You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups.md
+25-5Lines changed: 25 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,17 +33,27 @@ All organizations have a single default self-hosted runner group. Organizations
33
33
34
34
Self-hosted runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can move a runner from the default group to any group you create.
35
35
36
-
When creating a group, you must choose a policy that defines which repositories have access to the runner group. You can configure a runner group to be accessible to a specific list of repositories, all private repositories, or all repositories in the organization.
36
+
When creating a group, you must choose a policy that defines which repositories have access to the runner group.
37
37
38
38
{% data reusables.organizations.navigate-to-org %}
39
39
{% data reusables.organizations.org_settings %}
40
40
{% data reusables.organizations.settings-sidebar-actions %}
41
41
1. In the **Self-hosted runners** section, click **Add new**, and then **New group**.
1. Enter a name for your runner group, and select an access policy from the **Repository access** dropdown list.
44
+
1. Enter a name for your runner group, and assign a policy for repository access.
45
45
46
-
46
+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "[email protected]" %} You can configure a runner group to be accessible to a specific list of repositories, or to all repositories in the organization. By default, public repositories can't access runners in a runner group, but you can use the **Allow public repositories** option to override this.{% else if currentVersion == "[email protected]"%}You can configure a runner group to be accessible to a specific list of repositories, all private repositories, or all repositories in the organization.{% endif %}
For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories)."
53
+
54
+
{% endwarning %}
55
+
56
+
47
57
1. Click **Save group** to create the group and apply the policy.
48
58
49
59
### Creating a self-hosted runner group for an enterprise
@@ -52,7 +62,7 @@ Enterprises can add their self-hosted runners to groups for access management. E
52
62
53
63
Self-hosted runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can assign the runner to a specific group during the registration process, or you can later move the runner from the default group to a custom group.
54
64
55
-
When creating a group, you must choose a policy that grants access to all organizations in the enterprise or choose specific organizations.
65
+
When creating a group, you must choose a policy that defines which organizations have access to the runner group.
56
66
57
67
{% data reusables.enterprise-accounts.access-enterprise %}
58
68
{% data reusables.enterprise-accounts.policies-tab %}
@@ -61,7 +71,17 @@ When creating a group, you must choose a policy that grants access to all organi
1. Enter a name for your runner group, and select an access policy from the **Organization access** dropdown list.
74
+
1. Enter a name for your runner group, and assign a policy for organization access.
75
+
76
+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "[email protected]" %} You can configure a runner group to be accessible to a specific list of organizations, or all organizations in the enterprise. By default, public repositories can't access runners in a runner group, but you can use the **Allow public repositories** option to override this.{% else if currentVersion == "[email protected]"%}You can configure a runner group to be accessible to all organizations in the enterprise or choose specific organizations.{% endif %}
For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories)."
83
+
84
+
{% endwarning %}
65
85
66
86
67
87
1. Click **Save group** to create the group and apply the policy.
Copy file name to clipboardExpand all lines: content/actions/reference/workflow-syntax-for-github-actions.md
+31Lines changed: 31 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -876,6 +876,37 @@ strategy:
876
876
877
877
{% endnote %}
878
878
879
+
##### Using environment variables in a matrix
880
+
881
+
You can add custom environment variables for each test combination by using `include` with `env`. You can then refer to the custom environment variables in a later step.
882
+
883
+
In this example, the matrix entries for `node-version` are each configured to use different values for the `site` and `datacenter` environment variables. The `Echo site details` step then uses {% raw %}`env: ${{ matrix.env }}`{% endraw %} to refer to the custom variables:
884
+
885
+
{% raw %}
886
+
```yaml
887
+
name: Node.js CI
888
+
on: [push]
889
+
jobs:
890
+
build:
891
+
runs-on: ubuntu-latest
892
+
strategy:
893
+
matrix:
894
+
include:
895
+
- node-version: 10.x
896
+
site: "prod"
897
+
datacenter: "site-a"
898
+
- node-version: 12.x
899
+
site: "dev"
900
+
datacenter: "site-b"
901
+
steps:
902
+
- name: Echo site details
903
+
env:
904
+
SITE: ${{ matrix.site }}
905
+
DATACENTER: ${{ matrix.datacenter }}
906
+
run: echo $SITE $DATACENTER
907
+
```
908
+
{% endraw %}
909
+
879
910
### **`jobs.<job_id>.strategy.fail-fast`**
880
911
881
912
When set to `true`, {% data variables.product.prodname_dotcom %} cancels all in-progress jobs if any `matrix` job fails. Default: `true`
intro: 'With {% data variables.product.prodname_ghe_server %}, you can create an enterprise account to give administrators a single point of visibility and management for their billing and license usage.'
3
+
intro: 'With {% data variables.product.product_name %}, you can use an enterprise account to give administrators a single point of visibility and management{% if enterpriseServerVersions contains currentVersion %} for billing and license usage{% endif %}.'
### About enterprise accounts on {% data variables.product.prodname_ghe_server %}
12
+
### About enterprise accounts on {% data variables.product.product_name %}
12
13
13
-
An enterprise account allows you to manage multiple {% data variables.product.prodname_dotcom %} organizations and {% data variables.product.prodname_ghe_server %} instances. Your enterprise account must have a handle, like an organization or personal account on {% data variables.product.prodname_dotcom %}. Enterprise administrators can manage settings and preferences, like:
14
+
An enterprise account allows you to manage multiple organizations{% if enterpriseServerVersions contains currentVersion %} and {% data variables.product.prodname_ghe_server %} instances{% else %} on {% data variables.product.product_name %}{% endif %}. Your enterprise account must have a handle, like an organization or personal account on {% data variables.product.prodname_dotcom %}. Enterprise administrators can manage settings and preferences, like:
14
15
15
-
- Member access and management (organization members, outside collaborators)
16
-
- Billing and usage ({% data variables.product.prodname_ghe_server %} instances, user licenses, {% data variables.large_files.product_name_short %} packs)
17
-
- Security(single sign-on, two factor authentication)
18
-
- Requests and support bundle sharing with {% data variables.contact.enterprise_support %}
16
+
- Member access and management (organization members, outside collaborators){% if enterpriseServerVersions contains currentVersion %}
17
+
- Billing and usage ({% data variables.product.prodname_ghe_server %} instances, user licenses, {% data variables.large_files.product_name_short %} packs){% endif %}
18
+
- Security{% if enterpriseServerVersions contains currentVersion %}(single sign-on, two factor authentication)
19
+
- Requests {% if enterpriseServerVersions contains currentVersion %}and support bundle sharing {% endif %}with {% data variables.contact.enterprise_support %}{% endif %}
19
20
20
-
{% data reusables.enterprise-accounts.enterprise-accounts-billing %}
21
+
{% if enterpriseServerVersions contains currentVersion %}{% data reusables.enterprise-accounts.enterprise-accounts-billing %} For more information about managing your {% data variables.product.prodname_ghe_cloud %} subscription, see "[Viewing the subscription and usage for your enterprise account](/articles/viewing-the-subscription-and-usage-for-your-enterprise-account)." {% endif %}For more information about managing your {% data variables.product.product_name %} billing settings, see "[Managing billing for your enterprise](/admin/overview/managing-billing-for-your-enterprise)."
22
+
23
+
{% if enterpriseServerVersions contains currentVersion %}
21
24
22
25
For more information about the differences between {% data variables.product.prodname_ghe_cloud %} and {% data variables.product.prodname_ghe_server %}, see "[{% data variables.product.prodname_dotcom %}'s products](/articles/githubs-products)." To upgrade to {% data variables.product.prodname_enterprise %} or to get started with an enterprise account, contact {% data variables.contact.contact_enterprise_sales %}.
23
26
24
27
### Managing {% data variables.product.prodname_ghe_server %} licenses linked to your enterprise account
25
28
26
29
{% data reusables.enterprise-accounts.admin-managing-licenses %}
Copy file name to clipboardExpand all lines: content/admin/policies/enforcing-repository-management-policies-in-your-enterprise.md
+16-4Lines changed: 16 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@ versions:
34
34
35
35
Each time someone creates a new repository on your enterprise, that person must choose a visibility for the repository. When you configure a default visibility setting for the enterprise, you choose which visibility is selected by default. For more information on repository visibility, see "[About repository visibility](/github/creating-cloning-and-archiving-repositories/about-repository-visibility)."
36
36
37
-
If a site administrator disallows members from creating certain types of repositories, members will not be able to create that type of repository even if the visibility setting defaults to that type. For more information, see "[Setting a policy for repository creation](#setting-a-policy-for-repository-creation)."
37
+
If an enterprise owner disallows members from creating certain types of repositories, members will not be able to create that type of repository even if the visibility setting defaults to that type. For more information, see "[Setting a policy for repository creation](#setting-a-policy-for-repository-creation)."
38
38
39
39
{% data reusables.enterprise-accounts.access-enterprise %}
40
40
{% if currentVersion ver_gt "[email protected]" or currentVersion == "github-ae@latest" %}
@@ -50,9 +50,9 @@ If a site administrator disallows members from creating certain types of reposit
50
50
51
51
### Setting a policy for changing a repository's visibility
52
52
53
-
When you prevent members from changing repository visibility, only site administrators have the ability to make public repositories private or make private repositories public.
53
+
When you prevent members from changing repository visibility, only enterprise owners can change the visibility of a repository.
54
54
55
-
If a site administrator has restricted repository creation to organization owners only, then members will not be able to change repository visibility. If a site administrator has restricted member repository creation to private repositories only, then members will only be able to change repositories from public to private. For more information, see "[Setting a policy for repository creation](#setting-a-policy-for-repository-creation)."
55
+
If an enterprise owner has restricted repository creation to organization owners only, then members will not be able to change repository visibility. If an enterprise owner has restricted member repository creation to private repositories only, then members will only be able to change the visibility of a repository to private. For more information, see "[Setting a policy for repository creation](#setting-a-policy-for-repository-creation)."
56
56
57
57
{% data reusables.enterprise-accounts.access-enterprise %}
58
58
{% data reusables.enterprise-accounts.policies-tab %}
@@ -77,6 +77,16 @@ If a site administrator has restricted repository creation to organization owner
77
77
78
78
{% endif %}
79
79
80
+
### Enforcing a policy on forking private or internal repositories
81
+
82
+
Across all organizations owned by your enterprise, you can allow people with access to a private or internal repository to fork the repository, never allow forking of private or internal repositories, or allow owners to administer the setting on the organization level.
83
+
84
+
{% data reusables.enterprise-accounts.access-enterprise %}
85
+
{% data reusables.enterprise-accounts.policies-tab %}
86
+
3. On the **Repository policies** tab, under "Repository forking", review the information about changing the setting. {% data reusables.enterprise-accounts.view-current-policy-config-orgs %}
87
+
4. Under "Repository forking", use the drop-down menu and choose a policy.
88
+
89
+
80
90
### Setting a policy for repository deletion and transfer
81
91
82
92
{% data reusables.enterprise-accounts.access-enterprise %}
@@ -175,6 +185,8 @@ You can override the default inherited settings by configuring the settings for
175
185
6. Optionally, select **Enforce on all repositories** to override repository-specific settings. Note that this will **not** override an enterprise-wide policy.
176
186
177
187
188
+
{% if enterpriseServerVersions contains currentVersion %}
189
+
178
190
### Configuring anonymous Git read access
179
191
180
192
{% data reusables.enterprise_user_management.disclaimer-for-git-read-access %}
@@ -203,7 +215,6 @@ If necessary, you can prevent repository administrators from changing anonymous
203
215
3. Optionally, to prevent repository admins from changing anonymous Git read access settings in all repositories on your enterprise, select **Prevent repository admins from changing anonymous Git read access**.
204
216
205
217
206
-
{% if enterpriseServerVersions contains currentVersion %}
207
218
#### Setting anonymous Git read access for a specific repository
208
219
209
220
{% data reusables.enterprise_site_admin_settings.access-settings %}
@@ -217,6 +228,7 @@ If necessary, you can prevent repository administrators from changing anonymous
217
228
218
229
8. Optionally, to prevent repository admins from changing this setting for this repository, select **Prevent repository admins from changing anonymous Git read access**.
219
230
231
+
220
232
{% endif %}
221
233
222
234
{% if currentVersion ver_gt "[email protected]" or currentVersion == "github-ae@latest" %}
0 commit comments