/code-scanning-alert.png) +{% else %} +![来自 {% data variables.product.prodname_code_scanning %} 的警报示例](/assets/images/enterprise/3.4/repository/code-scanning-alert.png) +{% endif %} If you set up {% data variables.product.prodname_code_scanning %} using {% data variables.product.prodname_codeql %}, you can also find data-flow problems in your code. 数据流分析将查找代码中的潜在安全问题，例如：不安全地使用数据、将危险参数传递给函数以及泄漏敏感信息。 diff --git a/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository.md b/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository.md index d6ae1c809791..c8f214deaeed 100644 --- a/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository.md +++ b/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository.md @@ -46,9 +46,16 @@ By default, the code scanning alerts page is filtered to show alerts for the def {% else %} ![List of alerts from {% data variables.product.prodname_code_scanning %}](/assets/images/enterprise/3.1/help/repository/code-scanning-click-alert.png) {% endif %} +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} + {% data reusables.code-scanning.alert-default-branch %} + ![The "Affected branches" section in an alert](/assets/images/help/repository/code-scanning-affected-branches.png){% endif %} 1. Optionally, if the alert highlights a problem with data flow, click **Show paths** to display the path from the data source to the sink where it's used. + {% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![The "Show paths" link on an alert](/assets/images/help/repository/code-scanning-show-paths.png) -1. Alerts from {% data variables.product.prodname_codeql %} analysis include a description of the problem. Click **Show more** for guidance on how to fix your code. + {% else %} + ![The "Show paths" link on an alert](/assets/images/enterprise/3.4/repository/code-scanning-show-paths.png) + {% endif %} +2. Alerts from {% data variables.product.prodname_codeql %} analysis include a description of the problem. Click **Show more** for guidance on how to fix your code. ![Details for an alert](/assets/images/help/repository/code-scanning-alert-details.png) For more information, see "[About {% data variables.product.prodname_code_scanning %} alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts)." @@ -80,6 +87,10 @@ The benefit of using keyword filters is that only values with results are shown If you enter multiple filters, the view will show alerts matching _all_ these filters. For example, `is:closed severity:high branch:main` will only display closed high-severity alerts that are present on the `main` branch. The exception is filters relating to refs (`ref`, `branch` and `pr`): `is:open branch:main branch:next` will show you open alerts from both the `main` branch and the `next` branch. +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} +{% data reusables.code-scanning.filter-non-default-branches %} +{% endif %} + {% ifversion fpt or ghes > 3.3 or ghec %} You can prefix the `tag` filter with `-` to exclude results with that tag. For example, `-tag:style` only shows alerts that do not have the `style` tag{% if codeql-ml-queries %} and `-tag:experimental` will omit all experimental alerts. For more information, see "[About {% data variables.product.prodname_code_scanning %} alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts#about-experimental-alerts)."{% else %}.{% endif %} @@ -96,10 +107,12 @@ You can use the "Only alerts in application code" filter or `autofilter:true` ke You can search the list of alerts. This is useful if there is a large number of alerts in your repository, or if you don't know the exact name for an alert for example. {% data variables.product.product_name %} performs the free text search across: - The name of the alert -- The alert description - The alert details (this also includes the information hidden from view by default in the **Show more** collapsible section) - + {% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![The alert information used in searches](/assets/images/help/repository/code-scanning-free-text-search-areas.png) + {% else %} + ![The alert information used in searches](/assets/images/enterprise/3.4/repository/code-scanning-free-text-search-areas.png) + {% endif %} | Supported search | Syntax example | Results | | ---- | ---- | ---- | @@ -113,7 +126,7 @@ You can search the list of alerts. This is useful if there is a large number of **Tips:** - The multiple word search is equivalent to an OR search. -- The AND search will return results where the search terms are found _anywhere_, in any order in the alert name, description, or details. +- The AND search will return results where the search terms are found _anywhere_, in any order in the alert name or details. {% endtip %} @@ -143,7 +156,7 @@ If you have write permission for a repository, you can view fixed alerts by view You can use{% ifversion fpt or ghes > 3.1 or ghae or ghec %} the free text search or{% endif %} the filters to display a subset of alerts and then in turn mark all matching alerts as closed. -Alerts may be fixed in one branch but not in another. You can use the "Branch" drop-down menu, on the summary of alerts, to check whether an alert is fixed in a particular branch. +Alerts may be fixed in one branch but not in another. You can use the "Branch" filter, on the summary of alerts, to check whether an alert is fixed in a particular branch. {% ifversion fpt or ghes > 3.1 or ghae or ghec %} ![Filtering alerts by branch](/assets/images/help/repository/code-scanning-branch-filter.png) @@ -151,6 +164,9 @@ Alerts may be fixed in one branch but not in another. You can use the "Branch" d ![Filtering alerts by branch](/assets/images/enterprise/3.1/help/repository/code-scanning-branch-filter.png) {% endif %} +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} +{% data reusables.code-scanning.filter-non-default-branches %} +{% endif %} ## Dismissing or deleting alerts There are two ways of closing an alert. You can fix the problem in the code, or you can dismiss the alert. Alternatively, if you have admin permissions for the repository, you can delete alerts. Deleting alerts is useful in situations where you have set up a {% data variables.product.prodname_code_scanning %} tool and then decided to remove it, or where you have configured {% data variables.product.prodname_codeql %} analysis with a larger set of queries than you want to continue using, and you've then removed some queries from the tool. In both cases, deleting alerts allows you to clean up your {% data variables.product.prodname_code_scanning %} results. You can delete alerts from the summary list within the **Security** tab. diff --git a/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/tracking-code-scanning-alerts-in-issues-using-task-lists.md b/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/tracking-code-scanning-alerts-in-issues-using-task-lists.md index 5923e8163bd3..14334f73bd2d 100644 --- a/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/tracking-code-scanning-alerts-in-issues-using-task-lists.md +++ b/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/tracking-code-scanning-alerts-in-issues-using-task-lists.md @@ -39,7 +39,11 @@ You can use more than one issue to track the same {% data variables.product.prod - A "tracked in" section will also show in the corresponding alert page. + {% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![Tracked in section on code scanning alert page](/assets/images/help/repository/code-scanning-alert-tracked-in-pill.png) + {% else %} + ![Tracked in section on code scanning alert page](/assets/images/enterprise/3.4/repository/code-scanning-alert-tracked-in-pill.png) + {% endif %} - On the tracking issue, {% data variables.product.prodname_dotcom %} displays a security badge icon in the task list and on the hovercard. @@ -64,7 +68,12 @@ The status of the tracked alert won't change if you change the checkbox state of {% data reusables.code-scanning.explore-alert %} 1. Optionally, to find the alert to track, you can use the free-text search or the drop-down menus to filter and locate the alert. 更多信息请参阅“[管理仓库的代码扫描警报](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository#filtering-code-scanning-alerts)”。 {% endif %} -1. Towards the top of the page, on the right side, click **Create issue**. ![Create a tracking issue for the code scanning alert](/assets/images/help/repository/code-scanning-create-issue-for-alert.png) +1. Towards the top of the page, on the right side, click **Create issue**. + {% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} + ![Create a tracking issue for the code scanning alert](/assets/images/help/repository/code-scanning-create-issue-for-alert.png) + {% else %} + ![Create a tracking issue for the code scanning alert](/assets/images/enterprise/3.4/repository/code-scanning-create-issue-for-alert.png) + {% endif %} {% data variables.product.prodname_dotcom %} automatically creates an issue to track the alert and adds the alert as a task list item. {% data variables.product.prodname_dotcom %} prepopulates the issue: - The title contains the name of the {% data variables.product.prodname_code_scanning %} alert. diff --git a/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md b/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md index 4ad724494203..1177c8d43744 100644 --- a/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md +++ b/translations/zh-CN/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md @@ -74,10 +74,17 @@ topics: 要查看有关警报的更多信息，拥有写入权限的用户可单击注释中所示的 **Show more details（显示更多详情）**链接。 这允许您在警报视图中查看工具提供的所有上下文和元数据。 在下例中，您可以查看显示问题的严重性、类型和相关通用缺陷枚举 (CWE) 的标记。 该视图还显示哪个提交引入了问题。 +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} +{% data reusables.code-scanning.alert-default-branch %} +{% endif %} + 在警报的详细视图中，有些 {% data variables.product.prodname_code_scanning %} 工具，例如 {% data variables.product.prodname_codeql %} 分析，还包括问题描述和 **Show more（显示更多）**链接以指导您如何修复代码。 +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![显示更多信息的警报说明和链接](/assets/images/help/repository/code-scanning-pr-alert.png) - +{% else %} +![显示更多信息的警报说明和链接](/assets/images/enterprise/3.4/repository/code-scanning-pr-alert.png) +{% endif %} ## 修复拉取请求上的警报 任何对拉取请求具有推送权限的人都可以修复在该拉取请求上已识别的 {% data variables.product.prodname_code_scanning %} 警报。 如果将更改提交到拉取请求，这将触发拉取请求检查的新运行。 如果您的更改修复了问题，则警报将被关闭，注释将被删除。 diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.md similarity index 94% rename from translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.md index 52b0aa9c647d..da996b60cc9c 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.md @@ -1,11 +1,12 @@ --- -title: About alerts for vulnerable dependencies +title: About Dependabot alerts intro: '{% data variables.product.product_name %} sends {% data variables.product.prodname_dependabot_alerts %} when we detect vulnerabilities affecting your repository.' redirect_from: - /articles/about-security-alerts-for-vulnerable-dependencies - /github/managing-security-vulnerabilities/about-security-alerts-for-vulnerable-dependencies - /github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies - /code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies versions: fpt: '*' ghes: '*' @@ -81,7 +82,7 @@ For repositories where {% data variables.product.prodname_dependabot_security_up ## Access to {% data variables.product.prodname_dependabot_alerts %} -You can see all of the alerts that affect a particular project{% ifversion fpt or ghec %} on the repository's Security tab or{% endif %} in the repository's dependency graph. For more information, see "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)." +You can see all of the alerts that affect a particular project{% ifversion fpt or ghec %} on the repository's Security tab or{% endif %} in the repository's dependency graph. For more information, see "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)." By default, we notify people with admin permissions in the affected repositories about new {% data variables.product.prodname_dependabot_alerts %}. {% ifversion fpt or ghec %}{% data variables.product.product_name %} never publicly discloses identified vulnerabilities for any repository. You can also make {% data variables.product.prodname_dependabot_alerts %} visible to additional people or teams working repositories that you own or have admin permissions for. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)." {% endif %} @@ -95,5 +96,5 @@ You can also see all the {% data variables.product.prodname_dependabot_alerts %} ## Further reading - "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)" -- "[Viewing and updating vulnerable dependencies in your repository](/articles/viewing-and-updating-vulnerable-dependencies-in-your-repository)"{% endif %} +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/articles/viewing-and-updating-vulnerable-dependencies-in-your-repository)"{% endif %} {% ifversion fpt or ghec %}- "[Privacy on {% data variables.product.prodname_dotcom %}](/get-started/privacy-on-github)"{% endif %} diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database.md b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/browsing-security-vulnerabilities-in-the-github-advisory-database.md similarity index 95% rename from translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-alerts/browsing-security-vulnerabilities-in-the-github-advisory-database.md index 635a4f5ccecd..98741cedb4e7 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/browsing-security-vulnerabilities-in-the-github-advisory-database.md @@ -6,6 +6,7 @@ miniTocMaxHeadingLevel: 3 redirect_from: - /github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database - /code-security/supply-chain-security/browsing-security-vulnerabilities-in-the-github-advisory-database + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database versions: fpt: '*' ghec: '*' @@ -35,7 +36,7 @@ The {% data variables.product.prodname_advisory_database %} contains a list of k We carefully review each advisory for validity. Each {% data variables.product.company_short %}-reviewed advisory has a full description, and contains both ecosystem and package information. -If you enable {% data variables.product.prodname_dependabot_alerts %} for your repositories, you are automatically notified when a new {% data variables.product.company_short %}-reviewed advisory affects packages you depend on. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." +If you enable {% data variables.product.prodname_dependabot_alerts %} for your repositories, you are automatically notified when a new {% data variables.product.company_short %}-reviewed advisory affects packages you depend on. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." ### About unreviewed advisories @@ -107,7 +108,7 @@ You can search the database, and use qualifiers to narrow your search. For examp ## Viewing your vulnerable repositories -For any {% data variables.product.company_short %}-reviewed advisory in the {% data variables.product.prodname_advisory_database %}, you can see which of your repositories are affected by that security vulnerability. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#access-to-dependabot-alerts)." +For any {% data variables.product.company_short %}-reviewed advisory in the {% data variables.product.prodname_advisory_database %}, you can see which of your repositories are affected by that security vulnerability. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#access-to-dependabot-alerts)." 1. Navigate to https://github.com/advisories. 2. Click an advisory. diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies.md b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts.md similarity index 90% rename from translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts.md index 3fe7596f1a0f..a270357bddcd 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts.md @@ -1,10 +1,11 @@ --- -title: 配置有漏洞依赖项的通知 -shortTitle: 配置通知 +title: Configuring notifications for Dependabot alerts +shortTitle: Configure notifications intro: '优化接收 {% data variables.product.prodname_dependabot_alerts %} 相关通知的方式。' redirect_from: - /github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies - /code-security/supply-chain-security/configuring-notifications-for-vulnerable-dependencies + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies versions: fpt: '*' ghes: '*' @@ -59,7 +60,7 @@ topics: ## 如何减少有漏洞依赖项通知的干扰 -如果您想要收到太多 {% data variables.product.prodname_dependabot_alerts %} 的通知，我们建议您选择加入每周的电子邮件摘要，或者在保持 {% data variables.product.prodname_dependabot_alerts %} 启用时关闭通知。 您仍可导航到仓库的 Security（安全性）选项卡查看 {% data variables.product.prodname_dependabot_alerts %}。 更多信息请参阅“[查看和更新仓库中的漏洞依赖项](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)”。 +如果您想要收到太多 {% data variables.product.prodname_dependabot_alerts %} 的通知，我们建议您选择加入每周的电子邮件摘要，或者在保持 {% data variables.product.prodname_dependabot_alerts %} 启用时关闭通知。 您仍可导航到仓库的 Security（安全性）选项卡查看 {% data variables.product.prodname_dependabot_alerts %}。 For more information, see "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)." ## 延伸阅读 diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database.md b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/editing-security-advisories-in-the-github-advisory-database.md similarity index 94% rename from translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-alerts/editing-security-advisories-in-the-github-advisory-database.md index 09844722d3df..4de03025105a 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/editing-security-advisories-in-the-github-advisory-database.md @@ -3,6 +3,7 @@ title: Editing security advisories in the GitHub Advisory Database intro: 'You can submit improvements to any advisory published in the {% data variables.product.prodname_advisory_database %}.' redirect_from: - /code-security/security-advisories/editing-security-advisories-in-the-github-advisory-database + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database versions: fpt: '*' ghec: '*' diff --git a/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/index.md b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/index.md new file mode 100644 index 000000000000..e35a7af0490b --- /dev/null +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/index.md @@ -0,0 +1,24 @@ +--- +title: Identifying vulnerabilities in your project's dependencies with Dependabot alerts +shortTitle: Dependabot 警报 +intro: '{% data variables.product.prodname_dependabot %} generates {% data variables.product.prodname_dependabot_alerts %} when known vulnerabilites are detected in dependencies that your project uses.' +allowTitleToDifferFromFilename: true +versions: + fpt: '*' + ghes: '*' + ghae: issue-4864 + ghec: '*' +topics: + - Dependabot + - Alerts + - Vulnerabilities + - Repositories + - Dependencies +children: + - /browsing-security-vulnerabilities-in-the-github-advisory-database + - /editing-security-advisories-in-the-github-advisory-database + - /about-dependabot-alerts + - /viewing-and-updating-dependabot-alerts + - /configuring-notifications-for-dependabot-alerts +--- + diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository.md b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts.md similarity index 94% rename from translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts.md index ee55d288848b..376d857cdecd 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts.md @@ -1,12 +1,13 @@ --- -title: 查看和更新仓库中有漏洞的依赖项 +title: Viewing and updating Dependabot alerts intro: '如果 {% data variables.product.product_name %} 发现项目中存在有漏洞的依赖项，您可以在仓库的 Dependabot 警报选项卡中查看它们。 然后，您可以更新项目以解决或忽略漏洞。' redirect_from: - /articles/viewing-and-updating-vulnerable-dependencies-in-your-repository - /github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository - /code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository permissions: Repository administrators and organization owners can view and update dependencies. -shortTitle: 查看有漏洞的依赖项 +shortTitle: View Dependabot alerts versions: fpt: '*' ghes: '*' @@ -25,7 +26,7 @@ topics: {% data reusables.dependabot.beta-security-and-version-updates %} {% data reusables.dependabot.enterprise-enable-dependabot %} -仓库的 {% data variables.product.prodname_dependabot_alerts %} 选项卡列出所有打开和关闭的 {% data variables.product.prodname_dependabot_alerts %}{% ifversion fpt or ghec or ghes > 3.2 %} 以及对应的 {% data variables.product.prodname_dependabot_security_updates %}{% endif %}。 可以{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-5638 %} 按程序包、生态系统或清单筛选警报。 您还可以{% endif %} 对警报列表进行排序，单击特定警报以获取更多详细信息。 更多信息请参阅“[关于易受攻击的依赖项的警报](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)”。 +仓库的 {% data variables.product.prodname_dependabot_alerts %} 选项卡列出所有打开和关闭的 {% data variables.product.prodname_dependabot_alerts %}{% ifversion fpt or ghec or ghes > 3.2 %} 以及对应的 {% data variables.product.prodname_dependabot_security_updates %}{% endif %}。 可以{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-5638 %} 按程序包、生态系统或清单筛选警报。 您还可以{% endif %} 对警报列表进行排序，单击特定警报以获取更多详细信息。 For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." {% ifversion fpt or ghec or ghes > 3.2 %} 您可以为使用 {% data variables.product.prodname_dependabot_alerts %} 和依赖关系图的任何仓库启用自动安全更新。 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)“。 @@ -98,7 +99,7 @@ topics: ## 延伸阅读 -- "[关于有漏洞依赖项的警报](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)" {% ifversion fpt or ghec or ghes > 3.2 %} +- "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"{% ifversion fpt or ghec or ghes > 3.2 %} - "[配置 {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates)"{% endif %} - "[管理仓库的安全和分析设置](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" - "[漏洞依赖项检测疑难解答](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies)"{% ifversion fpt or ghec or ghes > 3.2 %} diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates.md b/translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates.md similarity index 92% rename from translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates.md index b283a4b5e09c..278efb2684dc 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates.md @@ -6,6 +6,7 @@ redirect_from: - /github/managing-security-vulnerabilities/about-github-dependabot-security-updates - /github/managing-security-vulnerabilities/about-dependabot-security-updates - /code-security/supply-chain-security/about-dependabot-security-updates + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates versions: fpt: '*' ghec: '*' @@ -27,7 +28,7 @@ topics: ## About {% data variables.product.prodname_dependabot_security_updates %} -{% data variables.product.prodname_dependabot_security_updates %} make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature, when a {% data variables.product.prodname_dependabot %} alert is raised for a vulnerable dependency in the dependency graph of your repository, {% data variables.product.prodname_dependabot %} automatically tries to fix it. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)" and "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)." +{% data variables.product.prodname_dependabot_security_updates %} make it easier for you to fix vulnerable dependencies in your repository. If you enable this feature, when a {% data variables.product.prodname_dependabot %} alert is raised for a vulnerable dependency in the dependency graph of your repository, {% data variables.product.prodname_dependabot %} automatically tries to fix it. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)" and "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)." {% data variables.product.prodname_dotcom %} may send {% data variables.product.prodname_dependabot_alerts %} to repositories affected by a vulnerability disclosed by a recently published {% data variables.product.prodname_dotcom %} security advisory. {% data reusables.security-advisory.link-browsing-advisory-db %} diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates.md b/translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates.md similarity index 95% rename from translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates.md index 4b5d03893f05..6cc5ca642cbc 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates.md @@ -9,6 +9,7 @@ redirect_from: - /github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates - /github/managing-security-vulnerabilities/configuring-dependabot-security-updates - /code-security/supply-chain-security/configuring-dependabot-security-updates + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates versions: fpt: '*' ghec: '*' @@ -74,6 +75,6 @@ You can also enable or disable {% data variables.product.prodname_dependabot_sec ## Further reading -- "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"{% ifversion fpt or ghec %} +- "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"{% ifversion fpt or ghec %} - "[Managing data use settings for your private repository](/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository)"{% endif %} - "[Supported package ecosystems](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)" diff --git a/translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/index.md b/translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/index.md new file mode 100644 index 000000000000..13456e36d9a3 --- /dev/null +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-security-updates/index.md @@ -0,0 +1,20 @@ +--- +title: Automatically updating dependencies with known vulnerabilities with Dependabot security updates +intro: '{% data variables.product.prodname_dependabot %} can help you fix vulnerable dependencies by automatically raising pull requests to update dependencies to secure versions.' +allowTitleToDifferFromFilename: true +versions: + fpt: '*' + ghec: '*' + ghes: '>3.2' +topics: + - Repositories + - Dependabot + - Security updates + - Dependencies + - Pull requests +shortTitle: Dependabot 安全更新 +children: + - /about-dependabot-security-updates + - /configuring-dependabot-security-updates +--- + diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates.md b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates.md similarity index 87% rename from translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates.md index 91c9ecf6da40..f00db06940e2 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates.md @@ -8,6 +8,7 @@ redirect_from: - /github/administering-a-repository/about-dependabot-version-updates - /code-security/supply-chain-security/about-dependabot-version-updates - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/upgrading-from-dependabotcom-to-github-native-dependabot + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates versions: fpt: '*' ghec: '*' @@ -31,7 +32,7 @@ shortTitle: Dependabot 版本更新 通过将配置文件检入仓库，可启用 {% data variables.product.prodname_dependabot_version_updates %}。 配置文件指定存储在仓库中的清单或其他包定义文件的位置。 {% data variables.product.prodname_dependabot %} 使用此信息来检查过时的软件包和应用程序。 {% data variables.product.prodname_dependabot %} 确定依赖项是否有新版本，它通过查看依赖的语义版本 ([semver](https://semver.org/)) 来决定是否应更新该版本。 对于某些软件包管理器，{% data variables.product.prodname_dependabot_version_updates %} 也支持供应。 供应（或缓存）的依赖项是检入仓库中特定目录的依赖项，而不是在清单中引用的依赖项。 即使包服务器不可用，供应的依赖项在生成时也可用。 {% data variables.product.prodname_dependabot_version_updates %} 可以配置为检查为新版本供应的依赖项，并在必要时更新它们。 -当 {% data variables.product.prodname_dependabot %} 发现过时的依赖项时，它会发起拉取请求以将清单更新到依赖项的最新版本。 对于供应和依赖项，{% data variables.product.prodname_dependabot %} 提出拉取请求以直接将过时的依赖项替换为新版本。 检查测试是否通过，查看拉取请求摘要中包含的更改日志和发行说明，然后合并它。 更多信息请参阅“[启用和禁用 {% data variables.product.prodname_dependabot %} 版本更新](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)”。 +当 {% data variables.product.prodname_dependabot %} 发现过时的依赖项时，它会发起拉取请求以将清单更新到依赖项的最新版本。 对于供应和依赖项，{% data variables.product.prodname_dependabot %} 提出拉取请求以直接将过时的依赖项替换为新版本。 检查测试是否通过，查看拉取请求摘要中包含的更改日志和发行说明，然后合并它。 For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." 如果启用_安全更新_，{% data variables.product.prodname_dependabot %} 还会发起拉取请求以更新易受攻击依赖项。 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)”。 @@ -50,7 +51,7 @@ shortTitle: Dependabot 版本更新 ## 支持的仓库和生态系统 -您可以为包含其中一个受支持包管理器的依赖项清单或锁定文件的仓库配置版本更新。 对于某些软件包管理器，您也可以配置依赖项的供应。 更多信息请参阅“[依赖项更新的配置选项](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#vendor)。” +您可以为包含其中一个受支持包管理器的依赖项清单或锁定文件的仓库配置版本更新。 对于某些软件包管理器，您也可以配置依赖项的供应。 For more information, see "[Configuration options for the dependabot.yml file](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#vendor)." {% note %} {% data reusables.dependabot.private-dependencies-note %} diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md similarity index 96% rename from translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md index 3d87ddd38605..3d8268b8f533 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md @@ -1,10 +1,12 @@ --- -title: 依赖项更新的配置选项 +title: Configuration options for the dependabot.yml file intro: '可用于自定义 {% data variables.product.prodname_dependabot %} 如何维护仓库的所有选项的详细信息。' permissions: 'People with write permissions to a repository can configure {% data variables.product.prodname_dependabot %} for the repository.' +allowTitleToDifferFromFilename: true redirect_from: - /github/administering-a-repository/configuration-options-for-dependency-updates - /code-security/supply-chain-security/configuration-options-for-dependency-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates miniTocMaxHeadingLevel: 3 versions: fpt: '*' @@ -17,7 +19,7 @@ topics: - Repositories - Dependencies - Pull requests -shortTitle: 配置选项 +shortTitle: Configure dependabot.yml --- {% data reusables.dependabot.beta-security-and-version-updates %} @@ -27,7 +29,7 @@ shortTitle: 配置选项 {% data variables.product.prodname_dependabot %} 配置文件 *dependabot.yml* 使用 YAML 语法。 如果您是 YAML 的新用户并想要了解更多信息，请参阅“[五分钟了解 YAML](https://www.codeproject.com/Articles/1214409/Learn-YAML-in-five-minutes)”。 -必须将此文件存储在仓库的 `.github` 目录中。 添加或更新 *dependabot.yml* 文件时，这将触发对版本更新的立即检查。 有关详细信息和示例，请参阅“[启用和禁用 {% data variables.product.prodname_dependabot %} 版本更新](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates#enabling-dependabot-version-updates)”。 +必须将此文件存储在仓库的 `.github` 目录中。 添加或更新 *dependabot.yml* 文件时，这将触发对版本更新的立即检查。 For more information and an example, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates#enabling-dependabot-version-updates)." 下次安全警报触发安全更新的拉取请求时将使用所有同时影响安全更新的选项。 更多信息请参阅“[配置 {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates)。” @@ -170,7 +172,7 @@ updates: {% note %} -**注意**：`时间表` 定义 {% data variables.product.prodname_dependabot %} 尝试更新的时间。 但是，这不是您可收到拉取请求的唯一时间。 更新可基于 `dependabot.yml` 文件的更改、更新失败后清单文件的更改或 {% data variables.product.prodname_dependabot_security_updates %} 触发。 更多信息请参阅“[{% data variables.product.prodname_dependabot %} 拉取请求的频率](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates#frequency-of-dependabot-pull-requests)”和“[关于 {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)”。 +**注意**：`时间表` 定义 {% data variables.product.prodname_dependabot %} 尝试更新的时间。 但是，这不是您可收到拉取请求的唯一时间。 更新可基于 `dependabot.yml` 文件的更改、更新失败后清单文件的更改或 {% data variables.product.prodname_dependabot_security_updates %} 触发。 For more information, see "[Frequency of {% data variables.product.prodname_dependabot %} pull requests](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates#frequency-of-dependabot-pull-requests)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)." {% endnote %} @@ -307,7 +309,7 @@ updates: 您可以搜索仓库中是否有 `"@dependabot ignore" in:comments`，以检查仓库是否存储了 `ignore` 首选项。 如果您希望取消忽略以这种方式忽略的依赖项，请重新打开拉取请求。 -有关 `@dependabot ignore` 命令的更多信息，请参阅“[管理依赖关系更新的拉取请求](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands)”。 +For more information about the `@dependabot ignore` commands, see "[Managing pull requests for dependency updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands)." #### 指定要忽略的依赖项和版本 diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates.md b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates.md similarity index 91% rename from translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates.md index 0377f112cf13..6ab566601b4f 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates.md @@ -1,11 +1,12 @@ --- -title: Enabling and disabling Dependabot version updates +title: Configuring Dependabot version updates intro: '您可以配置仓库，以便 {% data variables.product.prodname_dependabot %} 自动更新您使用的包。' permissions: 'People with write permissions to a repository can enable or disable {% data variables.product.prodname_dependabot_version_updates %} for the repository.' redirect_from: - /github/administering-a-repository/enabling-and-disabling-version-updates - /code-security/supply-chain-security/enabling-and-disabling-version-updates - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates versions: fpt: '*' ghec: '*' @@ -17,7 +18,7 @@ topics: - Repositories - Dependencies - Pull requests -shortTitle: 启用和禁用更新 +shortTitle: Configure version updates --- @@ -34,7 +35,7 @@ shortTitle: 启用和禁用更新 ## 启用 {% data variables.product.prodname_dependabot_version_updates %} -{% data reusables.dependabot.create-dependabot-yml %}有关信息，请参阅“[依赖项更新的配置选项](/github/administering-a-repository/configuration-options-for-dependency-updates)”。 +{% data reusables.dependabot.create-dependabot-yml %} For information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates)." 1. 添加 `version`。 1. （可选）如果您在私人注册表中包含依赖项，请添加包含身份验证详细信息的 `registries` 部分。 1. 添加 `updates` 部分，并输入您希望 {% data variables.product.prodname_dependabot %} 监控的每个包管理器的条目。 @@ -138,4 +139,4 @@ updates: update-types: ["version-update:semver-patch"] ``` -有关检查现有忽略首选项的更多信息，请参阅“[依赖项更新的配置选项](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore)。” +For more information about checking for existing ignore preferences, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore)." diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates.md b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/customizing-dependency-updates.md similarity index 91% rename from translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/customizing-dependency-updates.md index 2fc3408d85ed..6bff12e7457d 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/customizing-dependency-updates.md @@ -5,6 +5,7 @@ permissions: 'People with write permissions to a repository can configure {% dat redirect_from: - /github/administering-a-repository/customizing-dependency-updates - /code-security/supply-chain-security/customizing-dependency-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates versions: fpt: '*' ghec: '*' @@ -34,7 +35,7 @@ shortTitle: 自定义更新 - 更改为版本更新打开的拉取请求默认最大数 5：`open-pull-requests-limit` - 打开版本更新的拉取请求以定位特定分支，而不是默认分支：`target-branch` -有关配置选项的详细信息，请参阅“[依赖项更新的配置选项](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates)”。 +For more information about the configuration options, see "[Configuration options for the dependabot.yml file](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates)." 更新仓库中的 *dependabot.yml* 文件时，{% data variables.product.prodname_dependabot %} 使用新配置即刻进行检查。 几分钟内，您将在 **{% data variables.product.prodname_dependabot %}** 选项卡上看到更新的依赖项列表，如果仓库有很多依赖项，可能需要更长时间。 您可能还会看到针对版本更新的新拉取请求。 更多信息请参阅“[列出为版本更新配置的依赖项](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates)”。 @@ -140,4 +141,4 @@ updates: ## 更多示例 -更多示例请参阅“[依赖项更新的配置选项](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates)。” +For more examples, see "[Configuration options for the dependabot.yml file](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates)." diff --git a/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/index.md b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/index.md new file mode 100644 index 000000000000..84e6ced50b25 --- /dev/null +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/index.md @@ -0,0 +1,26 @@ +--- +title: Keeping your dependencies updated automatically with Dependabot version updates +intro: 'You can use {% data variables.product.prodname_dependabot %} to automatically keep the dependencies and packages used in your repository updated to the latest version, even when they don’t have any known vulnerabilities.' +allowTitleToDifferFromFilename: true +redirect_from: + - /github/administering-a-repository/keeping-your-dependencies-updated-automatically + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically +versions: + fpt: '*' + ghec: '*' + ghes: '>3.2' +topics: + - Repositories + - Dependabot + - Version updates + - Dependencies + - Pull requests +children: + - /about-dependabot-version-updates + - /configuring-dependabot-version-updates + - /listing-dependencies-configured-for-version-updates + - /customizing-dependency-updates + - /configuration-options-for-the-dependabot.yml-file +shortTitle: Dependabot 版本更新 +--- + diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates.md b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates.md similarity index 83% rename from translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates.md rename to translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates.md index 566aaa88d817..c1705785c9f0 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates.md +++ b/translations/zh-CN/content/code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates.md @@ -4,6 +4,7 @@ intro: '您可以查看由 {% data variables.product.prodname_dependabot %} 监 redirect_from: - /github/administering-a-repository/listing-dependencies-configured-for-version-updates - /code-security/supply-chain-security/listing-dependencies-configured-for-version-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates versions: fpt: '*' ghec: '*' @@ -22,7 +23,7 @@ shortTitle: 列出已配置的依赖项 ## 查看由 {% data variables.product.prodname_dependabot %} 监视的依赖项 -启用版本更新后，可以使用仓库依赖关系图中的 **{% data variables.product.prodname_dependabot %}** 选项卡确认配置是否正确。 更多信息请参阅“[启用和禁用 {% data variables.product.prodname_dependabot %} 版本更新](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)”。 +启用版本更新后，可以使用仓库依赖关系图中的 **{% data variables.product.prodname_dependabot %}** 选项卡确认配置是否正确。 For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.accessing-repository-graphs %} diff --git a/translations/zh-CN/content/code-security/dependabot/index.md b/translations/zh-CN/content/code-security/dependabot/index.md new file mode 100644 index 000000000000..cb1f4984f916 --- /dev/null +++ b/translations/zh-CN/content/code-security/dependabot/index.md @@ -0,0 +1,23 @@ +--- +title: Keeping your supply chain secure with Dependabot +shortTitle: Dependabot +intro: 'Monitor vulnerabilities in dependencies used in your project{% ifversion fpt or ghec or ghes > 3.2 %} and keep your dependencies up-to-date{% endif %} with {% data variables.product.prodname_dependabot %}.' +allowTitleToDifferFromFilename: true +versions: + fpt: '*' + ghes: '*' + ghae: issue-4864 + ghec: '*' +topics: + - Dependabot + - Alerts + - Vulnerabilities + - Repositories + - Dependencies +children: + - /dependabot-alerts + - /dependabot-security-updates + - /dependabot-version-updates + - /working-with-dependabot +--- + diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions.md b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions.md similarity index 99% rename from translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions.md rename to translations/zh-CN/content/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions.md index 9b97e577a9dc..d819a42fada1 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions.md +++ b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions.md @@ -17,6 +17,8 @@ topics: - Dependencies - Pull requests shortTitle: Use Dependabot with Actions +redirect_from: + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions --- {% data reusables.dependabot.beta-security-and-version-updates %} diff --git a/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/index.md b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/index.md new file mode 100644 index 000000000000..2ff0dbc0daf9 --- /dev/null +++ b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/index.md @@ -0,0 +1,24 @@ +--- +title: Working with Dependabot +shortTitle: Work with Dependabot +intro: 'Guidance and recommendations for working with {% data variables.product.prodname_dependabot %}, such as managing pull requests raised by {% data variables.product.prodname_dependabot %}, using {% data variables.product.prodname_actions %} with {% data variables.product.prodname_dependabot %}, and troubleshooting {% data variables.product.prodname_dependabot %} errors.' +versions: + fpt: '*' + ghec: '*' + ghes: '>3.2' +topics: + - Repositories + - Dependabot + - Version updates + - Security updates + - Dependencies + - Pull requests +children: + - /managing-pull-requests-for-dependency-updates + - /automating-dependabot-with-github-actions + - /keeping-your-actions-up-to-date-with-dependabot + - /managing-encrypted-secrets-for-dependabot + - /troubleshooting-the-detection-of-vulnerable-dependencies + - /troubleshooting-dependabot-errors +--- + diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot.md b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot.md similarity index 88% rename from translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot.md rename to translations/zh-CN/content/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot.md index 7261cc6b3be2..e373bef51aed 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot.md +++ b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot.md @@ -5,6 +5,7 @@ redirect_from: - /github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot - /github/administering-a-repository/keeping-your-actions-up-to-date-with-dependabot - /code-security/supply-chain-security/keeping-your-actions-up-to-date-with-dependabot + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot versions: fpt: '*' ghec: '*' @@ -36,7 +37,7 @@ Actions are often updated with bug fixes and new features to make automated proc 1. Set a `schedule.interval` to specify how often to check for new versions. {% data reusables.dependabot.check-in-dependabot-yml %} If you have edited an existing file, save your changes. -You can also enable {% data variables.product.prodname_dependabot_version_updates %} on forks. For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates#enabling-version-updates-on-forks)." +You can also enable {% data variables.product.prodname_dependabot_version_updates %} on forks. For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates#enabling-version-updates-on-forks)." ### Example *dependabot.yml* file for {% data variables.product.prodname_actions %} @@ -57,7 +58,7 @@ updates: ## Configuring {% data variables.product.prodname_dependabot_version_updates %} for actions -When enabling {% data variables.product.prodname_dependabot_version_updates %} for actions, you must specify values for `package-ecosystem`, `directory`, and `schedule.interval`. There are many more optional properties that you can set to further customize your version updates. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates)." +When enabling {% data variables.product.prodname_dependabot_version_updates %} for actions, you must specify values for `package-ecosystem`, `directory`, and `schedule.interval`. There are many more optional properties that you can set to further customize your version updates. For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates)." ## Further reading diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot.md b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/managing-encrypted-secrets-for-dependabot.md similarity index 93% rename from translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot.md rename to translations/zh-CN/content/code-security/dependabot/working-with-dependabot/managing-encrypted-secrets-for-dependabot.md index 93db3c20f5ea..f55ca00d333a 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot.md +++ b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/managing-encrypted-secrets-for-dependabot.md @@ -4,6 +4,7 @@ intro: '您可以将敏感信息（如密码和访问令牌）存储为加密密 redirect_from: - /github/administering-a-repository/managing-encrypted-secrets-for-dependabot - /code-security/supply-chain-security/managing-encrypted-secrets-for-dependabot + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot versions: fpt: '*' ghec: '*' @@ -33,7 +34,7 @@ password: ${{secrets.MY_ARTIFACTORY_PASSWORD}} ``` {% endraw %} -更多信息请参阅“[依赖项更新的配置选项](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)。” +For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)." ### 命名您的密码 diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates.md b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates.md similarity index 91% rename from translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates.md rename to translations/zh-CN/content/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates.md index 6c94f6c3715e..87103c4b1f37 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates.md +++ b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates.md @@ -4,6 +4,7 @@ intro: '您可以按和其他拉取请求大致相同的方式管理 {% data var redirect_from: - /github/administering-a-repository/managing-pull-requests-for-dependency-updates - /code-security/supply-chain-security/managing-pull-requests-for-dependency-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates versions: fpt: '*' ghec: '*' @@ -41,7 +42,7 @@ shortTitle: 管理 Dependabot PR ## 更改 {% data variables.product.prodname_dependabot %} 拉取请求的变基策略 -默认情况下，{% data variables.product.prodname_dependabot %} 会自动为拉取请求变基，以解决各种冲突。 如果您喜欢手动处理合并冲突，可以使用 `rebase-strategy` 选项禁用此功能。 详情请参阅“[依赖项更新的配置选项](/github/administering-a-repository/configuration-options-for-dependency-updates#rebase-strategy)。” +默认情况下，{% data variables.product.prodname_dependabot %} 会自动为拉取请求变基，以解决各种冲突。 如果您喜欢手动处理合并冲突，可以使用 `rebase-strategy` 选项禁用此功能。 For details, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#rebase-strategy)." ## 管理带注释命令的 {% data variables.product.prodname_dependabot %} 拉取请求 @@ -62,4 +63,4 @@ shortTitle: 管理 Dependabot PR {% data variables.product.prodname_dependabot %} 将用“竖起大拇指”表情符号来确认命令，并可能对拉取请求发表评论。 {% data variables.product.prodname_dependabot %} 通常快速响应，但如果 {% data variables.product.prodname_dependabot %} 正在忙于处理其他更新或命令，一些命令可能需要几分钟才能完成。 -如果您通过运行任何命令来忽略依赖项或版本，{% data variables.product.prodname_dependabot %} 将集中存储仓库的首选项。 虽然这是一种快速解决方案，但对于拥有多个参与者的仓库而言，最好是显式定义要在配置文件中忽略的依赖项和版本。 这样可以让所有参与者都能轻松了解某个特定依赖项为什么无法自动更新。 更多信息请参阅“[依赖项更新的配置选项](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore)。” +如果您通过运行任何命令来忽略依赖项或版本，{% data variables.product.prodname_dependabot %} 将集中存储仓库的首选项。 虽然这是一种快速解决方案，但对于拥有多个参与者的仓库而言，最好是显式定义要在配置文件中忽略的依赖项和版本。 这样可以让所有参与者都能轻松了解某个特定依赖项为什么无法自动更新。 For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore)." diff --git a/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors.md b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors.md new file mode 100644 index 000000000000..b59867579cdd --- /dev/null +++ b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors.md @@ -0,0 +1,129 @@ +--- +title: 排查 Dependabot 错误 +intro: '有时，{% data variables.product.prodname_dependabot %} 无法提出拉取请求以更新依赖项。 您可以查看错误并取消阻止 {% data variables.product.prodname_dependabot %}。' +shortTitle: 排查错误 +redirect_from: + - /github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors + - /github/managing-security-vulnerabilities/troubleshooting-dependabot-errors + - /code-security/supply-chain-security/troubleshooting-dependabot-errors + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors +versions: + fpt: '*' + ghec: '*' + ghes: '>3.2' +type: how_to +topics: + - Dependabot + - Security updates + - Version updates + - Repositories + - Pull requests + - Troubleshooting + - Errors + - Dependencies +--- + +{% data reusables.dependabot.beta-security-and-version-updates %} + +{% data reusables.dependabot.enterprise-enable-dependabot %} + +## 关于 {% data variables.product.prodname_dependabot %} 错误 + +{% data reusables.dependabot.pull-request-introduction %} + +如果有任何因素阻止 {% data variables.product.prodname_dependabot %} 提出拉取请求，则报告为错误。 + +## 使用 {% data variables.product.prodname_dependabot_security_updates %} 调查错误 + +当 {% data variables.product.prodname_dependabot %} 被阻止创建拉取请求以修复 {% data variables.product.prodname_dependabot %} 警报时，它会在警报上发布错误消息。 {% data variables.product.prodname_dependabot_alerts %} 视图显示尚未解决的所有警报列表。 要访问警报视图，请单击仓库 **Security（安全）**选项卡上的 **{% data variables.product.prodname_dependabot_alerts %}**。 如果旨在修复有漏洞依赖项的拉取请求已生成，则警报将包括指向该拉取请求的链接。 + +![{% data variables.product.prodname_dependabot_alerts %} 视图显示拉取请求链接](/assets/images/help/dependabot/dependabot-alert-pr-link.png) + +有三个原因可能导致警报中没有拉取请求链接： + +1. {% data variables.product.prodname_dependabot_security_updates %} 未对仓库启用。 +1. 警报针对未在锁文件中显式定义的间接或过渡依赖项。 +1. 某个错误阻止了 {% data variables.product.prodname_dependabot %} 创建拉取请求。 + +如果某个错误阻止了 {% data variables.product.prodname_dependabot %} 创建拉取请求，您可以通过单击警报来显示错误详情。 + +## 使用 {% data variables.product.prodname_dependabot_version_updates %} 调查错误 + +当 {% data variables.product.prodname_dependabot %} 被阻止创建拉取请求以更新生态系统中的依赖项时，它将在清单文件中发布错误图标。 由 {% data variables.product.prodname_dependabot %} 管理的清单文件列于 {% data variables.product.prodname_dependabot %} 选项卡上。 要访问此选项卡，请在仓库的 **Insights（洞察）**选项卡上单击 **Dependency graph（依赖项图）**，然后单击 **{% data variables.product.prodname_dependabot %}** 选项卡。 + +![{% data variables.product.prodname_dependabot %} 视图显示错误](/assets/images/help/dependabot/dependabot-tab-view-error.png) + +{% ifversion fpt or ghec %} + +要查看任何清单文件的日志文件，请单击 **Last checked TIME ago（上次检查时间以前）**链接。 当您显示一个带有错误符号的清单(例如上面截图中的 Maven）的日志文件时，也会显示任何错误。 + +![{% data variables.product.prodname_dependabot %} 版本更新错误和日志 ](/assets/images/help/dependabot/dependabot-version-update-error.png) + +{% else %} + +若要查看任何清单文件的日志，请单击**上次检查时间前**链接，然后单击 **View logs（查看日志）**。 + +![{% data variables.product.prodname_dependabot %} 版本更新错误和日志 ](/assets/images/enterprise/3.3/dependabot/dependabot-version-update-error.png) + +{% endif %} + +## 了解 {% data variables.product.prodname_dependabot %} 错误 + +安全更新拉取请求用于将有漏洞依赖项升级到包含漏洞修复的最低版本。 而版本更新拉取请求用于将依赖项升级到包清单文件和 {% data variables.product.prodname_dependabot %} 配置文件允许的最新版本。 因此，某些错误特定于一种类型的更新。 + +### {% data variables.product.prodname_dependabot %} 无法将依赖项更新到无漏洞版本 + +**仅限安全更新。** {% data variables.product.prodname_dependabot %} 无法创建拉取请求以将有漏洞依赖项更新到安全版本，而又不破坏此仓库依赖项图中的其他依赖项。 + +每个具有依赖项的应用程序都有一个依赖关系图，即应用程序直接或间接依赖的每个包版本的定向非循环图。 每次更新依赖项时，必须解决此图，否则将无法构建应用程序。 当生态系统具有深刻而复杂的依赖关系图（例如 npm 和 RubyGems）时，如果不升级整个生态系统，往往难以升级单个依赖项。 + +避免这个问题的最佳办法是跟上最新发布的版本，例如启用版本更新。 这增加了通过不破坏依赖关系图的简单升级解决一个依赖项中的漏洞的可能性。 For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." + +### {% data variables.product.prodname_dependabot %} 无法更新到所需的版本，因为已经为最新版本打开了拉取请求 + +**仅限安全更新。** {% data variables.product.prodname_dependabot %} 不会创建拉取请求以将有漏洞依赖项更新到安全版本，因为已存在更新此依赖项的打开拉取请求。 如果在一个依赖项中检测到漏洞，但已经存在将该依赖项更新到最新版本的打开拉取请求时，您将会看到此错误。 + +有两个选项：您可以查看打开的拉取请求，确认更改安全后合并它，或者关闭该拉取请求并触发新的安全更新拉取请求。 更多信息请参阅“[手动触发 {% data variables.product.prodname_dependabot %} 拉取请求](#triggering-a-dependabot-pull-request-manually)”。 + +### {% data variables.product.prodname_dependabot %} 在更新过程中超时 + +{% data variables.product.prodname_dependabot %} 评估所需更新和准备拉取请求所用的时间超过了允许的最大时间。 此错误一般只出现在具有许多清单文件的大型仓库，例如具有数百个 *package.json* 文件的 npm 或 yarn 单仓库项目。 对 Composer 生态系统的更新也需要较长的时间来评估，可能会超时。 + +此错误难以解决。 如果版本更新超时，您可以使用 `allow` 参数来指定更新最重要的依赖项，或者使用 `ignore` 参数从更新中排除某些依赖项。 更新配置可能使 {% data variables.product.prodname_dependabot %} 能够在规定时间内检查版本更新并生成请求。 + +如果安全更新超时，您可以通过保持依赖项更新（例如，启用版本更新）来减少更新需要。 For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." + +### {% data variables.product.prodname_dependabot %} 无法再打开拉取请求 + +{% data variables.product.prodname_dependabot %} 生成的打开拉取请求数量存在限制。 如果达到此限制，将无法打开新的拉取请求，并报告此错误。 解决此错误的最佳方法是审查并合并一些打开的拉取请求。 + +安全性和版本更新拉取请求有各自的限制，因此打开版本更新拉取请求不会阻止安全更新拉取请求的创建。 安全更新拉取请求的限制是 10。 默认情况下，版本更新的限制是 5，但您可以使用配置文件中的 `open-pull-requests-limit` 参数来更改它。 For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit)." + +解决此错误的最佳方法是合并或关闭一些现有拉取请求，然后手动触发新的拉取请求。 更多信息请参阅“[手动触发 {% data variables.product.prodname_dependabot %} 拉取请求](#triggering-a-dependabot-pull-request-manually)”。 + +### {% data variables.product.prodname_dependabot %} 无法解析或访问您的依赖项 + +如果 {% data variables.product.prodname_dependabot %} 尝试检查是否需要更新仓库中的依赖项引用，但无法访问一个或多个依赖项文件，则操作将失败，并返回错误消息“{% data variables.product.prodname_dependabot %} can't resolve your LANGUAGE dependency files（无法解析语言依赖项文件）”。 API 错误类型为 `git_dependencies_not_reachable`。 + +同样，如果 {% data variables.product.prodname_dependabot %} 不能访问依赖项所在的私有包注册表，则会产生以下错误之一： + +* "Dependabot can't reach a dependency in a private package registry"
（Dependabot 无法连接私有包注册表中的依赖项） （API 错误类型：`private_source_not_reachable`） +* "Dependabot can't authenticate to a private package registry"
（Dependabot 无法向私有包注册表验证） （API 错误类型：`private_source_authentication_failure`） +* "Dependabot timed out while waiting for a private package registry"
（Dependabot 在等待私有包注册表时超时） （API 错误类型：`private_source_timed_out`） +* "Dependabot couldn't validate the certificate for a private package registry"
（Dependabot 无法验证私有包注册表的证书） （API 错误类型：`private_source_certificate_failure`） + +要让 {% data variables.product.prodname_dependabot %} 成功更新依赖项引用，请确保所有引用依赖项都托管在可访问的位置。 + +**仅限版本更新。**{% data reusables.dependabot.private-dependencies-note %} 此外，{% data variables.product.prodname_dependabot %} 不支持所有包管理器的 {% data variables.product.prodname_dotcom %} 私有依赖项。 更多信息请参阅“[关于 Dependabot 版本更新](/github/administering-a-repository/about-dependabot-version-updates#supported-repositories-and-ecosystems)”。 + +## 手动触发 {% data variables.product.prodname_dependabot %} 拉取请求 + +如果取消阻止了 {% data variables.product.prodname_dependabot %}，您可以手动触发新的尝试来创建拉取请求。 + +- **Security updates**—display the {% data variables.product.prodname_dependabot %} alert that shows the error you have fixed and click **Create {% data variables.product.prodname_dependabot %} security update**. +- **版本更新**—在仓库的 **Insights（洞察）**选项卡上单击 **Dependency graph（依赖项图）**，然后单击 **Dependabot** 选项卡。 单击 **Last checked *TIME* ago**（上次检查时间以前），查看 {% data variables.product.prodname_dependabot %} 在上次检查版本更新时生成的日志文件。 单击 **Check for Updates（检查更新）**。 + +## 延伸阅读 + +- "[Troubleshooting the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph)" +- "[漏洞依赖项检测疑难解答](/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies)" diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies.md b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md similarity index 70% rename from translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies.md rename to translations/zh-CN/content/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md index 4a967cf2fb29..722d2e48bde4 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies.md +++ b/translations/zh-CN/content/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md @@ -1,10 +1,11 @@ --- title: Troubleshooting the detection of vulnerable dependencies intro: 'If the dependency information reported by {% data variables.product.product_name %} is not what you expected, there are a number of points to consider, and various things you can check.' -shortTitle: Troubleshoot detection +shortTitle: Troubleshoot vulnerability detection redirect_from: - /github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies - /code-security/supply-chain-security/troubleshooting-the-detection-of-vulnerable-dependencies + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies versions: fpt: '*' ghes: '*' @@ -19,72 +20,39 @@ topics: - Security updates - Dependencies - Vulnerabilities - - Dependency graph - - Alerts - CVEs - Repositories --- {% data reusables.dependabot.beta-security-and-version-updates %} - -The results of dependency detection reported by {% data variables.product.product_name %} may be different from the results returned by other tools. There are good reasons for this and it's helpful to understand how {% data variables.product.prodname_dotcom %} determines dependencies for your project. +{% data reusables.dependabot.result-discrepancy %} ## Why do some dependencies seem to be missing? {% data variables.product.prodname_dotcom %} generates and displays dependency data differently than other tools. Consequently, if you've been using another tool to identify dependencies you will almost certainly see different results. Consider the following: * {% data variables.product.prodname_advisory_database %} is one of the data sources that {% data variables.product.prodname_dotcom %} uses to identify vulnerable dependencies. It's a free, curated database of vulnerability information for common package ecosystems on {% data variables.product.prodname_dotcom %}. It includes both data reported directly to {% data variables.product.prodname_dotcom %} from {% data variables.product.prodname_security_advisories %}, as well as official feeds and community sources. This data is reviewed and curated by {% data variables.product.prodname_dotcom %} to ensure that false or unactionable information is not shared with the development community. {% data reusables.security-advisory.link-browsing-advisory-db %} -* The dependency graph parses all known package manifest files in a user’s repository. For example, for npm it will parse the _package-lock.json_ file. It constructs a graph of all of the repository’s dependencies and public dependents. This happens when you enable the dependency graph and when anyone pushes to the default branch, and it includes commits that makes changes to a supported manifest format. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)." -* {% data variables.product.prodname_dependabot %} scans any push, to the default branch, that contains a manifest file. When a new vulnerability record is added, it scans all existing repositories and generates an alert for each vulnerable repository. {% data variables.product.prodname_dependabot_alerts %} are aggregated at the repository level, rather than creating one alert per vulnerability. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." +* The dependency graph parses all known package manifest files in a user’s repository. For example, for npm it will parse the _package-lock.json_ file. It constructs a graph of all of the repository’s dependencies and public dependents. This happens when you enable the dependency graph and when anyone pushes to the default branch, and it includes commits that makes changes to a supported manifest format. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)" and "[Troubleshooting the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph)." +* {% data variables.product.prodname_dependabot %} scans any push, to the default branch, that contains a manifest file. When a new vulnerability record is added, it scans all existing repositories and generates an alert for each vulnerable repository. {% data variables.product.prodname_dependabot_alerts %} are aggregated at the repository level, rather than creating one alert per vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." * {% ifversion fpt or ghec or ghes > 3.2 %}{% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive an alert about a vulnerable dependency in your repository. Where possible, {% data variables.product.prodname_dependabot %} creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)" and "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)." - {% endif %}{% data variables.product.prodname_dependabot %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is added to the advisory database{% ifversion ghes or ghae-issue-4864 %} and synchronized to {% data variables.product.product_location %}{% endif %}. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#detection-of-vulnerable-dependencies)." - -## Why don't I get vulnerability alerts for some ecosystems? + {% endif %}{% data variables.product.prodname_dependabot %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is added to the advisory database{% ifversion ghes or ghae-issue-4864 %} and synchronized to {% data variables.product.product_location %}{% endif %}. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#detection-of-vulnerable-dependencies)." -{% data variables.product.prodname_dotcom %} limits its support for vulnerability alerts to a set of ecosystems where we can provide high-quality, actionable data. Curated vulnerabilities in the {% data variables.product.prodname_advisory_database %}, the dependency graph, {% ifversion fpt or ghec %}{% data variables.product.prodname_dependabot %} security updates, {% endif %}and {% data variables.product.prodname_dependabot_alerts %} are provided for several ecosystems, including Java’s Maven, JavaScript’s npm and Yarn, .NET’s NuGet, Python’s pip, Ruby's RubyGems, and PHP’s Composer. We'll continue to add support for more ecosystems over time. For an overview of the package ecosystems that we support, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)." - -It's worth noting that {% data variables.product.prodname_dotcom %} Security Advisories may exist for other ecosystems. The information in a security advisory is provided by the maintainers of a particular repository. This data is not curated in the same way as information for the supported ecosystems. {% ifversion fpt or ghec %}For more information, see "[About {% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."{% endif %} - -**Check**: Does the uncaught vulnerability apply to an unsupported ecosystem? - -## Does the dependency graph only find dependencies in manifests and lockfiles? - -The dependency graph includes information on dependencies that are explicitly declared in your environment. That is, dependencies that are specified in a manifest or a lockfile. The dependency graph generally also includes transitive dependencies, even when they aren't specified in a lockfile, by looking at the dependencies of the dependencies in a manifest file. +## Do {% data variables.product.prodname_dependabot_alerts %} only relate to vulnerable dependencies in manifests and lockfiles? {% data variables.product.prodname_dependabot_alerts %} advise you about dependencies you should update, including transitive dependencies, where the version can be determined from a manifest or a lockfile. {% ifversion fpt or ghec or ghes > 3.2 %}{% data variables.product.prodname_dependabot_security_updates %} only suggest a change where {% data variables.product.prodname_dependabot %} can directly "fix" the dependency, that is, when these are: * Direct dependencies explicitly declared in a manifest or lockfile * Transitive dependencies declared in a lockfile{% endif %} -The dependency graph doesn't include "loose" dependencies. "Loose" dependencies are individual files that are copied from another source and checked into the repository directly or within an archive (such as a ZIP or JAR file), rather than being referenced by in a package manager’s manifest or lockfile. - **Check**: Is the uncaught vulnerability for a component that's not specified in the repository's manifest or lockfile? -## Does the dependency graph detect dependencies specified using variables? - -The dependency graph analyzes manifests as they’re pushed to {% data variables.product.prodname_dotcom %}. The dependency graph doesn't, therefore, have access to the build environment of the project, so it can't resolve variables used within manifests. If you use variables within a manifest to specify the name, or more commonly the version of a dependency, then that dependency will not be included in the dependency graph. - -**Check**: Is the missing dependency declared in the manifest by using a variable for its name or version? - -## Are there limits which affect the dependency graph data? - -Yes, the dependency graph has two categories of limits: - -1. **Processing limits** - - These affect the dependency graph displayed within {% data variables.product.prodname_dotcom %} and also prevent {% data variables.product.prodname_dependabot_alerts %} being created. - - Manifests over 0.5 MB in size are only processed for enterprise accounts. For other accounts, manifests over 0.5 MB are ignored and will not create {% data variables.product.prodname_dependabot_alerts %}. - - By default, {% data variables.product.prodname_dotcom %} will not process more than 20 manifests per repository. {% data variables.product.prodname_dependabot_alerts %} are not created for manifests beyond this limit. If you need to increase the limit, contact {% data variables.contact.contact_support %}. - -2. **Visualization limits** +## Why don't I get vulnerability alerts for some ecosystems? - These affect what's displayed in the dependency graph within {% data variables.product.prodname_dotcom %}. However, they don't affect the {% data variables.product.prodname_dependabot_alerts %} that are created. +{% data variables.product.prodname_dotcom %} limits its support for vulnerability alerts to a set of ecosystems where we can provide high-quality, actionable data. Curated vulnerabilities in the {% data variables.product.prodname_advisory_database %}, the dependency graph, {% ifversion fpt or ghec %}{% data variables.product.prodname_dependabot %} security updates, {% endif %}and {% data variables.product.prodname_dependabot_alerts %} are provided for several ecosystems, including Java’s Maven, JavaScript’s npm and Yarn, .NET’s NuGet, Python’s pip, Ruby's RubyGems, and PHP’s Composer. We'll continue to add support for more ecosystems over time. For an overview of the package ecosystems that we support, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)." - The Dependencies view of the dependency graph for a repository only displays 100 manifests. Typically this is adequate as it is significantly higher than the processing limit described above. In situations where the processing limit is over 100, {% data variables.product.prodname_dependabot_alerts %} are still created for any manifests that are not shown within {% data variables.product.prodname_dotcom %}. +It's worth noting that {% data variables.product.prodname_dotcom %} Security Advisories may exist for other ecosystems. The information in a security advisory is provided by the maintainers of a particular repository. This data is not curated in the same way as information for the supported ecosystems. {% ifversion fpt or ghec %}For more information, see "[About {% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."{% endif %} -**Check**: Is the missing dependency in a manifest file that's over 0.5 MB, or in a repository with a large number of manifests? +**Check**: Does the uncaught vulnerability apply to an unsupported ecosystem? ## Does {% data variables.product.prodname_dependabot %} generate alerts for vulnerabilities that have been known for many years? @@ -118,7 +86,8 @@ The {% data variables.product.prodname_dependabot_alerts %} count in {% data var ## Further reading -- "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)" -- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" -- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"{% ifversion fpt or ghec or ghes > 3.2 %} +- "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)" +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" +- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" +- "[Troubleshooting the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph)"{% ifversion fpt or ghec or ghes > 3.2 %} - "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"{% endif %} diff --git a/translations/zh-CN/content/code-security/getting-started/github-security-features.md b/translations/zh-CN/content/code-security/getting-started/github-security-features.md index 19655b0a1854..21c6e0e3f757 100644 --- a/translations/zh-CN/content/code-security/getting-started/github-security-features.md +++ b/translations/zh-CN/content/code-security/getting-started/github-security-features.md @@ -37,7 +37,7 @@ Privately discuss and fix security vulnerabilities in your repository's code. Yo ### {% data variables.product.prodname_dependabot_alerts %} and security updates -View alerts about dependencies that are known to contain security vulnerabilities, and choose whether to have pull requests generated automatically to update these dependencies. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" +View alerts about dependencies that are known to contain security vulnerabilities, and choose whether to have pull requests generated automatically to update these dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)." {% endif %} @@ -46,7 +46,7 @@ and "[About {% data variables.product.prodname_dependabot_security_updates %}](/ {% data reusables.dependabot.dependabot-alerts-beta %} -View alerts about dependencies that are known to contain security vulnerabilities, and manage these alerts. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." +View alerts about dependencies that are known to contain security vulnerabilities, and manage these alerts. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." {% endif %} {% ifversion fpt or ghec or ghes > 3.2 %} diff --git a/translations/zh-CN/content/code-security/getting-started/securing-your-organization.md b/translations/zh-CN/content/code-security/getting-started/securing-your-organization.md index bd40761fcecb..667abbef4440 100644 --- a/translations/zh-CN/content/code-security/getting-started/securing-your-organization.md +++ b/translations/zh-CN/content/code-security/getting-started/securing-your-organization.md @@ -48,7 +48,7 @@ You can create a default security policy that will display in any of your organi {% data reusables.dependabot.dependabot-alerts-beta %} {% data reusables.dependabot.dependabot-alerts-dependency-graph-enterprise %} -For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)," "[Exploring the dependencies of a repository](/code-security/supply-chain-security/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)," and "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)." +For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)," "[Exploring the dependencies of a repository](/code-security/supply-chain-security/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)," and "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)." {% endif %} {% ifversion fpt or ghes > 3.1 or ghae-issue-4864 or ghec %} @@ -79,7 +79,7 @@ For more information, see "[About {% data variables.product.prodname_dependabot_ You can enable {% data variables.product.prodname_dependabot %} to automatically raise pull requests to keep your dependencies up-to-date. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/code-security/supply-chain-security/about-dependabot-version-updates)." -To enable {% data variables.product.prodname_dependabot_version_updates %}, you must create a *dependabot.yml* configuration file. For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." +To enable {% data variables.product.prodname_dependabot_version_updates %}, you must create a *dependabot.yml* configuration file. For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." {% endif %} @@ -135,7 +135,7 @@ For more information, see "[Managing security and analysis settings for your org ## Next steps {% ifversion fpt or ghes > 3.1 or ghec %}You can view, filter, and sort security alerts for repositories owned by your organization in the security overview. For more information, see "[About the security overview](/code-security/security-overview/about-the-security-overview)."{% endif %} -You can view and manage alerts from security features to address dependencies and vulnerabilities in your code. For more information, see {% ifversion fpt or ghes or ghec %} "[Viewing and updating vulnerable dependencies in your repository](/code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository),"{% endif %} {% ifversion fpt or ghec or ghes > 3.2 %}"[Managing pull requests for dependency updates](/code-security/supply-chain-security/managing-pull-requests-for-dependency-updates)," {% endif %}"[Managing {% data variables.product.prodname_code_scanning %} for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)," and "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." +You can view and manage alerts from security features to address dependencies and vulnerabilities in your code. For more information, see {% ifversion fpt or ghes or ghec %} "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository),"{% endif %} {% ifversion fpt or ghec or ghes > 3.2 %}"[Managing pull requests for dependency updates](/code-security/supply-chain-security/managing-pull-requests-for-dependency-updates)," {% endif %}"[Managing {% data variables.product.prodname_code_scanning %} for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)," and "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." {% ifversion fpt or ghec %}If you have a security vulnerability, you can create a security advisory to privately discuss and fix the vulnerability. For more information, see "[About {% data variables.product.prodname_security_advisories %}](/code-security/security-advisories/about-github-security-advisories)" and "[Creating a security advisory](/code-security/security-advisories/creating-a-security-advisory)." {% endif %} diff --git a/translations/zh-CN/content/code-security/getting-started/securing-your-repository.md b/translations/zh-CN/content/code-security/getting-started/securing-your-repository.md index 293eb3185b54..1073b342f8cb 100644 --- a/translations/zh-CN/content/code-security/getting-started/securing-your-repository.md +++ b/translations/zh-CN/content/code-security/getting-started/securing-your-repository.md @@ -75,7 +75,7 @@ For more information, see "[Exploring the dependencies of a repository](/code-se {% data reusables.dependabot.dependabot-alerts-beta %} {% data reusables.dependabot.dependabot-alerts-dependency-graph-enterprise %} -For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies){% ifversion fpt or ghec %}" and "[Managing security and analysis settings for your user account](/github/setting-up-and-managing-your-github-user-account/managing-security-and-analysis-settings-for-your-user-account){% endif %}." +For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies){% ifversion fpt or ghec %}" and "[Managing security and analysis settings for your user account](/github/setting-up-and-managing-your-github-user-account/managing-security-and-analysis-settings-for-your-user-account){% endif %}." {% endif %} @@ -111,7 +111,7 @@ For more information, see "[About {% data variables.product.prodname_dependabot_ You can enable {% data variables.product.prodname_dependabot %} to automatically raise pull requests to keep your dependencies up-to-date. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/code-security/supply-chain-security/about-dependabot-version-updates)." -To enable {% data variables.product.prodname_dependabot_version_updates %}, you must create a *dependabot.yml* configuration file. For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." +To enable {% data variables.product.prodname_dependabot_version_updates %}, you must create a *dependabot.yml* configuration file. For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." {% endif %} @@ -132,7 +132,7 @@ You can set up {% data variables.product.prodname_code_scanning %} to automatica {% endif %} ## Next steps -You can view and manage alerts from security features to address dependencies and vulnerabilities in your code. For more information, see {% ifversion fpt or ghes or ghec %} "[Viewing and updating vulnerable dependencies in your repository](/code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository),"{% endif %} {% ifversion fpt or ghec or ghes > 3.2 %}"[Managing pull requests for dependency updates](/code-security/supply-chain-security/managing-pull-requests-for-dependency-updates)," {% endif %}"[Managing {% data variables.product.prodname_code_scanning %} for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)," and "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." +You can view and manage alerts from security features to address dependencies and vulnerabilities in your code. For more information, see {% ifversion fpt or ghes or ghec %} "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository),"{% endif %} {% ifversion fpt or ghec or ghes > 3.2 %}"[Managing pull requests for dependency updates](/code-security/supply-chain-security/managing-pull-requests-for-dependency-updates)," {% endif %}"[Managing {% data variables.product.prodname_code_scanning %} for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)," and "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." {% ifversion fpt or ghec %}If you have a security vulnerability, you can create a security advisory to privately discuss and fix the vulnerability. For more information, see "[About {% data variables.product.prodname_security_advisories %}](/code-security/security-advisories/about-github-security-advisories)" and "[Creating a security advisory](/code-security/security-advisories/creating-a-security-advisory)." {% endif %} diff --git a/translations/zh-CN/content/code-security/guides.md b/translations/zh-CN/content/code-security/guides.md index 93f0b20ade77..de54cf01ebda 100644 --- a/translations/zh-CN/content/code-security/guides.md +++ b/translations/zh-CN/content/code-security/guides.md @@ -75,7 +75,6 @@ includeGuides: - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates diff --git a/translations/zh-CN/content/code-security/index.md b/translations/zh-CN/content/code-security/index.md index 48ae62962427..06f49ecadb88 100644 --- a/translations/zh-CN/content/code-security/index.md +++ b/translations/zh-CN/content/code-security/index.md @@ -54,6 +54,7 @@ children: - /code-scanning - /repository-security-advisories - /supply-chain-security + - /dependabot - /security-overview - /guides --- diff --git a/translations/zh-CN/content/code-security/security-overview/about-the-security-overview.md b/translations/zh-CN/content/code-security/security-overview/about-the-security-overview.md index 2fbe1a5db3b5..2e5433afbcee 100644 --- a/translations/zh-CN/content/code-security/security-overview/about-the-security-overview.md +++ b/translations/zh-CN/content/code-security/security-overview/about-the-security-overview.md @@ -28,7 +28,7 @@ shortTitle: 关于安全概述 您可以使用安全概述来简要了解组织的安全状态，或识别需要干预的问题仓库。 您可以在安全概述中查看综合或存储库特定的安全信息。 您还可以使用安全概述来查看为存储库启用了哪些安全功能，并配置当前未使用的任何可用安全功能。 -安全概述指示是否为组织拥有的存储库启用了 {% ifversion fpt or ghes > 3.1 or ghec %}安全{% endif %}{% ifversion ghae %}{% data variables.product.prodname_GH_advanced_security %}{% endif %} 功能，并合并每个功能的警报。{% ifversion fpt or ghes > 3.1 or ghec %} 安全功能包括 {% data variables.product.prodname_GH_advanced_security %} 功能，例如 {% data variables.product.prodname_code_scanning %} 和 {% data variables.product.prodname_secret_scanning %}以及 {% data variables.product.prodname_dependabot_alerts %}。{% endif %} 有关 {% data variables.product.prodname_GH_advanced_security %} 功能的详细信息，请参阅“[关于 {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)”。{% ifversion fpt or ghes > 3.1 or ghec %} 有关 {% data variables.product.prodname_dependabot_alerts %} 的详细信息，请参阅“[关于易受攻击的依赖项的警报](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)”。{% endif %} +The security overview indicates whether {% ifversion fpt or ghes > 3.1 or ghec %}security{% endif %}{% ifversion ghae %}{% data variables.product.prodname_GH_advanced_security %}{% endif %} features are enabled for repositories owned by your organization and consolidates alerts for each feature.{% ifversion fpt or ghes > 3.1 or ghec %} Security features include {% data variables.product.prodname_GH_advanced_security %} features, such as {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, as well as {% data variables.product.prodname_dependabot_alerts %}.{% endif %} For more information about {% data variables.product.prodname_GH_advanced_security %} features, see "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)."{% ifversion fpt or ghes > 3.1 or ghec %} For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)."{% endif %} 有关在存储库和组织级别保护代码的详细信息，请参阅“[保护存储库](/code-security/getting-started/securing-your-repository)”和“[保护组织](/code-security/getting-started/securing-your-organization)”。 @@ -50,13 +50,13 @@ shortTitle: 关于安全概述 ![安全概述中的图标](/assets/images/help/organizations/security-overview-icons.png) -| 图标 | 含义 | -| ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| {% octicon "code-square" aria-label="Code scanning alerts" %} | {% data variables.product.prodname_code_scanning_capc %} 警报. 更多信息请参阅“[关于 {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/about-code-scanning)”。 | -| {% octicon "key" aria-label="Secret scanning alerts" %} | {% data variables.product.prodname_secret_scanning_caps %} 警报. 更多信息请参阅“[关于 {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/about-secret-scanning)”。 | -| {% octicon "hubot" aria-label="Dependabot alerts" %} | {% data variables.product.prodname_dependabot_alerts %} 的通知。 更多信息请参阅“[关于易受攻击的依赖项的警报](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)”。 | -| {% octicon "check" aria-label="Check" %} | 安全功能已启用，但不会在此存储库中引发警报。 | -| {% octicon "x" aria-label="x" %} | 此存储库不支持该安全功能。 | +| 图标 | 含义 | +| ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| {% octicon "code-square" aria-label="Code scanning alerts" %} | {% data variables.product.prodname_code_scanning_capc %} 警报. 更多信息请参阅“[关于 {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/about-code-scanning)”。 | +| {% octicon "key" aria-label="Secret scanning alerts" %} | {% data variables.product.prodname_secret_scanning_caps %} 警报. 更多信息请参阅“[关于 {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/about-secret-scanning)”。 | +| {% octicon "hubot" aria-label="Dependabot alerts" %} | {% data variables.product.prodname_dependabot_alerts %} 的通知。 For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." | +| {% octicon "check" aria-label="Check" %} | 安全功能已启用，但不会在此存储库中引发警报。 | +| {% octicon "x" aria-label="x" %} | 此存储库不支持该安全功能。 | 安全概述显示由安全功能引发的活动警报。 如果仓库的安全概述中没有警报，则可能仍然存在未检测到的安全漏洞或代码错误。 diff --git a/translations/zh-CN/content/code-security/supply-chain-security/index.md b/translations/zh-CN/content/code-security/supply-chain-security/index.md index 826b69f8259d..eaeba9aeb4cd 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/index.md +++ b/translations/zh-CN/content/code-security/supply-chain-security/index.md @@ -16,8 +16,6 @@ topics: - Repositories children: - /understanding-your-software-supply-chain - - /keeping-your-dependencies-updated-automatically - - /managing-vulnerabilities-in-your-projects-dependencies - /end-to-end-supply-chain --- diff --git a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/index.md b/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/index.md deleted file mode 100644 index 78b4febd91b8..000000000000 --- a/translations/zh-CN/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/index.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: 自动更新依赖项 -intro: '{% data variables.product.prodname_dependabot %} 可以自动维护您的仓库的依赖项。' -redirect_from: - - /github/administering-a-repository/keeping-your-dependencies-updated-automatically -versions: - fpt: '*' - ghec: '*' - ghes: '>3.2' -topics: - - Repositories - - Dependabot - - Version updates - - Dependencies - - Pull requests -children: - - /about-dependabot-version-updates - - /enabling-and-disabling-dependabot-version-updates - - /listing-dependencies-configured-for-version-updates - - /managing-pull-requests-for-dependency-updates - - /automating-dependabot-with-github-actions - - /managing-encrypted-secrets-for-dependabot - - /customizing-dependency-updates - - /configuration-options-for-dependency-updates - - /keeping-your-actions-up-to-date-with-dependabot -shortTitle: 自动更新依赖项 ---- - -{% data reusables.dependabot.beta-security-and-version-updates %} diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies.md b/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies.md deleted file mode 100644 index b7f30cc7b5a1..000000000000 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: 关于管理有漏洞依赖项 -intro: '{% data variables.product.product_name %} 有助于避免使用包含已知漏洞的第三方软件。' -redirect_from: - - /github/managing-security-vulnerabilities/about-managing-vulnerable-dependencies - - /code-security/supply-chain-security/about-managing-vulnerable-dependencies -versions: - fpt: '*' - ghes: '>=3.2' - ghae: issue-4864 - ghec: '*' -type: overview -topics: - - Dependabot - - Dependency graph - - Dependency review - - Vulnerabilities - - Repositories - - Dependencies - - Pull requests -shortTitle: 有漏洞的依赖项 ---- - - - -{% data variables.product.product_name %} 提供以下工具来删除和避免有漏洞依赖项。 - -## 依赖关系图 -依赖项图是存储在仓库中的清单和锁定文件的摘要。 它显示您的代码库所依赖的生态系统和软件包（其依赖项）以及依赖于您的项目的仓库和包（其从属项）。 依赖关系图中的信息用于依赖项审查和 {% data variables.product.prodname_dependabot %}。 更多信息请参阅“[关于依赖关系图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)”。 - -## 依赖项审查 - -{% data reusables.dependency-review.beta %} - -通过检查拉取请求的依赖项审查，可以避免将依赖项的漏洞引入到代码库中。 如果拉取请求添加了有漏洞依赖项，或者将依赖项更改为有漏洞的版本，这将在依赖项审查中高亮显示。 您可以在合并拉取请求之前将依赖项更改为修补版本。 更多信息请参阅“[关于依赖项审查](/code-security/supply-chain-security/about-dependency-review)”。 - -## {% data variables.product.prodname_dependabot_alerts %} -检测到仓库中存在有漏洞依赖项时，{% data variables.product.product_name %} 可创建 {% data variables.product.prodname_dependabot_alerts %}。 警报显示在仓库的 Security（安全）选项卡上。 该警报包括指向项目中受影响的文件的链接，以及有关修复的版本的信息。 {% data variables.product.product_name %} 还根据仓库维护员的通知首选项通知他们。 更多信息请参阅“[关于易受攻击的依赖项的警报](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)”。 - -{% ifversion fpt or ghec or ghes > 3.2 %} -## {% data variables.product.prodname_dependabot_security_updates %} -当 {% data variables.product.product_name %} 针对仓库中的有漏洞依赖项生成 {% data variables.product.prodname_dependabot %} 警报时，{% data variables.product.prodname_dependabot %} 可以自动尝试为您修复它。 {% data variables.product.prodname_dependabot_security_updates %} 是自动生成的拉取请求，用于将有漏洞依赖项更新到修复版本。 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)”。 - -## {% data variables.product.prodname_dependabot_version_updates %} -启用 {% data variables.product.prodname_dependabot_version_updates %} 帮助您维护依赖项。 有了 {% data variables.product.prodname_dependabot_version_updates %}，每当 {% data variables.product.prodname_dotcom %} 发现过时的依赖项，它就会提出拉取请求，以将清单更新到依赖项的最新版本。 而 {% data variables.product.prodname_dependabot_security_updates %} 只是提出拉取请求以修复有漏洞依赖项。 更多信息请参阅“[关于 Dependabot 版本更新](/github/administering-a-repository/about-dependabot-version-updates)”。 -{% endif %} diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/index.md b/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/index.md deleted file mode 100644 index a86e842f2d82..000000000000 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/index.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Managing vulnerabilities in your project's dependencies -intro: 'You can track your repository''s dependencies and receive {% data variables.product.prodname_dependabot_alerts %} when {% data variables.product.product_name %} detects vulnerable dependencies.' -redirect_from: - - /articles/updating-your-project-s-dependencies - - /articles/updating-your-projects-dependencies - - /articles/managing-security-vulnerabilities-in-your-projects-dependencies - - /articles/managing-vulnerabilities-in-your-projects-dependencies - - /github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies -versions: - fpt: '*' - ghes: '*' - ghae: issue-4864 - ghec: '*' -topics: - - Repositories - - Dependabot - - Version updates - - Dependencies - - Pull requests - - Vulnerabilities - - Alerts -children: - - /about-managing-vulnerable-dependencies - - /browsing-security-vulnerabilities-in-the-github-advisory-database - - /editing-security-advisories-in-the-github-advisory-database - - /about-alerts-for-vulnerable-dependencies - - /configuring-notifications-for-vulnerable-dependencies - - /about-dependabot-security-updates - - /configuring-dependabot-security-updates - - /viewing-and-updating-vulnerable-dependencies-in-your-repository - - /troubleshooting-the-detection-of-vulnerable-dependencies - - /troubleshooting-dependabot-errors -shortTitle: Fix vulnerable dependencies ---- - diff --git a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors.md b/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors.md deleted file mode 100644 index f0e5dc57aa97..000000000000 --- a/translations/zh-CN/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: Troubleshooting Dependabot errors -intro: 'Sometimes {% data variables.product.prodname_dependabot %} is unable to raise a pull request to update your dependencies. You can review the error and unblock {% data variables.product.prodname_dependabot %}.' -shortTitle: Troubleshoot errors -redirect_from: - - /github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors - - /github/managing-security-vulnerabilities/troubleshooting-dependabot-errors - - /code-security/supply-chain-security/troubleshooting-dependabot-errors -versions: - fpt: '*' - ghec: '*' - ghes: '>3.2' -type: how_to -topics: - - Dependabot - - Security updates - - Version updates - - Repositories - - Pull requests - - Troubleshooting - - Errors - - Dependencies ---- - -{% data reusables.dependabot.beta-security-and-version-updates %} - -{% data reusables.dependabot.enterprise-enable-dependabot %} - -## About {% data variables.product.prodname_dependabot %} errors - -{% data reusables.dependabot.pull-request-introduction %} - -If anything prevents {% data variables.product.prodname_dependabot %} from raising a pull request, this is reported as an error. - -## Investigating errors with {% data variables.product.prodname_dependabot_security_updates %} - -When {% data variables.product.prodname_dependabot %} is blocked from creating a pull request to fix a {% data variables.product.prodname_dependabot %} alert, it posts the error message on the alert. The {% data variables.product.prodname_dependabot_alerts %} view shows a list of any alerts that have not been resolved yet. To access the alerts view, click **{% data variables.product.prodname_dependabot_alerts %}** on the **Security** tab for the repository. Where a pull request that will fix the vulnerable dependency has been generated, the alert includes a link to that pull request. - -![{% data variables.product.prodname_dependabot_alerts %} view showing a pull request link](/assets/images/help/dependabot/dependabot-alert-pr-link.png) - -There are three reasons why an alert may have no pull request link: - -1. {% data variables.product.prodname_dependabot_security_updates %} are not enabled for the repository. -1. The alert is for an indirect or transitive dependency that is not explicitly defined in a lock file. -1. An error blocked {% data variables.product.prodname_dependabot %} from creating a pull request. - -If an error blocked {% data variables.product.prodname_dependabot %} from creating a pull request, you can display details of the error by clicking the alert. - -## Investigating errors with {% data variables.product.prodname_dependabot_version_updates %} - -When {% data variables.product.prodname_dependabot %} is blocked from creating a pull request to update a dependency in an ecosystem, it posts the error icon on the manifest file. The manifest files that are managed by {% data variables.product.prodname_dependabot %} are listed on the {% data variables.product.prodname_dependabot %} tab. To access this tab, on the **Insights** tab for the repository click **Dependency graph**, and then click the **{% data variables.product.prodname_dependabot %}** tab. - -![{% data variables.product.prodname_dependabot %} view showing an error](/assets/images/help/dependabot/dependabot-tab-view-error.png) - -{% ifversion fpt or ghec %} - -To see the log file for any manifest file, click the **Last checked TIME ago** link. When you display the log file for a manifest that's shown with an error symbol (for example, Maven in the screenshot above), any errors are also displayed. - -![{% data variables.product.prodname_dependabot %} version update error and log ](/assets/images/help/dependabot/dependabot-version-update-error.png) - -{% else %} - -To see the logs for any manifest file, click the **Last checked TIME ago** link, and then click **View logs**. - -![{% data variables.product.prodname_dependabot %} version update error and log ](/assets/images/enterprise/3.3/dependabot/dependabot-version-update-error.png) - -{% endif %} - -## Understanding {% data variables.product.prodname_dependabot %} errors - -Pull requests for security updates act to upgrade a vulnerable dependency to the minimum version that includes a fix for the vulnerability. In contrast, pull requests for version updates act to upgrade a dependency to the latest version allowed by the package manifest and {% data variables.product.prodname_dependabot %} configuration files. Consequently, some errors are specific to one type of update. - -### {% data variables.product.prodname_dependabot %} cannot update DEPENDENCY to a non-vulnerable version - -**Security updates only.** {% data variables.product.prodname_dependabot %} cannot create a pull request to update the vulnerable dependency to a secure version without breaking other dependencies in the dependency graph for this repository. - -Every application that has dependencies has a dependency graph, that is, a directed acyclic graph of every package version that the application directly or indirectly depends on. Every time a dependency is updated, this graph must resolve otherwise the application won't build. When an ecosystem has a deep and complex dependency graph, for example, npm and RubyGems, it is often impossible to upgrade a single dependency without upgrading the whole ecosystem. - -The best way to avoid this problem is to stay up to date with the most recently released versions, for example, by enabling version updates. This increases the likelihood that a vulnerability in one dependency can be resolved by a simple upgrade that doesn't break the dependency graph. For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." - -### {% data variables.product.prodname_dependabot %} cannot update to the required version as there is already an open pull request for the latest version - -**Security updates only.** {% data variables.product.prodname_dependabot %} will not create a pull request to update the vulnerable dependency to a secure version because there is already an open pull request to update this dependency. You will see this error when a vulnerability is detected in a single dependency and there's already an open pull request to update the dependency to the latest version. - -There are two options: you can review the open pull request and merge it as soon as you are confident that the change is safe, or close that pull request and trigger a new security update pull request. For more information, see "[Triggering a {% data variables.product.prodname_dependabot %} pull request manually](#triggering-a-dependabot-pull-request-manually)." - -### {% data variables.product.prodname_dependabot %} timed out during its update - -{% data variables.product.prodname_dependabot %} took longer than the maximum time allowed to assess the update required and prepare a pull request. This error is usually seen only for large repositories with many manifest files, for example, npm or yarn monorepo projects with hundreds of *package.json* files. Updates to the Composer ecosystem also take longer to assess and may time out. - -This error is difficult to address. If a version update times out, you could specify the most important dependencies to update using the `allow` parameter or, alternatively, use the `ignore` parameter to exclude some dependencies from updates. Updating your configuration might allow {% data variables.product.prodname_dependabot %} to review the version update and generate the pull request in the time available. - -If a security update times out, you can reduce the chances of this happening by keeping the dependencies updated, for example, by enabling version updates. For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." - -### {% data variables.product.prodname_dependabot %} cannot open any more pull requests - -There's a limit on the number of open pull requests {% data variables.product.prodname_dependabot %} will generate. When this limit is reached, no new pull requests are opened and this error is reported. The best way to resolve this error is to review and merge some of the open pull requests. - -There are separate limits for security and version update pull requests, so that open version update pull requests cannot block the creation of a security update pull request. The limit for security update pull requests is 10. By default, the limit for version updates is 5 but you can change this using the `open-pull-requests-limit` parameter in the configuration file. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit)." - -The best way to resolve this error is to merge or close some of the existing pull requests and trigger a new pull request manually. For more information, see "[Triggering a {% data variables.product.prodname_dependabot %} pull request manually](#triggering-a-dependabot-pull-request-manually)." - -### {% data variables.product.prodname_dependabot %} can't resolve or access your dependencies - -If {% data variables.product.prodname_dependabot %} attempts to check whether dependency references need to be updated in a repository, but can't access one or more of the referenced files, the operation will fail with the error message "{% data variables.product.prodname_dependabot %} can't resolve your LANGUAGE dependency files." The API error type is `git_dependencies_not_reachable`. - -Similarly, if {% data variables.product.prodname_dependabot %} can't access a private package registry in which a dependency is located, one of the following errors is generated: - -* "Dependabot can't reach a dependency in a private package registry"
- (API error type: `private_source_not_reachable`) -* "Dependabot can't authenticate to a private package registry"
- (API error type:`private_source_authentication_failure`) -* "Dependabot timed out while waiting for a private package registry"
- (API error type:`private_source_timed_out`) -* "Dependabot couldn't validate the certificate for a private package registry"
- (API error type:`private_source_certificate_failure`) - -To allow {% data variables.product.prodname_dependabot %} to update the dependency references successfully, make sure that all of the referenced dependencies are hosted at accessible locations. - -**Version updates only.** {% data reusables.dependabot.private-dependencies-note %} Additionally, {% data variables.product.prodname_dependabot %} doesn't support private {% data variables.product.prodname_dotcom %} dependencies for all package managers. For more information, see "[About Dependabot version updates](/github/administering-a-repository/about-dependabot-version-updates#supported-repositories-and-ecosystems)." - -## Triggering a {% data variables.product.prodname_dependabot %} pull request manually - -If you unblock {% data variables.product.prodname_dependabot %}, you can manually trigger a fresh attempt to create a pull request. - -- **Security updates**—display the {% data variables.product.prodname_dependabot %} alert that shows the error you have fixed and click **Create {% data variables.product.prodname_dependabot %} security update**. -- **Version updates**—on the **Insights** tab for the repository click **Dependency graph**, and then click the **Dependabot** tab. Click **Last checked *TIME* ago** to see the log file that {% data variables.product.prodname_dependabot %} generated during the last check for version updates. Click **Check for updates**. diff --git a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review.md b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review.md index 85377a49ac72..5c49728aa83b 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review.md +++ b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review.md @@ -41,7 +41,7 @@ redirect_from: 通过检查拉取请求中的依赖项审查并更改被标记为有漏洞的任何依赖项，可以避免将漏洞添加到项目中。 有关依赖项审查工作的更多信息，请参阅“[审查拉取请求中的依赖项更改](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request)”。 -{% data variables.product.prodname_dependabot_alerts %} 将会查找依赖项中存在的漏洞，但避免引入潜在问题比在以后修复它们要好得多。 有关 {% data variables.product.prodname_dependabot_alerts %} 的更多信息，请参阅“[关于有漏洞依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)”。 +{% data variables.product.prodname_dependabot_alerts %} 将会查找依赖项中存在的漏洞，但避免引入潜在问题比在以后修复它们要好得多。 有关 {% data variables.product.prodname_dependabot_alerts %} 的更多信息，请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)”。 依赖项审查支持与依赖关系图相同的语言和包管理生态系统。 更多信息请参阅“[关于依赖关系图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)”。 diff --git a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md new file mode 100644 index 000000000000..6ff3e6e9edda --- /dev/null +++ b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md @@ -0,0 +1,156 @@ +--- +title: About supply chain security +intro: '{% data variables.product.product_name %} helps you secure your supply chain, from understanding the dependencies in your environment, to knowing about vulnerabilities in those dependencies{% ifversion fpt or ghec or ghes > 3.2 %}, and patching them{% endif %}.' +miniTocMaxHeadingLevel: 3 +shortTitle: Supply chain security +redirect_from: + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies +versions: + fpt: '*' + ghes: '*' + ghae: issue-4864 + ghec: '*' +type: overview +topics: + - Advanced Security + - Dependency review + - Dependency graph + - Vulnerabilities + - Dependencies + - Pull requests + - Repositories +--- + +## About supply chain security at GitHub + +With the accelerated use of open source, most projects depend on hundreds of open-source dependencies. This poses a security problem: what if the dependencies you're using are vulnerable? You could be putting your users at risk of a supply chain attack. One of the most important things you can do to protect your supply chain is to patch your vulnerabilities. + +You add dependencies directly to your supply chain when you specify them in a manifest file or a lockfile. Dependencies can also be included transitively, that is, even if you don’t specify a particular dependency, but a dependency of yours uses it, then you’re also dependent on that dependency. + +{% data variables.product.product_name %} offers a range of features to help you understand the dependencies in your environment{% ifversion ghes < 3.3 or ghae %} and know about vulnerabilities in those dependencies{% endif %}{% ifversion fpt or ghec or ghes > 3.2 %}, know about vulnerabilities in those dependencies, and patch them{% endif %}. + +The supply chain features on {% data variables.product.product_name %} are: +- **Dependency graph** +{% ifversion fpt or ghec or ghes > 3.1 or ghae %}- **Dependency review**{% endif %} +- **{% data variables.product.prodname_dependabot_alerts %} ** +{% ifversion fpt or ghec or ghes > 3.2 %}- **{% data variables.product.prodname_dependabot_updates %}** + - **{% data variables.product.prodname_dependabot_security_updates %}** + - **{% data variables.product.prodname_dependabot_version_updates %}**{% endif %} + +The dependency graph is central to supply chain security. The dependency graph identifies all upstream dependencies and public downstream dependents of a repository or package. You can see your repository’s dependencies and some of their properties, like vulnerability information, on the dependency graph for the repository. + +{% ifversion fpt or ghec or ghes > 3.1 or ghae %} +Other supply chain features on {% data variables.product.prodname_dotcom %} rely on the information provided by the dependency graph. + +- Dependency review uses the dependency graph to identify dependency changes and help you understand the security impact of these changes when you review pull requests. +- {% data variables.product.prodname_dependabot %} cross-references dependency data provided by the dependency graph with the list of known vulnerabilities published in the {% data variables.product.prodname_advisory_database %}, scans your dependecies and generates {% data variables.product.prodname_dependabot_alerts %} when a potential vulnerability is detected. +{% ifversion fpt or ghec or ghes > 3.2 %}- {% data variables.product.prodname_dependabot_security_updates %} use the dependency graph and {% data variables.product.prodname_dependabot_alerts %} to help you update dependencies with known vulnerabilities in your repository. + +{% data variables.product.prodname_dependabot_version_updates %} don't use the dependency graph and rely on the semantic versioning of dependencies instead. {% data variables.product.prodname_dependabot_version_updates %} help you keep your dependencies updated, even when they don’t have any vulnerabilities. +{% endif %} +{% endif %} + +{% ifversion ghes < 3.2 %} +{% data variables.product.prodname_dependabot %} cross-references dependency data provided by the dependency graph with the list of known vulnerabilities published in the {% data variables.product.prodname_advisory_database %}, scans your dependencies and generates {% data variables.product.prodname_dependabot_alerts %} when a potential vulnerability is detected. + {% endif %} + +## Feature overview + +### What is the dependency graph + +To generate the dependency graph, {% data variables.product.company_short %} looks at a repository’s explicit dependencies declared in the manifest and lockfiles. When enabled, the dependency graph automatically parses all known package manifest files in the repository, and uses this to construct a graph with known dependency names and versions. + +- The dependency graph includes information on your _direct_ dependencies and _transitive_ dependencies. +- The dependency graph is automatically updated when you push a commit to {% data variables.product.company_short %} that changes or adds a supported manifest or lock file to the default branch, and when anyone pushes a change to the repository of one of your dependencies. +- You can see the dependency graph by opening the repository's main page on {% data variables.product.product_name %}, and navigating to the **Insights** tab. + +For more information about the dependency graph, see "[About the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)." + +{% ifversion fpt or ghec or ghes > 3.1 or ghae %} +### What is dependency review + +Dependency review helps reviewers and contributors understand dependency changes and their security impact in every pull request. + +- Dependency review tells you which dependencies were added, removed, or updated, in a pull request. You can use the release dates, popularity of dependencies, and vulnerability information to help you decide whether to accept the change. +- You can see the dependency review for a pull request by showing the rich diff on the **Files Changed** tab. + +For more information about dependency review, see "[About dependency review](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review)." + +{% endif %} + +### What is Dependabot + +{% data variables.product.prodname_dependabot %} keeps your dependencies up to date by informing you of any security vulnerabilities in your dependencies{% ifversion fpt or ghec or ghes > 3.2 or ghae %}, and automatically opens pull requests to upgrade your dependencies to the next available secure version when a {% data variables.product.prodname_dependabot %} alert is triggered, or to the latest version when a release is published{% else %} so that you can update that dependency{% endif %}. + +{% ifversion fpt or ghec or ghes > 3.2 %} +The term "{% data variables.product.prodname_dependabot %}" encompasses the following features: +- {% data variables.product.prodname_dependabot_alerts %}—Displayed notification on the **Security** tab for the repository, and in the repository's dependency graph. The alert includes a link to the affected file in the project, and information about a fixed version. +- {% data variables.product.prodname_dependabot_updates %}: + - {% data variables.product.prodname_dependabot_security_updates %}—Triggered updates to upgrade your dependencies to a secure version when an alert is triggered. + - {% data variables.product.prodname_dependabot_version_updates %}—Scheduled updates to keep your dependencies up to date with the latest version. +{% endif %} + +#### What are Dependabot alerts + +{% data variables.product.prodname_dependabot_alerts %} highlight repositories affected by a newly discovered vulnerability based on the dependency graph and the {% data variables.product.prodname_advisory_database %}, which contains the versions on known vulnerability lists. + +- {% data variables.product.prodname_dependabot %} performs a scan to detect vulnerable dependencies and sends {% data variables.product.prodname_dependabot_alerts %} when: +{% ifversion fpt or ghec %} + - A new vulnerability is added to the {% data variables.product.prodname_advisory_database %}.{% else %} + - New advisory data is synchronized to {% data variables.product.product_location %} each hour from {% data variables.product.prodname_dotcom_the_website %}. {% data reusables.security-advisory.link-browsing-advisory-db %}{% endif %} + - The dependency graph for the repository changes. +- {% data variables.product.prodname_dependabot_alerts %} are displayed {% ifversion fpt or ghec or ghes > 3.0 %} on the **Security** tab for the repository and{% endif %} in the repository's dependency graph. The alert includes {% ifversion fpt or ghec or ghes > 3.0 %}a link to the affected file in the project, and {% endif %}information about a fixed version. + +For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)." + +{% ifversion fpt or ghec or ghes > 3.2 %} +#### What are Dependabot updates + +There are two types of {% data variables.product.prodname_dependabot_updates %}: {% data variables.product.prodname_dependabot %} _security_ updates and _version_ updates. {% data variables.product.prodname_dependabot %} generates automatic pull requests to update your dependencies in both cases, but there are several differences. + +{% data variables.product.prodname_dependabot_security_updates %}: + - Triggered by a {% data variables.product.prodname_dependabot %} alert + - Update dependencies to the minimum version that resolves a known vulnerability + - Supported for ecosystems the dependency graph supports + +{% data variables.product.prodname_dependabot_version_updates %}: + - Run on a schedule you configure + - Update dependencies to the latest version that matches the configuration + - Supported for a different group of ecosystems + +For more information about {% data variables.product.prodname_dependabot_updates %}, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)" and "[About {% data variables.product.prodname_dependabot_version_updates %}](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates)." +{% endif %} + +## Feature availability + +{% ifversion fpt or ghec %} + +Public repositories: +- **Dependency graph**—enabled by default and cannot be disabled. +- **Dependency review**—enabled by default and cannot be disabled. +- **{% data variables.product.prodname_dependabot_alerts %}**—not enabled by default. {% data variables.product.prodname_dotcom %} detects vulnerable dependencies and displays information in the dependency graph, but does not generate {% data variables.product.prodname_dependabot_alerts %} by default. Repository owners or people with admin access can enable {% data variables.product.prodname_dependabot_alerts %}. + You can also enable or disable Dependabot alerts for all repositories owned by your user account or organization. For more information, see "[Managing security and analysis settings for your user account](/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account)" or "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization)." + +Private repositories: +- **Dependency graph**—not enabled by default. The feature can be enabled by repository administrators. For more information, see "[Exploring the dependencies of a repository](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)." +{% ifversion fpt %} +- **Dependency review**—available in private repositories owned by organizations that use {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GH_advanced_security %}. For more information, see the [{% data variables.product.prodname_ghe_cloud %} documentation](/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review). +{% elsif ghec %} +- **Dependency review**—available in private repositories owned by organizations provided you have a license for {% data variables.product.prodname_GH_advanced_security %} and the dependency graph enabled. For more information, see "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)" and "[Exploring the dependencies of a repository](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)." +{% endif %} +- **{% data variables.product.prodname_dependabot_alerts %}**—not enabled by default. Owners of private repositories, or people with admin access, can enable {% data variables.product.prodname_dependabot_alerts %} by enabling the dependency graph and {% data variables.product.prodname_dependabot_alerts %} for their repositories. + You can also enable or disable Dependabot alerts for all repositories owned by your user account or organization. For more information, see "[Managing security and analysis settings for your user account](/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account)" or "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization)." + +Any repository type: +- **{% data variables.product.prodname_dependabot_security_updates %}**—not enabled by default. You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)." +- **{% data variables.product.prodname_dependabot_version_updates %}**—not enabled by default. People with write permissions to a repository can enable {% data variables.product.prodname_dependabot_version_updates %}. For information about enabling security updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)." +{% endif %} + +{% ifversion ghes or ghae %} +- **Dependency graph** and **{% data variables.product.prodname_dependabot_alerts %}**—not enabled by default. Both features are configured at an enterprise level by the enterprise owner. For more information, see {% ifversion ghes %}"[Enabling the dependency graph for your enterprise](/admin/code-security/managing-supply-chain-security-for-your-enterprise/enabling-the-dependency-graph-for-your-enterprise)" and {% endif %}"[Enabling {% data variables.product.prodname_dependabot %} for your enterprise](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise)." +- **Dependency review**—available when dependency graph is enabled for {% data variables.product.product_location %} and {% data variables.product.prodname_advanced_security %} is enabled for the organization or repository. For more information, see "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)." +{% endif %} +{% ifversion ghes > 3.2 %} +- **{% data variables.product.prodname_dependabot_security_updates %}**—not enabled by default. You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)." +- **{% data variables.product.prodname_dependabot_version_updates %}**—not enabled by default. People with write permissions to a repository can enable {% data variables.product.prodname_dependabot_version_updates %}. For information about enabling security updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)." +{% endif %} diff --git a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md index 53c972c93fa8..91b871b9efcf 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md +++ b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md @@ -55,7 +55,7 @@ You can use the dependency graph to: - Explore the repositories your code depends on{% ifversion fpt or ghec %}, and those that depend on it{% endif %}. For more information, see "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)." {% ifversion fpt or ghec %} - View a summary of the dependencies used in your organization's repositories in a single dashboard. For more information, see "[Viewing insights for your organization](/articles/viewing-insights-for-your-organization#viewing-organization-dependency-insights)."{% endif %} -- View and update vulnerable dependencies for your repository. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)."{% ifversion fpt or ghes > 3.1 or ghec %} +- View and update vulnerable dependencies for your repository. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)."{% ifversion fpt or ghes > 3.1 or ghec %} - See information about vulnerable dependencies in pull requests. For more information, see "[Reviewing dependency changes in a pull request](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request)."{% endif %} ## Enabling the dependency graph @@ -111,5 +111,5 @@ The recommended formats explicitly define which versions are used for all direct - "[Dependency graph](https://en.wikipedia.org/wiki/Dependency_graph)" on Wikipedia - "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)"{% ifversion fpt or ghec %} - "[Viewing insights for your organization](/organizations/collaborating-with-groups-in-organizations/viewing-insights-for-your-organization)"{% endif %} -- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" - "[Troubleshooting the detection of vulnerable dependencies](/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies)" diff --git a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md index a6a42f48d02d..e054f9a13cff 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md +++ b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md @@ -40,7 +40,7 @@ shortTitle: 探索依赖项 ### 依赖项视图 {% ifversion fpt or ghec %} -依赖项按生态系统分组。 您可以展开依赖项以查看其依赖项。 对于托管在 {% data variables.product.product_name %} 上公共仓库中的依赖项，您也可以单击依赖项来查看仓库。 私有仓库、私有包或无法识别文件上的依赖项以纯文本显示。 +依赖项按生态系统分组。 您可以展开依赖项以查看其依赖项。 私有仓库、私有包或无法识别文件上的依赖项以纯文本显示。 If the package manager for the dependency is in a public repository, {% data variables.product.product_name %} will display a link to that repository. 如果在仓库中检测到漏洞，这些漏洞将显示在视图顶部，供有权访问 {% data variables.product.prodname_dependabot_alerts %} 的用户查看。 @@ -83,7 +83,10 @@ shortTitle: 探索依赖项 ## 更改“Used by（使用者）”包 -如果启用了依赖项图，并且您的仓库包含已发布在受支持包生态系统上的包，则 {% data variables.product.prodname_dotcom %} 将在仓库的 **Code（代码）**选项卡的边栏中显示“Used by（使用者）”部分。 有关受支持包生态系统的更多信息，请参阅“[关于依赖项图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)”。 +You may notice some repositories have a "Used by" section in the sidebar of the **Code** tab. Your repository will have a "Used by" section if: + * The dependency graph is enabled for the repository (see the above section for more details). + * Your repository contains a package that is published on a [supported package ecosystem](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems). + * Within the ecosystem, your package has a link to a _public_ repository where the source is stored. “Used by（使用者）”部分显示已发现对包的公开引用数量，并显示某些依赖项所有者的头像。 @@ -112,7 +115,7 @@ shortTitle: 探索依赖项 ## 延伸阅读 - “[关于依赖关系图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)” -- "[查看和更新仓库中的漏洞依赖项](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)"{% ifversion fpt or ghec %} +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)"{% ifversion fpt or ghec %} - "[查看用于组织的洞见](/organizations/collaborating-with-groups-in-organizations/viewing-insights-for-your-organization)" - "[了解 {% data variables.product.prodname_dotcom %} 如何使用和保护数据](/get-started/privacy-on-github)" {% endif %} diff --git a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/index.md b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/index.md index 43c07b3bf4df..abffbfffa4f7 100644 --- a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/index.md +++ b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/index.md @@ -9,10 +9,12 @@ topics: - Dependency graph - Dependencies - Repositories +shortTitle: 了解供应链 children: + - /about-supply-chain-security - /about-the-dependency-graph - - /exploring-the-dependencies-of-a-repository - /about-dependency-review -shortTitle: 了解供应链 + - /exploring-the-dependencies-of-a-repository + - /troubleshooting-the-dependency-graph --- diff --git a/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md new file mode 100644 index 000000000000..6de1b7a25da5 --- /dev/null +++ b/translations/zh-CN/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md @@ -0,0 +1,62 @@ +--- +title: Troubleshooting the dependency graph +intro: 'If the dependency information reported by the dependency graph is not what you expected, there are a number of points to consider, and various things you can check.' +shortTitle: Troubleshoot dependency graph +versions: + fpt: '*' + ghes: '*' + ghae: issue-4864 + ghec: '*' +type: how_to +topics: + - Troubleshooting + - Errors + - Dependencies + - Vulnerabilities + - Dependency graph + - CVEs + - Repositories +--- + +{% data reusables.dependabot.result-discrepancy %} + +## Does the dependency graph only find dependencies in manifests and lockfiles? + +The dependency graph includes information on dependencies that are explicitly declared in your environment. That is, dependencies that are specified in a manifest or a lockfile. The dependency graph generally also includes transitive dependencies, even when they aren't specified in a lockfile, by looking at the dependencies of the dependencies in a manifest file. + +The dependency graph doesn't include "loose" dependencies. "Loose" dependencies are individual files that are copied from another source and checked into the repository directly or within an archive (such as a ZIP or JAR file), rather than being referenced by in a package manager’s manifest or lockfile. + +**Check**: Is the missing dependency for a component that's not specified in the repository's manifest or lockfile? + +## Does the dependency graph detect dependencies specified using variables? + +The dependency graph analyzes manifests as they’re pushed to {% data variables.product.prodname_dotcom %}. The dependency graph doesn't, therefore, have access to the build environment of the project, so it can't resolve variables used within manifests. If you use variables within a manifest to specify the name, or more commonly the version of a dependency, then that dependency will not be included in the dependency graph. + +**Check**: Is the missing dependency declared in the manifest by using a variable for its name or version? + +## Are there limits which affect the dependency graph data? + +Yes, the dependency graph has two categories of limits: + +1. **Processing limits** + + These affect the dependency graph displayed within {% data variables.product.prodname_dotcom %} and also prevent {% data variables.product.prodname_dependabot_alerts %} being created. + + Manifests over 0.5 MB in size are only processed for enterprise accounts. For other accounts, manifests over 0.5 MB are ignored and will not create {% data variables.product.prodname_dependabot_alerts %}. + + By default, {% data variables.product.prodname_dotcom %} will not process more than 20 manifests per repository. {% data variables.product.prodname_dependabot_alerts %} are not created for manifests beyond this limit. If you need to increase the limit, contact {% data variables.contact.contact_support %}. + +2. **Visualization limits** + + These affect what's displayed in the dependency graph within {% data variables.product.prodname_dotcom %}. However, they don't affect the {% data variables.product.prodname_dependabot_alerts %} that are created. + + The Dependencies view of the dependency graph for a repository only displays 100 manifests. Typically this is adequate as it is significantly higher than the processing limit described above. In situations where the processing limit is over 100, {% data variables.product.prodname_dependabot_alerts %} are still created for any manifests that are not shown within {% data variables.product.prodname_dotcom %}. + +**Check**: Is the missing dependency in a manifest file that's over 0.5 MB, or in a repository with a large number of manifests? + +## Further reading + +- "[About the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)" +- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" +- "[Troubleshooting the detection of vulnerable dependencies](/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies)"{% ifversion fpt or ghec or ghes > 3.2 %} +- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"{% endif %} \ No newline at end of file diff --git a/translations/zh-CN/content/developers/apps/building-github-apps/creating-a-github-app-using-url-parameters.md b/translations/zh-CN/content/developers/apps/building-github-apps/creating-a-github-app-using-url-parameters.md index 9ac7dd220feb..68cc79642c64 100644 --- a/translations/zh-CN/content/developers/apps/building-github-apps/creating-a-github-app-using-url-parameters.md +++ b/translations/zh-CN/content/developers/apps/building-github-apps/creating-a-github-app-using-url-parameters.md @@ -59,39 +59,39 @@ shortTitle: 应用程序创建查询参数 您可以在查询字符串中选择权限：使用下表中的权限名称作为查询参数名称，使用权限类型作为查询值。 例如，要在用户界面中为 `contents` 选择 `Read & write` 权限，您的查询字符串将包括 `&contents=write`。 要在用户界面中为 `blocking` 选择 `Read-only` 权限，您的查询字符串将包括 `&blocking=read`。 要在用户界面中为 `checks` 选择 `no-access` ，您的查询字符串将包括 `checks` 权限。 -| 权限 | 描述 | -| -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 权限 | 描述 | +| -------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [`管理`](/rest/reference/permissions-required-for-github-apps/#permission-on-administration) | 对用于组织和仓库管理的各种端点授予访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% ifversion fpt or ghec %} | [`blocking`](/rest/reference/permissions-required-for-github-apps/#permission-on-blocking) | 授予对[阻止用户 API](/rest/reference/users#blocking) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% endif %} | [`检查`](/rest/reference/permissions-required-for-github-apps/#permission-on-checks) | 授予对[检查 API](/rest/reference/checks) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% ifversion ghes < 3.4 %} | `content_references` | 授予对“[创建内容附件](/rest/reference/apps#create-a-content-attachment)”端点的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% endif %} -| [`内容`](/rest/reference/permissions-required-for-github-apps/#permission-on-contents) | 对用于修改仓库内容的各种端点授予访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`内容`](/rest/reference/permissions-required-for-github-apps/#permission-on-contents) | 对用于修改仓库内容的各种端点授予访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | | [`部署`](/rest/reference/permissions-required-for-github-apps/#permission-on-deployments) | 授予对[部署 API](/rest/reference/repos#deployments) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% ifversion fpt or ghes or ghec %} | [`emails`](/rest/reference/permissions-required-for-github-apps/#permission-on-emails) | 授予对[电子邮件 API](/rest/reference/users#emails) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% endif %} -| [`关注者`](/rest/reference/permissions-required-for-github-apps/#permission-on-followers) | 授予对[关注者 API](/rest/reference/users#followers) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | -| [`gpg_keys`](/rest/reference/permissions-required-for-github-apps/#permission-on-gpg-keys) | 授予对[GPG 密钥 API](/rest/reference/users#gpg-keys) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | -| [`议题`](/rest/reference/permissions-required-for-github-apps/#permission-on-issues) | 授予对[议题 API](/rest/reference/issues) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | -| [`键`](/rest/reference/permissions-required-for-github-apps/#permission-on-keys) | 授予对[公钥 API](/rest/reference/users#keys) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`关注者`](/rest/reference/permissions-required-for-github-apps/#permission-on-followers) | 授予对[关注者 API](/rest/reference/users#followers) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`gpg_keys`](/rest/reference/permissions-required-for-github-apps/#permission-on-gpg-keys) | 授予对[GPG 密钥 API](/rest/reference/users#gpg-keys) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`议题`](/rest/reference/permissions-required-for-github-apps/#permission-on-issues) | 授予对[议题 API](/rest/reference/issues) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`键`](/rest/reference/permissions-required-for-github-apps/#permission-on-keys) | 授予对[公钥 API](/rest/reference/users#keys) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | | [`members`](/rest/reference/permissions-required-for-github-apps/#permission-on-members) | 授予管理组织成员的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% ifversion fpt or ghec %} -| [`元数据`](/rest/reference/permissions-required-for-github-apps/#metadata-permissions) | 授予对不泄漏敏感数据的只读端点的访问权限。 可以是 `read` 或 `none`。 设置任何权限时，默认值为 `read`；没有为 {% data variables.product.prodname_github_app %} 指定任何权限时，默认值为 `none`。 | +| [`元数据`](/rest/reference/permissions-required-for-github-apps/#metadata-permissions) | 授予对不泄漏敏感数据的只读端点的访问权限。 可以是 `read` 或 `none`。 设置任何权限时，默认值为 `read`；没有为 {% data variables.product.prodname_github_app %} 指定任何权限时，默认值为 `none`。 | | [`organization_administration`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-administration) | 授予对“[更新组织](/rest/reference/orgs#update-an-organization)”端点和[组织交互限制 API](/rest/reference/interactions#set-interaction-restrictions-for-an-organization) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% endif %} -| [`organization_hooks`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-hooks) | 授予对[组织 web 挂钩 API](/rest/reference/orgs#webhooks/) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | -| `organization_plan` | 授予使用“[获取组织](/rest/reference/orgs#get-an-organization)”端点获取有关组织计划的信息的权限。 可以是以下项之一：`none` 或 `read`。 | +| [`organization_hooks`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-hooks) | 授予对[组织 web 挂钩 API](/rest/reference/orgs#webhooks/) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| `organization_plan` | 授予使用“[获取组织](/rest/reference/orgs#get-an-organization)”端点获取有关组织计划的信息的权限。 可以是以下项之一：`none` 或 `read`。 | | [`organization_projects`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-projects) | 授予对[项目 API](/rest/reference/projects) 的访问权限。 可以是以下项之一：`none`、`read`、`write` 或 `admin`。{% ifversion fpt or ghec %} | [`organization_user_blocking`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-projects) | 授予对[阻止组织用户 API](/rest/reference/orgs#blocking) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% endif %} -| [`页面`](/rest/reference/permissions-required-for-github-apps/#permission-on-pages) | 授予对[页面 API](/rest/reference/repos#pages) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | -| `plan` | 授予使用“[获取用户](/rest/reference/users#get-a-user)”端点获取有关用户 GitHub 计划的信息的权限。 可以是以下项之一：`none` 或 `read`。 | -| [`pull_requests`](/rest/reference/permissions-required-for-github-apps/#permission-on-pull-requests) | 授予对各种拉取请求端点的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | -| [`repository_hooks`](/rest/reference/permissions-required-for-github-apps/#permission-on-repository-hooks) | 授予对[仓库 web 挂钩 API](/rest/reference/repos#hooks) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`页面`](/rest/reference/permissions-required-for-github-apps/#permission-on-pages) | 授予对[页面 API](/rest/reference/repos#pages) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| `plan` | 授予使用“[获取用户](/rest/reference/users#get-a-user)”端点获取有关用户 GitHub 计划的信息的权限。 可以是以下项之一：`none` 或 `read`。 | +| [`pull_requests`](/rest/reference/permissions-required-for-github-apps/#permission-on-pull-requests) | 授予对各种拉取请求端点的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`repository_hooks`](/rest/reference/permissions-required-for-github-apps/#permission-on-repository-hooks) | 授予对[仓库 web 挂钩 API](/rest/reference/repos#hooks) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | | [`repository_projects`](/rest/reference/permissions-required-for-github-apps/#permission-on-repository-projects) | 授予对[项目 API](/rest/reference/projects) 的访问权限。 可以是以下项之一：`none`、`read`、`write` 或 `admin`。{% ifversion fpt or ghes or ghec %} | [`secret_scanning_alerts`](/rest/reference/permissions-required-for-github-apps/#permission-on-secret-scanning-alerts) | 授予对[密钥扫描 API](/rest/reference/secret-scanning) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% endif %}{% ifversion fpt or ghes or ghec %} | [`security_events`](/rest/reference/permissions-required-for-github-apps/#permission-on-security-events) | 授予对[代码扫描 API](/rest/reference/code-scanning/) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% endif %} -| [`single_file`](/rest/reference/permissions-required-for-github-apps/#permission-on-single-file) | 授予对[内容 API](/rest/reference/repos#contents) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | -| [`标星`](/rest/reference/permissions-required-for-github-apps/#permission-on-starring) | 授予对[标星 API](/rest/reference/activity#starring) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | -| [`状态`](/rest/reference/permissions-required-for-github-apps/#permission-on-statuses) | 授予对[状态 API](/rest/reference/commits#commit-statuses) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`single_file`](/rest/reference/permissions-required-for-github-apps/#permission-on-single-file) | 授予对[内容 API](/rest/reference/repos#contents) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`标星`](/rest/reference/permissions-required-for-github-apps/#permission-on-starring) | 授予对[标星 API](/rest/reference/activity#starring) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| [`状态`](/rest/reference/permissions-required-for-github-apps/#permission-on-statuses) | 授予对[状态 API](/rest/reference/commits#commit-statuses) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。 | | [`team_discussions`](/rest/reference/permissions-required-for-github-apps/#permission-on-team-discussions) | 授予对[团队讨论 API](/rest/reference/teams#discussions) 和[团队讨论注释 API](/rest/reference/teams#discussion-comments) 的访问权限。 可以是以下项之一：`none`、`read` 或 `write`。{% ifversion fpt or ghes or ghae-issue-4864 or ghec %} -| `vulnerability_alerts` | 授予接收仓库漏洞依赖项安全警报的权限。 更多信息请参阅“[关于漏洞依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)”。 可以是以下项之一：`none` 或 `read`。{% endif %} -| `关注` | 授予列出和更改用户订阅的仓库的权限。 可以是以下项之一：`none`、`read` 或 `write`。 | +| `vulnerability_alerts` | Grants access to receive {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies in a repository. See "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)" to learn more. 可以是以下项之一：`none` 或 `read`。{% endif %} +| `关注` | 授予列出和更改用户订阅的仓库的权限。 可以是以下项之一：`none`、`read` 或 `write`。 | ## {% data variables.product.prodname_github_app %} web 挂钩事件 diff --git a/translations/zh-CN/content/developers/apps/building-github-apps/creating-a-github-app.md b/translations/zh-CN/content/developers/apps/building-github-apps/creating-a-github-app.md index 4e5b322513e7..5756f60dba57 100644 --- a/translations/zh-CN/content/developers/apps/building-github-apps/creating-a-github-app.md +++ b/translations/zh-CN/content/developers/apps/building-github-apps/creating-a-github-app.md @@ -47,7 +47,7 @@ topics: {% endif %} 1. 默认情况下，为了提高应用程序的安全性，应用程序将使用过期用户授权令牌。 要选择不使用过期用户令牌，您必须取消选中“Expire user authorization tokens（过期用户授权令牌）”。 要了解有关设置刷新令牌流程和过期用户令牌的好处，请参阅“[刷新用户到服务器的访问令牌](/apps/building-github-apps/refreshing-user-to-server-access-tokens/)”。 ![在 GitHub 应用程序设置过程中选择加入过期用户令牌的选项](/assets/images/github-apps/expire-user-tokens-selection.png) 1. 如果应用程序授权用户使用 OAuth 流程，您可以选择**在安装过程中请求用户授权 (OAuth)**，以允许用户在安装应用程序时授权它，从而省去一个步骤。 如果您选择此选项，则“设置 URL”将不可用，用户在安装应用程序后将被重定向到您的“用户授权回调 URL”。 更多信息请参阅“[在安装过程中授权用户](/apps/installing-github-apps/#authorizing-users-during-installation)”。 ![Request user authorization during installation](/assets/images/github-apps/github_apps_request_auth_upon_install.png){% if device-flow-is-opt-in %} -1. If your GitHub App will use the device flow to identify and authorize users, click **Enable Device Flow**. For more information about the device flow, see "[Authorizing OAuth Apps](/developers/apps/building-oauth-apps/authorizing-oauth-apps#device-flow)." ![Screenshot showing field for enabling device flow](/assets/images/oauth-apps/enable-device-flow.png){% endif %} +1. 如果您的 GitHub 应用程序将使用设备流来识别和授权用户，请单击 **Enable Device Flow（启用设备流）**。 有关设备流的更多信息，请参阅“[授权 OAuth 应用程序](/developers/apps/building-oauth-apps/authorizing-oauth-apps#device-flow)”。 ![Screenshot showing field for enabling device flow](/assets/images/oauth-apps/enable-device-flow.png){% endif %} 1. 如果安装后需要附加设置，请添加一个“设置 URL”以便在用户安装应用程序后重定向他们。 ![GitHub 应用程序的设置 URL 字段 ](/assets/images/github-apps/github_apps_setup_url.png) {% note %} diff --git a/translations/zh-CN/content/developers/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps.md b/translations/zh-CN/content/developers/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps.md index 4eb9f656483a..0d38a2937097 100644 --- a/translations/zh-CN/content/developers/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps.md +++ b/translations/zh-CN/content/developers/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps.md @@ -127,7 +127,7 @@ curl -H "Authorization: token OAUTH-TOKEN" {% data variables.product.api_url_pre 设备流程允许您授权用户使用无头应用程序，例如 CLI 工具或 Git 凭据管理器。 -{% if device-flow-is-opt-in %}Before you can use the device flow to identify and authorize users, you must first enable it in your app's settings. For more information on enabling device flow, see "[Modifying a GitHub App](/developers/apps/managing-github-apps/modifying-a-github-app)." {% endif %}For more information about authorizing users using the device flow, see "[Authorizing OAuth Apps](/developers/apps/authorizing-oauth-apps#device-flow)." +{% if device-flow-is-opt-in %}在使用设备流识别和授权用户之前，必须先在应用的设置中启用它。 有关启用设备流的详细信息，请参阅“[修改 GitHub 应用程序](/developers/apps/managing-github-apps/modifying-a-github-app)”。 {% endif %}有关使用设备流程授权用户的更多信息，请参阅“[授权 OAuth 应用程序](/developers/apps/authorizing-oauth-apps#device-flow)”。 ## 检查用户可以访问哪些安装资源 diff --git a/translations/zh-CN/content/developers/apps/building-oauth-apps/authorizing-oauth-apps.md b/translations/zh-CN/content/developers/apps/building-oauth-apps/authorizing-oauth-apps.md index 0ac0b567185c..e81f5f7f50eb 100644 --- a/translations/zh-CN/content/developers/apps/building-oauth-apps/authorizing-oauth-apps.md +++ b/translations/zh-CN/content/developers/apps/building-oauth-apps/authorizing-oauth-apps.md @@ -128,7 +128,7 @@ curl -H "Authorization: token OAUTH-TOKEN" {% data variables.product.api_url_pre {% if device-flow-is-opt-in %} -Before you can use the device flow to authorize and identify users, you must first enable it in your app's settings. For more information about enabling the device flow in your app, see "[Modifying an OAuth App](/developers/apps/managing-oauth-apps/modifying-an-oauth-app)" for OAuth Apps and "[Modifying a GitHub App](/developers/apps/managing-github-apps/modifying-a-github-app)" for GitHub Apps. +在使用设备流识别和授权用户之前，必须先在应用的设置中启用它。 有关在应用中启用设备流的详细信息，请参阅“[修改 OAuth 应用程序](/developers/apps/managing-oauth-apps/modifying-an-oauth-app)”（对于 OAuth 应用程序）和“[修改 GitHub 应用程序](/developers/apps/managing-github-apps/modifying-a-github-app)”（对于 GitHub 应用程序）。 {% endif %} @@ -261,8 +261,8 @@ Accept: application/xml | `unsupported_grant_type` | 授予类型必须为 `urn:ietf:params:oauth:grant-type:device_code`，并在您轮询 OAuth 令牌请求 `POST {% data variables.product.oauth_host_code %}/login/oauth/access_token` 时作为输入参数包括在内。 | | `incorrect_client_credentials` | 对于设备流程，您必须传递应用程序的客户端 ID，您可以在应用程序设置页面上找到该 ID。 设备流程不需要 `client_secret`。 | | `incorrect_device_code` | 提供的 device_code 无效。 | -| `access_denied` | When a user clicks cancel during the authorization process, you'll receive a `access_denied` error and the user won't be able to use the verification code again.{% if device-flow-is-opt-in %} -| `device_flow_disabled` | Device flow has not been enabled in the app's settings. For more information, see "[Device flow](#device-flow)."{% endif %} +| `access_denied` | 当用户在授权过程中单击取消时，您将收到 `access_denied` 错误，用户将无法再次使用验证码。{% if device-flow-is-opt-in %} +| `device_flow_disabled` | 尚未在应用的设置中启用设备流。 更多信息请参阅“[设备流](#device-flow)”。{% endif %} 更多信息请参阅“[OAuth 2.0 设备授权授予](https://tools.ietf.org/html/rfc8628#section-3.5)”。 diff --git a/translations/zh-CN/content/developers/apps/building-oauth-apps/creating-an-oauth-app.md b/translations/zh-CN/content/developers/apps/building-oauth-apps/creating-an-oauth-app.md index 86412e4b25b1..3bb9c8fba65e 100644 --- a/translations/zh-CN/content/developers/apps/building-oauth-apps/creating-an-oauth-app.md +++ b/translations/zh-CN/content/developers/apps/building-oauth-apps/creating-an-oauth-app.md @@ -50,5 +50,5 @@ topics: {% endnote %} {% endif %}{% if device-flow-is-opt-in %} -1. If your OAuth App will use the device flow to identify and authorize users, click **Enable Device Flow**. For more information about the device flow, see "[Authorizing OAuth Apps](/developers/apps/building-oauth-apps/authorizing-oauth-apps#device-flow)." ![Screenshot showing field for enabling device flow](/assets/images/oauth-apps/enable-device-flow.png){% endif %} +1. 如果您的 OAuth 应用将使用设备流来识别和授权用户，请单击 **Enable Device Flow（启用设备流）**。 有关设备流的更多信息，请参阅“[授权 OAuth 应用程序](/developers/apps/building-oauth-apps/authorizing-oauth-apps#device-flow)”。 ![Screenshot showing field for enabling device flow](/assets/images/oauth-apps/enable-device-flow.png){% endif %} 2. 单击 **Register application（注册应用程序）**。 ![注册应用程序的按钮](/assets/images/oauth-apps/oauth_apps_register_application.png) diff --git a/translations/zh-CN/content/developers/apps/managing-github-apps/modifying-a-github-app.md b/translations/zh-CN/content/developers/apps/managing-github-apps/modifying-a-github-app.md index 1f909022e252..7ea7f27171a2 100644 --- a/translations/zh-CN/content/developers/apps/managing-github-apps/modifying-a-github-app.md +++ b/translations/zh-CN/content/developers/apps/managing-github-apps/modifying-a-github-app.md @@ -19,5 +19,5 @@ topics: {% data reusables.user-settings.github_apps %} {% data reusables.user-settings.modify_github_app %} 5. 在“Basic information（基本信息）”中，修改您要更改的 GitHub 应用程序信息。 ![Basic information section for your GitHub App](/assets/images/github-apps/github_apps_basic_information.png){% if device-flow-is-opt-in %} -1. If your GitHub App will use the device flow to identify and authorize users, click **Enable device flow**. For more information about the device flow, see "[Authorizing OAuth Apps](/developers/apps/building-oauth-apps/authorizing-oauth-apps#device-flow)." ![Screenshot showing field for enabling device flow](/assets/images/oauth-apps/enable-device-flow.png){% endif %} +1. 如果您的 GitHub 应用程序将使用设备流来识别和授权用户，请单击 **Enable device flow（启用设备流）**。 有关设备流的更多信息，请参阅“[授权 OAuth 应用程序](/developers/apps/building-oauth-apps/authorizing-oauth-apps#device-flow)”。 ![Screenshot showing field for enabling device flow](/assets/images/oauth-apps/enable-device-flow.png){% endif %} 6. 单击 **Save changes（保存更改）**。 ![保存 GitHub 应用程序更改的按钮](/assets/images/github-apps/github_apps_save_changes.png) diff --git a/translations/zh-CN/content/developers/webhooks-and-events/webhooks/webhook-events-and-payloads.md b/translations/zh-CN/content/developers/webhooks-and-events/webhooks/webhook-events-and-payloads.md index 068987fef5fd..f8a41f590f7d 100644 --- a/translations/zh-CN/content/developers/webhooks-and-events/webhooks/webhook-events-and-payloads.md +++ b/translations/zh-CN/content/developers/webhooks-and-events/webhooks/webhook-events-and-payloads.md @@ -1246,7 +1246,7 @@ Web 挂钩事件是基于您注册的域的特异性而触发的。 例如，如 与已由 {% data variables.product.company_short %} 审查的安全通告相关的活动。 经过 {% data variables.product.company_short %} 审查的安全通告提供了有关 {% data variables.product.prodname_dotcom %}上软件中安全相关漏洞的信息。 -安全通告数据集还为 GitHub {% data variables.product.prodname_dependabot_alerts %} 提供支持。 更多信息请参阅“[关于易受攻击的依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)”。 +安全通告数据集还为 GitHub {% data variables.product.prodname_dependabot_alerts %} 提供支持。 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)”。 ### 可用性 diff --git a/translations/zh-CN/content/get-started/privacy-on-github/about-githubs-use-of-your-data.md b/translations/zh-CN/content/get-started/privacy-on-github/about-githubs-use-of-your-data.md index e2b73c6a07c9..a5681e753d4a 100644 --- a/translations/zh-CN/content/get-started/privacy-on-github/about-githubs-use-of-your-data.md +++ b/translations/zh-CN/content/get-started/privacy-on-github/about-githubs-use-of-your-data.md @@ -20,7 +20,7 @@ shortTitle: GitHub 对您的数据的使用 {% data reusables.repositories.about-github-archive-program %} 更多信息请参阅“[关于在 {% data variables.product.prodname_dotcom %} 上存档内容](/github/creating-cloning-and-archiving-repositories/about-archiving-content-and-data-on-github#about-the-github-archive-program)”。 -{% data reusables.user-settings.export-data %} For more information, see "[Requesting an archive of your personal account's data](/articles/requesting-an-archive-of-your-personal-account-s-data)." +{% data reusables.user-settings.export-data %} 更多信息请参阅“[请求个人帐户数据的存档](/articles/requesting-an-archive-of-your-personal-account-s-data)”。 如果您选择使用私人仓库的数据，我们将继续按照[服务条款](/free-pro-team@latest/github/site-policy/github-terms-of-service)，将您的私人数据、源代码或商业秘密视为机密和私密。 我们了解的信息只来自汇总的数据。 更多信息请参阅“[管理私有仓库的数据使用设置](/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository)”。 @@ -28,7 +28,7 @@ shortTitle: GitHub 对您的数据的使用 ## 数据如何改进安全建议 -例如，在使用您的数据时，我们可能会检测您的公共仓库依赖项中的安全漏洞并提醒您。 更多信息请参阅“[关于易受攻击的依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 +例如，在使用您的数据时，我们可能会检测您的公共仓库依赖项中的安全漏洞并提醒您。 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 为检测潜在安全漏洞，{% data variables.product.product_name %} 会扫描依赖项清单文件的内容，以列出项目的依赖项。 diff --git a/translations/zh-CN/content/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository.md b/translations/zh-CN/content/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository.md index 8229beefb99a..d7b42f45ee61 100644 --- a/translations/zh-CN/content/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository.md +++ b/translations/zh-CN/content/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository.md @@ -16,7 +16,7 @@ shortTitle: Manage data use for private repo ## About data use for your private repository -When you enable data use for your private repository, you'll be able to access the dependency graph, where you can track your repository's dependencies and receive {% data variables.product.prodname_dependabot_alerts %} when {% data variables.product.product_name %} detects vulnerable dependencies. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)." +When you enable data use for your private repository, you'll be able to access the dependency graph, where you can track your repository's dependencies and receive {% data variables.product.prodname_dependabot_alerts %} when {% data variables.product.product_name %} detects vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)." ## Enabling or disabling data use features @@ -32,5 +32,5 @@ When you enable data use for your private repository, you'll be able to access t ## Further reading - "[About {% data variables.product.prodname_dotcom %}'s use of your data](/articles/about-github-s-use-of-your-data)" -- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" - "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" diff --git a/translations/zh-CN/content/get-started/quickstart/hello-world.md b/translations/zh-CN/content/get-started/quickstart/hello-world.md index a00bf2dc9985..b9735dea46fe 100644 --- a/translations/zh-CN/content/get-started/quickstart/hello-world.md +++ b/translations/zh-CN/content/get-started/quickstart/hello-world.md @@ -1,6 +1,6 @@ --- title: Hello World -intro: 'Follow this Hello World exercise to get started with {% data variables.product.product_name %}.' +intro: '按照此 Hello World 练习开始使用 {% data variables.product.product_name %}。' versions: fpt: '*' ghes: '*' @@ -15,39 +15,39 @@ miniTocMaxHeadingLevel: 3 ## 简介 -{% data variables.product.product_name %} is a code hosting platform for version control and collaboration. It lets you and others work together on projects from anywhere. +{% data variables.product.product_name %} 是一个用于版本控制和协作的代码托管平台。 它允许您和其他人随时随地协同处理项目。 -This tutorial teaches you {% data variables.product.product_name %} essentials like repositories, branches, commits, and pull requests. You'll create your own Hello World repository and learn {% data variables.product.product_name %}'s pull request workflow, a popular way to create and review code. +本教程培训 {% data variables.product.product_name %} 的基本知识，如存储库、分支、提交和拉取请求等。 您将创建自己的 Hello World 存储库，并了解 {% data variables.product.product_name %} 的拉取请求工作流，这是创建和查看代码的常用方法。 -In this quickstart guide, you will: +在本快速入门指南中，您将： -* Create and use a repository -* Start and manage a new branch -* Make changes to a file and push them to {% data variables.product.product_name %} as commits -* Open and merge a pull request +* 创建和使用存储库 +* 启动和管理新分支 +* 对文件进行更改并将其作为提交推送到 {% data variables.product.product_name %} +* 打开与合并拉取请求 -To complete this tutorial, you need a [{% data variables.product.product_name %} account](http://github.com) and Internet access. You don't need to know how to code, use the command line, or install Git (the version control software that {% data variables.product.product_name %} is built on). If you have a question about any of the expressions used in this guide, head on over to the [glossary](/get-started/quickstart/github-glossary) to find out more about our terminology. +要完成本教程，您需要 [{% data variables.product.product_name %} 帐户](http://github.com)和连接互联网。 您不需要知道如何编码、使用命令行或安装 Git（构建 {% data variables.product.product_name %} 的版本控制软件）。 如果您对本指南中使用的任何表达方式有疑问，请转到[词汇表](/get-started/quickstart/github-glossary)了解术语的更多信息。 ## 创建仓库 -A repository is usually used to organize a single project. Repositories can contain folders and files, images, videos, spreadsheets, and data sets -- anything your project needs. Often, repositories include a _README_ file, a file with information about your project. _README_ files are written in the plain text Markdown language. You can use this [cheat sheet](https://www.markdownguide.org/cheat-sheet/) to get started with Markdown syntax. {% data variables.product.product_name %} lets you add a _README_ file at the same time you create your new repository. {% data variables.product.product_name %} also offers other common options such as a license file, but you do not have to select any of them now. +存储库通常用于组织单个项目。 存储库可以包含文件夹和文件、图像、视频、电子表格和数据集 - 项目所需的任何内容。 通常，存储库包括一个 _README_ 文件，其中含项目的相关信息。 _README_ 文件以纯文本 Markdown 语言编写。 您可以使用此[备忘单](https://www.markdownguide.org/cheat-sheet/)开始使用 Markdown 语法。 {% data variables.product.product_name %} 允许您在创建新存储库的同时添加 _README_ 文件。 {% data variables.product.product_name %} 还提供了其他常用选项，例如许可证文件，但您现在不必选择其中任何一个。 -Your `hello-world` repository can be a place where you store ideas, resources, or even share and discuss things with others. +您的 `hello-world` 存储库可以是您存储想法、资源甚至与他人共享和讨论的地方。 {% data reusables.repositories.create_new %} -1. In the **Repository name** box, enter `hello-world`. -2. In the **Description** box, write a short description. -3. Select **Add a README file**. -4. Select whether your repository will be **Public** or **Private**. +1. 在 **Repository name（存储库名称）**框中，输入 `hello-world`。 +2. 在 **Description（说明）**框中，编写简短说明。 +3. 选择 **Add a README file（添加 README 文件）**。 +4. 选择您的存储库是**公有**还是**私有**。 5. 单击 **Create repository（创建仓库）**。 - ![Create a hello world repository](/assets/images/help/repository/hello-world-repo.png) + ![创建 hello world 存储库](/assets/images/help/repository/hello-world-repo.png) ## 创建分支 -Branching lets you have different versions of a repository at one time. +通过分支，您可以同时拥有不同版本的存储库。 -By default, your repository has one branch named `main` that is considered to be the definitive branch. You can create additional branches off of `main` in your repository. You can use branches to have different versions of a project at one time. This is helpful when you want to add new features to a project without changing the main source of code. The work done on different branches will not show up on the main branch until you merge it, which we will cover later in this guide. You can use branches to experiment and make edits before committing them to `main`. +默认情况下，存储库有一个名为 `main` 的分支，被视为最终分支。 您可以在存储库中创建 `main` 以外的其他分支。 You can use branches to have different versions of a project at one time. This is helpful when you want to add new features to a project without changing the main source of code. The work done on different branches will not show up on the main branch until you merge it, which we will cover later in this guide. You can use branches to experiment and make edits before committing them to `main`. When you create a branch off the `main` branch, you're making a copy, or snapshot, of `main` as it was at that point in time. If someone else made changes to the `main` branch while you were working on your branch, you could pull in those updates. @@ -87,7 +87,7 @@ When you created a new branch in the previous step, {% data variables.product.pr You can make and save changes to the files in your repository. On {% data variables.product.product_name %}, saved changes are called commits. Each commit has an associated commit message, which is a description explaining why a particular change was made. Commit messages capture the history of your changes so that other contributors can understand what you’ve done and why. 1. Under the `readme-edits` branch you created, click the _README.md_ file. -2. Click {% octicon "pencil" aria-label="The edit icon" %} to edit the file. +2. 单击 {% octicon "pencil" aria-label="The edit icon" %} 编辑文件。 3. In the editor, write a bit about yourself. Try using different Markdown elements. 4. In the **Commit changes** box, write a commit message that describes your changes. 5. 单击 **Commit changes（提交更改）**。 diff --git a/translations/zh-CN/content/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server.md b/translations/zh-CN/content/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server.md index 1f9ff8ce7801..0ac5b3a730ed 100644 --- a/translations/zh-CN/content/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server.md +++ b/translations/zh-CN/content/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server.md @@ -19,7 +19,7 @@ shortTitle: Enterprise Server 试用版 您可以申请 45 天试用版来试用 {% data variables.product.prodname_ghe_server %}。 您的试用版将作为虚拟设备安装，带有内部或云部署选项。 有关支持的可视化平台列表，请参阅“[设置 GitHub Enterprise Server 实例](/enterprise-server@latest/admin/installation/setting-up-a-github-enterprise-server-instance)”。 -{% ifversion ghes %}{% data variables.product.prodname_dependabot %}{% else %}安全{% endif %}警报和 {% data variables.product.prodname_github_connect %} 目前在 {% data variables.product.prodname_ghe_server %} 试用版中不可用。 要获取这些功能的演示，请联系 {% data variables.contact.contact_enterprise_sales %}。 有关这些功能的详细信息，请参阅“[关于有漏洞的依赖项警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”和“[将企业帐户连接到 {% data variables.product.prodname_ghe_cloud %}](/enterprise-server@latest/admin/configuration/managing-connections-between-your-enterprise-accounts/connecting-your-enterprise-account-to-github-enterprise-cloud)”。 +{% ifversion ghes %}{% data variables.product.prodname_dependabot %}{% else %}安全{% endif %}警报和 {% data variables.product.prodname_github_connect %} 目前在 {% data variables.product.prodname_ghe_server %} 试用版中不可用。 要获取这些功能的演示，请联系 {% data variables.contact.contact_enterprise_sales %}。 For more information about these features, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[Connecting your enterprise account to {% data variables.product.prodname_ghe_cloud %}](/enterprise-server@latest/admin/configuration/managing-connections-between-your-enterprise-accounts/connecting-your-enterprise-account-to-github-enterprise-cloud)." 试用版也可用于 {% data variables.product.prodname_ghe_cloud %}。 更多信息请参阅“[设置 {% data variables.product.prodname_ghe_cloud %} 的试用](/articles/setting-up-a-trial-of-github-enterprise-cloud)”。 diff --git a/translations/zh-CN/content/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks.md b/translations/zh-CN/content/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks.md index 4d2eceea1e87..e5eb337af94f 100644 --- a/translations/zh-CN/content/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks.md +++ b/translations/zh-CN/content/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks.md @@ -70,10 +70,9 @@ Look! You can see my backticks. {% if mermaid %} ## Creating diagrams -You can use Mermaid syntax to add diagrams. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams)." +You can also use code blocks to create diagrams in Markdown. GitHub supports Mermaid, geoJSON, topoJSON, and ASCII STL syntax. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams)." {% endif %} - ## 延伸阅读 - [{% data variables.product.prodname_dotcom %} Flavored Markdown 规格](https://github.github.com/gfm/) diff --git a/translations/zh-CN/content/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams.md b/translations/zh-CN/content/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams.md index 4f4f1a2e267c..eaa9268f216e 100644 --- a/translations/zh-CN/content/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams.md +++ b/translations/zh-CN/content/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams.md @@ -6,7 +6,13 @@ versions: shortTitle: Create diagrams --- -You can use Mermaid syntax to create diagrams. Mermaid is a Markdown-inspired tool that renders text into diagrams. For example, Mermaid can render flow charts, sequence diagrams, pie charts and more. For more information, see the [Mermaid documentation](https://mermaid-js.github.io/mermaid/#/). +## About creating diagrams + +You can create diagrams in Markdown using three different syntaxes: mermaid, geoJSON and topoJSON, and ASCII STL. + +## Creating Mermaid diagrams + +Mermaid is a Markdown-inspired tool that renders text into diagrams. For example, Mermaid can render flow charts, sequence diagrams, pie charts and more. For more information, see the [Mermaid documentation](https://mermaid-js.github.io/mermaid/#/). To create a Mermaid diagram, add Mermaid syntax inside a fenced code block with the `mermaid` language identifier. For more information about creating code blocks, see "[Creating and highlighting code blocks](/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks)." @@ -31,3 +37,122 @@ graph TD; **Note:** You may observe errors if you run a third-party Mermaid plugin when using Mermaid syntax on {% data variables.product.company_short %}. {% endnote %} + +## Creating geoJSON and topoJSON maps + +You can use geo/topoJSON syntax to create interactive maps. To create a map, add geoJSON or topoJSON inside a fenced code block with the `geojson` or `topojson` syntax identifier. 更多信息请参阅“[创建和突出显示代码块](/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks)”。 + +### Using geoJSON + +For example, you can create a simple map: + +
+```geojson
+{
+  "type": "Polygon",
+  "coordinates": [
+      [
+          [-90,30],
+          [-90,35],
+          [-90,35],
+          [-85,35],
+          [-85,30]
+      ]
+  ]
+}
+```
+
+ +![Rendered map](/assets/images/help/writing/fenced-geojson-rendered-map.png) + +### Using topoJSON + +For example, you can create a simple topoJSON map: + +
+```topojson
+{
+  "type": "Topology",
+  "transform": {
+    "scale": [0.0005000500050005, 0.00010001000100010001],
+    "translate": [100, 0]
+  },
+  "objects": {
+    "example": {
+      "type": "GeometryCollection",
+      "geometries": [
+        {
+          "type": "Point",
+          "properties": {"prop0": "value0"},
+          "coordinates": [4000, 5000]
+        },
+        {
+          "type": "LineString",
+          "properties": {"prop0": "value0", "prop1": 0},
+          "arcs": [0]
+        },
+        {
+          "type": "Polygon",
+          "properties": {"prop0": "value0",
+            "prop1": {"this": "that"}
+          },
+          "arcs": [[1]]
+        }
+      ]
+    }
+  },
+  "arcs": [[[4000, 0], [1999, 9999], [2000, -9999], [2000, 9999]],[[0, 0], [0, 9999], [2000, 0], [0, -9999], [-2000, 0]]]
+}
+```
+
+ +![Rendered topojson map](/assets/images/help/writing/fenced-topojson-rendered-map.png) + +For more information on working with `.geojson` and `.topojson` files, see "[Working with non-code files](/repositories/working-with-files/using-files/working-with-non-code-files#mapping-geojson-files-on-github)." + + +## Creating STL 3D models + +You can use ASCII STL syntax directly in markdown to create interactive 3D models. To display a model, add ASCII STL syntax inside a fenced code block with the `stl` syntax identifier. 更多信息请参阅“[创建和突出显示代码块](/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks)”。 + +For example, you can create a simple 3D model: + +
+```stl
+solid cube_corner
+  facet normal 0.0 -1.0 0.0
+    outer loop
+      vertex 0.0 0.0 0.0
+      vertex 1.0 0.0 0.0
+      vertex 0.0 0.0 1.0
+    endloop
+  endfacet
+  facet normal 0.0 0.0 -1.0
+    outer loop
+      vertex 0.0 0.0 0.0
+      vertex 0.0 1.0 0.0
+      vertex 1.0 0.0 0.0
+    endloop
+  endfacet
+  facet normal -1.0 0.0 0.0
+    outer loop
+      vertex 0.0 0.0 0.0
+      vertex 0.0 0.0 1.0
+      vertex 0.0 1.0 0.0
+    endloop
+  endfacet
+  facet normal 0.577 0.577 0.577
+    outer loop
+      vertex 1.0 0.0 0.0
+      vertex 0.0 1.0 0.0
+      vertex 0.0 0.0 1.0
+    endloop
+  endfacet
+endsolid
+```
+
+ +![Rendered 3D model](/assets/images/help/writing/fenced-stl-rendered-object.png) + +For more information on working with `.stl` files, see "[Working with non-code files](/repositories/working-with-files/using-files/working-with-non-code-files#3d-file-viewer)." + diff --git a/translations/zh-CN/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md b/translations/zh-CN/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md index d59c1e32ecf0..ceaa325d9ab6 100644 --- a/translations/zh-CN/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md +++ b/translations/zh-CN/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md @@ -122,7 +122,7 @@ shortTitle: 管理安全和分析 默认情况下，{% data variables.product.prodname_dependabot %} 无法更新位于私有仓库或私有仓库注册表中的依赖项。 但是，如果依赖项位于与使用该依赖项之项目相同的组织内的私有 {% data variables.product.prodname_dotcom %} 仓库中，则可以通过授予对主机仓库的访问权限来允许 {% data variables.product.prodname_dependabot %} 成功更新版本。 -如果您的代码依赖于私有注册表中的软件包，您可以在仓库级别进行配置，允许 {% data variables.product.prodname_dependabot %} 更新这些依赖项的版本。 可通过将身份验证详细信息添加到仓库的 _dependabot.yml_ 文件来做到这一点。 更多信息请参阅“[依赖项更新的配置选项](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)。” +如果您的代码依赖于私有注册表中的软件包，您可以在仓库级别进行配置，允许 {% data variables.product.prodname_dependabot %} 更新这些依赖项的版本。 可通过将身份验证详细信息添加到仓库的 _dependabot.yml_ 文件来做到这一点。 For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)." 要允许 {% data variables.product.prodname_dependabot %} 访问私有 {% data variables.product.prodname_dotcom %} 仓库： @@ -157,6 +157,5 @@ shortTitle: 管理安全和分析 - "[保护您的仓库](/code-security/getting-started/securing-your-repository)"{% ifversion not fpt %} - "[About secret scanning](/github/administering-a-repository/about-secret-scanning)"{% endif %}{% ifversion not ghae %} -- “[关于依赖关系图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)” -- "[Managing vulnerabilities in your project's dependencies](/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies)"{% endif %}{% ifversion fpt or ghec or ghes > 3.2 %} -- "[自动更新依赖项](/github/administering-a-repository/keeping-your-dependencies-updated-automatically)"{% endif %} +- "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)"{% endif %}{% ifversion fpt or ghec or ghes or ghae-issue-4864 %} +- "[About supply chain security](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security)"{% endif %} diff --git a/translations/zh-CN/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md b/translations/zh-CN/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md index 440cc0203dac..88ed01950900 100644 --- a/translations/zh-CN/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md +++ b/translations/zh-CN/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md @@ -35,52 +35,52 @@ The audit log lists events triggered by activities that affect your organization 要搜索特定事件，请在查询中使用 `action` 限定符。 审核日志中列出的操作分为以下类别： -| 类别名称 | 描述 | -| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |{% ifversion fpt or ghec %} -| [`帐户`](#account-category-actions) | 包含与组织帐户相关的所有活动。 | -| [`advisory_credit`](#advisory_credit-category-actions) | 包含与 {% data variables.product.prodname_advisory_database %} 中安全通告的贡献者积分相关的所有活动。 更多信息请参阅“[关于 {% data variables.product.prodname_dotcom %} 安全通告](/github/managing-security-vulnerabilities/about-github-security-advisories)”。 | -| [`计费，帐单`](#billing-category-actions) | 包含与组织帐单相关的所有活动。 | -| [`business`](#business-category-actions) | 包含与企业业务设置相关的活动。 | +| 类别名称 | 描述 | +| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |{% ifversion fpt or ghec %} +| [`帐户`](#account-category-actions) | 包含与组织帐户相关的所有活动。 | +| [`advisory_credit`](#advisory_credit-category-actions) | 包含与 {% data variables.product.prodname_advisory_database %} 中安全通告的贡献者积分相关的所有活动。 更多信息请参阅“[关于 {% data variables.product.prodname_dotcom %} 安全通告](/github/managing-security-vulnerabilities/about-github-security-advisories)”。 | +| [`计费，帐单`](#billing-category-actions) | 包含与组织帐单相关的所有活动。 | +| [`business`](#business-category-actions) | 包含与企业业务设置相关的活动。 | | [`codespaces`](#codespaces-category-actions) | Contains all activities related to your organization's codespaces. |{% endif %}{% ifversion fpt or ghec or ghes > 3.2 %} -| [`dependabot_alerts`](#dependabot_alerts-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_alerts %} in existing repositories. 更多信息请参阅“[关于易受攻击的依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 | -| [`dependabot_alerts_new_repos`](#dependabot_alerts_new_repos-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_alerts %} in new repositories created in the organization. | -| [`dependabot_security_updates`](#dependabot_security_updates-category-actions) | 包含现有仓库中 {% data variables.product.prodname_dependabot_security_updates %} 的组织级配置活动。 更多信息请参阅“[配置 {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)。” | +| [`dependabot_alerts`](#dependabot_alerts-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_alerts %} in existing repositories. 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 | +| [`dependabot_alerts_new_repos`](#dependabot_alerts_new_repos-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_alerts %} in new repositories created in the organization. | +| [`dependabot_security_updates`](#dependabot_security_updates-category-actions) | 包含现有仓库中 {% data variables.product.prodname_dependabot_security_updates %} 的组织级配置活动。 更多信息请参阅“[配置 {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)。” | | [`dependabot_security_updates_new_repos`](#dependabot_security_updates_new_repos-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_security_updates %} for new repositories created in the organization.{% endif %}{% ifversion fpt or ghec %} -| [`dependency_graph`](#dependency_graph-category-actions) | 包含仓库依赖项图的组织级配置活动。 更多信息请参阅“[关于依赖关系图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)”。 | +| [`dependency_graph`](#dependency_graph-category-actions) | 包含仓库依赖项图的组织级配置活动。 更多信息请参阅“[关于依赖关系图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)”。 | | [`dependency_graph_new_repos`](#dependency_graph_new_repos-category-actions) | 包含组织新建仓库的组织级配置活动。{% endif %} -| [`discussion_post`](#discussion_post-category-actions) | 包含与发布到团队页面的讨论相关的所有活动。 | +| [`discussion_post`](#discussion_post-category-actions) | 包含与发布到团队页面的讨论相关的所有活动。 | | [`discussion_post_reply`](#discussion_post_reply-category-actions) | 包含与发布到团队页面的讨论回复相关的所有活动。{% ifversion fpt or ghes or ghec %} -| [`企业`](#enterprise-category-actions) | 包含与企业设置相关的活动。 |{% endif %} -| [`挂钩`](#hook-category-actions) | 包含与 web 挂钩相关的所有活动。 | +| [`企业`](#enterprise-category-actions) | 包含与企业设置相关的活动。 |{% endif %} +| [`挂钩`](#hook-category-actions) | 包含与 web 挂钩相关的所有活动。 | | [`integration_installation_request`](#integration_installation_request-category-actions) | 包含与组织成员请求所有者批准用于组织的集成相关的所有活动。 |{% ifversion ghec or ghae %} -| [`ip_allow_list`](#ip_allow_list-category-actions) | Contains activities related to enabling or disabling the IP allow list for an organization. | +| [`ip_allow_list`](#ip_allow_list-category-actions) | Contains activities related to enabling or disabling the IP allow list for an organization. | | [`ip_allow_list_entry`](#ip_allow_list_entry-category-actions) | Contains activities related to the creation, deletion, and editing of an IP allow list entry for an organization.{% endif %} -| [`议题`](#issue-category-actions) | 包含与删除议题相关的活动。 |{% ifversion fpt or ghec %} -| [`marketplace_agreement_signature`](#marketplace_agreement_signature-category-actions) | 包含与签署 {% data variables.product.prodname_marketplace %} 开发者协议相关的所有活动。 | +| [`议题`](#issue-category-actions) | 包含与删除议题相关的活动。 |{% ifversion fpt or ghec %} +| [`marketplace_agreement_signature`](#marketplace_agreement_signature-category-actions) | 包含与签署 {% data variables.product.prodname_marketplace %} 开发者协议相关的所有活动。 | | [`marketplace_listing`](#marketplace_listing-category-actions) | 包含与在 {% data variables.product.prodname_marketplace %} 中上架应用程序相关的所有活动。{% endif %}{% ifversion fpt or ghes or ghec %} -| [`members_can_create_pages`](#members_can_create_pages-category-actions) | 包含与管理组织仓库的 {% data variables.product.prodname_pages %} 站点发布相关的所有活动。 更多信息请参阅“[管理组织的 {% data variables.product.prodname_pages %} 站点发布](/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization)”。 |{% endif %} +| [`members_can_create_pages`](#members_can_create_pages-category-actions) | 包含与管理组织仓库的 {% data variables.product.prodname_pages %} 站点发布相关的所有活动。 更多信息请参阅“[管理组织的 {% data variables.product.prodname_pages %} 站点发布](/organizations/managing-organization-settings/managing-the-publication-of-github-pages-sites-for-your-organization)”。 |{% endif %} | [`org`](#org-category-actions) | 包含与组织成员身份相关的活动。{% ifversion ghec %} | [`org_credential_authorization`](#org_credential_authorization-category-actions) | 包含与授权凭据以用于 SAML 单点登录相关的所有活动。{% endif %}{% ifversion fpt or ghes or ghae or ghec %} | [`organization_label`](#organization_label-category-actions) | 包含与组织中仓库的默认标签相关的所有活动。{% endif %} | [`oauth_application`](#oauth_application-category-actions) | 包含与 OAuth 应用程序相关的所有活动。{% ifversion fpt or ghes or ghec %} | [`包`](#packages-category-actions) | 包含与 {% data variables.product.prodname_registry %} 相关的所有活动。{% endif %}{% ifversion fpt or ghec %} | [`payment_method`](#payment_method-category-actions) | 包含与组织如何支付 GitHub 相关的所有活动。{% endif %} -| [`profile_picture`](#profile_picture-category-actions) | 包含与组织的头像相关的所有活动。 | -| [`project`](#project-category-actions) | 包含与项目板相关的所有活动。 | -| [`protected_branch`](#protected_branch-category-actions) | 包含与受保护分支相关的所有活动。 | +| [`profile_picture`](#profile_picture-category-actions) | 包含与组织的头像相关的所有活动。 | +| [`project`](#project-category-actions) | 包含与项目板相关的所有活动。 | +| [`protected_branch`](#protected_branch-category-actions) | 包含与受保护分支相关的所有活动。 | | [`repo`](#repo-category-actions) | 包含与组织拥有的仓库相关的所有活动。{% ifversion fpt or ghec %} -| [`repository_advisory`](#repository_advisory-category-actions) | 包含与 {% data variables.product.prodname_advisory_database %} 中的安全通告相关的仓库级活动。 更多信息请参阅“[关于 {% data variables.product.prodname_dotcom %} 安全通告](/github/managing-security-vulnerabilities/about-github-security-advisories)”。 | +| [`repository_advisory`](#repository_advisory-category-actions) | 包含与 {% data variables.product.prodname_advisory_database %} 中的安全通告相关的仓库级活动。 更多信息请参阅“[关于 {% data variables.product.prodname_dotcom %} 安全通告](/github/managing-security-vulnerabilities/about-github-security-advisories)”。 | | [`repository_content_analysis`](#repository_content_analysis-category-actions) | 包含与[启用或禁用私有仓库的数据使用](/articles/about-github-s-use-of-your-data)相关的所有活动。{% endif %}{% ifversion fpt or ghec %} -| [`repository_dependency_graph`](#repository_dependency_graph-category-actions) | 包含与启用或禁用依赖项图相关的仓库级活动 | -| {% ifversion fpt or ghec %}私有{% endif %}仓库。 更多信息请参阅“[关于依赖项图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)”。{% endif %}{% ifversion ghes or ghae or ghec %} | | -| [`repository_secret_scanning`](#repository_secret_scanning-category-actions) | 包含与密码扫描相关的仓库级活动。 更多信息请参阅“[关于密钥扫描](/github/administering-a-repository/about-secret-scanning)”。 |{% endif %}{% ifversion fpt or ghes or ghae-issue-4864 or ghec %} +| [`repository_dependency_graph`](#repository_dependency_graph-category-actions) | 包含与启用或禁用依赖项图相关的仓库级活动 | +| {% ifversion fpt or ghec %}私有{% endif %}仓库。 更多信息请参阅“[关于依赖项图](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)”。{% endif %}{% ifversion ghes or ghae or ghec %} | | +| [`repository_secret_scanning`](#repository_secret_scanning-category-actions) | 包含与密码扫描相关的仓库级活动。 更多信息请参阅“[关于密钥扫描](/github/administering-a-repository/about-secret-scanning)”。 |{% endif %}{% ifversion fpt or ghes or ghae-issue-4864 or ghec %} | [`repository_vulnerability_alert`](#repository_vulnerability_alert-category-actions) | 包含与[有漏洞依赖项的 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)相关的所有活动。{% endif %}{% ifversion fpt or ghec %} | [`repository_vulnerability_alerts`](#repository_vulnerability_alerts-category-actions) | Contains repository-level configuration activities for {% data variables.product.prodname_dependabot_alerts %}.{% endif %}{% ifversion ghec %} | [`角色`](#role-category-actions) | Contains all activities related to [custom repository roles](/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization).{% endif %}{% ifversion ghes or ghae or ghec %} -| [`secret_scanning`](#secret_scanning-category-actions) | 包含现有仓库中密码扫描的组织级配置活动。 更多信息请参阅“[关于密钥扫描](/github/administering-a-repository/about-secret-scanning)”。 | -| [`secret_scanning_new_repos`](#secret_scanning_new_repos-category-actions) | 包含组织新建仓库中密码扫描的组织级配置活动。 |{% endif %}{% ifversion fpt or ghec %} +| [`secret_scanning`](#secret_scanning-category-actions) | 包含现有仓库中密码扫描的组织级配置活动。 更多信息请参阅“[关于密钥扫描](/github/administering-a-repository/about-secret-scanning)”。 | +| [`secret_scanning_new_repos`](#secret_scanning_new_repos-category-actions) | 包含组织新建仓库中密码扫描的组织级配置活动。 |{% endif %}{% ifversion fpt or ghec %} | [`sponsors`](#sponsors-category-actions) | 包含与与赞助者按钮相关的所有事件（请参阅“[在仓库中显示赞助者按钮](/articles/displaying-a-sponsor-button-in-your-repository)”）{% endif %} -| [`团队`](#team-category-actions) | 包含与您的组织中的团队相关的所有活动。 | +| [`团队`](#team-category-actions) | 包含与您的组织中的团队相关的所有活动。 | | [`team_discussions`](#team_discussions-category-actions) | Contains activities related to managing team discussions for an organization.{% ifversion fpt or ghec or ghes > 3.1 or ghae %} | [`工作流程`](#workflows-category-actions) | Contains activities related to {% data variables.product.prodname_actions %} workflows.{% endif %} @@ -680,11 +680,11 @@ By default, only events from the past three months are returned. To include olde {% endif %}{% ifversion fpt or ghes or ghae-issue-4864 or ghec %} ### `repository_vulnerability_alert` 类操作 -| 操作 | 描述 | -| -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `create` | Triggered when {% data variables.product.product_name %} creates a {% data variables.product.prodname_dependabot %} alert for a repository that uses a vulnerable dependency. 更多信息请参阅“[关于易受攻击的依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 | -| `忽略` | Triggered when an organization owner or person with admin access to the repository dismisses a {% data variables.product.prodname_dependabot %} alert about a vulnerable dependency. | -| `解决` | 当对仓库具有写入权限的人推送更改以更新和解决项目依赖项中的漏洞时触发。 | +| 操作 | 描述 | +| -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `create` | Triggered when {% data variables.product.product_name %} creates a {% data variables.product.prodname_dependabot %} alert for a repository that uses a vulnerable dependency. 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 | +| `忽略` | Triggered when an organization owner or person with admin access to the repository dismisses a {% data variables.product.prodname_dependabot %} alert about a vulnerable dependency. | +| `解决` | 当对仓库具有写入权限的人推送更改以更新和解决项目依赖项中的漏洞时触发。 | {% endif %}{% ifversion fpt or ghec %} ### `repository_vulnerability_alerts` 类操作 diff --git a/translations/zh-CN/content/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry.md b/translations/zh-CN/content/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry.md index b3a5b600b912..01a56b4478d1 100644 --- a/translations/zh-CN/content/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry.md +++ b/translations/zh-CN/content/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry.md @@ -136,7 +136,7 @@ You can use gems from {% data variables.product.prodname_registry %} much like y end ``` -3. For Bundler versions earlier than 1.7.0, you need to add a new global `source`. For more information on using Bundler, see the [bundler.io documentation](http://bundler.io/v1.5/gemfile.html). +3. For Bundler versions earlier than 1.7.0, you need to add a new global `source`. For more information on using Bundler, see the [bundler.io documentation](https://bundler.io/gemfile.html). ```ruby source "https://{% ifversion fpt or ghec %}rubygems.pkg.github.com{% else %}REGISTRY-URL{% endif %}/OWNER" diff --git a/translations/zh-CN/content/pages/quickstart.md b/translations/zh-CN/content/pages/quickstart.md index 12d738d1bb37..07e08e7130a0 100644 --- a/translations/zh-CN/content/pages/quickstart.md +++ b/translations/zh-CN/content/pages/quickstart.md @@ -1,6 +1,6 @@ --- -title: Quickstart for GitHub Pages -intro: 'You can use {% data variables.product.prodname_pages %} to showcase some open source projects, host a blog, or even share your résumé. This guide will help get you started on creating your next website.' +title: GitHub Pages 快速入门 +intro: '您可以使用 {% data variables.product.prodname_pages %} 来展示一些开源项目、主持博客甚或分享您的简历。 本指南将帮助您开始创建下一个网站。' allowTitleToDifferFromFilename: true versions: fpt: '*' @@ -16,30 +16,30 @@ product: '{% data reusables.gated-features.pages %}' ## 简介 -{% data variables.product.prodname_pages %} are public webpages hosted and published through {% data variables.product.product_name %}. The quickest way to get up and running is by using the Jekyll Theme Chooser to load a pre-made theme. You can then modify your {% data variables.product.prodname_pages %}' content and style. +{% data variables.product.prodname_pages %} 是通过 {% data variables.product.product_name %} 托管和发布的公共网页。 启动和运行的最快方法是使用 Jekyll 主题选择器加载预置主题。 然后，您可以修改 {% data variables.product.prodname_pages %} 的内容和样式。 -This guide will lead you through creating a user site at `username.github.io`. +本指南将引导您完成在 `username.github.io` 创建用户站点的过程。 -## Creating your website +## 创建网站 {% data reusables.repositories.create_new %} -1. Enter `username.github.io` as the repository name. Replace `username` with your {% data variables.product.prodname_dotcom %} username. For example, if your username is `octocat`, the repository name should be `octocat.github.io`. ![Repository name field](/assets/images/help/pages/create-repository-name-pages.png) +1. 输入 `username.github.io` 作为存储库名称。 Replace `username` with your {% data variables.product.prodname_dotcom %} username. For example, if your username is `octocat`, the repository name should be `octocat.github.io`. ![存储库名称字段](/assets/images/help/pages/create-repository-name-pages.png) {% data reusables.repositories.sidebar-settings %} {% data reusables.pages.sidebar-pages %} 1. Click **Choose a theme**. ![选择主题按钮](/assets/images/help/pages/choose-theme.png) 2. The Theme Chooser will open. Browse the available themes, then click **Select theme** to select a theme. It's easy to change your theme later, so if you're not sure, just choose one for now. ![主题选项和选择主题按钮](/assets/images/help/pages/select-theme.png) 3. After you select a theme, your repository's `README.md` file will open in the file editor. The `README.md` file is where you will write the content for your site. You can edit the file or keep the default content for now. -4. When you are done editing the file, click **Commit changes**. +4. 编辑完文件后，单击 **Commit changes（提交更改）**。 5. Visit `username.github.io` to view your new website. **注：**对站点的更改在推送到 {% data variables.product.product_name %} 后，最长可能需要 20 分钟才会发布。 ## Changing the title and description -By default, the title of your site is `username.github.io`. You can change the title by editing the `_config.yml` file in your repository. You can also add a description for your site. +默认情况下，网站的标题为 `username.github.io`。 您可以通过编辑存储库中的 `_config.yml` 文件来更改标题。 您还可以为您的网站添加说明。 -1. Click the **Code** tab of your repository. -1. In the file list, click `_config.yml` to open the file. -1. Click {% octicon "pencil" aria-label="The edit icon" %} to edit the file. -1. The `_config.yml` file already contains a line that specifies the theme for your site. Add a new line with `title:` followed by the title you want. Add a new line with `description:` followed by the description you want. 例如： +1. 单击存储库的 **Code（代码）**选项卡。 +1. 在文件列表中，单击 `_config.yml` 打开该文件。 +1. 单击 {% octicon "pencil" aria-label="The edit icon" %} 编辑文件。 +1. `_config.yml` 文件已包含指定网站主题的行。 添加一个新行，其中包含 `title:`，后跟所需的标题。 添加一个新行，其中包含 `description:`，后跟所需的说明。 例如： ```yaml theme: jekyll-theme-minimal @@ -47,10 +47,10 @@ By default, the title of your site is `username.github.io`. You can change the t description: Bookmark this to keep an eye on my project updates! ``` -1. When you are done editing the file, click **Commit changes**. +1. 编辑完文件后，单击 **Commit changes（提交更改）**。 ## 后续步骤 -For more information about how to add additional pages to your site, see "[Adding content to your GitHub Pages site using Jekyll](/pages/setting-up-a-github-pages-site-with-jekyll/adding-content-to-your-github-pages-site-using-jekyll#about-content-in-jekyll-sites)." +有关如何向站点添加其他页面的详细信息，请参阅“[使用 Jekyll 向 GitHub Pages 站点添加内容](/pages/setting-up-a-github-pages-site-with-jekyll/adding-content-to-your-github-pages-site-using-jekyll#about-content-in-jekyll-sites)”。 -For more information about setting up a {% data variables.product.prodname_pages %} site with Jekyll, see "[About GitHub Pages and Jekyll](/pages/setting-up-a-github-pages-site-with-jekyll/about-github-pages-and-jekyll)." +有关使用 Jekyll 设置 {% data variables.product.prodname_pages %} 站点的更多信息，请参阅“[关于 GitHub Pages 和 Jekyll](/pages/setting-up-a-github-pages-site-with-jekyll/about-github-pages-and-jekyll)”。 diff --git a/translations/zh-CN/content/pages/setting-up-a-github-pages-site-with-jekyll/testing-your-github-pages-site-locally-with-jekyll.md b/translations/zh-CN/content/pages/setting-up-a-github-pages-site-with-jekyll/testing-your-github-pages-site-locally-with-jekyll.md index 9b047c5a415d..c89a26f9c95a 100644 --- a/translations/zh-CN/content/pages/setting-up-a-github-pages-site-with-jekyll/testing-your-github-pages-site-locally-with-jekyll.md +++ b/translations/zh-CN/content/pages/setting-up-a-github-pages-site-with-jekyll/testing-your-github-pages-site-locally-with-jekyll.md @@ -50,6 +50,12 @@ shortTitle: 使用 Jekyll 本地测试站点 ``` 3. 要预览站点，请在 web 浏览器中导航到 `http://localhost:4000`。 +{% note %} + +**Note:** If you are using Ruby 3.0 and Jekyll 4.2.x or older, you will need to add the `webrick` gem to your project's Gemfile prior to running `bundle install`. + +{% endnote %} + ## 更新 {% data variables.product.prodname_pages %} gem Jekyll 是一个活跃的开源项目，经常更新。 如果您计算机上的 `github-pages` gem 版本落后于 {% data variables.product.prodname_pages %} 服务器上的 `github-pages` gem 版本，则您的站点在本地构建时的外观与在 {% data variables.product.product_name %} 上发布时的外观可能不同。 为避免这种情况，请定期更新计算机上的 `github-pages` gem。 diff --git a/translations/zh-CN/content/repositories/releasing-projects-on-github/searching-a-repositorys-releases.md b/translations/zh-CN/content/repositories/releasing-projects-on-github/searching-a-repositorys-releases.md index 00e10a4bc103..c81c08a9de2a 100644 --- a/translations/zh-CN/content/repositories/releasing-projects-on-github/searching-a-repositorys-releases.md +++ b/translations/zh-CN/content/repositories/releasing-projects-on-github/searching-a-repositorys-releases.md @@ -1,8 +1,8 @@ --- -title: Searching a repository's releases -intro: 'You can use keywords, tags, and other qualifiers to search for particular releases in a repository.' +title: 搜索存储库的版本 +intro: 您可以使用关键字、标记和其他限定符来搜索存储库中的特定版本。 permissions: Anyone with read access to a repository can search that repository's releases. -shortTitle: Searching releases +shortTitle: 搜索版本 versions: fpt: '*' ghec: '*' @@ -12,21 +12,21 @@ topics: - Repositories --- -## Searching for releases in a repository +## 在存储库中搜索版本 {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.releases %} -1. To search the repository's releases, in the search field at the top of the Releases page, type your query and press **Enter**. ![Releases search field](/assets/images/help/releases/search-releases.png) +1. 要搜索存储库的版本，请在 Releases（发行版）页面顶部的搜索字段中，键入您的查询，然后按 **Enter**。 ![版本搜索字段](/assets/images/help/releases/search-releases.png) -## Search syntax for searching releases in a repository +## 用于在存储库中搜索版本的搜索语法 -You can provide text in your search query which will be matched against the title, body, and tag of the repository's releases. You can also combine the following qualifiers to target specific releases. +您可以在搜索查询中提供文本，这些文本将与存储库版本的标题、正文和标记进行匹配。 您还可以组合以下限定符以面向特定版本。 -| 限定符 | 示例 | -| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `draft:true` | **draft:true** will only match draft releases. | -| `draft:false` | **draft:false** will only match published releases. | -| `prerelease:true` | **prerelease:true** will only match pre-releases. | -| `prerelease:false` | **prerelease:false** will only match releases that are not pre-releases. | -| tag:TAG | **tag:v1** matches a release with the v1 tag and any minor or patch versions within v1, such as v1.0, v1.2, and v1.2.5. | -| created:DATE | **created:2021** will match releases created during 2021. You can also provide date ranges. 更多信息请参阅“[了解搜索语法](/search-github/getting-started-with-searching-on-github/understanding-the-search-syntax#query-for-dates)”。 | +| 限定符 | 示例 | +| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `draft:true` | **draft:true** 将仅匹配草稿版本。 | +| `draft:false` | **draft:false** 仅匹配已发布的版本。 | +| `prerelease:true` | **prerelease:true** 仅匹配预发行版本。 | +| `prerelease:false` | **prerelease:false** 仅匹配非预发行版的版本。 | +| tag:TAG | **tag:v1** 匹配具有 v1 标记的版本以及 v1 中的任何次要版本或修补程序版本，例如 v1.0、v1.2 和 v1.2.5。 | +| created:DATE | **created:2021** 将匹配 2021 年期间创建的版本。 您还可以提供日期范围。 更多信息请参阅“[了解搜索语法](/search-github/getting-started-with-searching-on-github/understanding-the-search-syntax#query-for-dates)”。 | diff --git a/translations/zh-CN/content/repositories/viewing-activity-and-data-for-your-repository/understanding-connections-between-repositories.md b/translations/zh-CN/content/repositories/viewing-activity-and-data-for-your-repository/understanding-connections-between-repositories.md index 1180043ae50e..86db4cefb840 100644 --- a/translations/zh-CN/content/repositories/viewing-activity-and-data-for-your-repository/understanding-connections-between-repositories.md +++ b/translations/zh-CN/content/repositories/viewing-activity-and-data-for-your-repository/understanding-connections-between-repositories.md @@ -73,5 +73,5 @@ shortTitle: 存储库之间的连接 依赖关系图提供了可视化和探索仓库依赖关系的好方法。 更多信息请参阅“[关于依赖关系图](/code-security/supply-chain-security/about-the-dependency-graph)”和“[探索仓库的依赖关系](/code-security/supply-chain-security/exploring-the-dependencies-of-a-repository)”。 -您也可以设置仓库，以便在您的一个依赖项中发现安全漏洞时，{% data variables.product.company_short %} 会自动提醒您。 更多信息请参阅“[关于易受攻击的依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 +您也可以设置仓库，以便在您的一个依赖项中发现安全漏洞时，{% data variables.product.company_short %} 会自动提醒您。 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 {% endif %} diff --git a/translations/zh-CN/content/repositories/working-with-files/using-files/working-with-non-code-files.md b/translations/zh-CN/content/repositories/working-with-files/using-files/working-with-non-code-files.md index 6948d6df3648..bc03bf6a9159 100644 --- a/translations/zh-CN/content/repositories/working-with-files/using-files/working-with-non-code-files.md +++ b/translations/zh-CN/content/repositories/working-with-files/using-files/working-with-non-code-files.md @@ -130,6 +130,12 @@ SVG 目前不支持内联脚本或动画。 {% endtip %} +{% if mermaid %} +### Rendering in Markdown + +You can embed ASCII STL syntax directly in Markdown. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams#creating-stl-3d-models)." +{% endif %} + ## 呈现 CSV 和 TSV 数据 GitHub 支持以 *.csv*（逗号分隔）和 .*tsv*（制表符分隔）文件的形式呈现表格数据。 @@ -233,7 +239,7 @@ GitHub 支持呈现 PDF 文档。 ![源渲染切换屏幕截图](/assets/images/help/repository/source-render-toggle-geojson.png) -### 几何类型 +### Geometry types {% data variables.product.product_name %} 上的地图使用 [Leaflet.js](http://leafletjs.com)，并且支持 [geoJSON 规格](http://www.geojson.org/geojson-spec.html)中列出的所有几何类型（Point、LineString、Polygon、MultiPoint、MultiLineString、MultiPolygon 和 GeometryCollection）。 TopoJSON 文件类型应为 "Topology"（拓扑），并且遵守 [topoJSON 规格](https://github.com/mbostock/topojson/wiki/Specification)。 @@ -274,6 +280,12 @@ GitHub 支持呈现 PDF 文档。 {% endtip %} +{% if mermaid %} +### Mapping in Markdown + +You can embed geoJSON and topoJSON directly in Markdown. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams#creating-geojson-and-topojson-maps)." +{% endif %} + ### 集群 如果地图包含大量标记（大约超过 750 个），GitHub 将自动以较高的缩放比例集群附近的标记。 只需单击群集或放大便可查看个别标记。 @@ -292,7 +304,7 @@ GitHub 支持呈现 PDF 文档。 如果将 `.geojson` 文件转换为 [TopoJSON](https://github.com/mbostock/topojson)，可能还是能够渲染数据，TopoJSON 是一种压缩格式，有时能将文件减小 80%。 当然，您始终可以将文件分解为更小的数据块（例如按州或年分解），并将数据在仓库中存储为多个文件。 -### 其他资源 +### 延伸阅读 * [Leaflet.js geojson 文档](http://leafletjs.com/examples/geojson.html) * [MapBox marker-styling 文档](http://www.mapbox.com/developers/simplestyle/) @@ -320,3 +332,44 @@ $ jupyter nbconvert --to html NOTEBOOK-NAME.ipynb - [Jupyter Notebook 的 GitHub 仓库](https://github.com/jupyter/jupyter_notebook) - [Jupyter Notebook 的图片库](https://github.com/jupyter/jupyter/wiki/A-gallery-of-interesting-Jupyter-Notebooks) + +{% if mermaid %} +## Displaying Mermaid files on {% data variables.product.prodname_dotcom %} + +{% data variables.product.product_name %} supports rendering Mermaid files within repositories. Commit the file as you would normally using a `.mermaid` or `.mmd` extension. Then, navigate to the path of the Mermaid file on {% data variables.product.prodname_dotcom %}. + +For example, if you add a `.mmd` file with the following content to your repository: + +``` +graph TD + A[Friend's Birthday] -->|Get money| B(Go shopping) + B --> C{Let me think} + C -->|One| D["Cool
Laptop"] + C -->|Two| E[iPhone] + C -->|Three| F[fa:fa-car Car] +``` + +When you view the file in the repository, it is rendered as a flow chart. ![Rendered mermaid file diagram](/assets/images/help/repository/mermaid-file-diagram.png) + +### 疑难解答 + +If your chart does not render at all, verify that it contains valid Mermaid Markdown syntax by checking your chart with the [Mermaid live editor](https://mermaid.live/edit). + +If the chart displays, but does not appear as you'd expect, you can create a new [feedback discussion](https://github.com/github/feedback/discussions/categories/general-feedback), and add the `mermaid` tag. + +#### 已知问题 + +* Sequence diagram charts frequently render with additional padding below the chart, with more padding added as the chart size increases. This is a known issue with the Mermaid library. +* Actor nodes with popover menus do not work as expected within sequence diagram charts. This is due to a discrepancy in how JavaScript events are added to a chart when the Mermaid library's API is used to render a chart. +* Not all charts are a11y compliant. This may affect users who rely on a screen reader. + +### Mermaid in Markdown + +You can embed Mermaid syntax directly in Markdown. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams#creating-mermaid-diagrams)." + +### 延伸阅读 + +* [Mermaid.js documentation](https://mermaid-js.github.io/mermaid/#/) +* [Mermaid.js live editor](https://mermaid.live/edit) +{% endif %} + diff --git a/translations/zh-CN/content/rest/reference/deploy_keys.md b/translations/zh-CN/content/rest/reference/deploy_keys.md new file mode 100644 index 000000000000..2a49dbdf4759 --- /dev/null +++ b/translations/zh-CN/content/rest/reference/deploy_keys.md @@ -0,0 +1,17 @@ +--- +title: Deploy Keys +intro: 'The Deploy Keys API allows to create an SSH key that is stored on your server and grants access to a GitHub repository.' +allowTitleToDifferFromFilename: true +versions: + fpt: '*' + ghes: '*' + ghae: '*' + ghec: '*' +topics: + - API +miniTocMaxHeadingLevel: 3 +--- + + \ No newline at end of file diff --git a/translations/zh-CN/content/rest/reference/deployments.md b/translations/zh-CN/content/rest/reference/deployments.md index 0b4daf9c5e11..b9b2dfc6fea7 100644 --- a/translations/zh-CN/content/rest/reference/deployments.md +++ b/translations/zh-CN/content/rest/reference/deployments.md @@ -1,6 +1,6 @@ --- title: 部署 -intro: 'The deployments API allows you to create and delete deploy keys, deployments, and deployment environments.' +intro: The deployments API allows you to create and delete deployments and deployment environments. allowTitleToDifferFromFilename: true versions: fpt: '*' diff --git a/translations/zh-CN/content/rest/reference/index.md b/translations/zh-CN/content/rest/reference/index.md index ffd7a7674d48..d1620d78bbb8 100644 --- a/translations/zh-CN/content/rest/reference/index.md +++ b/translations/zh-CN/content/rest/reference/index.md @@ -22,6 +22,7 @@ children: - /collaborators - /commits - /dependabot + - /deploy_keys - /deployments - /emojis - /enterprise-admin diff --git a/translations/zh-CN/data/features/mermaid.yml b/translations/zh-CN/data/features/mermaid.yml index 09870e35f9fe..db633f907dcc 100644 --- a/translations/zh-CN/data/features/mermaid.yml +++ b/translations/zh-CN/data/features/mermaid.yml @@ -1,8 +1,8 @@ --- -#Issue 5812 and 6172 -#Mermaid syntax support +#Issues 5812 and 6172, also 6411 +#Mermaid syntax support, also ASCII STL and geoJSON/topoJSON syntax support versions: fpt: '*' ghec: '*' - ghes: '>=3.5' + ghes: '>=3.6' ghae: 'issue-6172' diff --git a/translations/zh-CN/data/learning-tracks/code-security.yml b/translations/zh-CN/data/learning-tracks/code-security.yml index 3b9db87e4a9e..f8abf8dc63fc 100644 --- a/translations/zh-CN/data/learning-tracks/code-security.yml +++ b/translations/zh-CN/data/learning-tracks/code-security.yml @@ -18,39 +18,39 @@ dependabot_alerts: title: '获取漏洞依赖项的通知' description: '设置 Dependabot 提醒您的依赖项中有新漏洞。' guides: - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies + - /code-security/dependabot/dependabot-alerts/about-dependabot-alerts - '{% ifversion fpt or ghec or ghes > 3.2 %}/github/administering-a-repository/managing-repository-settings/managing-security-and-analysis-settings-for-your-repository{% endif %}' - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors + - /code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts + - /code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts + - /code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates + - /code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies + - /code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors #Feature available on dotcom and GHES 3.3+, so articles available on GHAE and earlier GHES hidden to hide the learning track dependabot_security_updates: title: '获取拉取请求以更新您的漏洞依赖项' description: '设置 Dependabot 以在报告新漏洞时创建拉取请求。' guides: - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates + - /code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates + - /code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates - '{% ifversion fpt or ghec or ghes > 3.2 %}/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies{% endif %}' - '{% ifversion fpt or ghec or ghes > 3.2 %}/github/administering-a-repository/managing-repository-settings/managing-security-and-analysis-settings-for-your-repository{% endif %}' - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates + - /code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates - '{% ifversion fpt or ghec or ghes > 3.2 %}/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies{% endif %}' #Feature available only on dotcom and GHES 3.3+ dependency_version_updates: title: '保持更新依赖项' description: '使用 Dependabot 检查新版本并创建拉取请求来更新您的依赖关系。' guides: - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors + - /code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates + - /code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates + - /code-security/dependabot/dependabot-version-updates/customizing-dependency-updates + - /code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + - /code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot + - /code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions + - /code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates + - /code-security/dependabot/working-with-dependabot/managing-encrypted-secrets-for-dependabot + - /code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates + - /code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors #Feature available in GHEC, GHES 3.0 up, and GHAE. Feature limited on FPT so hidden there. secret_scanning: title: '扫描密码' diff --git a/translations/zh-CN/data/product-examples/code-security/code-examples.yml b/translations/zh-CN/data/product-examples/code-security/code-examples.yml index 3d3471e16870..cd1da9f0ad50 100644 --- a/translations/zh-CN/data/product-examples/code-security/code-examples.yml +++ b/translations/zh-CN/data/product-examples/code-security/code-examples.yml @@ -24,7 +24,7 @@ #Security policies title: Microsoft security policy template description: 示例安全策略 - href: https://github.com/microsoft/repo-templates/blob/main/shared/SECURITY.md + href: /microsoft/repo-templates/blob/main/shared/SECURITY.md tags: - 安全策略 - diff --git a/translations/zh-CN/data/reusables/code-scanning/alert-default-branch.md b/translations/zh-CN/data/reusables/code-scanning/alert-default-branch.md new file mode 100644 index 000000000000..c6a6029e70d5 --- /dev/null +++ b/translations/zh-CN/data/reusables/code-scanning/alert-default-branch.md @@ -0,0 +1 @@ +The status and details on the alert page only reflect the state of the alert on the default branch of the repository, even if the alert exists in other branches. You can see the status of the alert on non-default branches in the **Affected branches** section on the right-hand side of the alert page. If an alert doesn't exist in the default branch, the status of the alert will display as "in pull request" or "in branch" and will be colored grey. \ No newline at end of file diff --git a/translations/zh-CN/data/reusables/code-scanning/filter-non-default-branches.md b/translations/zh-CN/data/reusables/code-scanning/filter-non-default-branches.md new file mode 100644 index 000000000000..4df28a76d5b9 --- /dev/null +++ b/translations/zh-CN/data/reusables/code-scanning/filter-non-default-branches.md @@ -0,0 +1 @@ +Please note that if you have filtered for alerts on a non-default branch, but the same alerts exist on the default branch, the alert page for any given alert will still only reflect the alert's status on the default branch, even if that status conflicts with the status on a non-default branch. For example, an alert that appears in the "Open" list in the summary of alerts for `branch-x` could show a status of "Fixed" on the alert page, if the alert is already fixed on the default branch. You can view the status of the alert for the branch you filtered on in the **Affected branches** section on the right side of the alert page. \ No newline at end of file diff --git a/translations/zh-CN/data/reusables/dependabot/private-dependencies-note.md b/translations/zh-CN/data/reusables/dependabot/private-dependencies-note.md index 555ed25950d3..8a9fd456d6cc 100644 --- a/translations/zh-CN/data/reusables/dependabot/private-dependencies-note.md +++ b/translations/zh-CN/data/reusables/dependabot/private-dependencies-note.md @@ -1 +1 @@ -在运行安全性或版本更新时，有些生态系统必须能够解决来自其来源的所有依赖项，以验证版本更新是否成功。 如果清单或锁定文件包含任何私有依赖项，{% data variables.product.prodname_dependabot %} 必须能够访问这些依赖项所在的位置。 组织所有者可以授予 {% data variables.product.prodname_dependabot %} 访问包含同一个组织内项目依赖项的私有仓库. 更多信息请参阅“[管理组织的安全和分析设置](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private-dependencies)”。 您可以在仓库的 _dependabot.yml_ 配置文件中配置对私有注册表的访问。 更多信息请参阅“[依赖项更新的配置选项](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)。” +在运行安全性或版本更新时，有些生态系统必须能够解决来自其来源的所有依赖项，以验证版本更新是否成功。 如果清单或锁定文件包含任何私有依赖项，{% data variables.product.prodname_dependabot %} 必须能够访问这些依赖项所在的位置。 组织所有者可以授予 {% data variables.product.prodname_dependabot %} 访问包含同一个组织内项目依赖项的私有仓库. 更多信息请参阅“[管理组织的安全和分析设置](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private-dependencies)”。 您可以在仓库的 _dependabot.yml_ 配置文件中配置对私有注册表的访问。 For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)." diff --git a/translations/zh-CN/data/reusables/dependabot/result-discrepancy.md b/translations/zh-CN/data/reusables/dependabot/result-discrepancy.md new file mode 100644 index 000000000000..c3a50a1bc919 --- /dev/null +++ b/translations/zh-CN/data/reusables/dependabot/result-discrepancy.md @@ -0,0 +1 @@ +{% data variables.product.product_name %} 报告的依赖项检测结果可能不同于其他工具返回的结果。 这是有原因的，它有助于了解 {% data variables.product.prodname_dotcom %} 如何确定项目的依赖项。 diff --git a/translations/zh-CN/data/reusables/repositories/github-reviews-security-advisories.md b/translations/zh-CN/data/reusables/repositories/github-reviews-security-advisories.md index cf870a9e65d0..23dfa68dc7dc 100644 --- a/translations/zh-CN/data/reusables/repositories/github-reviews-security-advisories.md +++ b/translations/zh-CN/data/reusables/repositories/github-reviews-security-advisories.md @@ -1,3 +1,3 @@ {% data variables.product.prodname_dotcom %} will review each published security advisory, add it to the {% data variables.product.prodname_advisory_database %}, and may use the security advisory to send {% data variables.product.prodname_dependabot_alerts %} to affected repositories. If the security advisory comes from a fork, we'll only send an alert if the fork owns a package, published under a unique name, on a public package registry. This process can take up to 72 hours and {% data variables.product.prodname_dotcom %} may contact you for more information. -For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-dependabot-security-updates)." For more information about {% data variables.product.prodname_advisory_database %}, see "[Browsing security vulnerabilities in the {% data variables.product.prodname_advisory_database %}](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database)." +For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-dependabot-security-updates)." For more information about {% data variables.product.prodname_advisory_database %}, see "[Browsing security vulnerabilities in the {% data variables.product.prodname_advisory_database %}](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database)." diff --git a/translations/zh-CN/data/reusables/repositories/security-alert-delivery-options.md b/translations/zh-CN/data/reusables/repositories/security-alert-delivery-options.md index 4b1b8c82a209..8172cc2c1694 100644 --- a/translations/zh-CN/data/reusables/repositories/security-alert-delivery-options.md +++ b/translations/zh-CN/data/reusables/repositories/security-alert-delivery-options.md @@ -1,4 +1,4 @@ {% ifversion not ghae %} 如果您的仓库具有受支持的依赖项清单 -{% ifversion fpt or ghec %}（并且对私有仓库设置了依赖图）{% endif %}，则只要 {% data variables.product.product_name %} 检测到仓库中易受攻击的依赖项，您就会收到每周摘要电子邮件。 您也可以在 {% data variables.product.product_name %} 界面中将安全警报配置为 web 通知、单个电子邮件通知、每日电子邮件摘要或警报。 更多信息请参阅“[关于易受攻击的依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 +{% ifversion fpt or ghec %}（并且对私有仓库设置了依赖图）{% endif %}，则只要 {% data variables.product.product_name %} 检测到仓库中易受攻击的依赖项，您就会收到每周摘要电子邮件。 您也可以在 {% data variables.product.product_name %} 界面中将安全警报配置为 web 通知、单个电子邮件通知、每日电子邮件摘要或警报。 更多信息请参阅“[关于 {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)”。 {% endif %} diff --git a/translations/zh-CN/data/reusables/rest-reference/deployments/keys.md b/translations/zh-CN/data/reusables/rest-reference/deploy_keys/deploy_keys.md similarity index 94% rename from translations/zh-CN/data/reusables/rest-reference/deployments/keys.md rename to translations/zh-CN/data/reusables/rest-reference/deploy_keys/deploy_keys.md index 7ae7efa109c1..7a0ca8693daa 100644 --- a/translations/zh-CN/data/reusables/rest-reference/deployments/keys.md +++ b/translations/zh-CN/data/reusables/rest-reference/deploy_keys/deploy_keys.md @@ -1,5 +1,3 @@ -## 部署密钥 - {% data reusables.repositories.deploy-keys %} 部署密钥可以使用以下 API 端点进行设置，也可以使用 GitHub 进行设置。 要了解如何在 GitHub 中设置部署密钥，请参阅“[管理部署密钥](/developers/overview/managing-deploy-keys)”。 \ No newline at end of file diff --git a/translations/zh-CN/data/reusables/webhooks/repository_vulnerability_alert_short_desc.md b/translations/zh-CN/data/reusables/webhooks/repository_vulnerability_alert_short_desc.md index ad2466a83ef1..77b05afdbd89 100644 --- a/translations/zh-CN/data/reusables/webhooks/repository_vulnerability_alert_short_desc.md +++ b/translations/zh-CN/data/reusables/webhooks/repository_vulnerability_alert_short_desc.md @@ -1 +1 @@ -与仓库中的安全漏洞警报相关的活动。 {% data reusables.webhooks.action_type_desc %} 更多信息请参阅“[关于易受攻击的依赖项的警报](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)”。 +与仓库中的安全漏洞警报相关的活动。 {% data reusables.webhooks.action_type_desc %} For more information, see the "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)". From c050d0f0d16c2bcaa255417eff19e4e84d33c636 Mon Sep 17 00:00:00 2001 From: docubot <67483024+docubot@users.noreply.github.com> Date: Fri, 18 Mar 2022 14:40:23 -0700 Subject: [PATCH 2/2] New translation batch for ja (#26329) * Add crowdin translations * Run script/i18n/homogenize-frontmatter.js * Run script/i18n/lint-translation-files.js --check parsing * Run script/i18n/lint-translation-files.js --check rendering * run script/i18n/reset-files-with-broken-liquid-tags.js --language=ja * run script/i18n/reset-known-broken-translation-files.js * Check in ja CSV report --- .../configuring-notifications.md | 2 +- .../managing-notifications-from-your-inbox.md | 4 +- ...analysis-settings-for-your-user-account.md | 4 +- ...on-levels-for-a-user-account-repository.md | 2 +- .../security-guides/encrypted-secrets.md | 4 + .../workflow-syntax-for-github-actions.md | 27 ++- ...ub-advanced-security-in-your-enterprise.md | 2 +- ...enabling-dependabot-for-your-enterprise.md | 4 +- .../about-code-scanning-alerts.md | 8 + ...ode-scanning-alerts-for-your-repository.md | 26 ++- ...nning-alerts-in-issues-using-task-lists.md | 11 +- ...g-code-scanning-alerts-in-pull-requests.md | 9 +- .../about-dependabot-alerts.md} | 7 +- ...ilities-in-the-github-advisory-database.md | 5 +- ...ng-notifications-for-dependabot-alerts.md} | 9 +- ...isories-in-the-github-advisory-database.md | 1 + .../dependabot/dependabot-alerts/index.md | 24 +++ ...viewing-and-updating-dependabot-alerts.md} | 11 +- .../about-dependabot-security-updates.md | 7 +- ...configuring-dependabot-security-updates.md | 3 +- .../dependabot-security-updates/index.md | 20 +++ .../about-dependabot-version-updates.md | 7 +- ...on-options-for-the-dependabot.yml-file.md} | 26 +-- ...configuring-dependabot-version-updates.md} | 9 +- .../customizing-dependency-updates.md | 5 +- .../dependabot-version-updates/index.md | 26 +++ ...ndencies-configured-for-version-updates.md | 3 +- .../content/code-security/dependabot/index.md | 23 +++ ...tomating-dependabot-with-github-actions.md | 4 +- .../working-with-dependabot/index.md | 24 +++ ...your-actions-up-to-date-with-dependabot.md | 5 +- ...naging-encrypted-secrets-for-dependabot.md | 3 +- ...ng-pull-requests-for-dependency-updates.md | 5 +- .../troubleshooting-dependabot-errors.md | 12 +- ...he-detection-of-vulnerable-dependencies.md | 61 ++----- .../github-security-features.md | 4 +- .../securing-your-organization.md | 6 +- .../securing-your-repository.md | 6 +- .../ja-JP/content/code-security/guides.md | 1 - .../ja-JP/content/code-security/index.md | 1 + .../about-the-security-overview.md | 16 +- .../supply-chain-security/index.md | 2 - .../index.md | 29 ---- .../about-managing-vulnerable-dependencies.md | 46 ------ .../index.md | 36 ---- .../about-dependency-review.md | 2 +- .../about-supply-chain-security.md | 156 ++++++++++++++++++ .../about-the-dependency-graph.md | 4 +- ...loring-the-dependencies-of-a-repository.md | 9 +- .../index.md | 6 +- .../troubleshooting-the-dependency-graph.md | 62 +++++++ ...ating-a-github-app-using-url-parameters.md | 38 ++--- .../webhooks/webhook-events-and-payloads.md | 2 +- .../about-githubs-use-of-your-data.md | 4 +- ...se-settings-for-your-private-repository.md | 4 +- ...-up-a-trial-of-github-enterprise-server.md | 2 +- .../creating-and-highlighting-code-blocks.md | 3 +- .../creating-diagrams.md | 127 +++++++++++++- ...analysis-settings-for-your-organization.md | 7 +- ...ing-the-audit-log-for-your-organization.md | 4 +- .../about-permissions-for-github-packages.md | 2 +- .../working-with-the-rubygems-registry.md | 2 +- ...r-github-pages-site-locally-with-jekyll.md | 6 + ...anding-connections-between-repositories.md | 2 +- .../working-with-non-code-files.md | 57 ++++++- .../content/rest/reference/deploy_keys.md | 17 ++ .../content/rest/reference/deployments.md | 2 +- .../ja-JP/content/rest/reference/index.md | 1 + translations/ja-JP/data/features/mermaid.yml | 6 +- .../data/learning-tracks/code-security.yml | 38 ++--- .../code-security/code-examples.yml | 2 +- .../code-scanning/alert-default-branch.md | 1 + .../filter-non-default-branches.md | 1 + .../dependabot/private-dependencies-note.md | 2 +- .../dependabot/result-discrepancy.md | 1 + .../github-reviews-security-advisories.md | 2 +- .../security-alert-delivery-options.md | 2 +- .../keys.md => deploy_keys/deploy_keys.md} | 2 - ...pository_vulnerability_alert_short_desc.md | 2 +- translations/log/ja-resets.csv | 10 +- 80 files changed, 815 insertions(+), 323 deletions(-) rename translations/ja-JP/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md => dependabot/dependabot-alerts/about-dependabot-alerts.md} (94%) rename translations/ja-JP/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/dependabot-alerts}/browsing-security-vulnerabilities-in-the-github-advisory-database.md (94%) rename translations/ja-JP/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies.md => dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts.md} (88%) rename translations/ja-JP/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/dependabot-alerts}/editing-security-advisories-in-the-github-advisory-database.md (94%) create mode 100644 translations/ja-JP/content/code-security/dependabot/dependabot-alerts/index.md rename translations/ja-JP/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository.md => dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts.md} (94%) rename translations/ja-JP/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/dependabot-security-updates}/about-dependabot-security-updates.md (89%) rename translations/ja-JP/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/dependabot-security-updates}/configuring-dependabot-security-updates.md (95%) create mode 100644 translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/index.md rename translations/ja-JP/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/dependabot-version-updates}/about-dependabot-version-updates.md (91%) rename translations/ja-JP/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md => dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md} (95%) rename translations/ja-JP/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates.md => dependabot/dependabot-version-updates/configuring-dependabot-version-updates.md} (93%) rename translations/ja-JP/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/dependabot-version-updates}/customizing-dependency-updates.md (93%) create mode 100644 translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/index.md rename translations/ja-JP/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/dependabot-version-updates}/listing-dependencies-configured-for-version-updates.md (85%) create mode 100644 translations/ja-JP/content/code-security/dependabot/index.md rename translations/ja-JP/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/working-with-dependabot}/automating-dependabot-with-github-actions.md (98%) create mode 100644 translations/ja-JP/content/code-security/dependabot/working-with-dependabot/index.md rename translations/ja-JP/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/working-with-dependabot}/keeping-your-actions-up-to-date-with-dependabot.md (88%) rename translations/ja-JP/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/working-with-dependabot}/managing-encrypted-secrets-for-dependabot.md (95%) rename translations/ja-JP/content/code-security/{supply-chain-security/keeping-your-dependencies-updated-automatically => dependabot/working-with-dependabot}/managing-pull-requests-for-dependency-updates.md (93%) rename translations/ja-JP/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/working-with-dependabot}/troubleshooting-dependabot-errors.md (92%) rename translations/ja-JP/content/code-security/{supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies => dependabot/working-with-dependabot}/troubleshooting-the-detection-of-vulnerable-dependencies.md (70%) delete mode 100644 translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/index.md delete mode 100644 translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies.md delete mode 100644 translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/index.md create mode 100644 translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md create mode 100644 translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md create mode 100644 translations/ja-JP/content/rest/reference/deploy_keys.md create mode 100644 translations/ja-JP/data/reusables/code-scanning/alert-default-branch.md create mode 100644 translations/ja-JP/data/reusables/code-scanning/filter-non-default-branches.md create mode 100644 translations/ja-JP/data/reusables/dependabot/result-discrepancy.md rename translations/ja-JP/data/reusables/rest-reference/{deployments/keys.md => deploy_keys/deploy_keys.md} (94%) diff --git a/translations/ja-JP/content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md b/translations/ja-JP/content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md index 286b7b089f5f..066ef4eb9706 100644 --- a/translations/ja-JP/content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md +++ b/translations/ja-JP/content/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications.md @@ -134,7 +134,7 @@ Email notifications from {% data variables.product.product_location %} contain t | `To` field | This field connects directly to the thread.{% ifversion not ghae %} If you reply to the email, you'll add a new comment to the conversation.{% endif %} | | `Cc` address | {% data variables.product.product_name %} will `Cc` you if you're subscribed to a conversation. The second `Cc` email address matches the notification reason. The suffix for these notification reasons is {% data variables.notifications.cc_address %}. The possible notification reasons are:
  • `assign`: You were assigned to an issue or pull request.
  • `author`: You created an issue or pull request.
  • `ci_activity`: A {% data variables.product.prodname_actions %} workflow run that you triggered was completed.
  • `comment`: You commented on an issue or pull request.
  • `manual`: There was an update to an issue or pull request you manually subscribed to.
  • `mention`: You were mentioned on an issue or pull request.
  • `push`: Someone committed to a pull request you're subscribed to.
  • `review_requested`: You or a team you're a member of was requested to review a pull request.
    • {% ifversion fpt or ghes or ghae-issue-4864 or ghec %}
  • `security_alert`: {% data variables.product.prodname_dotcom %} detected a vulnerability in a repository you receive alerts for.
    • {% endif %}
  • `state_change`: An issue or pull request you're subscribed to was either closed or opened.
  • `subscribed`: There was an update in a repository you're watching.
  • `team_mention`: A team you belong to was mentioned on an issue or pull request.
  • `your_activity`: You opened, commented on, or closed an issue or pull request.
| | `mailing list` field | This field identifies the name of the repository and its owner. The format of this address is always `..{% data variables.command_line.backticks %}`. |{% ifversion fpt or ghes or ghae-issue-4864 or ghec %} -| `X-GitHub-Severity` field | {% data reusables.repositories.security-alerts-x-github-severity %} The possible severity levels are:
  • `low`
  • `moderate`
  • `high`
  • `critical`
For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." |{% endif %} +| `X-GitHub-Severity` field | {% data reusables.repositories.security-alerts-x-github-severity %} The possible severity levels are:
  • `low`
  • `moderate`
  • `high`
  • `critical`
For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." |{% endif %} ## Choosing your notification settings diff --git a/translations/ja-JP/content/account-and-profile/managing-subscriptions-and-notifications-on-github/viewing-and-triaging-notifications/managing-notifications-from-your-inbox.md b/translations/ja-JP/content/account-and-profile/managing-subscriptions-and-notifications-on-github/viewing-and-triaging-notifications/managing-notifications-from-your-inbox.md index 19a4dad76142..aacbf1d864d9 100644 --- a/translations/ja-JP/content/account-and-profile/managing-subscriptions-and-notifications-on-github/viewing-and-triaging-notifications/managing-notifications-from-your-inbox.md +++ b/translations/ja-JP/content/account-and-profile/managing-subscriptions-and-notifications-on-github/viewing-and-triaging-notifications/managing-notifications-from-your-inbox.md @@ -174,7 +174,7 @@ If you use {% data variables.product.prodname_dependabot %} to keep your depende - `reason:security_alert` は {% data variables.product.prodname_dependabot_alerts %} とセキュリティアップデートのプルリクエストの通知を表示します。 - `author:app/dependabot` は {% data variables.product.prodname_dependabot %} によって生成された通知を表示します。 これには、{% data variables.product.prodname_dependabot_alerts %}、セキュリティアップデートのプルリクエスト、およびバージョン更新のプルリクエストが含まれます。 -For more information about {% data variables.product.prodname_dependabot %}, see "[About managing vulnerable dependencies](/github/managing-security-vulnerabilities/about-managing-vulnerable-dependencies)." +{% data variables.product.prodname_dependabot %} の詳細については、「[{% data variables.product.prodname_dependabot_alerts %} について](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)」を参照してください。 {% endif %} {% ifversion ghes < 3.3 or ghae-issue-4864 %} @@ -183,7 +183,7 @@ If you use {% data variables.product.prodname_dependabot %} to tell you about vu - `is:repository_vulnerability_alert` - `reason:security_alert` -{% data variables.product.prodname_dependabot %} に関する詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 +{% data variables.product.prodname_dependabot %} の詳細については、「[{% data variables.product.prodname_dependabot_alerts %} について](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 {% endif %} {% endif %} diff --git a/translations/ja-JP/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account.md b/translations/ja-JP/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account.md index ae9fcfa48b24..805abb17d12c 100644 --- a/translations/ja-JP/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account.md +++ b/translations/ja-JP/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account.md @@ -31,7 +31,7 @@ For an overview of repository-level security, see "[Securing your repository](/c {% data reusables.user-settings.access_settings %} {% data reusables.user-settings.security-analysis %} -3. Under "Code security and analysis", to the right of the feature, click **Disable all** or **Enable all**. +3. "Code security and analysis（コードのセキュリティ及び分析）"の下で、機能の右にある**Disable all（すべて無効化）**もしくは**Enable all（すべて有効化）**をクリックしてください。 {% ifversion ghes > 3.2 %}!["Enable all" or "Disable all" button for "Configure security and analysis" features](/assets/images/enterprise/3.3/settings/security-and-analysis-disable-or-enable-all.png){% else %}!["Enable all" or "Disable all" button for "Configure security and analysis" features](/assets/images/help/settings/security-and-analysis-disable-or-enable-all.png){% endif %} 6. Optionally, enable the feature by default for new repositories that you own. {% ifversion ghes > 3.2 %}!["Enable by default" option for new repositories](/assets/images/enterprise/3.3/settings/security-and-analysis-enable-by-default-in-modal.png){% else %}!["Enable by default" option for new repositories](/assets/images/help/settings/security-and-analysis-enable-by-default-in-modal.png){% endif %} @@ -50,5 +50,5 @@ For an overview of repository-level security, see "[Securing your repository](/c ## 参考リンク - [依存関係グラフについて](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph) -- [プロジェクトの依存関係にある脆弱性を管理する](/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies) +- 「[{% data variables.product.prodname_dependabot_alerts %} について](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)」 - [依存関係を自動的に更新する](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically) diff --git a/translations/ja-JP/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/permission-levels-for-a-user-account-repository.md b/translations/ja-JP/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/permission-levels-for-a-user-account-repository.md index fadc98773a40..e9b90a2b1092 100644 --- a/translations/ja-JP/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/permission-levels-for-a-user-account-repository.md +++ b/translations/ja-JP/content/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/permission-levels-for-a-user-account-repository.md @@ -45,7 +45,7 @@ The repository owner has full control of the repository. In addition to the acti | Customize the repository's social media preview | "[Customizing your repository's social media preview](/github/administering-a-repository/customizing-your-repositorys-social-media-preview)" | | Create a template from the repository | "[Creating a template repository](/github/creating-cloning-and-archiving-repositories/creating-a-template-repository)" |{% ifversion fpt or ghes or ghae-issue-4864 or ghec %} | Control access to {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies | "[Managing security and analysis settings for your repository](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)" |{% endif %}{% ifversion fpt or ghec %} -| Dismiss {% data variables.product.prodname_dependabot_alerts %} in the repository | "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" | +| Dismiss {% data variables.product.prodname_dependabot_alerts %} in the repository | "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" | | Manage data use for a private repository | "[Managing data use settings for your private repository](/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository)"|{% endif %} | Define code owners for the repository | "[About code owners](/github/creating-cloning-and-archiving-repositories/about-code-owners)" | | Archive the repository | "[Archiving repositories](/repositories/archiving-a-github-repository/archiving-repositories)" |{% ifversion fpt or ghec %} diff --git a/translations/ja-JP/content/actions/security-guides/encrypted-secrets.md b/translations/ja-JP/content/actions/security-guides/encrypted-secrets.md index 6694de713487..6682ef4fb2ae 100644 --- a/translations/ja-JP/content/actions/security-guides/encrypted-secrets.md +++ b/translations/ja-JP/content/actions/security-guides/encrypted-secrets.md @@ -226,6 +226,10 @@ steps: ``` {% endraw %} +Secrets cannot be directly referenced in `if:` conditionals. Instead, consider setting secrets as job-level environment variables, then referencing the environment variables to conditionally run steps in the job. For more information, see "[Context availability](/actions/learn-github-actions/contexts#context-availability)" and [`jobs..steps[*].if`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsif). + +If a secret has not been set, the return value of an expression referencing the secret (such as {% raw %}`${{ secrets.SuperSecret }}`{% endraw %} in the example) will be an empty string. + 可能であれば、コマンドラインからプロセス間でシークレットを渡すのは避けてください。 Command-line processes may be visible to other users (using the `ps` command) or captured by [security audit events](https://docs.microsoft.com/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing). シークレットの保護のために、環境変数、`STDIN`、あるいはターゲットのプロセスがサポートしている他の仕組みの利用を考慮してください。 コマンドラインからシークレットを渡さなければならない場合は、それらを適切なルールでクオート内に収めてください。 シークレットは、意図せずシェルに影響するかもしれない特殊なキャラクターをしばしば含みます。 それらの特殊なキャラクターをエスケープするには、環境変数をクオートで囲ってください。 例: diff --git a/translations/ja-JP/content/actions/using-workflows/workflow-syntax-for-github-actions.md b/translations/ja-JP/content/actions/using-workflows/workflow-syntax-for-github-actions.md index e2e93444af64..beb0751474c0 100644 --- a/translations/ja-JP/content/actions/using-workflows/workflow-syntax-for-github-actions.md +++ b/translations/ja-JP/content/actions/using-workflows/workflow-syntax-for-github-actions.md @@ -342,6 +342,31 @@ steps: uses: actions/heroku@1.0.0 ``` +#### Example: Using secrets + +Secrets cannot be directly referenced in `if:` conditionals. Instead, consider setting secrets as job-level environment variables, then referencing the environment variables to conditionally run steps in the job. + +If a secret has not been set, the return value of an expression referencing the secret (such as {% raw %}`${{ secrets.SuperSecret }}`{% endraw %} in the example) will be an empty string. + +{% raw %} +```yaml +name: Run a step if a secret has been set +on: push +jobs: + my-jobname: + runs-on: ubuntu-latest + env: + super_secret: ${{ secrets.SuperSecret }} + steps: + - if: ${{ env.super_secret != '' }} + run: echo 'This step will only run if the secret has a value set.' + - if: ${{ env.super_secret == '' }} + run: echo 'This step will only run if the secret does not have a value set.' +``` +{% endraw %} + +For more information, see "[Context availability](/actions/learn-github-actions/contexts#context-availability)" and "[Encrypted secrets](/actions/security-guides/encrypted-secrets)." + ### `jobs..steps[*].name` {% data variables.product.prodname_dotcom %}で表示されるステップの名前。 @@ -521,7 +546,7 @@ jobs: ### `jobs..steps[*].shell` -`shell`キーワードを使用して、ランナーのオペレーティングシステムのデフォルトシェルを上書きできます。 組み込みの`shell`キーワードを使用するか、カスタムセットのシェルオプションを定義することができます。 The shell command that is run internally executes a temporary file that contains the commands specified in the `run` keyword. +`shell`キーワードを使用して、ランナーのオペレーティングシステムのデフォルトシェルの設定を上書きできます。 組み込みの`shell`キーワードを使用するか、カスタムセットのシェルオプションを定義することができます。 The shell command that is run internally executes a temporary file that contains the commands specified in the `run` keyword. | サポートされているプラットフォーム | `shell` パラメータ | 説明 | 内部で実行されるコマンド | | ----------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | diff --git a/translations/ja-JP/content/admin/code-security/managing-github-advanced-security-for-your-enterprise/deploying-github-advanced-security-in-your-enterprise.md b/translations/ja-JP/content/admin/code-security/managing-github-advanced-security-for-your-enterprise/deploying-github-advanced-security-in-your-enterprise.md index 8c12c9efcabc..e5b16446704a 100644 --- a/translations/ja-JP/content/admin/code-security/managing-github-advanced-security-for-your-enterprise/deploying-github-advanced-security-in-your-enterprise.md +++ b/translations/ja-JP/content/admin/code-security/managing-github-advanced-security-for-your-enterprise/deploying-github-advanced-security-in-your-enterprise.md @@ -271,7 +271,7 @@ GitHub helps you avoid using third-party software that contains known vulnerabil | Dependency Management Tool | 説明 | | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Dependabot Alerts | You can track your repository's dependencies and receive Dependabot alerts when your enterprise detects vulnerable dependencies. 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)」を参照してください。 | +| Dependabot Alerts | You can track your repository's dependencies and receive Dependabot alerts when your enterprise detects vulnerable dependencies. 詳しい情報については、「[{% data variables.product.prodname_dependabot_alerts %} について](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)」を参照してください。 | | Dependency Graph | 依存関係グラフは、リポジトリに保存されているマニフェストファイルおよびロックファイルのサマリーです。 コードベースが依存するエコシステムとパッケージ（依存関係）、およびプロジェクトに依存するリポジトリとパッケージ（依存関係）が表示されます。 詳しい情報については、「[依存関係グラフについて](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)」を参照してください。 |{% ifversion ghes > 3.1 or ghec %} | Dependency Review | プルリクエストに依存関係への変更が含まれている場合は、変更内容の概要と、依存関係に既知の脆弱性があるかどうかを確認できます。 For more information, see "[About dependency review](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review)" or "[Reviewing Dependency Changes in a Pull Request](/github/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request)." |{% endif %} {% ifversion ghec or ghes > 3.2 %} | Dependabot Security Updates | Dependabot can fix vulnerable dependencies for you by raising pull requests with security updates. For more information, see "[About Dependabot security updates](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)." | diff --git a/translations/ja-JP/content/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise.md b/translations/ja-JP/content/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise.md index c6d2a08abe47..d5d9c480a825 100644 --- a/translations/ja-JP/content/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise.md +++ b/translations/ja-JP/content/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise.md @@ -49,7 +49,7 @@ After you enable {% data variables.product.prodname_dependabot_alerts %} for you When {% data variables.product.product_location %} receives information about a vulnerability, it identifies repositories in {% data variables.product.product_location %} that use the affected version of the dependency and generates {% data variables.product.prodname_dependabot_alerts %}. You can choose whether or not to notify users automatically about new {% data variables.product.prodname_dependabot_alerts %}. -For repositories with {% data variables.product.prodname_dependabot_alerts %} enabled, scanning is triggered on any push to the default branch that contains a manifest file or lock file. Additionally, when a new vulnerability record is added to {% data variables.product.product_location %}, {% data variables.product.product_name %} scans all existing repositories on {% data variables.product.product_location %} and generates alerts for any repository that is vulnerable. 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 +For repositories with {% data variables.product.prodname_dependabot_alerts %} enabled, scanning is triggered on any push to the default branch that contains a manifest file or lock file. Additionally, when a new vulnerability record is added to {% data variables.product.product_location %}, {% data variables.product.product_name %} scans all existing repositories on {% data variables.product.product_location %} and generates alerts for any repository that is vulnerable. 詳しい情報については、「[{% data variables.product.prodname_dependabot_alerts %} について](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 {% ifversion ghes > 3.2 %} ### {% data variables.product.prodname_dependabot_updates %}について @@ -67,7 +67,7 @@ After you enable {% data variables.product.prodname_dependabot_alerts %}, you ca With {% data variables.product.prodname_dependabot_updates %}, {% data variables.product.company_short %} automatically creates pull requests to update dependencies in two ways. - **{% data variables.product.prodname_dependabot_version_updates %}**: Users add a {% data variables.product.prodname_dependabot %} configuration file to the repository to enable {% data variables.product.prodname_dependabot %} to create pull requests when a new version of a tracked dependency is released. 詳しい情報については「[{% data variables.product.prodname_dependabot_version_updates %}について](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates)」を参照してください。 -- **{% data variables.product.prodname_dependabot_security_updates %}**: Users toggle a repository setting to enable {% data variables.product.prodname_dependabot %} to create pull requests when {% data variables.product.prodname_dotcom %} detects a vulnerability in one of the dependencies of the dependency graph for the repository. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)." +- **{% data variables.product.prodname_dependabot_security_updates %}**: Users toggle a repository setting to enable {% data variables.product.prodname_dependabot %} to create pull requests when {% data variables.product.prodname_dotcom %} detects a vulnerability in one of the dependencies of the dependency graph for the repository. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)." {% endif %} ## {% data variables.product.prodname_dependabot_alerts %} の有効化 diff --git a/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts.md b/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts.md index 3d628cfa43ae..60fc384867e9 100644 --- a/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts.md +++ b/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts.md @@ -27,7 +27,15 @@ By default, {% data variables.product.prodname_code_scanning %} analyzes your co Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the alert severity{% ifversion fpt or ghes > 3.1 or ghae or ghec %}, security severity,{% endif %} and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by {% data variables.product.prodname_codeql %} analysis, you will also see information on how to fix the problem. +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} +{% data reusables.code-scanning.alert-default-branch %} +{% endif %} + +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![Example alert from {% data variables.product.prodname_code_scanning %}](/assets/images/help/repository/code-scanning-alert.png) +{% else %} +![Example alert from {% data variables.product.prodname_code_scanning %}](/assets/images/enterprise/3.4/repository/code-scanning-alert.png) +{% endif %} If you set up {% data variables.product.prodname_code_scanning %} using {% data variables.product.prodname_codeql %}, you can also find data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information. diff --git a/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository.md b/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository.md index d6ae1c809791..c8f214deaeed 100644 --- a/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository.md +++ b/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository.md @@ -46,9 +46,16 @@ By default, the code scanning alerts page is filtered to show alerts for the def {% else %} ![List of alerts from {% data variables.product.prodname_code_scanning %}](/assets/images/enterprise/3.1/help/repository/code-scanning-click-alert.png) {% endif %} +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} + {% data reusables.code-scanning.alert-default-branch %} + ![The "Affected branches" section in an alert](/assets/images/help/repository/code-scanning-affected-branches.png){% endif %} 1. Optionally, if the alert highlights a problem with data flow, click **Show paths** to display the path from the data source to the sink where it's used. + {% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![The "Show paths" link on an alert](/assets/images/help/repository/code-scanning-show-paths.png) -1. Alerts from {% data variables.product.prodname_codeql %} analysis include a description of the problem. Click **Show more** for guidance on how to fix your code. + {% else %} + ![The "Show paths" link on an alert](/assets/images/enterprise/3.4/repository/code-scanning-show-paths.png) + {% endif %} +2. Alerts from {% data variables.product.prodname_codeql %} analysis include a description of the problem. Click **Show more** for guidance on how to fix your code. ![Details for an alert](/assets/images/help/repository/code-scanning-alert-details.png) For more information, see "[About {% data variables.product.prodname_code_scanning %} alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts)." @@ -80,6 +87,10 @@ The benefit of using keyword filters is that only values with results are shown If you enter multiple filters, the view will show alerts matching _all_ these filters. For example, `is:closed severity:high branch:main` will only display closed high-severity alerts that are present on the `main` branch. The exception is filters relating to refs (`ref`, `branch` and `pr`): `is:open branch:main branch:next` will show you open alerts from both the `main` branch and the `next` branch. +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} +{% data reusables.code-scanning.filter-non-default-branches %} +{% endif %} + {% ifversion fpt or ghes > 3.3 or ghec %} You can prefix the `tag` filter with `-` to exclude results with that tag. For example, `-tag:style` only shows alerts that do not have the `style` tag{% if codeql-ml-queries %} and `-tag:experimental` will omit all experimental alerts. For more information, see "[About {% data variables.product.prodname_code_scanning %} alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts#about-experimental-alerts)."{% else %}.{% endif %} @@ -96,10 +107,12 @@ You can use the "Only alerts in application code" filter or `autofilter:true` ke You can search the list of alerts. This is useful if there is a large number of alerts in your repository, or if you don't know the exact name for an alert for example. {% data variables.product.product_name %} performs the free text search across: - The name of the alert -- The alert description - The alert details (this also includes the information hidden from view by default in the **Show more** collapsible section) - + {% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![The alert information used in searches](/assets/images/help/repository/code-scanning-free-text-search-areas.png) + {% else %} + ![The alert information used in searches](/assets/images/enterprise/3.4/repository/code-scanning-free-text-search-areas.png) + {% endif %} | Supported search | Syntax example | Results | | ---- | ---- | ---- | @@ -113,7 +126,7 @@ You can search the list of alerts. This is useful if there is a large number of **Tips:** - The multiple word search is equivalent to an OR search. -- The AND search will return results where the search terms are found _anywhere_, in any order in the alert name, description, or details. +- The AND search will return results where the search terms are found _anywhere_, in any order in the alert name or details. {% endtip %} @@ -143,7 +156,7 @@ If you have write permission for a repository, you can view fixed alerts by view You can use{% ifversion fpt or ghes > 3.1 or ghae or ghec %} the free text search or{% endif %} the filters to display a subset of alerts and then in turn mark all matching alerts as closed. -Alerts may be fixed in one branch but not in another. You can use the "Branch" drop-down menu, on the summary of alerts, to check whether an alert is fixed in a particular branch. +Alerts may be fixed in one branch but not in another. You can use the "Branch" filter, on the summary of alerts, to check whether an alert is fixed in a particular branch. {% ifversion fpt or ghes > 3.1 or ghae or ghec %} ![Filtering alerts by branch](/assets/images/help/repository/code-scanning-branch-filter.png) @@ -151,6 +164,9 @@ Alerts may be fixed in one branch but not in another. You can use the "Branch" d ![Filtering alerts by branch](/assets/images/enterprise/3.1/help/repository/code-scanning-branch-filter.png) {% endif %} +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} +{% data reusables.code-scanning.filter-non-default-branches %} +{% endif %} ## Dismissing or deleting alerts There are two ways of closing an alert. You can fix the problem in the code, or you can dismiss the alert. Alternatively, if you have admin permissions for the repository, you can delete alerts. Deleting alerts is useful in situations where you have set up a {% data variables.product.prodname_code_scanning %} tool and then decided to remove it, or where you have configured {% data variables.product.prodname_codeql %} analysis with a larger set of queries than you want to continue using, and you've then removed some queries from the tool. In both cases, deleting alerts allows you to clean up your {% data variables.product.prodname_code_scanning %} results. You can delete alerts from the summary list within the **Security** tab. diff --git a/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/tracking-code-scanning-alerts-in-issues-using-task-lists.md b/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/tracking-code-scanning-alerts-in-issues-using-task-lists.md index ef4ffcfa65e2..4c4bcf7cd9be 100644 --- a/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/tracking-code-scanning-alerts-in-issues-using-task-lists.md +++ b/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/tracking-code-scanning-alerts-in-issues-using-task-lists.md @@ -39,7 +39,11 @@ You can use more than one issue to track the same {% data variables.product.prod - A "tracked in" section will also show in the corresponding alert page. + {% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![Tracked in section on code scanning alert page](/assets/images/help/repository/code-scanning-alert-tracked-in-pill.png) + {% else %} + ![Tracked in section on code scanning alert page](/assets/images/enterprise/3.4/repository/code-scanning-alert-tracked-in-pill.png) + {% endif %} - On the tracking issue, {% data variables.product.prodname_dotcom %} displays a security badge icon in the task list and on the hovercard. @@ -64,7 +68,12 @@ The status of the tracked alert won't change if you change the checkbox state of {% data reusables.code-scanning.explore-alert %} 1. Optionally, to find the alert to track, you can use the free-text search or the drop-down menus to filter and locate the alert. 詳しい情報については、「[リポジトリの Code scanningアラートを管理する](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository#filtering-code-scanning-alerts)」を参照してください。 {% endif %} -1. Towards the top of the page, on the right side, click **Create issue**. ![Create a tracking issue for the code scanning alert](/assets/images/help/repository/code-scanning-create-issue-for-alert.png) +1. Towards the top of the page, on the right side, click **Create issue**. + {% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} + ![Create a tracking issue for the code scanning alert](/assets/images/help/repository/code-scanning-create-issue-for-alert.png) + {% else %} + ![Create a tracking issue for the code scanning alert](/assets/images/enterprise/3.4/repository/code-scanning-create-issue-for-alert.png) + {% endif %} {% data variables.product.prodname_dotcom %} automatically creates an issue to track the alert and adds the alert as a task list item. {% data variables.product.prodname_dotcom %} prepopulates the issue: - The title contains the name of the {% data variables.product.prodname_code_scanning %} alert. diff --git a/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md b/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md index 66ae7d484f3e..29eaaa3ea7f0 100644 --- a/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md +++ b/translations/ja-JP/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests.md @@ -74,10 +74,17 @@ If you have write permission for the repository, some annotations contain links To see more information about an alert, users with write permission can click the **Show more details** link shown in the annotation. This allows you to see all of the context and metadata provided by the tool in an alert view. In the example below, you can see tags showing the severity, type, and relevant common weakness enumerations (CWEs) for the problem. The view also shows which commit introduced the problem. +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} +{% data reusables.code-scanning.alert-default-branch %} +{% endif %} + In the detailed view for an alert, some {% data variables.product.prodname_code_scanning %} tools, like {% data variables.product.prodname_codeql %} analysis, also include a description of the problem and a **Show more** link for guidance on how to fix your code. +{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-6249 %} ![Alert description and link to show more information](/assets/images/help/repository/code-scanning-pr-alert.png) - +{% else %} +![Alert description and link to show more information](/assets/images/enterprise/3.4/repository/code-scanning-pr-alert.png) +{% endif %} ## Fixing an alert on your pull request Anyone with push access to a pull request can fix a {% data variables.product.prodname_code_scanning %} alert that's identified on that pull request. If you commit changes to the pull request this triggers a new run of the pull request checks. If your changes fix the problem, the alert is closed and the annotation removed. diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.md similarity index 94% rename from translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.md index 52b0aa9c647d..da996b60cc9c 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.md @@ -1,11 +1,12 @@ --- -title: About alerts for vulnerable dependencies +title: About Dependabot alerts intro: '{% data variables.product.product_name %} sends {% data variables.product.prodname_dependabot_alerts %} when we detect vulnerabilities affecting your repository.' redirect_from: - /articles/about-security-alerts-for-vulnerable-dependencies - /github/managing-security-vulnerabilities/about-security-alerts-for-vulnerable-dependencies - /github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies - /code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies versions: fpt: '*' ghes: '*' @@ -81,7 +82,7 @@ For repositories where {% data variables.product.prodname_dependabot_security_up ## Access to {% data variables.product.prodname_dependabot_alerts %} -You can see all of the alerts that affect a particular project{% ifversion fpt or ghec %} on the repository's Security tab or{% endif %} in the repository's dependency graph. For more information, see "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)." +You can see all of the alerts that affect a particular project{% ifversion fpt or ghec %} on the repository's Security tab or{% endif %} in the repository's dependency graph. For more information, see "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)." By default, we notify people with admin permissions in the affected repositories about new {% data variables.product.prodname_dependabot_alerts %}. {% ifversion fpt or ghec %}{% data variables.product.product_name %} never publicly discloses identified vulnerabilities for any repository. You can also make {% data variables.product.prodname_dependabot_alerts %} visible to additional people or teams working repositories that you own or have admin permissions for. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)." {% endif %} @@ -95,5 +96,5 @@ You can also see all the {% data variables.product.prodname_dependabot_alerts %} ## Further reading - "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)" -- "[Viewing and updating vulnerable dependencies in your repository](/articles/viewing-and-updating-vulnerable-dependencies-in-your-repository)"{% endif %} +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/articles/viewing-and-updating-vulnerable-dependencies-in-your-repository)"{% endif %} {% ifversion fpt or ghec %}- "[Privacy on {% data variables.product.prodname_dotcom %}](/get-started/privacy-on-github)"{% endif %} diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database.md b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/browsing-security-vulnerabilities-in-the-github-advisory-database.md similarity index 94% rename from translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-alerts/browsing-security-vulnerabilities-in-the-github-advisory-database.md index 7be2222f6583..f1ef00374bef 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/browsing-security-vulnerabilities-in-the-github-advisory-database.md @@ -6,6 +6,7 @@ miniTocMaxHeadingLevel: 3 redirect_from: - /github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database - /code-security/supply-chain-security/browsing-security-vulnerabilities-in-the-github-advisory-database + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database versions: fpt: '*' ghec: '*' @@ -36,7 +37,7 @@ The {% data variables.product.prodname_advisory_database %} contains a list of k We carefully review each advisory for validity. Each {% data variables.product.company_short %}-reviewed advisory has a full description, and contains both ecosystem and package information. -If you enable {% data variables.product.prodname_dependabot_alerts %} for your repositories, you are automatically notified when a new {% data variables.product.company_short %}-reviewed advisory affects packages you depend on. 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)」を参照してください。 +If you enable {% data variables.product.prodname_dependabot_alerts %} for your repositories, you are automatically notified when a new {% data variables.product.company_short %}-reviewed advisory affects packages you depend on. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." ### About unreviewed advisories @@ -107,7 +108,7 @@ You can suggest improvements to any advisory in the {% data variables.product.pr ## 脆弱性のあるリポジトリを表示する -For any {% data variables.product.company_short %}-reviewed advisory in the {% data variables.product.prodname_advisory_database %}, you can see which of your repositories are affected by that security vulnerability. 脆弱性のあるリポジトリを確認するには、そのリポジトリの {% data variables.product.prodname_dependabot_alerts %} にアクセスできる必要があります。 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#access-to-dependabot-alerts)」を参照してください。 +For any {% data variables.product.company_short %}-reviewed advisory in the {% data variables.product.prodname_advisory_database %}, you can see which of your repositories are affected by that security vulnerability. 脆弱性のあるリポジトリを確認するには、そのリポジトリの {% data variables.product.prodname_dependabot_alerts %} にアクセスできる必要があります。 詳しい情報については「[{% data variables.product.prodname_dependabot_alerts %}について](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#access-to-dependabot-alerts)」を参照してください。 1. Https://github.com/advisories にアクセスします。 2. アドバイザリをクリックします。 diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies.md b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts.md similarity index 88% rename from translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts.md index 38aedd5f8ece..c7aa8fda69e0 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts.md @@ -1,10 +1,11 @@ --- -title: 脆弱性のある依存関係の通知を設定する -shortTitle: 通知を設定する +title: Configuring notifications for Dependabot alerts +shortTitle: Configure notifications intro: 'Optimize how you receive notifications about {% data variables.product.prodname_dependabot_alerts %}.' redirect_from: - /github/managing-security-vulnerabilities/configuring-notifications-for-vulnerable-dependencies - /code-security/supply-chain-security/configuring-notifications-for-vulnerable-dependencies + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies versions: fpt: '*' ghes: '*' @@ -51,7 +52,7 @@ When a new {% data variables.product.prodname_dependabot %} alert is detected, { {% note %} -**Note:** You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot_alerts %}. 詳しい情報については「[インボックスからの通知の管理](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#dependabot-custom-filters)」を参照してください。 +**Note:** You can filter your notifications on {% data variables.product.company_short %} to show {% data variables.product.prodname_dependabot_alerts %}. 詳しい情報については「[インボックスからの通知を管理する](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#dependabot-custom-filters)」を参照してください。 {% endnote %} @@ -59,7 +60,7 @@ When a new {% data variables.product.prodname_dependabot %} alert is detected, { ## 脆弱性のある依存関係の通知を減らす方法 -{% data variables.product.prodname_dependabot_alerts %}の通知をあまりに多く受け取ることが心配なら、週次のメールダイジェストにオプトインするか、{% data variables.product.prodname_dependabot_alerts %}を有効化したままで通知をオフにすることをおすすめします。 その場合でも、リポジトリのセキュリティタブで{% data variables.product.prodname_dependabot_alerts %}を確認することはできます。 詳細については、「[リポジトリ内の脆弱な依存関係を表示・更新する](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)」を参照してください。 +{% data variables.product.prodname_dependabot_alerts %}の通知をあまりに多く受け取ることが心配なら、週次のメールダイジェストにオプトインするか、{% data variables.product.prodname_dependabot_alerts %}を有効化したままで通知をオフにすることをおすすめします。 その場合でも、リポジトリのセキュリティタブで{% data variables.product.prodname_dependabot_alerts %}を確認することはできます。 For more information, see "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)." ## 参考リンク diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database.md b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/editing-security-advisories-in-the-github-advisory-database.md similarity index 94% rename from translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-alerts/editing-security-advisories-in-the-github-advisory-database.md index 5f75c903731c..7dbfd801814f 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/editing-security-advisories-in-the-github-advisory-database.md @@ -3,6 +3,7 @@ title: Editing security advisories in the GitHub Advisory Database intro: 'You can submit improvements to any advisory published in the {% data variables.product.prodname_advisory_database %}.' redirect_from: - /code-security/security-advisories/editing-security-advisories-in-the-github-advisory-database + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database versions: fpt: '*' ghec: '*' diff --git a/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/index.md b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/index.md new file mode 100644 index 000000000000..f5d51e64aa68 --- /dev/null +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/index.md @@ -0,0 +1,24 @@ +--- +title: Identifying vulnerabilities in your project's dependencies with Dependabot alerts +shortTitle: Dependabotアラート +intro: '{% data variables.product.prodname_dependabot %} generates {% data variables.product.prodname_dependabot_alerts %} when known vulnerabilites are detected in dependencies that your project uses.' +allowTitleToDifferFromFilename: true +versions: + fpt: '*' + ghes: '*' + ghae: issue-4864 + ghec: '*' +topics: + - Dependabot + - Alerts + - Vulnerabilities + - Repositories + - Dependencies +children: + - /browsing-security-vulnerabilities-in-the-github-advisory-database + - /editing-security-advisories-in-the-github-advisory-database + - /about-dependabot-alerts + - /viewing-and-updating-dependabot-alerts + - /configuring-notifications-for-dependabot-alerts +--- + diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository.md b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts.md similarity index 94% rename from translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts.md index c1e0d76330bc..a22458eebae1 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts.md @@ -1,12 +1,13 @@ --- -title: リポジトリ内の脆弱な依存関係を表示・更新する +title: Viewing and updating Dependabot alerts intro: '{% data variables.product.product_name %} がプロジェクト内の脆弱性のある依存関係を発見した場合は、それらをリポジトリの [Dependabot alerts] タブで確認できます。 その後、プロジェクトを更新してこの脆弱性を解決することができます。' redirect_from: - /articles/viewing-and-updating-vulnerable-dependencies-in-your-repository - /github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository - /code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository permissions: Repository administrators and organization owners can view and update dependencies. -shortTitle: View vulnerable dependencies +shortTitle: View Dependabot alerts versions: fpt: '*' ghes: '*' @@ -25,7 +26,7 @@ topics: {% data reusables.dependabot.beta-security-and-version-updates %} {% data reusables.dependabot.enterprise-enable-dependabot %} -Your repository's {% data variables.product.prodname_dependabot_alerts %} tab lists all open and closed {% data variables.product.prodname_dependabot_alerts %}{% ifversion fpt or ghec or ghes > 3.2 %} and corresponding {% data variables.product.prodname_dependabot_security_updates %}{% endif %}. You can{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-5638 %} filter alerts by package, ecosystem, or manifest. You can also{% endif %} sort the list of alerts, and you can click into specific alerts for more details. 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)」を参照してください。 +Your repository's {% data variables.product.prodname_dependabot_alerts %} tab lists all open and closed {% data variables.product.prodname_dependabot_alerts %}{% ifversion fpt or ghec or ghes > 3.2 %} and corresponding {% data variables.product.prodname_dependabot_security_updates %}{% endif %}. You can{% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-5638 %} filter alerts by package, ecosystem, or manifest. You can also{% endif %} sort the list of alerts, and you can click into specific alerts for more details. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." {% ifversion fpt or ghec or ghes > 3.2 %} {% data variables.product.prodname_dependabot_alerts %} と依存関係グラフを使用するリポジトリの自動セキュリティ更新を有効にすることができます。 詳しい情報については、「[{% data variables.product.prodname_dependabot_security_updates %} について](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)」を参照してください。 @@ -36,7 +37,7 @@ Your repository's {% data variables.product.prodname_dependabot_alerts %} tab li {% ifversion fpt or ghec or ghes > 3.2 %} ## リポジトリ内の脆弱性のある依存関係の更新について -コードベースが既知の脆弱性のある依存関係を使用していることを検出すると、{% data variables.product.product_name %} は {% data variables.product.prodname_dependabot_alerts %} を生成します。 {% data variables.product.prodname_dependabot_security_updates %} が有効になっているリポジトリの場合、{% data variables.product.product_name %} がデフォルトのブランチで脆弱性のある依存関係を検出すると、{% data variables.product.prodname_dependabot %} はそれを修正するためのプルリクエストを作成します。 Pull Requestは、脆弱性を回避するために必要最低限の安全なバージョンに依存関係をアップグレードします。 +コードベースが既知の脆弱性のある依存関係を使用していることを検出すると、{% data variables.product.product_name %} は {% data variables.product.prodname_dependabot_alerts %} を生成します。 {% data variables.product.prodname_dependabot_security_updates %} が有効になっているリポジトリの場合、{% data variables.product.product_name %} がデフォルトのブランチで脆弱性のある依存関係を検出すると、{% data variables.product.prodname_dependabot %} はそれを修正するためのプルリクエストを作成します。 プルリクエストは、脆弱性を回避するために必要最低限の安全なバージョンに依存関係をアップグレードします。 {% ifversion fpt or ghec or ghes > 3.4 or ghae-issue-5638 %}You can sort and filter {% data variables.product.prodname_dependabot_alerts %} with the dropdown menus in the {% data variables.product.prodname_dependabot_alerts %} tab or by typing filters as `key:value` pairs into the search bar. The available filters are repository (for example, `repo:my-repository`), package (for example, `package:django`), ecosystem (for example, `ecosystem:npm`), manifest (for example, `manifest:webwolf/pom.xml`), state (for example, `is:open`), and whether an advisory has a patch (for example, `has: patch`). @@ -98,7 +99,7 @@ Each {% data variables.product.prodname_dependabot %} alert has a unique numeric ## 参考リンク -- 「[脆弱性のある依存関係に対するアラートについて](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)」{% ifversion fpt or ghec or ghes > 3.2 %} +- "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"{% ifversion fpt or ghec or ghes > 3.2 %} - 「[{% data variables.product.prodname_dependabot_security_updates %}の設定](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates)」{% endif %} - 「[リポジトリのセキュリティおよび分析設定を管理する](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)」 - 「[脆弱性のある依存関係の検出のトラブルシューティング](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies)」{% ifversion fpt or ghec or ghes > 3.2 %} diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates.md b/translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates.md similarity index 89% rename from translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates.md index aa02dff06ef4..4b9cc30b4dbe 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates.md @@ -6,6 +6,7 @@ redirect_from: - /github/managing-security-vulnerabilities/about-github-dependabot-security-updates - /github/managing-security-vulnerabilities/about-dependabot-security-updates - /code-security/supply-chain-security/about-dependabot-security-updates + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates versions: fpt: '*' ghec: '*' @@ -25,9 +26,9 @@ topics: {% data reusables.dependabot.beta-security-and-version-updates %} {% data reusables.dependabot.enterprise-enable-dependabot %} -## {% data variables.product.prodname_dependabot_security_updates %} について +## {% data variables.product.prodname_dependabot_security_updates %}について -{% data variables.product.prodname_dependabot_security_updates %} で、リポジトリ内の脆弱性のある依存関係を簡単に修正できます。 この機能を有効にすると、リポジトリの依存関係グラフで脆弱性のある依存関係に対して {% data variables.product.prodname_dependabot %} アラートが発生すると、{% data variables.product.prodname_dependabot %} は自動的にそれを修正しようとします。 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)」 および「[{% data variables.product.prodname_dependabot_security_updates %} を設定する](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)」を参照してください。 +{% data variables.product.prodname_dependabot_security_updates %} で、リポジトリ内の脆弱性のある依存関係を簡単に修正できます。 この機能を有効にすると、リポジトリの依存関係グラフで脆弱性のある依存関係に対して {% data variables.product.prodname_dependabot %} アラートが発生すると、{% data variables.product.prodname_dependabot %} は自動的にそれを修正しようとします。 詳しい情報については、「[{% data variables.product.prodname_dependabot_alerts %} について](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)」および「[{% data variables.product.prodname_dependabot_security_updates %} の設定](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)」を参照してください。 {% data variables.product.prodname_dotcom %} may send {% data variables.product.prodname_dependabot_alerts %} to repositories affected by a vulnerability disclosed by a recently published {% data variables.product.prodname_dotcom %} security advisory. {% data reusables.security-advisory.link-browsing-advisory-db %} @@ -63,4 +64,4 @@ topics: ## {% data variables.product.prodname_dependabot %} セキュリティアップデートの通知について -{% data variables.product.company_short %} で通知をフィルタして、{% data variables.product.prodname_dependabot %} セキュリティアップデートを表示できます。 詳しい情報については「[インボックスからの通知の管理](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#dependabot-custom-filters)」を参照してください。 +{% data variables.product.company_short %} で通知をフィルタして、{% data variables.product.prodname_dependabot %} セキュリティアップデートを表示できます。 詳しい情報については「[インボックスからの通知を管理する](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#dependabot-custom-filters)」を参照してください。 diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates.md b/translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates.md similarity index 95% rename from translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates.md index 4b5d03893f05..6cc5ca642cbc 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates.md @@ -9,6 +9,7 @@ redirect_from: - /github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates - /github/managing-security-vulnerabilities/configuring-dependabot-security-updates - /code-security/supply-chain-security/configuring-dependabot-security-updates + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates versions: fpt: '*' ghec: '*' @@ -74,6 +75,6 @@ You can also enable or disable {% data variables.product.prodname_dependabot_sec ## Further reading -- "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"{% ifversion fpt or ghec %} +- "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)"{% ifversion fpt or ghec %} - "[Managing data use settings for your private repository](/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository)"{% endif %} - "[Supported package ecosystems](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)" diff --git a/translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/index.md b/translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/index.md new file mode 100644 index 000000000000..30b0fe607032 --- /dev/null +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/index.md @@ -0,0 +1,20 @@ +--- +title: Automatically updating dependencies with known vulnerabilities with Dependabot security updates +intro: '{% data variables.product.prodname_dependabot %} can help you fix vulnerable dependencies by automatically raising pull requests to update dependencies to secure versions.' +allowTitleToDifferFromFilename: true +versions: + fpt: '*' + ghec: '*' + ghes: '>3.2' +topics: + - Repositories + - Dependabot + - Security updates + - Dependencies + - Pull requests +shortTitle: Dependabotセキュリティアップデート +children: + - /about-dependabot-security-updates + - /configuring-dependabot-security-updates +--- + diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates.md b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates.md similarity index 91% rename from translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates.md index e87757c4bf4c..40b2cdefd905 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates.md @@ -8,6 +8,7 @@ redirect_from: - /github/administering-a-repository/about-dependabot-version-updates - /code-security/supply-chain-security/about-dependabot-version-updates - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/upgrading-from-dependabotcom-to-github-native-dependabot + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates versions: fpt: '*' ghec: '*' @@ -25,13 +26,13 @@ shortTitle: Dependabotバージョンアップデート {% data reusables.dependabot.beta-security-and-version-updates %} {% data reusables.dependabot.enterprise-enable-dependabot %} -## {% data variables.product.prodname_dependabot_version_updates %} について +## {% data variables.product.prodname_dependabot_version_updates %}について {% data variables.product.prodname_dependabot %} は、依存関係を維持する手間を省きます。 これを使用して、リポジトリが依存するパッケージおよびアプリケーションの最新リリースに自動的に対応できるようにすることができます。 設定ファイルをリポジトリにチェックインすることにより、{% data variables.product.prodname_dependabot_version_updates %} を有効化します。 設定ファイルは、リポジトリに保存されているマニフェストまたは他のパッケージ定義ファイルの場所を指定します。 {% data variables.product.prodname_dependabot %} はこの情報を使用して、古いパッケージとアプリケーションをチェックします。 {% data variables.product.prodname_dependabot %} は、依存関係のセマンティックバージョニング（[semver](https://semver.org/)）を調べて、そのバージョンへの更新の必要性を判断することにより、依存関係の新しいバージョンの有無を決定します。 特定のパッケージマネージャーでは、{% data variables.product.prodname_dependabot_version_updates %} もベンダをサポートしています。 ベンダ (またはキャッシュ) された依存関係は、マニフェストで参照されるのではなく、リポジトリ内の特定のディレクトリにチェックインされる依存関係です。 パッケージサーバーが利用できない場合でも、ビルド時にベンダ依存関係を利用できます。 {% data variables.product.prodname_dependabot_version_updates %} は、ベンダの依存関係をチェックして新しいバージョンを確認し、必要に応じて更新するように設定できます。 -{% data variables.product.prodname_dependabot %} が古い依存関係を特定すると、プルリクエストを発行して、マニフェストを依存関係の最新バージョンに更新します。 ベンダーの依存関係の場合、{% data variables.product.prodname_dependabot %} はプルリクエストを生成して、古い依存関係を新しいバージョンに直接置き換えます。 テストに合格したことを確認し、プルリクエストの概要に含まれている変更履歴とリリースノートを確認して、マージします。 For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." +{% data variables.product.prodname_dependabot %} が古い依存関係を特定すると、プルリクエストを発行して、マニフェストを依存関係の最新バージョンに更新します。 ベンダーの依存関係の場合、{% data variables.product.prodname_dependabot %} はプルリクエストを生成して、古い依存関係を新しいバージョンに直接置き換えます。 テストに合格したことを確認し、プルリクエストの概要に含まれている変更履歴とリリースノートを確認して、マージします。 For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." If you enable _security updates_, {% data variables.product.prodname_dependabot %} also raises pull requests to update vulnerable dependencies. 詳しい情報については、「[{% data variables.product.prodname_dependabot_security_updates %} について](/github/managing-security-vulnerabilities/about-dependabot-security-updates)」を参照してください。 @@ -50,7 +51,7 @@ If you enable _security updates_, {% data variables.product.prodname_dependabot ## サポートされているリポジトリとエコシステム -サポートされているパッケージマネージャーのいずれかの依存関係マニフェストまたはロックファイルを含むリポジトリのバージョン更新を設定できます。 一部のパッケージマネージャーでは、依存関係のベンダを設定することもできます。 詳しい情報については、「[依存関係の更新の設定オプション](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#vendor) 」を参照してください。 +サポートされているパッケージマネージャーのいずれかの依存関係マニフェストまたはロックファイルを含むリポジトリのバージョン更新を設定できます。 一部のパッケージマネージャーでは、依存関係のベンダを設定することもできます。 For more information, see "[Configuration options for the dependabot.yml file](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#vendor)." {% note %} {% data reusables.dependabot.private-dependencies-note %} diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md similarity index 95% rename from translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md index 0a38bb5acc58..2368b595b011 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.md @@ -1,10 +1,12 @@ --- -title: 依存関係の更新の設定オプション +title: Configuration options for the dependabot.yml file intro: '{% data variables.product.prodname_dependabot %} がリポジトリを維持する方法をカスタマイズする場合に使用可能なすべてのオプションの詳細情報。' permissions: 'People with write permissions to a repository can configure {% data variables.product.prodname_dependabot %} for the repository.' +allowTitleToDifferFromFilename: true redirect_from: - /github/administering-a-repository/configuration-options-for-dependency-updates - /code-security/supply-chain-security/configuration-options-for-dependency-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates miniTocMaxHeadingLevel: 3 versions: fpt: '*' @@ -17,7 +19,7 @@ topics: - Repositories - Dependencies - Pull requests -shortTitle: 設定オプション +shortTitle: Configure dependabot.yml --- {% data reusables.dependabot.beta-security-and-version-updates %} @@ -27,9 +29,9 @@ shortTitle: 設定オプション {% data variables.product.prodname_dependabot %} の設定ファイルである *dependabot.yml* では YAML 構文を使用します。 YAMLについて詳しくなく、学んでいきたい場合は、「[Learn YAML in five minutes (5分で学ぶYAML)](https://www.codeproject.com/Articles/1214409/Learn-YAML-in-five-minutes)」をお読みください。 -このファイルは、リポジトリの `.github` ディレクトリに保存する必要があります。 *dependabot.yml* ファイルを追加または更新すると、即座にバージョン更新を確認します。 For more information and an example, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates#enabling-dependabot-version-updates)." +このファイルは、リポジトリの `.github` ディレクトリに保存する必要があります。 *dependabot.yml* ファイルを追加または更新すると、即座にバージョン更新を確認します。 For more information and an example, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates#enabling-dependabot-version-updates)." -セキュリティアップデートに影響するオプションは、次にセキュリティアラートがセキュリティアップデートのためのプルリクエストをトリガーするときにも使用されます。 For more information, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates)." +セキュリティアップデートに影響するオプションは、次にセキュリティアラートがセキュリティアップデートのためのプルリクエストをトリガーするときにも使用されます。 詳しい情報については、「[{% data variables.product.prodname_dependabot_security_updates %} を設定する](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates)」を参照してください。 *dependabot.yml* ファイルには、必須の最上位キーに `version` と `updates` の 2 つがあります。 必要に応じて、最上位に `registries` キーを含めることができます。 ファイルは、`version: 2` で始まる必要があります。 @@ -53,7 +55,7 @@ shortTitle: 設定オプション | [`pull-request-branch-name.separator`](#pull-request-branch-nameseparator) | | プルリクエストブランチ名の区切り文字を変更する | | [`rebase-strategy`](#rebase-strategy) | | 自動リベースを無効にする | | [`registries`](#registries) | | {% data variables.product.prodname_dependabot %} がアクセスできるプライベートリポジトリ | -| [`reviewers`](#reviewers) | | プルリクエストのレビュー担当者 | +| [`レビュー担当者`](#reviewers) | | プルリクエストのレビュー担当者 | | [`schedule.day`](#scheduleday) | | 更新を確認する曜日 | | [`schedule.time`](#scheduletime) | | 更新を確認する時刻 (hh:mm) | | [`schedule.timezone`](#scheduletimezone) | | 時刻のタイムゾーン（ゾーン識別子） | @@ -170,7 +172,7 @@ updates: {% note %} -**注釈**: `schedule` は、{% data variables.product.prodname_dependabot %} が新規更新を試行するタイミングを設定します。 ただし、プルリクエストを受け取るタイミングはこれだけではありません。 更新は、 `dependabot.yml` ファイルへの変更、更新失敗後のマニフェストファイルへの変更、または {% data variables.product.prodname_dependabot_security_updates %} に基づいてトリガーされることがあります。 詳しい情報については、「[{% data variables.product.prodname_dependabot %} プルリクエストの頻度](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates#frequency-of-dependabot-pull-requests)」および「[{% data variables.product.prodname_dependabot_security_updates %} について](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)」を参照してください。 +**注釈**: `schedule` は、{% data variables.product.prodname_dependabot %} が新規更新を試行するタイミングを設定します。 ただし、プルリクエストを受け取るタイミングはこれだけではありません。 更新は、 `dependabot.yml` ファイルへの変更、更新失敗後のマニフェストファイルへの変更、または {% data variables.product.prodname_dependabot_security_updates %} に基づいてトリガーされることがあります。 For more information, see "[Frequency of {% data variables.product.prodname_dependabot %} pull requests](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates#frequency-of-dependabot-pull-requests)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)." {% endnote %} @@ -187,7 +189,7 @@ updates: | ------------- | ----------------------------------------------- | ----------------------------------------------------------------------------- | | `direct` | すべて | 明示的に定義されたすべての依存関係。 | | `indirect` | `bundler`、`pip`、`composer`、`cargo` | 直接依存関係の依存関係 (サブ依存関係、または過渡依存関係とも呼ばれる)。 | - | `すべて` | すべて | 明示的に定義されたすべての依存関係。 `bundler`、`pip`、`composer`、`cargo` についても、直接依存関係の依存関係になります。 | + | `all` | すべて | 明示的に定義されたすべての依存関係。 `bundler`、`pip`、`composer`、`cargo` についても、直接依存関係の依存関係になります。 | | `production` | `bundler`、`composer`、`mix`, `maven`、`npm`、`pip` | Only dependencies in the "Production dependency group". | | `development` | `bundler`、`composer`、`mix`, `maven`、`npm`、`pip` | [Development dependency group] 内の依存関係のみ。 | @@ -307,7 +309,7 @@ updates: リポジトリが`ignore`の設定を保存したかは、リポジトリで`"@dependabot ignore" in:comments`を検索すれば調べられます。 この方法で無視された依存関係の無視を解除したいなら、Pull Requestを再度オープンしてください。 -`@dependabot ignore` コマンドに関する詳細については、「[依存関係の更新に関するプルリクエストを管理する](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands)」をご覧ください。 +For more information about the `@dependabot ignore` commands, see "[Managing pull requests for dependency updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands)." #### 無視する依存関係とバージョンを指定する @@ -322,7 +324,7 @@ updates: {% data reusables.dependabot.option-affects-security-updates %} ```yaml -# 更新されるべきではない依存関係を、`ignore`を使って指定する +# `ignore`を使って更新されるべきではない依存関係を指定 version: 2 updates: @@ -332,7 +334,7 @@ updates: interval: "daily" ignore: - dependency-name: "express" - # Expressではバージョン4と5に対するすべての更新を無視 + # Expressについてはバージョン4と5に対するすべての更新を無視 versions: ["4.x", "5.x"] # Lodashについてはすべての更新を無視 - dependency-name: "lodash" @@ -521,7 +523,7 @@ updates: {% endraw %} ``` -### `reviewers` +### `レビュー担当者` `reviewers` を使用して、パッケージマネージャーに対して発行されたすべてのプルリクエストの個々のレビュー担当者またはレビュー担当者の Team を指定します。 チームを@メンションしている場合と同様に、Organization を含む完全な Team 名を使用する必要があります。 @@ -725,7 +727,7 @@ updates: {% raw %} ```yaml -# 1つのプライベートリポジトリで依存関係を更新するための最低限の設定 +# 1つのプライベートリポジトリ内の依存関係の更新のための最小設定 version: 2 registries: diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates.md b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates.md similarity index 93% rename from translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates.md index 158e6dea9ab6..f039485d4074 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates.md @@ -1,11 +1,12 @@ --- -title: Enabling and disabling Dependabot version updates +title: Configuring Dependabot version updates intro: '{% data variables.product.prodname_dependabot %} が使用するパッケージを自動的に更新するようにリポジトリを設定できます。' permissions: 'People with write permissions to a repository can enable or disable {% data variables.product.prodname_dependabot_version_updates %} for the repository.' redirect_from: - /github/administering-a-repository/enabling-and-disabling-version-updates - /code-security/supply-chain-security/enabling-and-disabling-version-updates - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-version-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates versions: fpt: '*' ghec: '*' @@ -17,7 +18,7 @@ topics: - Repositories - Dependencies - Pull requests -shortTitle: 更新の有効化と無効化 +shortTitle: Configure version updates --- @@ -34,7 +35,7 @@ shortTitle: 更新の有効化と無効化 ## {% data variables.product.prodname_dependabot_version_updates %} を有効化する -{% data reusables.dependabot.create-dependabot-yml %}詳しい情報については、「[依存関係の更新の設定オプション](/github/administering-a-repository/configuration-options-for-dependency-updates)」を参照してください。 +{% data reusables.dependabot.create-dependabot-yml %} For information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates)." 1. `version` を追加します。 1. プライベートレジストリに依存関係がある場合、必要に応じて認証情報を含む `registries` セクションを追加します。 1. `updates` セクションを追加し、{% data variables.product.prodname_dependabot %} に監視させるパッケージマネージャーごとにエントリを追加します。 @@ -138,4 +139,4 @@ updates: update-types: ["version-update:semver-patch"] ``` -既存の無視設定の確認に関する詳細については、「[依存関係の更新の設定オプション](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore)」を参照してください。 +For more information about checking for existing ignore preferences, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore)." diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates.md b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/customizing-dependency-updates.md similarity index 93% rename from translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/customizing-dependency-updates.md index 43c33fc5eada..cdaedce50050 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/customizing-dependency-updates.md @@ -5,6 +5,7 @@ permissions: 'People with write permissions to a repository can configure {% dat redirect_from: - /github/administering-a-repository/customizing-dependency-updates - /code-security/supply-chain-security/customizing-dependency-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates versions: fpt: '*' ghec: '*' @@ -34,7 +35,7 @@ shortTitle: 更新のカスタマイズ - `open-pull-requests-limit`: バージョン更新のオープンプルリクエストの最大数をデフォルトの 5 件から変更する - `target-branch`: デフォルトブランチではなく、特定のブランチを対象とするバージョン更新のプルリクエストを開く -設定オプションの詳細については、「[依存関係の更新の設定オプション](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) 」を参照してください。 +For more information about the configuration options, see "[Configuration options for the dependabot.yml file](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates)." リポジトリ内の *dependabot.yml* ファイルを更新すると、{% data variables.product.prodname_dependabot %} は新しい設定で即座にチェックを実行します。 数分以内に、[**{% data variables.product.prodname_dependabot %}**] タブに更新された依存関係のリストが表示されます。リポジトリに多くの依存関係がある場合、表示までにさらに時間がかかることがあります。 バージョン更新に関する新しいプルリクエストが表示されることもあります。 詳しい情報については、「[バージョン更新用に設定された依存関係を一覧表示する](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates) 」を参照してください。 @@ -139,4 +140,4 @@ updates: ## その他の例 -その他の例ついては、「[依存関係の更新の設定オプション](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) 」を参照してください。 +For more examples, see "[Configuration options for the dependabot.yml file](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates)." diff --git a/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/index.md b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/index.md new file mode 100644 index 000000000000..49056570acf2 --- /dev/null +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/index.md @@ -0,0 +1,26 @@ +--- +title: Keeping your dependencies updated automatically with Dependabot version updates +intro: 'You can use {% data variables.product.prodname_dependabot %} to automatically keep the dependencies and packages used in your repository updated to the latest version, even when they don’t have any known vulnerabilities.' +allowTitleToDifferFromFilename: true +redirect_from: + - /github/administering-a-repository/keeping-your-dependencies-updated-automatically + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically +versions: + fpt: '*' + ghec: '*' + ghes: '>3.2' +topics: + - Repositories + - Dependabot + - Version updates + - Dependencies + - Pull requests +children: + - /about-dependabot-version-updates + - /configuring-dependabot-version-updates + - /listing-dependencies-configured-for-version-updates + - /customizing-dependency-updates + - /configuration-options-for-the-dependabot.yml-file +shortTitle: Dependabotバージョンアップデート +--- + diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates.md b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates.md similarity index 85% rename from translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates.md rename to translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates.md index ed581cda0262..7331e568d6c5 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates.md +++ b/translations/ja-JP/content/code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates.md @@ -4,6 +4,7 @@ intro: '{% data variables.product.prodname_dependabot %} が更新を監視し redirect_from: - /github/administering-a-repository/listing-dependencies-configured-for-version-updates - /code-security/supply-chain-security/listing-dependencies-configured-for-version-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates versions: fpt: '*' ghec: '*' @@ -22,7 +23,7 @@ shortTitle: 設定された依存関係の一覧 ## {% data variables.product.prodname_dependabot %} によって監視されている依存関係を表示する -バージョン更新を有効にした後、リポジトリの依存関係グラフの [**{% data variables.product.prodname_dependabot %}**] タブで、設定が正しいかどうかを確認できます。 For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." +バージョン更新を有効にした後、リポジトリの依存関係グラフの [**{% data variables.product.prodname_dependabot %}**] タブで、設定が正しいかどうかを確認できます。 For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.accessing-repository-graphs %} diff --git a/translations/ja-JP/content/code-security/dependabot/index.md b/translations/ja-JP/content/code-security/dependabot/index.md new file mode 100644 index 000000000000..cb1f4984f916 --- /dev/null +++ b/translations/ja-JP/content/code-security/dependabot/index.md @@ -0,0 +1,23 @@ +--- +title: Keeping your supply chain secure with Dependabot +shortTitle: Dependabot +intro: 'Monitor vulnerabilities in dependencies used in your project{% ifversion fpt or ghec or ghes > 3.2 %} and keep your dependencies up-to-date{% endif %} with {% data variables.product.prodname_dependabot %}.' +allowTitleToDifferFromFilename: true +versions: + fpt: '*' + ghes: '*' + ghae: issue-4864 + ghec: '*' +topics: + - Dependabot + - Alerts + - Vulnerabilities + - Repositories + - Dependencies +children: + - /dependabot-alerts + - /dependabot-security-updates + - /dependabot-version-updates + - /working-with-dependabot +--- + diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions.md b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions.md similarity index 98% rename from translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions.md rename to translations/ja-JP/content/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions.md index 08083383dfd8..04794ab34a48 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions.md +++ b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions.md @@ -17,6 +17,8 @@ topics: - Dependencies - Pull requests shortTitle: Use Dependabot with Actions +redirect_from: + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions --- {% data reusables.dependabot.beta-security-and-version-updates %} @@ -72,7 +74,7 @@ For more information, see "[Modifying the permissions for the GITHUB_TOKEN](/act ### Accessing secrets -When a {% data variables.product.prodname_dependabot %} event triggers a workflow, the only secrets available to the workflow are {% data variables.product.prodname_dependabot %} secrets. {% data variables.product.prodname_actions %} secrets are not available. Consequently, you must store any secrets that are used by a workflow triggered by {% data variables.product.prodname_dependabot %} events as {% data variables.product.prodname_dependabot %} secrets. For more information, see "[Managing encrypted secrets for Dependabot](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot)". +When a {% data variables.product.prodname_dependabot %} event triggers a workflow, the only secrets available to the workflow are {% data variables.product.prodname_dependabot %} secrets. {% data variables.product.prodname_actions %} secrets are not available. Consequently, you must store any secrets that are used by a workflow triggered by {% data variables.product.prodname_dependabot %} events as {% data variables.product.prodname_dependabot %} secrets. 詳しい情報については「[Dependabotの暗号化されたシークレットの管理](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot)」を参照してください。 {% data variables.product.prodname_dependabot %} secrets are added to the `secrets` context and referenced using exactly the same syntax as secrets for {% data variables.product.prodname_actions %}. For more information, see "[Encrypted secrets](/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow)." diff --git a/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/index.md b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/index.md new file mode 100644 index 000000000000..2ff0dbc0daf9 --- /dev/null +++ b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/index.md @@ -0,0 +1,24 @@ +--- +title: Working with Dependabot +shortTitle: Work with Dependabot +intro: 'Guidance and recommendations for working with {% data variables.product.prodname_dependabot %}, such as managing pull requests raised by {% data variables.product.prodname_dependabot %}, using {% data variables.product.prodname_actions %} with {% data variables.product.prodname_dependabot %}, and troubleshooting {% data variables.product.prodname_dependabot %} errors.' +versions: + fpt: '*' + ghec: '*' + ghes: '>3.2' +topics: + - Repositories + - Dependabot + - Version updates + - Security updates + - Dependencies + - Pull requests +children: + - /managing-pull-requests-for-dependency-updates + - /automating-dependabot-with-github-actions + - /keeping-your-actions-up-to-date-with-dependabot + - /managing-encrypted-secrets-for-dependabot + - /troubleshooting-the-detection-of-vulnerable-dependencies + - /troubleshooting-dependabot-errors +--- + diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot.md b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot.md similarity index 88% rename from translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot.md rename to translations/ja-JP/content/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot.md index 7261cc6b3be2..e373bef51aed 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot.md +++ b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot.md @@ -5,6 +5,7 @@ redirect_from: - /github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot - /github/administering-a-repository/keeping-your-actions-up-to-date-with-dependabot - /code-security/supply-chain-security/keeping-your-actions-up-to-date-with-dependabot + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot versions: fpt: '*' ghec: '*' @@ -36,7 +37,7 @@ Actions are often updated with bug fixes and new features to make automated proc 1. Set a `schedule.interval` to specify how often to check for new versions. {% data reusables.dependabot.check-in-dependabot-yml %} If you have edited an existing file, save your changes. -You can also enable {% data variables.product.prodname_dependabot_version_updates %} on forks. For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates#enabling-version-updates-on-forks)." +You can also enable {% data variables.product.prodname_dependabot_version_updates %} on forks. For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates#enabling-version-updates-on-forks)." ### Example *dependabot.yml* file for {% data variables.product.prodname_actions %} @@ -57,7 +58,7 @@ updates: ## Configuring {% data variables.product.prodname_dependabot_version_updates %} for actions -When enabling {% data variables.product.prodname_dependabot_version_updates %} for actions, you must specify values for `package-ecosystem`, `directory`, and `schedule.interval`. There are many more optional properties that you can set to further customize your version updates. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates)." +When enabling {% data variables.product.prodname_dependabot_version_updates %} for actions, you must specify values for `package-ecosystem`, `directory`, and `schedule.interval`. There are many more optional properties that you can set to further customize your version updates. For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates)." ## Further reading diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot.md b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/managing-encrypted-secrets-for-dependabot.md similarity index 95% rename from translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot.md rename to translations/ja-JP/content/code-security/dependabot/working-with-dependabot/managing-encrypted-secrets-for-dependabot.md index 4f4bc4a4abfc..942e0495022e 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot.md +++ b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/managing-encrypted-secrets-for-dependabot.md @@ -4,6 +4,7 @@ intro: 'パスワードアクセストークンなどの機密情報を、暗号 redirect_from: - /github/administering-a-repository/managing-encrypted-secrets-for-dependabot - /code-security/supply-chain-security/managing-encrypted-secrets-for-dependabot + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot versions: fpt: '*' ghec: '*' @@ -33,7 +34,7 @@ password: ${{secrets.MY_ARTIFACTORY_PASSWORD}} ``` {% endraw %} -詳しい情報については、「[依存関係の更新の設定オプション](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries) 」を参照してください。 +For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)." ### シークレットに名前を付ける diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates.md b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates.md similarity index 93% rename from translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates.md rename to translations/ja-JP/content/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates.md index de66c9428208..8fd8a900e98e 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates.md +++ b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates.md @@ -4,6 +4,7 @@ intro: '{% data variables.product.prodname_dependabot %} によって生成さ redirect_from: - /github/administering-a-repository/managing-pull-requests-for-dependency-updates - /code-security/supply-chain-security/managing-pull-requests-for-dependency-updates + - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates versions: fpt: '*' ghec: '*' @@ -41,7 +42,7 @@ shortTitle: Dependabot PRの管理 ## {% data variables.product.prodname_dependabot %} Pull Requestのリベース戦略を変更する -デフォルトでは、{% data variables.product.prodname_dependabot %} は自動的にプルリクエストをリベースして競合を解決します。 マージの競合を手動で処理する場合は、`rebase-strategy` オプションを使用してこれを無効にできます。 詳細については、「[依存関係の更新の設定オプション](/github/administering-a-repository/configuration-options-for-dependency-updates#rebase-strategy) 」を参照してください。 +デフォルトでは、{% data variables.product.prodname_dependabot %} は自動的にプルリクエストをリベースして競合を解決します。 マージの競合を手動で処理する場合は、`rebase-strategy` オプションを使用してこれを無効にできます。 For details, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#rebase-strategy)." ## {% data variables.product.prodname_dependabot %} Pull Requestをコメントコマンドで管理する @@ -62,4 +63,4 @@ shortTitle: Dependabot PRの管理 {% data variables.product.prodname_dependabot %}はコマンドを認識すると"thumbs up"の絵文字で反応し、Pull Requestのコメントで応答することがあります。 {% data variables.product.prodname_dependabot %}は通常すぐに反応しますが、コマンドによっては{% data variables.product.prodname_dependabot %}が他の更新やコマンドを処理するのに忙しい場合、完了に数分かかることがあります。 -依存関係やバージョンを無視するコマンドを実行すると、{% data variables.product.prodname_dependabot %} はリポジトリの設定を一元的に保存します。 これは簡単な解決策ですが、複数のコントリビューターがいるリポジトリの場合は、設定ファイルで無視する依存関係とバージョンを明示的に定義することをお勧めします。 これにより、特定の依存関係が自動的に更新されない理由をすべてのコントリビューターが簡単に確認できます。 詳しい情報については、「[依存関係の更新の設定オプション](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore) 」を参照してください。 +依存関係やバージョンを無視するコマンドを実行すると、{% data variables.product.prodname_dependabot %} はリポジトリの設定を一元的に保存します。 これは簡単な解決策ですが、複数のコントリビューターがいるリポジトリの場合は、設定ファイルで無視する依存関係とバージョンを明示的に定義することをお勧めします。 これにより、特定の依存関係が自動的に更新されない理由をすべてのコントリビューターが簡単に確認できます。 For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#ignore)." diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors.md b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors.md similarity index 92% rename from translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors.md rename to translations/ja-JP/content/code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors.md index f53f1f19ab7f..46de024e13b8 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors.md +++ b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors.md @@ -6,6 +6,7 @@ redirect_from: - /github/managing-security-vulnerabilities/troubleshooting-github-dependabot-errors - /github/managing-security-vulnerabilities/troubleshooting-dependabot-errors - /code-security/supply-chain-security/troubleshooting-dependabot-errors + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors versions: fpt: '*' ghec: '*' @@ -76,7 +77,7 @@ To see the logs for any manifest file, click the **Last checked TIME ago** link, 依存関係を含むすべてのアプリケーションには、依存関係グラフ、つまり、アプリケーションが直接または間接的に依存するすべてのパッケージバージョンの有向非巡回グラフがあります。 依存関係が更新されるたびに、このグラフを解決する必要があります。解決しない場合、アプリケーションがビルドされません。 npm や RubyGems のように、エコシステムに深く複雑な依存関係グラフがある場合、エコシステム全体をアップグレードせずに単一の依存関係をアップグレードすることは不可能な場合があります。 -この問題を回避する最善策としては、たとえばバージョン更新を有効化するなどして、最新のリリースバージョンで最新の状態に保つことです。 これにより、依存関係グラフを壊さない単純なアップグレードで 1 つの依存関係の脆弱性を解決できる可能性が高くなります。 For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." +この問題を回避する最善策としては、たとえばバージョン更新を有効化するなどして、最新のリリースバージョンで最新の状態に保つことです。 これにより、依存関係グラフを壊さない単純なアップグレードで 1 つの依存関係の脆弱性を解決できる可能性が高くなります。 For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." ### 最新バージョンのオープンプルリクエストがすでに存在するため、{% data variables.product.prodname_dependabot %} を必要なバージョンに更新できない @@ -90,13 +91,13 @@ To see the logs for any manifest file, click the **Last checked TIME ago** link, これは対処が難しいエラーです。 バージョン更新がタイムアウトした場合は、`allow` パラメーターを使用して更新する最も重要な依存関係を指定するか、または、`ignore` パラメーターを使用して更新から一部の依存関係を除外できます。 設定を更新すると、{% data variables.product.prodname_dependabot %} がバージョンの更新を確認し、利用可能な時間内にプルリクエストを生成できます。 -セキュリティアップデートがタイムアウトする場合、たとえばバージョン更新を有効にするなどして依存関係を最新に保つことで、タイムアウトが発生する可能性を減らすことができます。 For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." +セキュリティアップデートがタイムアウトする場合、たとえばバージョン更新を有効にするなどして依存関係を最新に保つことで、タイムアウトが発生する可能性を減らすことができます。 For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." ### {% data variables.product.prodname_dependabot %} で追加のプルリクエストをオープンできない {% data variables.product.prodname_dependabot %} が生成するオープンプルリクエスト数には制限があります。 上限に達すると、新しいプルリクエストはオープンされず、このエラーが報告されます。 エラーを解決する最善策として、複数のオープンプルリクエストを確認してマージします。 -セキュリティアップデートとバージョン更新のプルリクエストには個別の制限があるため、オープンなバージョン更新のプルリクエストがセキュリティアップデートのプルリクエストの作成をブロックすることはできません。 セキュリティアップデートのプルリクエストの上限は 10 件です。 デフォルトではバージョン更新の上限は 5 件ですが、設定ファイルの `open-pull-requests-limit` パラメータを使用して変更できます。 詳しい情報については、「[依存関係の更新の設定オプション](/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit) 」を参照してください。 +セキュリティアップデートとバージョン更新のプルリクエストには個別の制限があるため、オープンなバージョン更新のプルリクエストがセキュリティアップデートのプルリクエストの作成をブロックすることはできません。 セキュリティアップデートのプルリクエストの上限は 10 件です。 デフォルトではバージョン更新の上限は 5 件ですが、設定ファイルの `open-pull-requests-limit` パラメータを使用して変更できます。 For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit)." このエラーを解決する最善策として、既存のプルリクエストの一部をマージまたはクローズして、新しいプルリクエストを手動でトリガーします。 詳しい情報については、「[{% data variables.product.prodname_dependabot %} のプルリクエストを手動でトリガーする](#triggering-a-dependabot-pull-request-manually)」を参照してください。 @@ -121,3 +122,8 @@ To see the logs for any manifest file, click the **Last checked TIME ago** link, - **セキュリティアップデート** — 修正済みのエラーを示す {% data variables.product.prodname_dependabot %} アラートを表示します。[**Create {% data variables.product.prodname_dependabot %} security update**] をクリックします。 - **バージョン更新** — リポジトリの [**Insights**] タブで、[**Dependency graph**] をクリックし、[**Dependabot**] タブをクリックします。 [**Last checked *TIME* ago**] をクリックして、バージョン更新の最終チェック中に {% data variables.product.prodname_dependabot %} が生成したログファイルを表示します。 [**Check for updates**] をクリックします。 + +## 参考リンク + +- "[Troubleshooting the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph)" +- 「[脆弱性のある依存関係の検出のトラブルシューティング](/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies)」 diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies.md b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md similarity index 70% rename from translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies.md rename to translations/ja-JP/content/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md index 4a967cf2fb29..722d2e48bde4 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies.md +++ b/translations/ja-JP/content/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md @@ -1,10 +1,11 @@ --- title: Troubleshooting the detection of vulnerable dependencies intro: 'If the dependency information reported by {% data variables.product.product_name %} is not what you expected, there are a number of points to consider, and various things you can check.' -shortTitle: Troubleshoot detection +shortTitle: Troubleshoot vulnerability detection redirect_from: - /github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies - /code-security/supply-chain-security/troubleshooting-the-detection-of-vulnerable-dependencies + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies versions: fpt: '*' ghes: '*' @@ -19,72 +20,39 @@ topics: - Security updates - Dependencies - Vulnerabilities - - Dependency graph - - Alerts - CVEs - Repositories --- {% data reusables.dependabot.beta-security-and-version-updates %} - -The results of dependency detection reported by {% data variables.product.product_name %} may be different from the results returned by other tools. There are good reasons for this and it's helpful to understand how {% data variables.product.prodname_dotcom %} determines dependencies for your project. +{% data reusables.dependabot.result-discrepancy %} ## Why do some dependencies seem to be missing? {% data variables.product.prodname_dotcom %} generates and displays dependency data differently than other tools. Consequently, if you've been using another tool to identify dependencies you will almost certainly see different results. Consider the following: * {% data variables.product.prodname_advisory_database %} is one of the data sources that {% data variables.product.prodname_dotcom %} uses to identify vulnerable dependencies. It's a free, curated database of vulnerability information for common package ecosystems on {% data variables.product.prodname_dotcom %}. It includes both data reported directly to {% data variables.product.prodname_dotcom %} from {% data variables.product.prodname_security_advisories %}, as well as official feeds and community sources. This data is reviewed and curated by {% data variables.product.prodname_dotcom %} to ensure that false or unactionable information is not shared with the development community. {% data reusables.security-advisory.link-browsing-advisory-db %} -* The dependency graph parses all known package manifest files in a user’s repository. For example, for npm it will parse the _package-lock.json_ file. It constructs a graph of all of the repository’s dependencies and public dependents. This happens when you enable the dependency graph and when anyone pushes to the default branch, and it includes commits that makes changes to a supported manifest format. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)." -* {% data variables.product.prodname_dependabot %} scans any push, to the default branch, that contains a manifest file. When a new vulnerability record is added, it scans all existing repositories and generates an alert for each vulnerable repository. {% data variables.product.prodname_dependabot_alerts %} are aggregated at the repository level, rather than creating one alert per vulnerability. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." +* The dependency graph parses all known package manifest files in a user’s repository. For example, for npm it will parse the _package-lock.json_ file. It constructs a graph of all of the repository’s dependencies and public dependents. This happens when you enable the dependency graph and when anyone pushes to the default branch, and it includes commits that makes changes to a supported manifest format. For more information, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)" and "[Troubleshooting the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph)." +* {% data variables.product.prodname_dependabot %} scans any push, to the default branch, that contains a manifest file. When a new vulnerability record is added, it scans all existing repositories and generates an alert for each vulnerable repository. {% data variables.product.prodname_dependabot_alerts %} are aggregated at the repository level, rather than creating one alert per vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." * {% ifversion fpt or ghec or ghes > 3.2 %}{% data variables.product.prodname_dependabot_security_updates %} are triggered when you receive an alert about a vulnerable dependency in your repository. Where possible, {% data variables.product.prodname_dependabot %} creates a pull request in your repository to upgrade the vulnerable dependency to the minimum possible secure version needed to avoid the vulnerability. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)" and "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)." - {% endif %}{% data variables.product.prodname_dependabot %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is added to the advisory database{% ifversion ghes or ghae-issue-4864 %} and synchronized to {% data variables.product.product_location %}{% endif %}. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#detection-of-vulnerable-dependencies)." - -## Why don't I get vulnerability alerts for some ecosystems? + {% endif %}{% data variables.product.prodname_dependabot %} doesn't scan repositories for vulnerable dependencies on a schedule, but rather when something changes. For example, a scan is triggered when a new dependency is added ({% data variables.product.prodname_dotcom %} checks for this on every push), or when a new vulnerability is added to the advisory database{% ifversion ghes or ghae-issue-4864 %} and synchronized to {% data variables.product.product_location %}{% endif %}. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies#detection-of-vulnerable-dependencies)." -{% data variables.product.prodname_dotcom %} limits its support for vulnerability alerts to a set of ecosystems where we can provide high-quality, actionable data. Curated vulnerabilities in the {% data variables.product.prodname_advisory_database %}, the dependency graph, {% ifversion fpt or ghec %}{% data variables.product.prodname_dependabot %} security updates, {% endif %}and {% data variables.product.prodname_dependabot_alerts %} are provided for several ecosystems, including Java’s Maven, JavaScript’s npm and Yarn, .NET’s NuGet, Python’s pip, Ruby's RubyGems, and PHP’s Composer. We'll continue to add support for more ecosystems over time. For an overview of the package ecosystems that we support, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)." - -It's worth noting that {% data variables.product.prodname_dotcom %} Security Advisories may exist for other ecosystems. The information in a security advisory is provided by the maintainers of a particular repository. This data is not curated in the same way as information for the supported ecosystems. {% ifversion fpt or ghec %}For more information, see "[About {% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."{% endif %} - -**Check**: Does the uncaught vulnerability apply to an unsupported ecosystem? - -## Does the dependency graph only find dependencies in manifests and lockfiles? - -The dependency graph includes information on dependencies that are explicitly declared in your environment. That is, dependencies that are specified in a manifest or a lockfile. The dependency graph generally also includes transitive dependencies, even when they aren't specified in a lockfile, by looking at the dependencies of the dependencies in a manifest file. +## Do {% data variables.product.prodname_dependabot_alerts %} only relate to vulnerable dependencies in manifests and lockfiles? {% data variables.product.prodname_dependabot_alerts %} advise you about dependencies you should update, including transitive dependencies, where the version can be determined from a manifest or a lockfile. {% ifversion fpt or ghec or ghes > 3.2 %}{% data variables.product.prodname_dependabot_security_updates %} only suggest a change where {% data variables.product.prodname_dependabot %} can directly "fix" the dependency, that is, when these are: * Direct dependencies explicitly declared in a manifest or lockfile * Transitive dependencies declared in a lockfile{% endif %} -The dependency graph doesn't include "loose" dependencies. "Loose" dependencies are individual files that are copied from another source and checked into the repository directly or within an archive (such as a ZIP or JAR file), rather than being referenced by in a package manager’s manifest or lockfile. - **Check**: Is the uncaught vulnerability for a component that's not specified in the repository's manifest or lockfile? -## Does the dependency graph detect dependencies specified using variables? - -The dependency graph analyzes manifests as they’re pushed to {% data variables.product.prodname_dotcom %}. The dependency graph doesn't, therefore, have access to the build environment of the project, so it can't resolve variables used within manifests. If you use variables within a manifest to specify the name, or more commonly the version of a dependency, then that dependency will not be included in the dependency graph. - -**Check**: Is the missing dependency declared in the manifest by using a variable for its name or version? - -## Are there limits which affect the dependency graph data? - -Yes, the dependency graph has two categories of limits: - -1. **Processing limits** - - These affect the dependency graph displayed within {% data variables.product.prodname_dotcom %} and also prevent {% data variables.product.prodname_dependabot_alerts %} being created. - - Manifests over 0.5 MB in size are only processed for enterprise accounts. For other accounts, manifests over 0.5 MB are ignored and will not create {% data variables.product.prodname_dependabot_alerts %}. - - By default, {% data variables.product.prodname_dotcom %} will not process more than 20 manifests per repository. {% data variables.product.prodname_dependabot_alerts %} are not created for manifests beyond this limit. If you need to increase the limit, contact {% data variables.contact.contact_support %}. - -2. **Visualization limits** +## Why don't I get vulnerability alerts for some ecosystems? - These affect what's displayed in the dependency graph within {% data variables.product.prodname_dotcom %}. However, they don't affect the {% data variables.product.prodname_dependabot_alerts %} that are created. +{% data variables.product.prodname_dotcom %} limits its support for vulnerability alerts to a set of ecosystems where we can provide high-quality, actionable data. Curated vulnerabilities in the {% data variables.product.prodname_advisory_database %}, the dependency graph, {% ifversion fpt or ghec %}{% data variables.product.prodname_dependabot %} security updates, {% endif %}and {% data variables.product.prodname_dependabot_alerts %} are provided for several ecosystems, including Java’s Maven, JavaScript’s npm and Yarn, .NET’s NuGet, Python’s pip, Ruby's RubyGems, and PHP’s Composer. We'll continue to add support for more ecosystems over time. For an overview of the package ecosystems that we support, see "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)." - The Dependencies view of the dependency graph for a repository only displays 100 manifests. Typically this is adequate as it is significantly higher than the processing limit described above. In situations where the processing limit is over 100, {% data variables.product.prodname_dependabot_alerts %} are still created for any manifests that are not shown within {% data variables.product.prodname_dotcom %}. +It's worth noting that {% data variables.product.prodname_dotcom %} Security Advisories may exist for other ecosystems. The information in a security advisory is provided by the maintainers of a particular repository. This data is not curated in the same way as information for the supported ecosystems. {% ifversion fpt or ghec %}For more information, see "[About {% data variables.product.prodname_dotcom %} Security Advisories](/github/managing-security-vulnerabilities/about-github-security-advisories)."{% endif %} -**Check**: Is the missing dependency in a manifest file that's over 0.5 MB, or in a repository with a large number of manifests? +**Check**: Does the uncaught vulnerability apply to an unsupported ecosystem? ## Does {% data variables.product.prodname_dependabot %} generate alerts for vulnerabilities that have been known for many years? @@ -118,7 +86,8 @@ The {% data variables.product.prodname_dependabot_alerts %} count in {% data var ## Further reading -- "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)" -- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" -- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)"{% ifversion fpt or ghec or ghes > 3.2 %} +- "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)" +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" +- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" +- "[Troubleshooting the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph)"{% ifversion fpt or ghec or ghes > 3.2 %} - "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"{% endif %} diff --git a/translations/ja-JP/content/code-security/getting-started/github-security-features.md b/translations/ja-JP/content/code-security/getting-started/github-security-features.md index 55bf4818a68b..bdb89559b4c3 100644 --- a/translations/ja-JP/content/code-security/getting-started/github-security-features.md +++ b/translations/ja-JP/content/code-security/getting-started/github-security-features.md @@ -37,7 +37,7 @@ topics: ### {% data variables.product.prodname_dependabot_alerts %} およびセキュリティアップデート -セキュリティの脆弱性を含むことを把握している依存関係に関するアラートを表示し、プルリクエストを自動的に生成してこれらの依存関係を更新するかどうかを選択します。 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」 および「[{% data variables.product.prodname_dependabot_security_updates %} について](/github/managing-security-vulnerabilities/about-dependabot-security-updates)」を参照してください。 +セキュリティの脆弱性を含むことを把握している依存関係に関するアラートを表示し、プルリクエストを自動的に生成してこれらの依存関係を更新するかどうかを選択します。 For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)." {% endif %} {% ifversion ghes < 3.3 or ghae-issue-4864 %} @@ -45,7 +45,7 @@ topics: {% data reusables.dependabot.dependabot-alerts-beta %} -セキュリティの脆弱性を含むことを把握している依存関係に関するアラートを表示し、それらのアラートを管理します。 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 +セキュリティの脆弱性を含むことを把握している依存関係に関するアラートを表示し、それらのアラートを管理します。 詳しい情報については、「[{% data variables.product.prodname_dependabot_alerts %} について](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 {% endif %} {% ifversion fpt or ghec or ghes > 3.2 %} diff --git a/translations/ja-JP/content/code-security/getting-started/securing-your-organization.md b/translations/ja-JP/content/code-security/getting-started/securing-your-organization.md index bd40761fcecb..667abbef4440 100644 --- a/translations/ja-JP/content/code-security/getting-started/securing-your-organization.md +++ b/translations/ja-JP/content/code-security/getting-started/securing-your-organization.md @@ -48,7 +48,7 @@ You can create a default security policy that will display in any of your organi {% data reusables.dependabot.dependabot-alerts-beta %} {% data reusables.dependabot.dependabot-alerts-dependency-graph-enterprise %} -For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)," "[Exploring the dependencies of a repository](/code-security/supply-chain-security/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)," and "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)." +For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)," "[Exploring the dependencies of a repository](/code-security/supply-chain-security/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)," and "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)." {% endif %} {% ifversion fpt or ghes > 3.1 or ghae-issue-4864 or ghec %} @@ -79,7 +79,7 @@ For more information, see "[About {% data variables.product.prodname_dependabot_ You can enable {% data variables.product.prodname_dependabot %} to automatically raise pull requests to keep your dependencies up-to-date. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/code-security/supply-chain-security/about-dependabot-version-updates)." -To enable {% data variables.product.prodname_dependabot_version_updates %}, you must create a *dependabot.yml* configuration file. For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." +To enable {% data variables.product.prodname_dependabot_version_updates %}, you must create a *dependabot.yml* configuration file. For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." {% endif %} @@ -135,7 +135,7 @@ For more information, see "[Managing security and analysis settings for your org ## Next steps {% ifversion fpt or ghes > 3.1 or ghec %}You can view, filter, and sort security alerts for repositories owned by your organization in the security overview. For more information, see "[About the security overview](/code-security/security-overview/about-the-security-overview)."{% endif %} -You can view and manage alerts from security features to address dependencies and vulnerabilities in your code. For more information, see {% ifversion fpt or ghes or ghec %} "[Viewing and updating vulnerable dependencies in your repository](/code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository),"{% endif %} {% ifversion fpt or ghec or ghes > 3.2 %}"[Managing pull requests for dependency updates](/code-security/supply-chain-security/managing-pull-requests-for-dependency-updates)," {% endif %}"[Managing {% data variables.product.prodname_code_scanning %} for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)," and "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." +You can view and manage alerts from security features to address dependencies and vulnerabilities in your code. For more information, see {% ifversion fpt or ghes or ghec %} "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository),"{% endif %} {% ifversion fpt or ghec or ghes > 3.2 %}"[Managing pull requests for dependency updates](/code-security/supply-chain-security/managing-pull-requests-for-dependency-updates)," {% endif %}"[Managing {% data variables.product.prodname_code_scanning %} for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)," and "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." {% ifversion fpt or ghec %}If you have a security vulnerability, you can create a security advisory to privately discuss and fix the vulnerability. For more information, see "[About {% data variables.product.prodname_security_advisories %}](/code-security/security-advisories/about-github-security-advisories)" and "[Creating a security advisory](/code-security/security-advisories/creating-a-security-advisory)." {% endif %} diff --git a/translations/ja-JP/content/code-security/getting-started/securing-your-repository.md b/translations/ja-JP/content/code-security/getting-started/securing-your-repository.md index 293eb3185b54..1073b342f8cb 100644 --- a/translations/ja-JP/content/code-security/getting-started/securing-your-repository.md +++ b/translations/ja-JP/content/code-security/getting-started/securing-your-repository.md @@ -75,7 +75,7 @@ For more information, see "[Exploring the dependencies of a repository](/code-se {% data reusables.dependabot.dependabot-alerts-beta %} {% data reusables.dependabot.dependabot-alerts-dependency-graph-enterprise %} -For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies){% ifversion fpt or ghec %}" and "[Managing security and analysis settings for your user account](/github/setting-up-and-managing-your-github-user-account/managing-security-and-analysis-settings-for-your-user-account){% endif %}." +For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies){% ifversion fpt or ghec %}" and "[Managing security and analysis settings for your user account](/github/setting-up-and-managing-your-github-user-account/managing-security-and-analysis-settings-for-your-user-account){% endif %}." {% endif %} @@ -111,7 +111,7 @@ For more information, see "[About {% data variables.product.prodname_dependabot_ You can enable {% data variables.product.prodname_dependabot %} to automatically raise pull requests to keep your dependencies up-to-date. For more information, see "[About {% data variables.product.prodname_dependabot_version_updates %}](/code-security/supply-chain-security/about-dependabot-version-updates)." -To enable {% data variables.product.prodname_dependabot_version_updates %}, you must create a *dependabot.yml* configuration file. For more information, see "[Enabling and disabling {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." +To enable {% data variables.product.prodname_dependabot_version_updates %}, you must create a *dependabot.yml* configuration file. For more information, see "[Configuring {% data variables.product.prodname_dependabot %} version updates](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates)." {% endif %} @@ -132,7 +132,7 @@ You can set up {% data variables.product.prodname_code_scanning %} to automatica {% endif %} ## Next steps -You can view and manage alerts from security features to address dependencies and vulnerabilities in your code. For more information, see {% ifversion fpt or ghes or ghec %} "[Viewing and updating vulnerable dependencies in your repository](/code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository),"{% endif %} {% ifversion fpt or ghec or ghes > 3.2 %}"[Managing pull requests for dependency updates](/code-security/supply-chain-security/managing-pull-requests-for-dependency-updates)," {% endif %}"[Managing {% data variables.product.prodname_code_scanning %} for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)," and "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." +You can view and manage alerts from security features to address dependencies and vulnerabilities in your code. For more information, see {% ifversion fpt or ghes or ghec %} "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/code-security/supply-chain-security/viewing-and-updating-vulnerable-dependencies-in-your-repository),"{% endif %} {% ifversion fpt or ghec or ghes > 3.2 %}"[Managing pull requests for dependency updates](/code-security/supply-chain-security/managing-pull-requests-for-dependency-updates)," {% endif %}"[Managing {% data variables.product.prodname_code_scanning %} for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)," and "[Managing alerts from {% data variables.product.prodname_secret_scanning %}](/code-security/secret-security/managing-alerts-from-secret-scanning)." {% ifversion fpt or ghec %}If you have a security vulnerability, you can create a security advisory to privately discuss and fix the vulnerability. For more information, see "[About {% data variables.product.prodname_security_advisories %}](/code-security/security-advisories/about-github-security-advisories)" and "[Creating a security advisory](/code-security/security-advisories/creating-a-security-advisory)." {% endif %} diff --git a/translations/ja-JP/content/code-security/guides.md b/translations/ja-JP/content/code-security/guides.md index 75e6b0fd262f..a0e505f2678b 100644 --- a/translations/ja-JP/content/code-security/guides.md +++ b/translations/ja-JP/content/code-security/guides.md @@ -75,7 +75,6 @@ includeGuides: - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/browsing-security-vulnerabilities-in-the-github-advisory-database - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/editing-security-advisories-in-the-github-advisory-database - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates diff --git a/translations/ja-JP/content/code-security/index.md b/translations/ja-JP/content/code-security/index.md index 19f3861138df..e7248afec2a2 100644 --- a/translations/ja-JP/content/code-security/index.md +++ b/translations/ja-JP/content/code-security/index.md @@ -54,6 +54,7 @@ children: - /code-scanning - /repository-security-advisories - /supply-chain-security + - /dependabot - /security-overview - /guides --- diff --git a/translations/ja-JP/content/code-security/security-overview/about-the-security-overview.md b/translations/ja-JP/content/code-security/security-overview/about-the-security-overview.md index 6bbc0ee124c0..d4a6e3f0206c 100644 --- a/translations/ja-JP/content/code-security/security-overview/about-the-security-overview.md +++ b/translations/ja-JP/content/code-security/security-overview/about-the-security-overview.md @@ -28,7 +28,7 @@ shortTitle: About security overview セキュリティの概要は、Organizationのセキュリティの状況の高レベルでの表示、あるいは介入が必要な問題のあるリポジトリを特定するために利用できます。 You can view aggregate or repository-specific security information in the security overview. You can also use the security overview to see which security features are enabled for your repositories and to configure any available security features that are not currently in use. -The security overview indicates whether {% ifversion fpt or ghes > 3.1 or ghec %}security{% endif %}{% ifversion ghae %}{% data variables.product.prodname_GH_advanced_security %}{% endif %} features are enabled for repositories owned by your organization and consolidates alerts for each feature.{% ifversion fpt or ghes > 3.1 or ghec %} Security features include {% data variables.product.prodname_GH_advanced_security %} features, such as {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, as well as {% data variables.product.prodname_dependabot_alerts %}.{% endif %} For more information about {% data variables.product.prodname_GH_advanced_security %} features, see "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)."{% ifversion fpt or ghes > 3.1 or ghec %} For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)."{% endif %} +The security overview indicates whether {% ifversion fpt or ghes > 3.1 or ghec %}security{% endif %}{% ifversion ghae %}{% data variables.product.prodname_GH_advanced_security %}{% endif %} features are enabled for repositories owned by your organization and consolidates alerts for each feature.{% ifversion fpt or ghes > 3.1 or ghec %} Security features include {% data variables.product.prodname_GH_advanced_security %} features, such as {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, as well as {% data variables.product.prodname_dependabot_alerts %}.{% endif %} For more information about {% data variables.product.prodname_GH_advanced_security %} features, see "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)."{% ifversion fpt or ghes > 3.1 or ghec %} For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)."{% endif %} For more information about securing your code at the repository and organization levels, see "[Securing your repository](/code-security/getting-started/securing-your-repository)" and "[Securing your organization](/code-security/getting-started/securing-your-organization)." @@ -50,13 +50,13 @@ For each repository in the security overview, you will see icons for each type o ![セキュリティの概要中のアイコン](/assets/images/help/organizations/security-overview-icons.png) -| アイコン | 意味 | -| ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| {% octicon "code-square" aria-label="Code scanning alerts" %} | {% data variables.product.prodname_code_scanning_capc %} アラート. 詳しい情報については「[{% data variables.product.prodname_code_scanning %}について](/code-security/secure-coding/about-code-scanning)」を参照してください。 | -| {% octicon "key" aria-label="Secret scanning alerts" %} | {% data variables.product.prodname_secret_scanning_caps %} アラート. 詳しい情報については「[{% data variables.product.prodname_secret_scanning %}について](/code-security/secret-security/about-secret-scanning)」を参照してください。 | -| {% octicon "hubot" aria-label="Dependabot alerts" %} | {% data variables.product.prodname_dependabot_alerts %}について受ける方法は、カスタマイズできます。 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)」を参照してください。 | -| {% octicon "check" aria-label="Check" %} | The security feature is enabled, but does not raise alerts in this repository. | -| {% octicon "x" aria-label="x" %} | The security feature is not supported in this repository. | +| アイコン | 意味 | +| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| {% octicon "code-square" aria-label="Code scanning alerts" %} | {% data variables.product.prodname_code_scanning_capc %} アラート. 詳しい情報については「[{% data variables.product.prodname_code_scanning %}について](/code-security/secure-coding/about-code-scanning)」を参照してください。 | +| {% octicon "key" aria-label="Secret scanning alerts" %} | {% data variables.product.prodname_secret_scanning_caps %} アラート. 詳しい情報については「[{% data variables.product.prodname_secret_scanning %}について](/code-security/secret-security/about-secret-scanning)」を参照してください。 | +| {% octicon "hubot" aria-label="Dependabot alerts" %} | {% data variables.product.prodname_dependabot_alerts %}について受ける方法は、カスタマイズできます。 For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)." | +| {% octicon "check" aria-label="Check" %} | The security feature is enabled, but does not raise alerts in this repository. | +| {% octicon "x" aria-label="x" %} | The security feature is not supported in this repository. | The security overview displays active alerts raised by security features. リポジトリに対してセキュリティの概要でアラートがない場合でも、検出されていないセキュリティ脆弱性やコードのエラーは存在するかもしれません。 diff --git a/translations/ja-JP/content/code-security/supply-chain-security/index.md b/translations/ja-JP/content/code-security/supply-chain-security/index.md index 69c78b07b72f..93a4d082a958 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/index.md +++ b/translations/ja-JP/content/code-security/supply-chain-security/index.md @@ -16,8 +16,6 @@ topics: - Repositories children: - /understanding-your-software-supply-chain - - /keeping-your-dependencies-updated-automatically - - /managing-vulnerabilities-in-your-projects-dependencies - /end-to-end-supply-chain --- diff --git a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/index.md b/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/index.md deleted file mode 100644 index 96d217d37f60..000000000000 --- a/translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/index.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: 依存関係を自動的に更新する -intro: '{% data variables.product.prodname_dependabot %} はリポジトリの依存関係を自動的に維持することができます。' -redirect_from: - - /github/administering-a-repository/keeping-your-dependencies-updated-automatically -versions: - fpt: '*' - ghec: '*' - ghes: '>3.2' -topics: - - Repositories - - Dependabot - - Version updates - - Dependencies - - Pull requests -children: - - /about-dependabot-version-updates - - /enabling-and-disabling-dependabot-version-updates - - /listing-dependencies-configured-for-version-updates - - /managing-pull-requests-for-dependency-updates - - /automating-dependabot-with-github-actions - - /managing-encrypted-secrets-for-dependabot - - /customizing-dependency-updates - - /configuration-options-for-dependency-updates - - /keeping-your-actions-up-to-date-with-dependabot -shortTitle: 依存関係の自動更新 ---- - -{% data reusables.dependabot.beta-security-and-version-updates %} diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies.md b/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies.md deleted file mode 100644 index 23eab349d8b6..000000000000 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-managing-vulnerable-dependencies.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: 脆弱性のある依存関係の管理について -intro: '{% data variables.product.product_name %} は、既知の脆弱性を含むサードパーティソフトウェアの使用を回避するのに役立ちます。' -redirect_from: - - /github/managing-security-vulnerabilities/about-managing-vulnerable-dependencies - - /code-security/supply-chain-security/about-managing-vulnerable-dependencies -versions: - fpt: '*' - ghes: '>=3.2' - ghae: issue-4864 - ghec: '*' -type: overview -topics: - - Dependabot - - Dependency graph - - Dependency review - - Vulnerabilities - - Repositories - - Dependencies - - Pull requests -shortTitle: 脆弱性のある依存関係 ---- - - - -{% data variables.product.product_name %} は、脆弱性のある依存関係を削除および回避するための次のツールを提供しています。 - -## 依存関係グラフ -依存関係グラフは、リポジトリに保存されているマニフェストファイルおよびロックファイルのサマリーです。 コードベースが依存するエコシステムとパッケージ（依存関係）、およびプロジェクトに依存するリポジトリとパッケージ（依存関係）が表示されます。 依存関係グラフの情報は、依存関係のレビューと {% data variables.product.prodname_dependabot %} によって使用されます。 詳しい情報については、「[依存関係グラフについて](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)」を参照してください。 - -## 依存関係のレビュー - -{% data reusables.dependency-review.beta %} - -プルリクエストの依存関係のレビューを確認することで、依存関係からコードベースに脆弱性が発生するのを防ぐことができます。 プルリクエストが脆弱性のある依存関係を追加したり、依存関係を脆弱性のあるバージョンに変更した場合、これは依存関係のレビューで強調表示されます。 プルリクエストをマージする前に、依存関係をパッチを適用したバージョンに変更できます。 詳しい情報については「[依存関係のレビュー](/code-security/supply-chain-security/about-dependency-review)」を参照してください。 - -## {% data variables.product.prodname_dependabot_alerts %} -リポジトリ内の脆弱性のある依存関係を検出すると、{% data variables.product.product_name %} は {% data variables.product.prodname_dependabot_alerts %} を作成できます。 アラートは、リポジトリの [Security] タブに表示されます。 アラートには、プロジェクト内で影響を受けるファイルへのリンクと、修正バージョンに関する情報が含まれています。 {% data variables.product.product_name %} は、通知設定に従って、リポジトリのメンテナにも通知します。 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)」を参照してください。 - -{% ifversion fpt or ghec or ghes > 3.2 %} -## {% data variables.product.prodname_dependabot_security_updates %} -{% data variables.product.product_name %} がリポジトリ内の脆弱性のある依存関係に対して {% data variables.product.prodname_dependabot %} アラートが発生すると、{% data variables.product.prodname_dependabot %} は自動的にそれを修正しようとします。 {% data variables.product.prodname_dependabot_security_updates %} は、脆弱性のある依存関係を修正バージョンに更新するプルリクエストを自動的に生成します。 詳しい情報については、「[{% data variables.product.prodname_dependabot_security_updates %} について](/github/managing-security-vulnerabilities/about-dependabot-security-updates)」を参照してください。 - -## {% data variables.product.prodname_dependabot_version_updates %} -{% data variables.product.prodname_dependabot_version_updates %} を有効にすると、依存関係を維持する手間が省けます。 {% data variables.product.prodname_dependabot_version_updates %} を使用すると、{% data variables.product.prodname_dotcom %} が古い依存関係を識別するたびに、マニフェストを最新バージョンの依存関係に更新するためのプルリクエストを発行します。 対照的に、{% data variables.product.prodname_dependabot_security_updates %} は脆弱性のある依存関係を修正するためにプルリクエストのみを発行します。 詳しい情報については、「[ Dependabot のバージョン更新について](/github/administering-a-repository/about-dependabot-version-updates)」を参照してください。 -{% endif %} diff --git a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/index.md b/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/index.md deleted file mode 100644 index 150d83c73486..000000000000 --- a/translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/index.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: プロジェクトの依存関係にある脆弱性を管理する -intro: 'You can track your repository''s dependencies and receive {% data variables.product.prodname_dependabot_alerts %} when {% data variables.product.product_name %} detects vulnerable dependencies.' -redirect_from: - - /articles/updating-your-project-s-dependencies - - /articles/updating-your-projects-dependencies - - /articles/managing-security-vulnerabilities-in-your-projects-dependencies - - /articles/managing-vulnerabilities-in-your-projects-dependencies - - /github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies -versions: - fpt: '*' - ghes: '*' - ghae: issue-4864 - ghec: '*' -topics: - - Repositories - - Dependabot - - Version updates - - Dependencies - - Pull requests - - Vulnerabilities - - Alerts -children: - - /about-managing-vulnerable-dependencies - - /browsing-security-vulnerabilities-in-the-github-advisory-database - - /editing-security-advisories-in-the-github-advisory-database - - /about-alerts-for-vulnerable-dependencies - - /configuring-notifications-for-vulnerable-dependencies - - /about-dependabot-security-updates - - /configuring-dependabot-security-updates - - /viewing-and-updating-vulnerable-dependencies-in-your-repository - - /troubleshooting-the-detection-of-vulnerable-dependencies - - /troubleshooting-dependabot-errors -shortTitle: 脆弱性のある依存関係の修復 ---- - diff --git a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review.md b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review.md index 72a04be9efb3..cc0a6df48cd6 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review.md +++ b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review.md @@ -41,7 +41,7 @@ Dependency review is available when dependency graph is enabled for {% data vari プルリクエストで依存関係のレビューを確認し、脆弱性としてフラグが付けられている依存関係を変更することで、プロジェクトに脆弱性が追加されるのを防ぐことができます。 依存関係のレビューの動作に関する詳しい情報については「[Pull Request中の依存関係の変更のレビュー](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request)」を参照してください。 -{% data variables.product.prodname_dependabot_alerts %} は、すでに依存関係にある脆弱性を検出しますが、あとで修正するよりも、潜在的な問題が持ち込まれることを回避する方がはるかに良いです。 {% data variables.product.prodname_dependabot_alerts %} に関する詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)」を参照してください。 +{% data variables.product.prodname_dependabot_alerts %} は、すでに依存関係にある脆弱性を検出しますが、あとで修正するよりも、潜在的な問題が持ち込まれることを回避する方がはるかに良いです。 For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)." 依存関係のレビューは、依存関係グラフと同じ言語とパッケージ管理エコシステムをサポートしています。 詳しい情報については、「[依存関係グラフについて](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)」を参照してください。 diff --git a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md new file mode 100644 index 000000000000..6ff3e6e9edda --- /dev/null +++ b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md @@ -0,0 +1,156 @@ +--- +title: About supply chain security +intro: '{% data variables.product.product_name %} helps you secure your supply chain, from understanding the dependencies in your environment, to knowing about vulnerabilities in those dependencies{% ifversion fpt or ghec or ghes > 3.2 %}, and patching them{% endif %}.' +miniTocMaxHeadingLevel: 3 +shortTitle: Supply chain security +redirect_from: + - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies +versions: + fpt: '*' + ghes: '*' + ghae: issue-4864 + ghec: '*' +type: overview +topics: + - Advanced Security + - Dependency review + - Dependency graph + - Vulnerabilities + - Dependencies + - Pull requests + - Repositories +--- + +## About supply chain security at GitHub + +With the accelerated use of open source, most projects depend on hundreds of open-source dependencies. This poses a security problem: what if the dependencies you're using are vulnerable? You could be putting your users at risk of a supply chain attack. One of the most important things you can do to protect your supply chain is to patch your vulnerabilities. + +You add dependencies directly to your supply chain when you specify them in a manifest file or a lockfile. Dependencies can also be included transitively, that is, even if you don’t specify a particular dependency, but a dependency of yours uses it, then you’re also dependent on that dependency. + +{% data variables.product.product_name %} offers a range of features to help you understand the dependencies in your environment{% ifversion ghes < 3.3 or ghae %} and know about vulnerabilities in those dependencies{% endif %}{% ifversion fpt or ghec or ghes > 3.2 %}, know about vulnerabilities in those dependencies, and patch them{% endif %}. + +The supply chain features on {% data variables.product.product_name %} are: +- **Dependency graph** +{% ifversion fpt or ghec or ghes > 3.1 or ghae %}- **Dependency review**{% endif %} +- **{% data variables.product.prodname_dependabot_alerts %} ** +{% ifversion fpt or ghec or ghes > 3.2 %}- **{% data variables.product.prodname_dependabot_updates %}** + - **{% data variables.product.prodname_dependabot_security_updates %}** + - **{% data variables.product.prodname_dependabot_version_updates %}**{% endif %} + +The dependency graph is central to supply chain security. The dependency graph identifies all upstream dependencies and public downstream dependents of a repository or package. You can see your repository’s dependencies and some of their properties, like vulnerability information, on the dependency graph for the repository. + +{% ifversion fpt or ghec or ghes > 3.1 or ghae %} +Other supply chain features on {% data variables.product.prodname_dotcom %} rely on the information provided by the dependency graph. + +- Dependency review uses the dependency graph to identify dependency changes and help you understand the security impact of these changes when you review pull requests. +- {% data variables.product.prodname_dependabot %} cross-references dependency data provided by the dependency graph with the list of known vulnerabilities published in the {% data variables.product.prodname_advisory_database %}, scans your dependecies and generates {% data variables.product.prodname_dependabot_alerts %} when a potential vulnerability is detected. +{% ifversion fpt or ghec or ghes > 3.2 %}- {% data variables.product.prodname_dependabot_security_updates %} use the dependency graph and {% data variables.product.prodname_dependabot_alerts %} to help you update dependencies with known vulnerabilities in your repository. + +{% data variables.product.prodname_dependabot_version_updates %} don't use the dependency graph and rely on the semantic versioning of dependencies instead. {% data variables.product.prodname_dependabot_version_updates %} help you keep your dependencies updated, even when they don’t have any vulnerabilities. +{% endif %} +{% endif %} + +{% ifversion ghes < 3.2 %} +{% data variables.product.prodname_dependabot %} cross-references dependency data provided by the dependency graph with the list of known vulnerabilities published in the {% data variables.product.prodname_advisory_database %}, scans your dependencies and generates {% data variables.product.prodname_dependabot_alerts %} when a potential vulnerability is detected. + {% endif %} + +## Feature overview + +### What is the dependency graph + +To generate the dependency graph, {% data variables.product.company_short %} looks at a repository’s explicit dependencies declared in the manifest and lockfiles. When enabled, the dependency graph automatically parses all known package manifest files in the repository, and uses this to construct a graph with known dependency names and versions. + +- The dependency graph includes information on your _direct_ dependencies and _transitive_ dependencies. +- The dependency graph is automatically updated when you push a commit to {% data variables.product.company_short %} that changes or adds a supported manifest or lock file to the default branch, and when anyone pushes a change to the repository of one of your dependencies. +- You can see the dependency graph by opening the repository's main page on {% data variables.product.product_name %}, and navigating to the **Insights** tab. + +For more information about the dependency graph, see "[About the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)." + +{% ifversion fpt or ghec or ghes > 3.1 or ghae %} +### What is dependency review + +Dependency review helps reviewers and contributors understand dependency changes and their security impact in every pull request. + +- Dependency review tells you which dependencies were added, removed, or updated, in a pull request. You can use the release dates, popularity of dependencies, and vulnerability information to help you decide whether to accept the change. +- You can see the dependency review for a pull request by showing the rich diff on the **Files Changed** tab. + +For more information about dependency review, see "[About dependency review](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review)." + +{% endif %} + +### What is Dependabot + +{% data variables.product.prodname_dependabot %} keeps your dependencies up to date by informing you of any security vulnerabilities in your dependencies{% ifversion fpt or ghec or ghes > 3.2 or ghae %}, and automatically opens pull requests to upgrade your dependencies to the next available secure version when a {% data variables.product.prodname_dependabot %} alert is triggered, or to the latest version when a release is published{% else %} so that you can update that dependency{% endif %}. + +{% ifversion fpt or ghec or ghes > 3.2 %} +The term "{% data variables.product.prodname_dependabot %}" encompasses the following features: +- {% data variables.product.prodname_dependabot_alerts %}—Displayed notification on the **Security** tab for the repository, and in the repository's dependency graph. The alert includes a link to the affected file in the project, and information about a fixed version. +- {% data variables.product.prodname_dependabot_updates %}: + - {% data variables.product.prodname_dependabot_security_updates %}—Triggered updates to upgrade your dependencies to a secure version when an alert is triggered. + - {% data variables.product.prodname_dependabot_version_updates %}—Scheduled updates to keep your dependencies up to date with the latest version. +{% endif %} + +#### What are Dependabot alerts + +{% data variables.product.prodname_dependabot_alerts %} highlight repositories affected by a newly discovered vulnerability based on the dependency graph and the {% data variables.product.prodname_advisory_database %}, which contains the versions on known vulnerability lists. + +- {% data variables.product.prodname_dependabot %} performs a scan to detect vulnerable dependencies and sends {% data variables.product.prodname_dependabot_alerts %} when: +{% ifversion fpt or ghec %} + - A new vulnerability is added to the {% data variables.product.prodname_advisory_database %}.{% else %} + - New advisory data is synchronized to {% data variables.product.product_location %} each hour from {% data variables.product.prodname_dotcom_the_website %}. {% data reusables.security-advisory.link-browsing-advisory-db %}{% endif %} + - The dependency graph for the repository changes. +- {% data variables.product.prodname_dependabot_alerts %} are displayed {% ifversion fpt or ghec or ghes > 3.0 %} on the **Security** tab for the repository and{% endif %} in the repository's dependency graph. The alert includes {% ifversion fpt or ghec or ghes > 3.0 %}a link to the affected file in the project, and {% endif %}information about a fixed version. + +For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies)." + +{% ifversion fpt or ghec or ghes > 3.2 %} +#### What are Dependabot updates + +There are two types of {% data variables.product.prodname_dependabot_updates %}: {% data variables.product.prodname_dependabot %} _security_ updates and _version_ updates. {% data variables.product.prodname_dependabot %} generates automatic pull requests to update your dependencies in both cases, but there are several differences. + +{% data variables.product.prodname_dependabot_security_updates %}: + - Triggered by a {% data variables.product.prodname_dependabot %} alert + - Update dependencies to the minimum version that resolves a known vulnerability + - Supported for ecosystems the dependency graph supports + +{% data variables.product.prodname_dependabot_version_updates %}: + - Run on a schedule you configure + - Update dependencies to the latest version that matches the configuration + - Supported for a different group of ecosystems + +For more information about {% data variables.product.prodname_dependabot_updates %}, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates)" and "[About {% data variables.product.prodname_dependabot_version_updates %}](/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates)." +{% endif %} + +## Feature availability + +{% ifversion fpt or ghec %} + +Public repositories: +- **Dependency graph**—enabled by default and cannot be disabled. +- **Dependency review**—enabled by default and cannot be disabled. +- **{% data variables.product.prodname_dependabot_alerts %}**—not enabled by default. {% data variables.product.prodname_dotcom %} detects vulnerable dependencies and displays information in the dependency graph, but does not generate {% data variables.product.prodname_dependabot_alerts %} by default. Repository owners or people with admin access can enable {% data variables.product.prodname_dependabot_alerts %}. + You can also enable or disable Dependabot alerts for all repositories owned by your user account or organization. For more information, see "[Managing security and analysis settings for your user account](/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account)" or "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization)." + +Private repositories: +- **Dependency graph**—not enabled by default. The feature can be enabled by repository administrators. For more information, see "[Exploring the dependencies of a repository](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)." +{% ifversion fpt %} +- **Dependency review**—available in private repositories owned by organizations that use {% data variables.product.prodname_ghe_cloud %} and have a license for {% data variables.product.prodname_GH_advanced_security %}. For more information, see the [{% data variables.product.prodname_ghe_cloud %} documentation](/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review). +{% elsif ghec %} +- **Dependency review**—available in private repositories owned by organizations provided you have a license for {% data variables.product.prodname_GH_advanced_security %} and the dependency graph enabled. For more information, see "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)" and "[Exploring the dependencies of a repository](/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#enabling-and-disabling-the-dependency-graph-for-a-private-repository)." +{% endif %} +- **{% data variables.product.prodname_dependabot_alerts %}**—not enabled by default. Owners of private repositories, or people with admin access, can enable {% data variables.product.prodname_dependabot_alerts %} by enabling the dependency graph and {% data variables.product.prodname_dependabot_alerts %} for their repositories. + You can also enable or disable Dependabot alerts for all repositories owned by your user account or organization. For more information, see "[Managing security and analysis settings for your user account](/account-and-profile/setting-up-and-managing-your-github-user-account/managing-user-account-settings/managing-security-and-analysis-settings-for-your-user-account)" or "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization)." + +Any repository type: +- **{% data variables.product.prodname_dependabot_security_updates %}**—not enabled by default. You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)." +- **{% data variables.product.prodname_dependabot_version_updates %}**—not enabled by default. People with write permissions to a repository can enable {% data variables.product.prodname_dependabot_version_updates %}. For information about enabling security updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)." +{% endif %} + +{% ifversion ghes or ghae %} +- **Dependency graph** and **{% data variables.product.prodname_dependabot_alerts %}**—not enabled by default. Both features are configured at an enterprise level by the enterprise owner. For more information, see {% ifversion ghes %}"[Enabling the dependency graph for your enterprise](/admin/code-security/managing-supply-chain-security-for-your-enterprise/enabling-the-dependency-graph-for-your-enterprise)" and {% endif %}"[Enabling {% data variables.product.prodname_dependabot %} for your enterprise](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise)." +- **Dependency review**—available when dependency graph is enabled for {% data variables.product.product_location %} and {% data variables.product.prodname_advanced_security %} is enabled for the organization or repository. For more information, see "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)." +{% endif %} +{% ifversion ghes > 3.2 %} +- **{% data variables.product.prodname_dependabot_security_updates %}**—not enabled by default. You can enable {% data variables.product.prodname_dependabot_security_updates %} for any repository that uses {% data variables.product.prodname_dependabot_alerts %} and the dependency graph. For more information, see "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates)." +- **{% data variables.product.prodname_dependabot_version_updates %}**—not enabled by default. People with write permissions to a repository can enable {% data variables.product.prodname_dependabot_version_updates %}. For information about enabling security updates, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)." +{% endif %} diff --git a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md index 53c972c93fa8..91b871b9efcf 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md +++ b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md @@ -55,7 +55,7 @@ You can use the dependency graph to: - Explore the repositories your code depends on{% ifversion fpt or ghec %}, and those that depend on it{% endif %}. For more information, see "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)." {% ifversion fpt or ghec %} - View a summary of the dependencies used in your organization's repositories in a single dashboard. For more information, see "[Viewing insights for your organization](/articles/viewing-insights-for-your-organization#viewing-organization-dependency-insights)."{% endif %} -- View and update vulnerable dependencies for your repository. For more information, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)."{% ifversion fpt or ghes > 3.1 or ghec %} +- View and update vulnerable dependencies for your repository. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/code-security/supply-chain-security/about-alerts-for-vulnerable-dependencies)."{% ifversion fpt or ghes > 3.1 or ghec %} - See information about vulnerable dependencies in pull requests. For more information, see "[Reviewing dependency changes in a pull request](/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-dependency-changes-in-a-pull-request)."{% endif %} ## Enabling the dependency graph @@ -111,5 +111,5 @@ The recommended formats explicitly define which versions are used for all direct - "[Dependency graph](https://en.wikipedia.org/wiki/Dependency_graph)" on Wikipedia - "[Exploring the dependencies of a repository](/github/visualizing-repository-data-with-graphs/exploring-the-dependencies-of-a-repository)"{% ifversion fpt or ghec %} - "[Viewing insights for your organization](/organizations/collaborating-with-groups-in-organizations/viewing-insights-for-your-organization)"{% endif %} -- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" - "[Troubleshooting the detection of vulnerable dependencies](/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies)" diff --git a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md index 0b53c0aa2c84..6a51a337433b 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md +++ b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository.md @@ -40,7 +40,7 @@ Enterprise owners can configure the dependency graph at an enterprise level. For ### 依存関係ビュー {% ifversion fpt or ghec %} -依存関係はエコシステム別にグループ化されます。 依存関係を拡張すると、その依存関係を表示できます。 {% data variables.product.product_name %}でホストされているパブリックリポジトリの依存関係については、クリックしてそのリポジトリを見ることもできます。 プライベートリポジトリ、プライベートパッケージ、認識できないファイルの依存関係は、プレーンテキストで表示されます。 +依存関係はエコシステム別にグループ化されます。 依存関係を拡張すると、その依存関係を表示できます。 プライベートリポジトリ、プライベートパッケージ、認識できないファイルの依存関係は、プレーンテキストで表示されます。 If the package manager for the dependency is in a public repository, {% data variables.product.product_name %} will display a link to that repository. リポジトリで脆弱性が検出された場合は、{% data variables.product.prodname_dependabot_alerts %}にアクセスできるユーザに、ビューの上部で表示されます。 @@ -83,7 +83,10 @@ Enterprise owners can configure the dependency graph at an enterprise level. For ## "Used by"パッケージの変更 -依存関係グラフが有効になっている場合、サポートされているパッケージエコシステム上で公開されているパッケージをリポジトリが含んでいると、{% data variables.product.prodname_dotcom %}はリポジトリの**Code**タブのサイドバー内の"Used by"セクションに表示します。 サポートされているパッケージエコシステムに関する詳しい情報については「[依存関係グラフについて](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)」を参照してください。 +You may notice some repositories have a "Used by" section in the sidebar of the **Code** tab. Your repository will have a "Used by" section if: + * The dependency graph is enabled for the repository (see the above section for more details). + * Your repository contains a package that is published on a [supported package ecosystem](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems). + * Within the ecosystem, your package has a link to a _public_ repository where the source is stored. "Used by"セクションは、見つかったパッケージに対する公開参照数を示し、依存物のプロジェクトのオーナーのアバターを表示します。 @@ -112,7 +115,7 @@ Enterprise owners can configure the dependency graph at an enterprise level. For ## 参考リンク - [依存関係グラフについて](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph) -- [リポジトリ内の脆弱な依存関係を表示・更新する](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository){% ifversion fpt or ghec %} +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)"{% ifversion fpt or ghec %} - [Organization のインサイトを表示する](/organizations/collaborating-with-groups-in-organizations/viewing-insights-for-your-organization) - [{% data variables.product.prodname_dotcom %}によるデータの利用と保護の方法の理解](/get-started/privacy-on-github) {% endif %} diff --git a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/index.md b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/index.md index faf0f20e3ea7..46fe16bc265f 100644 --- a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/index.md +++ b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/index.md @@ -9,10 +9,12 @@ topics: - Dependency graph - Dependencies - Repositories +shortTitle: Understand your supply chain children: + - /about-supply-chain-security - /about-the-dependency-graph - - /exploring-the-dependencies-of-a-repository - /about-dependency-review -shortTitle: Understand your supply chain + - /exploring-the-dependencies-of-a-repository + - /troubleshooting-the-dependency-graph --- diff --git a/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md new file mode 100644 index 000000000000..6de1b7a25da5 --- /dev/null +++ b/translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md @@ -0,0 +1,62 @@ +--- +title: Troubleshooting the dependency graph +intro: 'If the dependency information reported by the dependency graph is not what you expected, there are a number of points to consider, and various things you can check.' +shortTitle: Troubleshoot dependency graph +versions: + fpt: '*' + ghes: '*' + ghae: issue-4864 + ghec: '*' +type: how_to +topics: + - Troubleshooting + - Errors + - Dependencies + - Vulnerabilities + - Dependency graph + - CVEs + - Repositories +--- + +{% data reusables.dependabot.result-discrepancy %} + +## Does the dependency graph only find dependencies in manifests and lockfiles? + +The dependency graph includes information on dependencies that are explicitly declared in your environment. That is, dependencies that are specified in a manifest or a lockfile. The dependency graph generally also includes transitive dependencies, even when they aren't specified in a lockfile, by looking at the dependencies of the dependencies in a manifest file. + +The dependency graph doesn't include "loose" dependencies. "Loose" dependencies are individual files that are copied from another source and checked into the repository directly or within an archive (such as a ZIP or JAR file), rather than being referenced by in a package manager’s manifest or lockfile. + +**Check**: Is the missing dependency for a component that's not specified in the repository's manifest or lockfile? + +## Does the dependency graph detect dependencies specified using variables? + +The dependency graph analyzes manifests as they’re pushed to {% data variables.product.prodname_dotcom %}. The dependency graph doesn't, therefore, have access to the build environment of the project, so it can't resolve variables used within manifests. If you use variables within a manifest to specify the name, or more commonly the version of a dependency, then that dependency will not be included in the dependency graph. + +**Check**: Is the missing dependency declared in the manifest by using a variable for its name or version? + +## Are there limits which affect the dependency graph data? + +Yes, the dependency graph has two categories of limits: + +1. **Processing limits** + + These affect the dependency graph displayed within {% data variables.product.prodname_dotcom %} and also prevent {% data variables.product.prodname_dependabot_alerts %} being created. + + Manifests over 0.5 MB in size are only processed for enterprise accounts. For other accounts, manifests over 0.5 MB are ignored and will not create {% data variables.product.prodname_dependabot_alerts %}. + + By default, {% data variables.product.prodname_dotcom %} will not process more than 20 manifests per repository. {% data variables.product.prodname_dependabot_alerts %} are not created for manifests beyond this limit. If you need to increase the limit, contact {% data variables.contact.contact_support %}. + +2. **Visualization limits** + + These affect what's displayed in the dependency graph within {% data variables.product.prodname_dotcom %}. However, they don't affect the {% data variables.product.prodname_dependabot_alerts %} that are created. + + The Dependencies view of the dependency graph for a repository only displays 100 manifests. Typically this is adequate as it is significantly higher than the processing limit described above. In situations where the processing limit is over 100, {% data variables.product.prodname_dependabot_alerts %} are still created for any manifests that are not shown within {% data variables.product.prodname_dotcom %}. + +**Check**: Is the missing dependency in a manifest file that's over 0.5 MB, or in a repository with a large number of manifests? + +## Further reading + +- "[About the dependency graph](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)" +- "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" +- "[Troubleshooting the detection of vulnerable dependencies](/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies)"{% ifversion fpt or ghec or ghes > 3.2 %} +- "[Troubleshooting {% data variables.product.prodname_dependabot %} errors](/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors)"{% endif %} \ No newline at end of file diff --git a/translations/ja-JP/content/developers/apps/building-github-apps/creating-a-github-app-using-url-parameters.md b/translations/ja-JP/content/developers/apps/building-github-apps/creating-a-github-app-using-url-parameters.md index 1ea731f222b7..01b7f9dca6af 100644 --- a/translations/ja-JP/content/developers/apps/building-github-apps/creating-a-github-app-using-url-parameters.md +++ b/translations/ja-JP/content/developers/apps/building-github-apps/creating-a-github-app-using-url-parameters.md @@ -59,39 +59,39 @@ webhook を保護するためにシークレットが必要なアプリケーシ 以下の表にある権限名をクエリパラメータ名として、権限タイプをクエリの値として使用することで、クエリ文字列で権限を設定できます。 たとえば、`contents` のユーザインターフェースに `Read & write` 権限を設定するには、クエリ文字列に `&contents=write` を含めます。 `blocking` のユーザインターフェースに `Read-only` 権限を設定するには、クエリ文字列に `&blocking=read` を含めます。 `checks` のユーザインターフェースに `no-access` を設定するには、クエリ文字列に `checks` 権限を含めないようにします。 -| 権限 | 説明 | -| -------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 権限 | 説明 | +| -------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`administration`](/rest/reference/permissions-required-for-github-apps/#permission-on-administration) | Organization およびリポジトリ管理のためのさまざまなエンドポイントにアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% ifversion fpt or ghec %} | [`blocking`](/rest/reference/permissions-required-for-github-apps/#permission-on-blocking) | [Blocking Users API](/rest/reference/users#blocking) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% endif %} | [`checks`](/rest/reference/permissions-required-for-github-apps/#permission-on-checks) | [Checks API](/rest/reference/checks) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% ifversion ghes < 3.4 %} | `content_references` | 「[コンテンツ添付の作成](/rest/reference/apps#create-a-content-attachment)」エンドポイントへのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% endif %} -| [`contents`](/rest/reference/permissions-required-for-github-apps/#permission-on-contents) | さまざまなエンドポイントにアクセス権を付与し、リポジトリのコンテンツを変更できるようにします。 `none`、`read`、`write` のいずれかです。 | +| [`contents`](/rest/reference/permissions-required-for-github-apps/#permission-on-contents) | さまざまなエンドポイントにアクセス権を付与し、リポジトリのコンテンツを変更できるようにします。 `none`、`read`、`write` のいずれかです。 | | [`deployments`](/rest/reference/permissions-required-for-github-apps/#permission-on-deployments) | [Deployments API](/rest/reference/repos#deployments) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% ifversion fpt or ghes or ghec %} | [`emails`](/rest/reference/permissions-required-for-github-apps/#permission-on-emails) | [Emails API](/rest/reference/users#emails) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% endif %} -| [`followers`](/rest/reference/permissions-required-for-github-apps/#permission-on-followers) | [Followers API](/rest/reference/users#followers) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | -| [`gpg_keys`](/rest/reference/permissions-required-for-github-apps/#permission-on-gpg-keys) | [GPG Keys API](/rest/reference/users#gpg-keys) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | -| [`issues`](/rest/reference/permissions-required-for-github-apps/#permission-on-issues) | [Issues API](/rest/reference/issues) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | -| [`keys`](/rest/reference/permissions-required-for-github-apps/#permission-on-keys) | [Public Keys API](/rest/reference/users#keys) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| [`followers`](/rest/reference/permissions-required-for-github-apps/#permission-on-followers) | [Followers API](/rest/reference/users#followers) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| [`gpg_keys`](/rest/reference/permissions-required-for-github-apps/#permission-on-gpg-keys) | [GPG Keys API](/rest/reference/users#gpg-keys) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| [`issues`](/rest/reference/permissions-required-for-github-apps/#permission-on-issues) | [Issues API](/rest/reference/issues) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| [`keys`](/rest/reference/permissions-required-for-github-apps/#permission-on-keys) | [Public Keys API](/rest/reference/users#keys) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | | [`members`](/rest/reference/permissions-required-for-github-apps/#permission-on-members) | Organization のメンバーへのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% ifversion fpt or ghec %} -| [`メタデータ`](/rest/reference/permissions-required-for-github-apps/#metadata-permissions) | 機密データを漏洩しない、読み取り専用のエンドポイントへのアクセス権を付与します。 `read`、`none` のいずれかです。 {% data variables.product.prodname_github_app %} に何らかの権限を設定した場合、デフォルトは `read` となり、権限を指定しなかった場合、デフォルトは `none` となります。 | +| [`メタデータ`](/rest/reference/permissions-required-for-github-apps/#metadata-permissions) | 機密データを漏洩しない、読み取り専用のエンドポイントへのアクセス権を付与します。 `read`、`none` のいずれかです。 {% data variables.product.prodname_github_app %} に何らかの権限を設定した場合、デフォルトは `read` となり、権限を指定しなかった場合、デフォルトは `none` となります。 | | [`organization_administration`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-administration) | 「[Organization の更新](/rest/reference/orgs#update-an-organization)」エンドポイントと、[Organization Interaction Restrictions API](/rest/reference/interactions#set-interaction-restrictions-for-an-organization) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% endif %} -| [`organization_hooks`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-hooks) | [Organization Webhooks API](/rest/reference/orgs#webhooks/) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | -| `organization_plan` | 「[Organization の取得](/rest/reference/orgs#get-an-organization)」エンドポイントを使用して Organization のプランについての情報を取得するためのアクセス権を付与します。 `none`、`read` のいずれかです。 | +| [`organization_hooks`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-hooks) | [Organization Webhooks API](/rest/reference/orgs#webhooks/) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| `organization_plan` | 「[Organization の取得](/rest/reference/orgs#get-an-organization)」エンドポイントを使用して Organization のプランについての情報を取得するためのアクセス権を付与します。 `none`、`read` のいずれかです。 | | [`organization_projects`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-projects) | [Projects API](/rest/reference/projects) へのアクセス権を付与します。 `none`、`read`、`write`、`admin` のいずれかです。{% ifversion fpt or ghec %} | [`organization_user_blocking`](/rest/reference/permissions-required-for-github-apps/#permission-on-organization-projects) | [Blocking Organization Users API](/rest/reference/orgs#blocking) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% endif %} -| [`pages`](/rest/reference/permissions-required-for-github-apps/#permission-on-pages) | [Pages API](/rest/reference/repos#pages) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | -| `plan` | 「[ユーザの取得](/rest/reference/users#get-a-user)」エンドポイントを使用してユーザの GitHub プランについての情報を取得するためのアクセス権を付与します。 `none`、`read` のいずれかです。 | -| [`pull_requests`](/rest/reference/permissions-required-for-github-apps/#permission-on-pull-requests) | さまざまなプルリクエストエンドポイントへのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | -| [`repository_hooks`](/rest/reference/permissions-required-for-github-apps/#permission-on-repository-hooks) | [Repository Webhooks API](/rest/reference/repos#hooks) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| [`pages`](/rest/reference/permissions-required-for-github-apps/#permission-on-pages) | [Pages API](/rest/reference/repos#pages) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| `plan` | 「[ユーザの取得](/rest/reference/users#get-a-user)」エンドポイントを使用してユーザの GitHub プランについての情報を取得するためのアクセス権を付与します。 `none`、`read` のいずれかです。 | +| [`pull_requests`](/rest/reference/permissions-required-for-github-apps/#permission-on-pull-requests) | さまざまなプルリクエストエンドポイントへのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| [`repository_hooks`](/rest/reference/permissions-required-for-github-apps/#permission-on-repository-hooks) | [Repository Webhooks API](/rest/reference/repos#hooks) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | | [`repository_projects`](/rest/reference/permissions-required-for-github-apps/#permission-on-repository-projects) | [Projects API](/rest/reference/projects) へのアクセス権を付与します。 `none`、`read`、`write`、`admin` のいずれかです。{% ifversion fpt or ghes or ghec %} | [`secret_scanning_alerts`](/rest/reference/permissions-required-for-github-apps/#permission-on-secret-scanning-alerts) | [Secret scanning API](/rest/reference/secret-scanning) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% endif %}{% ifversion fpt or ghes or ghec %} | [`security_events`](/rest/reference/permissions-required-for-github-apps/#permission-on-security-events) | [Code scanning API](/rest/reference/code-scanning/) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% endif %} -| [`single_file`](/rest/reference/permissions-required-for-github-apps/#permission-on-single-file) | [Contents API](/rest/reference/repos#contents) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | -| [`starring`](/rest/reference/permissions-required-for-github-apps/#permission-on-starring) | [Starring API](/rest/reference/activity#starring) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | -| [`statuses`](/rest/reference/permissions-required-for-github-apps/#permission-on-statuses) | [Statuses API](/rest/reference/commits#commit-statuses) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| [`single_file`](/rest/reference/permissions-required-for-github-apps/#permission-on-single-file) | [Contents API](/rest/reference/repos#contents) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| [`starring`](/rest/reference/permissions-required-for-github-apps/#permission-on-starring) | [Starring API](/rest/reference/activity#starring) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | +| [`statuses`](/rest/reference/permissions-required-for-github-apps/#permission-on-statuses) | [Statuses API](/rest/reference/commits#commit-statuses) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。 | | [`team_discussions`](/rest/reference/permissions-required-for-github-apps/#permission-on-team-discussions) | [Team Discussions API](/rest/reference/teams#discussions) および [Team Discussion Comments API](/rest/reference/teams#discussion-comments) へのアクセス権を付与します。 `none`、`read`、`write` のいずれかです。{% ifversion fpt or ghes or ghae-issue-4864 or ghec %} -| `vulnerability_alerts` | リポジトリ内の脆弱性のある依存関係に対するセキュリティアラートを受信するためのアクセス権を付与します。 詳細は「[脆弱性のある依存関係に関するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)」を参照。 `none`、`read` のいずれかです。{% endif %} -| `Watch` | リストへのアクセス権を付与し、ユーザがサブスクライブするリポジトリの変更を許可します。 `none`、`read`、`write` のいずれかです。 | +| `vulnerability_alerts` | Grants access to receive {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies in a repository. See "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)" to learn more. `none`、`read` のいずれかです。{% endif %} +| `Watch` | リストへのアクセス権を付与し、ユーザがサブスクライブするリポジトリの変更を許可します。 `none`、`read`、`write` のいずれかです。 | ## {% data variables.product.prodname_github_app %} webhook イベント diff --git a/translations/ja-JP/content/developers/webhooks-and-events/webhooks/webhook-events-and-payloads.md b/translations/ja-JP/content/developers/webhooks-and-events/webhooks/webhook-events-and-payloads.md index cb85b42e78e3..95567e16c8fa 100644 --- a/translations/ja-JP/content/developers/webhooks-and-events/webhooks/webhook-events-and-payloads.md +++ b/translations/ja-JP/content/developers/webhooks-and-events/webhooks/webhook-events-and-payloads.md @@ -1246,7 +1246,7 @@ GitHub Marketplace の購入に関連するアクティビティ。 {% data reus Activity related to a security advisory that has been reviewed by {% data variables.product.company_short %}. A {% data variables.product.company_short %}-reviewed security advisory provides information about security-related vulnerabilities in software on {% data variables.product.prodname_dotcom %}. -The security advisory dataset also powers the GitHub {% data variables.product.prodname_dependabot_alerts %}. 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)」を参照してください。 +The security advisory dataset also powers the GitHub {% data variables.product.prodname_dependabot_alerts %}. 詳しい情報については、「[{% data variables.product.prodname_dependabot_alerts %} について](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)」を参照してください。 ### 利用の可否 diff --git a/translations/ja-JP/content/get-started/privacy-on-github/about-githubs-use-of-your-data.md b/translations/ja-JP/content/get-started/privacy-on-github/about-githubs-use-of-your-data.md index ccfbf6ade763..00b10cd4caef 100644 --- a/translations/ja-JP/content/get-started/privacy-on-github/about-githubs-use-of-your-data.md +++ b/translations/ja-JP/content/get-started/privacy-on-github/about-githubs-use-of-your-data.md @@ -20,7 +20,7 @@ shortTitle: GitHub's use of your data {% data reusables.repositories.about-github-archive-program %} 詳細は「[{% data variables.product.prodname_dotcom %} 上のコンテンツとデータのアーカイブ処理について](/github/creating-cloning-and-archiving-repositories/about-archiving-content-and-data-on-github#about-the-github-archive-program)」を参照してください。 -{% data reusables.user-settings.export-data %} For more information, see "[Requesting an archive of your personal account's data](/articles/requesting-an-archive-of-your-personal-account-s-data)." +{% data reusables.user-settings.export-data %}詳細は「[個人アカウントのデータのアーカイブをリクエストする](/articles/requesting-an-archive-of-your-personal-account-s-data)」を参照してください。 プライベートリポジトリのデータの利用をオプトインした場合でも、プライベートデータ、ソースコード、企業秘密は引き続き弊社の[利用規約](/free-pro-team@latest/github/site-policy/github-terms-of-service)の下で機密事項として扱われます。 弊社が知る情報は、集約されたデータからのみです。 詳しい情報については、「[プライベートリポジトリのデータ使用を管理する](/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository)」を参照してください。 @@ -28,7 +28,7 @@ shortTitle: GitHub's use of your data ## データによるセキュリティの推奨事項の改善 -データの利用方法の例として、パブリックリポジトリの依存対象のセキュリティの脆弱性を検出し、アラートを出すことができます。 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 +データの利用方法の例として、パブリックリポジトリの依存対象のセキュリティの脆弱性を検出し、アラートを出すことができます。 詳しい情報については、「[{% data variables.product.prodname_dependabot_alerts %} について](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 潜在的なセキュリティの脆弱性を検出するために、{% data variables.product.product_name %}は依存対象のマニフェストファイルの内容をスキャンし、プロジェクトの依存対象のリストを作成します。 diff --git a/translations/ja-JP/content/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository.md b/translations/ja-JP/content/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository.md index 8229beefb99a..d7b42f45ee61 100644 --- a/translations/ja-JP/content/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository.md +++ b/translations/ja-JP/content/get-started/privacy-on-github/managing-data-use-settings-for-your-private-repository.md @@ -16,7 +16,7 @@ shortTitle: Manage data use for private repo ## About data use for your private repository -When you enable data use for your private repository, you'll be able to access the dependency graph, where you can track your repository's dependencies and receive {% data variables.product.prodname_dependabot_alerts %} when {% data variables.product.product_name %} detects vulnerable dependencies. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)." +When you enable data use for your private repository, you'll be able to access the dependency graph, where you can track your repository's dependencies and receive {% data variables.product.prodname_dependabot_alerts %} when {% data variables.product.product_name %} detects vulnerable dependencies. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)." ## Enabling or disabling data use features @@ -32,5 +32,5 @@ When you enable data use for your private repository, you'll be able to access t ## Further reading - "[About {% data variables.product.prodname_dotcom %}'s use of your data](/articles/about-github-s-use-of-your-data)" -- "[Viewing and updating vulnerable dependencies in your repository](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" +- "[Viewing {% data variables.product.prodname_dependabot_alerts %} for vulnerable dependencies](/github/managing-security-vulnerabilities/viewing-and-updating-vulnerable-dependencies-in-your-repository)" - "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)" diff --git a/translations/ja-JP/content/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server.md b/translations/ja-JP/content/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server.md index 77eb9bbd374b..01e6944f0555 100644 --- a/translations/ja-JP/content/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server.md +++ b/translations/ja-JP/content/get-started/signing-up-for-github/setting-up-a-trial-of-github-enterprise-server.md @@ -19,7 +19,7 @@ shortTitle: Enterprise Server trial {% data variables.product.prodname_ghe_server %} を評価するための 45 日間トライアルをリクエストできます。 トライアルは仮想アプライアンスとしてインストールされ、オンプレミスまたはクラウドでのデプロイメントのオプションがあります。 サポートされている仮想化プラットフォームの一覧については「[GitHub Enterprise Server インスタンスをセットアップする](/enterprise-server@latest/admin/installation/setting-up-a-github-enterprise-server-instance)」を参照してください。 -{% ifversion ghes %}{% data variables.product.prodname_dependabot %}{% else %}現在、セキュリティ{% endif %}アラートと {% data variables.product.prodname_github_connect %} は {% data variables.product.prodname_ghe_server %} のトライアルでは利用できません。 これらの機能のデモについては、{% data variables.contact.contact_enterprise_sales %} にお問い合わせください。 For more information about these features, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[Connecting your enterprise account to {% data variables.product.prodname_ghe_cloud %}](/enterprise-server@latest/admin/configuration/managing-connections-between-your-enterprise-accounts/connecting-your-enterprise-account-to-github-enterprise-cloud)." +{% ifversion ghes %}{% data variables.product.prodname_dependabot %}{% else %}現在、セキュリティ{% endif %}アラートと {% data variables.product.prodname_github_connect %} は {% data variables.product.prodname_ghe_server %} のトライアルでは利用できません。 これらの機能のデモについては、{% data variables.contact.contact_enterprise_sales %} にお問い合わせください。 For more information about these features, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)" and "[Connecting your enterprise account to {% data variables.product.prodname_ghe_cloud %}](/enterprise-server@latest/admin/configuration/managing-connections-between-your-enterprise-accounts/connecting-your-enterprise-account-to-github-enterprise-cloud)." {% data variables.product.prodname_ghe_cloud %} のトライアルも利用できます。 詳しい情報については、「[{% data variables.product.prodname_ghe_cloud %} のトライアルを設定する](/articles/setting-up-a-trial-of-github-enterprise-cloud)」を参照してください。 diff --git a/translations/ja-JP/content/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks.md b/translations/ja-JP/content/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks.md index 60b87b47b272..9ddc037251a2 100644 --- a/translations/ja-JP/content/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks.md +++ b/translations/ja-JP/content/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks.md @@ -69,10 +69,9 @@ Look! You can see my backticks. {% if mermaid %} ## Creating diagrams -You can use Mermaid syntax to add diagrams. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams)." +You can also use code blocks to create diagrams in Markdown. GitHub supports Mermaid, geoJSON, topoJSON, and ASCII STL syntax. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams)." {% endif %} - ## 参考リンク - [{% data variables.product.prodname_dotcom %} Flavored Markdown の仕様](https://github.github.com/gfm/) diff --git a/translations/ja-JP/content/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams.md b/translations/ja-JP/content/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams.md index 4f4f1a2e267c..b781425b93a6 100644 --- a/translations/ja-JP/content/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams.md +++ b/translations/ja-JP/content/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams.md @@ -6,7 +6,13 @@ versions: shortTitle: Create diagrams --- -You can use Mermaid syntax to create diagrams. Mermaid is a Markdown-inspired tool that renders text into diagrams. For example, Mermaid can render flow charts, sequence diagrams, pie charts and more. For more information, see the [Mermaid documentation](https://mermaid-js.github.io/mermaid/#/). +## About creating diagrams + +You can create diagrams in Markdown using three different syntaxes: mermaid, geoJSON and topoJSON, and ASCII STL. + +## Creating Mermaid diagrams + +Mermaid is a Markdown-inspired tool that renders text into diagrams. For example, Mermaid can render flow charts, sequence diagrams, pie charts and more. For more information, see the [Mermaid documentation](https://mermaid-js.github.io/mermaid/#/). To create a Mermaid diagram, add Mermaid syntax inside a fenced code block with the `mermaid` language identifier. For more information about creating code blocks, see "[Creating and highlighting code blocks](/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks)." @@ -31,3 +37,122 @@ graph TD; **Note:** You may observe errors if you run a third-party Mermaid plugin when using Mermaid syntax on {% data variables.product.company_short %}. {% endnote %} + +## Creating geoJSON and topoJSON maps + +You can use geo/topoJSON syntax to create interactive maps. To create a map, add geoJSON or topoJSON inside a fenced code block with the `geojson` or `topojson` syntax identifier. 詳しい情報については[コードブロックの作成とハイライト](/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks)を参照してください。 + +### Using geoJSON + +For example, you can create a simple map: + +
+```geojson
+{
+  "type": "Polygon",
+  "coordinates": [
+      [
+          [-90,30],
+          [-90,35],
+          [-90,35],
+          [-85,35],
+          [-85,30]
+      ]
+  ]
+}
+```
+
+ +![Rendered map](/assets/images/help/writing/fenced-geojson-rendered-map.png) + +### Using topoJSON + +For example, you can create a simple topoJSON map: + +
+```topojson
+{
+  "type": "Topology",
+  "transform": {
+    "scale": [0.0005000500050005, 0.00010001000100010001],
+    "translate": [100, 0]
+  },
+  "objects": {
+    "example": {
+      "type": "GeometryCollection",
+      "geometries": [
+        {
+          "type": "Point",
+          "properties": {"prop0": "value0"},
+          "coordinates": [4000, 5000]
+        },
+        {
+          "type": "LineString",
+          "properties": {"prop0": "value0", "prop1": 0},
+          "arcs": [0]
+        },
+        {
+          "type": "Polygon",
+          "properties": {"prop0": "value0",
+            "prop1": {"this": "that"}
+          },
+          "arcs": [[1]]
+        }
+      ]
+    }
+  },
+  "arcs": [[[4000, 0], [1999, 9999], [2000, -9999], [2000, 9999]],[[0, 0], [0, 9999], [2000, 0], [0, -9999], [-2000, 0]]]
+}
+```
+
+ +![Rendered topojson map](/assets/images/help/writing/fenced-topojson-rendered-map.png) + +For more information on working with `.geojson` and `.topojson` files, see "[Working with non-code files](/repositories/working-with-files/using-files/working-with-non-code-files#mapping-geojson-files-on-github)." + + +## Creating STL 3D models + +You can use ASCII STL syntax directly in markdown to create interactive 3D models. To display a model, add ASCII STL syntax inside a fenced code block with the `stl` syntax identifier. 詳しい情報については[コードブロックの作成とハイライト](/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks)を参照してください。 + +For example, you can create a simple 3D model: + +
+```stl
+solid cube_corner
+  facet normal 0.0 -1.0 0.0
+    outer loop
+      vertex 0.0 0.0 0.0
+      vertex 1.0 0.0 0.0
+      vertex 0.0 0.0 1.0
+    endloop
+  endfacet
+  facet normal 0.0 0.0 -1.0
+    outer loop
+      vertex 0.0 0.0 0.0
+      vertex 0.0 1.0 0.0
+      vertex 1.0 0.0 0.0
+    endloop
+  endfacet
+  facet normal -1.0 0.0 0.0
+    outer loop
+      vertex 0.0 0.0 0.0
+      vertex 0.0 0.0 1.0
+      vertex 0.0 1.0 0.0
+    endloop
+  endfacet
+  facet normal 0.577 0.577 0.577
+    outer loop
+      vertex 1.0 0.0 0.0
+      vertex 0.0 1.0 0.0
+      vertex 0.0 0.0 1.0
+    endloop
+  endfacet
+endsolid
+```
+
+ +![Rendered 3D model](/assets/images/help/writing/fenced-stl-rendered-object.png) + +For more information on working with `.stl` files, see "[Working with non-code files](/repositories/working-with-files/using-files/working-with-non-code-files#3d-file-viewer)." + diff --git a/translations/ja-JP/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md b/translations/ja-JP/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md index 535f165c2533..61b87d653073 100644 --- a/translations/ja-JP/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md +++ b/translations/ja-JP/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization.md @@ -123,7 +123,7 @@ You can enable or disable features for all repositories. By default, {% data variables.product.prodname_dependabot %} can't update dependencies that are located in private repositories or private package registries. However, if a dependency is in a private {% data variables.product.prodname_dotcom %} repository within the same organization as the project that uses that dependency, you can allow {% data variables.product.prodname_dependabot %} to update the version successfully by giving it access to the host repository. -If your code depends on packages in a private registry, you can allow {% data variables.product.prodname_dependabot %} to update the versions of these dependencies by configuring this at the repository level. You do this by adding authentication details to the _dependabot.yml_ file for the repository. For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)." +If your code depends on packages in a private registry, you can allow {% data variables.product.prodname_dependabot %} to update the versions of these dependencies by configuring this at the repository level. You do this by adding authentication details to the _dependabot.yml_ file for the repository. For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)." To allow {% data variables.product.prodname_dependabot %} to access a private {% data variables.product.prodname_dotcom %} repository: @@ -163,6 +163,5 @@ You can manage access to {% data variables.product.prodname_GH_advanced_security - "[Securing your repository](/code-security/getting-started/securing-your-repository)"{% ifversion not fpt %} - "[About secret scanning](/github/administering-a-repository/about-secret-scanning)"{% endif %}{% ifversion not ghae %} -- "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)" -- "[Managing vulnerabilities in your project's dependencies](/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies)"{% endif %}{% ifversion fpt or ghec or ghes > 3.2 %} -- "[Keeping your dependencies updated automatically](/github/administering-a-repository/keeping-your-dependencies-updated-automatically)"{% endif %} +- "[About the dependency graph](/github/visualizing-repository-data-with-graphs/about-the-dependency-graph)"{% endif %}{% ifversion fpt or ghec or ghes or ghae-issue-4864 %} +- "[About supply chain security](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security)"{% endif %} diff --git a/translations/ja-JP/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md b/translations/ja-JP/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md index a79bd3321e0a..f6d67a50f8f8 100644 --- a/translations/ja-JP/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md +++ b/translations/ja-JP/content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md @@ -42,7 +42,7 @@ To search for specific events, use the `action` qualifier in your query. Actions | [`billing`](#billing-category-actions) | Contains all activities related to your organization's billing. | [`business`](#business-category-actions) | Contains activities related to business settings for an enterprise. | | [`codespaces`](#codespaces-category-actions) | Contains all activities related to your organization's codespaces. |{% endif %}{% ifversion fpt or ghec or ghes > 3.2 %} -| [`dependabot_alerts`](#dependabot_alerts-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_alerts %} in existing repositories. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." +| [`dependabot_alerts`](#dependabot_alerts-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_alerts %} in existing repositories. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." | [`dependabot_alerts_new_repos`](#dependabot_alerts_new_repos-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_alerts %} in new repositories created in the organization. | [`dependabot_security_updates`](#dependabot_security_updates-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_security_updates %} in existing repositories. For more information, see "[Configuring {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/configuring-dependabot-security-updates)." | [`dependabot_security_updates_new_repos`](#dependabot_security_updates_new_repos-category-actions) | Contains organization-level configuration activities for {% data variables.product.prodname_dependabot_security_updates %} for new repositories created in the organization.{% endif %}{% ifversion fpt or ghec %} @@ -680,7 +680,7 @@ For more information, see "[Managing the publication of {% data variables.produc | Action | Description |------------------|------------------- -| `create` | Triggered when {% data variables.product.product_name %} creates a {% data variables.product.prodname_dependabot %} alert for a repository that uses a vulnerable dependency. For more information, see "[About alerts for vulnerable dependencies](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." +| `create` | Triggered when {% data variables.product.product_name %} creates a {% data variables.product.prodname_dependabot %} alert for a repository that uses a vulnerable dependency. For more information, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)." | `dismiss` | Triggered when an organization owner or person with admin access to the repository dismisses a {% data variables.product.prodname_dependabot %} alert about a vulnerable dependency. | `resolve` | Triggered when someone with write access to a repository pushes changes to update and resolve a vulnerability in a project dependency. diff --git a/translations/ja-JP/content/packages/learn-github-packages/about-permissions-for-github-packages.md b/translations/ja-JP/content/packages/learn-github-packages/about-permissions-for-github-packages.md index e2eea2abaaf3..021191b162d8 100644 --- a/translations/ja-JP/content/packages/learn-github-packages/about-permissions-for-github-packages.md +++ b/translations/ja-JP/content/packages/learn-github-packages/about-permissions-for-github-packages.md @@ -47,7 +47,7 @@ shortTitle: 権限について 例: - リポジトリからパッケージをダウンロードしてインストールするには、トークンは`read:packages`スコープを持っていなければならず、ユーザアカウントは読み取り権限を持っていなければなりません。 -- |{% ifversion fpt or ghes > 3.1 or ghec %}To delete a package on {% data variables.product.product_name %}, your token must at least have the `delete:packages` and `read:packages` scope. The `repo` scope is also required for repo-scoped packages. For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% elsif ghae %}To delete a specified version of a package on {% data variables.product.product_name %}, your token must have the `delete:packages` and `repo` scope. For more information, see "[Deleting and restoring a package](/packages/learn-github-packages/deleting-and-restoring-a-package)."{% endif %} +- |{% ifversion fpt or ghes > 3.1 or ghec %}{% data variables.product.product_name %}上のパッケージを削除するには、トークンが少なくとも`delete:packages`と`read:packages`のスコープを持っている必要があります。 リポジトリをスコープとするパッケージには、 `repo`スコープも必要です。 詳しい情報については「[パッケージの削除と復元](/packages/learn-github-packages/deleting-and-restoring-a-package)」を参照してください。{% elsif ghae %}{% data variables.product.product_name %}上のパッケージの指定されたバージョンを削除するには、トークンが`delete:packages`及び`repo`スコープを持っていなければなりません。 詳しい情報については、「[パッケージの削除とリストア](/packages/learn-github-packages/deleting-and-restoring-a-package)」を参照してください。{% endif %} | スコープ | 説明 | 必要な権限 | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | ------------ | | `read:packages` | {% data variables.product.prodname_registry %}からのパッケージのダウンロードとインストール | 読み取り | diff --git a/translations/ja-JP/content/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry.md b/translations/ja-JP/content/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry.md index b3a5b600b912..01a56b4478d1 100644 --- a/translations/ja-JP/content/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry.md +++ b/translations/ja-JP/content/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry.md @@ -136,7 +136,7 @@ You can use gems from {% data variables.product.prodname_registry %} much like y end ``` -3. For Bundler versions earlier than 1.7.0, you need to add a new global `source`. For more information on using Bundler, see the [bundler.io documentation](http://bundler.io/v1.5/gemfile.html). +3. For Bundler versions earlier than 1.7.0, you need to add a new global `source`. For more information on using Bundler, see the [bundler.io documentation](https://bundler.io/gemfile.html). ```ruby source "https://{% ifversion fpt or ghec %}rubygems.pkg.github.com{% else %}REGISTRY-URL{% endif %}/OWNER" diff --git a/translations/ja-JP/content/pages/setting-up-a-github-pages-site-with-jekyll/testing-your-github-pages-site-locally-with-jekyll.md b/translations/ja-JP/content/pages/setting-up-a-github-pages-site-with-jekyll/testing-your-github-pages-site-locally-with-jekyll.md index 0614d8ad8e76..6f1fa114b1ac 100644 --- a/translations/ja-JP/content/pages/setting-up-a-github-pages-site-with-jekyll/testing-your-github-pages-site-locally-with-jekyll.md +++ b/translations/ja-JP/content/pages/setting-up-a-github-pages-site-with-jekyll/testing-your-github-pages-site-locally-with-jekyll.md @@ -50,6 +50,12 @@ Jekyll を使用してサイトをテストする前に、以下の操作が必 ``` 3. サイトをプレビューするには、ウェブブラウザで `http://localhost:4000` を開きます。 +{% note %} + +**Note:** If you are using Ruby 3.0 and Jekyll 4.2.x or older, you will need to add the `webrick` gem to your project's Gemfile prior to running `bundle install`. + +{% endnote %} + ## {% data variables.product.prodname_pages %} gem の更新 Jekyll は、頻繁に更新されているアクティブなオープンソースプロジェクトです。 お使いのコンピュータ上の `github-pages` gem が {% data variables.product.prodname_pages %} サーバー上の `github-pages` gem と比較して古くなっている場合は、ローカルでビルドしたときと {% data variables.product.product_name %} に公開したときで、サイトの見え方が異なることがあります。 こうならないように、お使いのコンピュータ上の `github-pages` gem は常にアップデートしておきましょう。 diff --git a/translations/ja-JP/content/repositories/viewing-activity-and-data-for-your-repository/understanding-connections-between-repositories.md b/translations/ja-JP/content/repositories/viewing-activity-and-data-for-your-repository/understanding-connections-between-repositories.md index f9238820cb8d..e16ade776bac 100644 --- a/translations/ja-JP/content/repositories/viewing-activity-and-data-for-your-repository/understanding-connections-between-repositories.md +++ b/translations/ja-JP/content/repositories/viewing-activity-and-data-for-your-repository/understanding-connections-between-repositories.md @@ -73,5 +73,5 @@ shortTitle: Connections between repositories 依存関係グラフは、リポジトリの依存関係を視覚化して調査するために最適な方法を提供しています。 詳しい情報については、「[依存関係グラフについて](/code-security/supply-chain-security/about-the-dependency-graph)」および「[リポジトリの依存関係を調べる](/code-security/supply-chain-security/exploring-the-dependencies-of-a-repository) 」を参照してください。 -依存関係の 1 つにセキュリティの脆弱性が見つかった場合は、{% data variables.product.company_short %} が自動的に警告するようにリポジトリを設定することもできます。 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 +依存関係の 1 つにセキュリティの脆弱性が見つかった場合は、{% data variables.product.company_short %} が自動的に警告するようにリポジトリを設定することもできます。 詳しい情報については、「[{% data variables.product.prodname_dependabot_alerts %} について](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 {% endif %} diff --git a/translations/ja-JP/content/repositories/working-with-files/using-files/working-with-non-code-files.md b/translations/ja-JP/content/repositories/working-with-files/using-files/working-with-non-code-files.md index a72acf5017b2..3a763b886912 100644 --- a/translations/ja-JP/content/repositories/working-with-files/using-files/working-with-non-code-files.md +++ b/translations/ja-JP/content/repositories/working-with-files/using-files/working-with-non-code-files.md @@ -130,6 +130,12 @@ For example, if your model's URL is [`github.com/skalnik/secret-bear-clip/blob/m {% endtip %} +{% if mermaid %} +### Rendering in Markdown + +You can embed ASCII STL syntax directly in Markdown. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams#creating-stl-3d-models)." +{% endif %} + ## CSV および TSV データをレンダリングする GitHub では、*.csv* (カンマ区切り) 形式および *.tsv* (タブ区切り) 形式のファイルのレンダリングがサポートされています。 @@ -233,7 +239,7 @@ HTML ドキュメントへのコミットのレンダリング済みビューは ![ソースとレンダリングの切り替えのスクリーンショット](/assets/images/help/repository/source-render-toggle-geojson.png) -### ジオメトリのタイプ +### Geometry types {% data variables.product.product_name %} のマップは [Leaflet.js](http://leafletjs.com) を使用し、[geoJSON の仕様](http://www.geojson.org/geojson-spec.html) (Point、LineString、Polygon、MultiPoint、MultiLineString、MultiPolygon、GeometryCollection) に概要が示されているジオメトリのタイプをすべてサポートしています。 TopoJSON ファイルは "Topology" タイプで、[topoJSON の仕様](https://github.com/mbostock/topojson/wiki/Specification)に従っている必要があります。 @@ -274,6 +280,12 @@ GeoJSON マップを {% data variables.product.product_name %} 以外の場所 {% endtip %} +{% if mermaid %} +### Mapping in Markdown + +You can embed geoJSON and topoJSON directly in Markdown. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams#creating-geojson-and-topojson-maps)." +{% endif %} + ### クラスタリング マップに大量のマーカー (およそ 750 以上) が設定されている場合、ズーム レベルが大きいときは近隣のマーカーが自動的にクラスタ化されます。 クラスタをクリックしてズームするだけで、個々のマーカーが表示されます。 @@ -292,7 +304,7 @@ geoJSON ファイルのレンダリングに問題がある場合は、[geoJSON その場合でも、`.geojson` ファイルを [TopoJSON](https://github.com/mbostock/topojson) に変換すればデータをレンダリングできます。TopoJSONは、ファイルサイズを最大 80% まで縮小できる圧縮形式です。 ファイルを小さいチャンクに分割し (州ごと、年ごとなど)、データを複数のファイルとしてリポジトリに格納することは、もちろんいつでもできます。 -### 他のリソース +### 参考リンク * [Leaflet.js geojson ドキュメント](http://leafletjs.com/examples/geojson.html) * [MapBox マーカースタイリングのドキュメント](http://www.mapbox.com/developers/simplestyle/) @@ -320,3 +332,44 @@ $ jupyter nbconvert --to html NOTEBOOK-NAME.ipynb - [Jupyter notebook の GitHub リポジトリ](https://github.com/jupyter/jupyter_notebook) - [Jupyter notebooks のギャラリー](https://github.com/jupyter/jupyter/wiki/A-gallery-of-interesting-Jupyter-Notebooks) + +{% if mermaid %} +## Displaying Mermaid files on {% data variables.product.prodname_dotcom %} + +{% data variables.product.product_name %} supports rendering Mermaid files within repositories. Commit the file as you would normally using a `.mermaid` or `.mmd` extension. Then, navigate to the path of the Mermaid file on {% data variables.product.prodname_dotcom %}. + +For example, if you add a `.mmd` file with the following content to your repository: + +``` +graph TD + A[Friend's Birthday] -->|Get money| B(Go shopping) + B --> C{Let me think} + C -->|One| D["Cool
Laptop"] + C -->|Two| E[iPhone] + C -->|Three| F[fa:fa-car Car] +``` + +When you view the file in the repository, it is rendered as a flow chart. ![Rendered mermaid file diagram](/assets/images/help/repository/mermaid-file-diagram.png) + +### トラブルシューティング + +If your chart does not render at all, verify that it contains valid Mermaid Markdown syntax by checking your chart with the [Mermaid live editor](https://mermaid.live/edit). + +If the chart displays, but does not appear as you'd expect, you can create a new [feedback discussion](https://github.com/github/feedback/discussions/categories/general-feedback), and add the `mermaid` tag. + +#### 既知の問題 + +* Sequence diagram charts frequently render with additional padding below the chart, with more padding added as the chart size increases. This is a known issue with the Mermaid library. +* Actor nodes with popover menus do not work as expected within sequence diagram charts. This is due to a discrepancy in how JavaScript events are added to a chart when the Mermaid library's API is used to render a chart. +* Not all charts are a11y compliant. This may affect users who rely on a screen reader. + +### Mermaid in Markdown + +You can embed Mermaid syntax directly in Markdown. For more information, see "[Creating diagrams](/get-started/writing-on-github/working-with-advanced-formatting/creating-diagrams#creating-mermaid-diagrams)." + +### 参考リンク + +* [Mermaid.js documentation](https://mermaid-js.github.io/mermaid/#/) +* [Mermaid.js live editor](https://mermaid.live/edit) +{% endif %} + diff --git a/translations/ja-JP/content/rest/reference/deploy_keys.md b/translations/ja-JP/content/rest/reference/deploy_keys.md new file mode 100644 index 000000000000..2a49dbdf4759 --- /dev/null +++ b/translations/ja-JP/content/rest/reference/deploy_keys.md @@ -0,0 +1,17 @@ +--- +title: Deploy Keys +intro: 'The Deploy Keys API allows to create an SSH key that is stored on your server and grants access to a GitHub repository.' +allowTitleToDifferFromFilename: true +versions: + fpt: '*' + ghes: '*' + ghae: '*' + ghec: '*' +topics: + - API +miniTocMaxHeadingLevel: 3 +--- + + \ No newline at end of file diff --git a/translations/ja-JP/content/rest/reference/deployments.md b/translations/ja-JP/content/rest/reference/deployments.md index 4bc3de81a07d..d4e5c24d5034 100644 --- a/translations/ja-JP/content/rest/reference/deployments.md +++ b/translations/ja-JP/content/rest/reference/deployments.md @@ -1,6 +1,6 @@ --- title: デプロイメント -intro: デプロイメントAPIを使うと、デプロイーキー、デプロイメント、デプロイメント環境の作成と削除ができます。 +intro: The deployments API allows you to create and delete deployments and deployment environments. allowTitleToDifferFromFilename: true versions: fpt: '*' diff --git a/translations/ja-JP/content/rest/reference/index.md b/translations/ja-JP/content/rest/reference/index.md index bbc7d47c7a38..4c1aeeb0620b 100644 --- a/translations/ja-JP/content/rest/reference/index.md +++ b/translations/ja-JP/content/rest/reference/index.md @@ -22,6 +22,7 @@ children: - /collaborators - /commits - /dependabot + - /deploy_keys - /deployments - /emojis - /enterprise-admin diff --git a/translations/ja-JP/data/features/mermaid.yml b/translations/ja-JP/data/features/mermaid.yml index 09870e35f9fe..db633f907dcc 100644 --- a/translations/ja-JP/data/features/mermaid.yml +++ b/translations/ja-JP/data/features/mermaid.yml @@ -1,8 +1,8 @@ --- -#Issue 5812 and 6172 -#Mermaid syntax support +#Issues 5812 and 6172, also 6411 +#Mermaid syntax support, also ASCII STL and geoJSON/topoJSON syntax support versions: fpt: '*' ghec: '*' - ghes: '>=3.5' + ghes: '>=3.6' ghae: 'issue-6172' diff --git a/translations/ja-JP/data/learning-tracks/code-security.yml b/translations/ja-JP/data/learning-tracks/code-security.yml index e3ff1aadfcc7..cd72a37bbad5 100644 --- a/translations/ja-JP/data/learning-tracks/code-security.yml +++ b/translations/ja-JP/data/learning-tracks/code-security.yml @@ -18,39 +18,39 @@ dependabot_alerts: title: '脆弱な依存関係に関する通知を取得' description: '依存関係中の新しい脆弱性に対するアラートを発するようDependabotをセットアップしてください。' guides: - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies + - /code-security/dependabot/dependabot-alerts/about-dependabot-alerts - '{% ifversion fpt or ghec or ghes > 3.2 %}/github/administering-a-repository/managing-repository-settings/managing-security-and-analysis-settings-for-your-repository{% endif %}' - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/viewing-and-updating-vulnerable-dependencies-in-your-repository - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors + - /code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts + - /code-security/dependabot/dependabot-alerts/configuring-notifications-for-dependabot-alerts + - /code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates + - /code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies + - /code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors #Feature available on dotcom and GHES 3.3+, so articles available on GHAE and earlier GHES hidden to hide the learning track dependabot_security_updates: title: '脆弱な依存関係を更新するためのPull Requestを取得' description: '新しい脆弱性が報告されたときにPull Requestを作成するようDependabotをセットアップ' guides: - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates + - /code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates + - /code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates - '{% ifversion fpt or ghec or ghes > 3.2 %}/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-notifications-for-vulnerable-dependencies{% endif %}' - '{% ifversion fpt or ghec or ghes > 3.2 %}/github/administering-a-repository/managing-repository-settings/managing-security-and-analysis-settings-for-your-repository{% endif %}' - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates + - /code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates - '{% ifversion fpt or ghec or ghes > 3.2 %}/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies{% endif %}' #Feature available only on dotcom and GHES 3.3+ dependency_version_updates: title: '依存関係を最新に保つ' description: '新しいリリースをチェックし、依存関係を更新するPull Requestを作成するためにDependabotを使ってください。' guides: - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/enabling-and-disabling-dependabot-version-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/customizing-dependency-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/automating-dependabot-with-github-actions - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/listing-dependencies-configured-for-version-updates - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-encrypted-secrets-for-dependabot - - /code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/managing-pull-requests-for-dependency-updates - - /code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-dependabot-errors + - /code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates + - /code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates + - /code-security/dependabot/dependabot-version-updates/customizing-dependency-updates + - /code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + - /code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot + - /code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions + - /code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates + - /code-security/dependabot/working-with-dependabot/managing-encrypted-secrets-for-dependabot + - /code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates + - /code-security/dependabot/working-with-dependabot/troubleshooting-dependabot-errors #Feature available in GHEC, GHES 3.0 up, and GHAE. Feature limited on FPT so hidden there. secret_scanning: title: 'シークレットのスキャン' diff --git a/translations/ja-JP/data/product-examples/code-security/code-examples.yml b/translations/ja-JP/data/product-examples/code-security/code-examples.yml index 38beac236f6b..523fc7352120 100644 --- a/translations/ja-JP/data/product-examples/code-security/code-examples.yml +++ b/translations/ja-JP/data/product-examples/code-security/code-examples.yml @@ -24,7 +24,7 @@ #Security policies title: Microsoft security policy template description: セキュリティポリシーの例 - href: https://github.com/microsoft/repo-templates/blob/main/shared/SECURITY.md + href: /microsoft/repo-templates/blob/main/shared/SECURITY.md tags: - セキュリティポリシー - diff --git a/translations/ja-JP/data/reusables/code-scanning/alert-default-branch.md b/translations/ja-JP/data/reusables/code-scanning/alert-default-branch.md new file mode 100644 index 000000000000..c6a6029e70d5 --- /dev/null +++ b/translations/ja-JP/data/reusables/code-scanning/alert-default-branch.md @@ -0,0 +1 @@ +The status and details on the alert page only reflect the state of the alert on the default branch of the repository, even if the alert exists in other branches. You can see the status of the alert on non-default branches in the **Affected branches** section on the right-hand side of the alert page. If an alert doesn't exist in the default branch, the status of the alert will display as "in pull request" or "in branch" and will be colored grey. \ No newline at end of file diff --git a/translations/ja-JP/data/reusables/code-scanning/filter-non-default-branches.md b/translations/ja-JP/data/reusables/code-scanning/filter-non-default-branches.md new file mode 100644 index 000000000000..4df28a76d5b9 --- /dev/null +++ b/translations/ja-JP/data/reusables/code-scanning/filter-non-default-branches.md @@ -0,0 +1 @@ +Please note that if you have filtered for alerts on a non-default branch, but the same alerts exist on the default branch, the alert page for any given alert will still only reflect the alert's status on the default branch, even if that status conflicts with the status on a non-default branch. For example, an alert that appears in the "Open" list in the summary of alerts for `branch-x` could show a status of "Fixed" on the alert page, if the alert is already fixed on the default branch. You can view the status of the alert for the branch you filtered on in the **Affected branches** section on the right side of the alert page. \ No newline at end of file diff --git a/translations/ja-JP/data/reusables/dependabot/private-dependencies-note.md b/translations/ja-JP/data/reusables/dependabot/private-dependencies-note.md index bba112ff1c87..98c5a29e426a 100644 --- a/translations/ja-JP/data/reusables/dependabot/private-dependencies-note.md +++ b/translations/ja-JP/data/reusables/dependabot/private-dependencies-note.md @@ -1 +1 @@ -セキュリティあるいはバージョンアップデートを実行する際に、エコシステムによってはアップデートが成功したことを検証するためにすべての依存関係をソースから解決できなければならないことがあります。 マニフェストあるいはロックファイルにプライベートの依存関係が含まれているなら、{% data variables.product.prodname_dependabot %}はそれらの依存関係がホストされている場所にアクセスできなければなりません。 Organizationのオーナーは、同じOrganization内のプロジェクトに対する依存関係を含むプライベートリポジトリへのアクセス権を{% data variables.product.prodname_dependabot %}に付与できます。 詳しい情報については「[Organizatonのためのセキュリティ及び分析設定の管理](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private-dependencies)」を参照してください。 リポジトリの_dependabot.yml_設定ファイル中で、プライベートリポジトリへのアクセスを設定できます。 詳しい情報については、「[依存関係の更新の設定オプション](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries) 」を参照してください。 +セキュリティあるいはバージョンアップデートを実行する際に、エコシステムによってはアップデートが成功したことを検証するためにすべての依存関係をソースから解決できなければならないことがあります。 マニフェストあるいはロックファイルにプライベートの依存関係が含まれているなら、{% data variables.product.prodname_dependabot %}はそれらの依存関係がホストされている場所にアクセスできなければなりません。 Organizationのオーナーは、同じOrganization内のプロジェクトに対する依存関係を含むプライベートリポジトリへのアクセス権を{% data variables.product.prodname_dependabot %}に付与できます。 詳しい情報については「[Organizatonのためのセキュリティ及び分析設定の管理](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization#allowing-dependabot-to-access-private-dependencies)」を参照してください。 リポジトリの_dependabot.yml_設定ファイル中で、プライベートリポジトリへのアクセスを設定できます。 For more information, see "[Configuration options for the dependabot.yml file](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)." diff --git a/translations/ja-JP/data/reusables/dependabot/result-discrepancy.md b/translations/ja-JP/data/reusables/dependabot/result-discrepancy.md new file mode 100644 index 000000000000..866f6f4d02bd --- /dev/null +++ b/translations/ja-JP/data/reusables/dependabot/result-discrepancy.md @@ -0,0 +1 @@ +{% data variables.product.product_name %} によって報告された依存関係の検出結果は、他のツールから返される結果とは異なる場合があります。 これには理由があり、{% data variables.product.prodname_dotcom %} がプロジェクトの依存関係をどのように決定するかを理解しておくと便利です。 diff --git a/translations/ja-JP/data/reusables/repositories/github-reviews-security-advisories.md b/translations/ja-JP/data/reusables/repositories/github-reviews-security-advisories.md index 4f84799a05c0..e74228e1a498 100644 --- a/translations/ja-JP/data/reusables/repositories/github-reviews-security-advisories.md +++ b/translations/ja-JP/data/reusables/repositories/github-reviews-security-advisories.md @@ -1,3 +1,3 @@ {% data variables.product.prodname_dotcom %}は、公開されたそれぞれのセキュリティアドバイザリをレビューし、{% data variables.product.prodname_advisory_database %}に追加し、そのセキュリティアドバイザリを使って影響されるリポジトリに{% data variables.product.prodname_dependabot_alerts %}を送信することがあります。 セキュリティアドバイザリがフォークから生ずる場合、ユニークな名前の下でパブリックなパッケージレジストリに公開されたパッケージをフォークが所有しているときにのみアラートが送信されます。 このプロセスには最大で72時間がかかり、{% data variables.product.prodname_dotcom %}がさらなる情報を求めてあなたに連絡することがあります。 -{% data variables.product.prodname_dependabot_alerts %}に関する詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)」 および「[{% data variables.product.prodname_dependabot_security_updates %}について](/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-dependabot-security-updates)」を参照してください。 {% data variables.product.prodname_advisory_database %}に関する詳しい情報については、「[{% data variables.product.prodname_advisory_database %}におけるセキュリティ脆弱性をブラウズする](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database)」を参照してください。 +For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)" and "[About {% data variables.product.prodname_dependabot_security_updates %}](/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-dependabot-security-updates)." {% data variables.product.prodname_advisory_database %}に関する詳しい情報については、「[{% data variables.product.prodname_advisory_database %}におけるセキュリティ脆弱性をブラウズする](/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database)」を参照してください。 diff --git a/translations/ja-JP/data/reusables/repositories/security-alert-delivery-options.md b/translations/ja-JP/data/reusables/repositories/security-alert-delivery-options.md index df5701fa850b..7612c7374b24 100644 --- a/translations/ja-JP/data/reusables/repositories/security-alert-delivery-options.md +++ b/translations/ja-JP/data/reusables/repositories/security-alert-delivery-options.md @@ -1,4 +1,4 @@ {% ifversion not ghae %} リポジトリにサポートされている依存関係マニフェストがあり -{% ifversion fpt or ghec %}（そしてプライベートリポジトリの場合に依存関係グラフをセットアップしているなら）{% endif %}、リポジトリ内に脆弱な依存関係を{% data variables.product.product_name %}が検出すると、週次のダイジェストメールを受け取ることになります。 セキュリティアラートは、Web通知、個別のメール通知、日次のメールダイジェスト、{% data variables.product.product_name %}インターフェース上のアラートとして設定することもできます。 詳しい情報については、「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 +{% ifversion fpt or ghec %}（そしてプライベートリポジトリの場合に依存関係グラフをセットアップしているなら）{% endif %}、リポジトリ内に脆弱な依存関係を{% data variables.product.product_name %}が検出すると、週次のダイジェストメールを受け取ることになります。 セキュリティアラートは、Web通知、個別のメール通知、日次のメールダイジェスト、{% data variables.product.product_name %}インターフェース上のアラートとして設定することもできます。 詳しい情報については、「[{% data variables.product.prodname_dependabot_alerts %} について](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies)」を参照してください。 {% endif %} diff --git a/translations/ja-JP/data/reusables/rest-reference/deployments/keys.md b/translations/ja-JP/data/reusables/rest-reference/deploy_keys/deploy_keys.md similarity index 94% rename from translations/ja-JP/data/reusables/rest-reference/deployments/keys.md rename to translations/ja-JP/data/reusables/rest-reference/deploy_keys/deploy_keys.md index ae5ed1ae39bb..f8e7a1c953c6 100644 --- a/translations/ja-JP/data/reusables/rest-reference/deployments/keys.md +++ b/translations/ja-JP/data/reusables/rest-reference/deploy_keys/deploy_keys.md @@ -1,5 +1,3 @@ -## デプロイキー - {% data reusables.repositories.deploy-keys %} デプロイキーは、以下の API エンドポイントを使用するか、GitHub を使用することでセットアップできます。 GitHub でデプロイキーを設定する方法については、「[デプロイキーを管理する](/developers/overview/managing-deploy-keys)」を参照してください。 \ No newline at end of file diff --git a/translations/ja-JP/data/reusables/webhooks/repository_vulnerability_alert_short_desc.md b/translations/ja-JP/data/reusables/webhooks/repository_vulnerability_alert_short_desc.md index 4aea3852817f..2fe7cd8e0d76 100644 --- a/translations/ja-JP/data/reusables/webhooks/repository_vulnerability_alert_short_desc.md +++ b/translations/ja-JP/data/reusables/webhooks/repository_vulnerability_alert_short_desc.md @@ -1 +1 @@ -リポジトリ内のセキュリティ脆弱性アラートに関連するアクティビティ。 {% data reusables.webhooks.action_type_desc %} 詳しい情報については「[脆弱性のある依存関係に対するアラートについて](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)」を参照してください。 +リポジトリ内のセキュリティ脆弱性アラートに関連するアクティビティ。 {% data reusables.webhooks.action_type_desc %} For more information, see the "[About {% data variables.product.prodname_dependabot_alerts %}](/github/managing-security-vulnerabilities/about-alerts-for-vulnerable-dependencies/)". diff --git a/translations/log/ja-resets.csv b/translations/log/ja-resets.csv index a64bef81ea58..f57fd583feb6 100644 --- a/translations/log/ja-resets.csv +++ b/translations/log/ja-resets.csv @@ -98,15 +98,17 @@ translations/ja-JP/content/code-security/code-scanning/using-codeql-code-scannin translations/ja-JP/content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-runner-in-your-ci-system.md,broken liquid tags translations/ja-JP/content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system.md,broken liquid tags translations/ja-JP/content/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/running-codeql-runner-in-your-ci-system.md,broken liquid tags +translations/ja-JP/content/code-security/dependabot/dependabot-alerts/about-dependabot-alerts.md,broken liquid tags +translations/ja-JP/content/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates.md,broken liquid tags +translations/ja-JP/content/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot.md,broken liquid tags +translations/ja-JP/content/code-security/dependabot/working-with-dependabot/troubleshooting-the-detection-of-vulnerable-dependencies.md,broken liquid tags translations/ja-JP/content/code-security/getting-started/securing-your-organization.md,broken liquid tags translations/ja-JP/content/code-security/getting-started/securing-your-repository.md,broken liquid tags translations/ja-JP/content/code-security/index.md,broken liquid tags translations/ja-JP/content/code-security/secret-scanning/about-secret-scanning.md,broken liquid tags -translations/ja-JP/content/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot.md,broken liquid tags -translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies.md,broken liquid tags -translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates.md,broken liquid tags -translations/ja-JP/content/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/troubleshooting-the-detection-of-vulnerable-dependencies.md,broken liquid tags +translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security.md,broken liquid tags translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph.md,Listed in localization-support#489 +translations/ja-JP/content/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph.md,broken liquid tags translations/ja-JP/content/codespaces/customizing-your-codespace/personalizing-codespaces-for-your-account.md,broken liquid tags translations/ja-JP/content/codespaces/developing-in-codespaces/using-codespaces-in-visual-studio-code.md,broken liquid tags translations/ja-JP/content/codespaces/prebuilding-your-codespaces/configuring-prebuilds.md,broken liquid tags