GitHub Advanced Security — knowledge map
The 177 core concepts of GitHub Advanced Security and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (177)
Encrypted secrets and variables (secrets / vars)
Store sensitive values as secrets (secrets.<name>) and non-sensitive config as variables (vars.<name>); scoped at org/repo/environment, with the narrower scope winning (environment > repo > org). Managed via REST API (writes are public-key encrypted).
Related: Environment and protection rules
Workflow
An automation process defined as a YAML file under .github/workflows/; declares triggers in on: and runs one or more jobs.
Prerequisites: YAML
Job
A unit of execution in a workflow; selects a runner via runs-on and runs a sequence of steps. Jobs run in parallel by default, each in an isolated environment.
Related: runs-on
Contexts
Objects to access runtime metadata—github, env, vars, secrets, inputs, matrix, needs, runner, job, steps, etc.
Prerequisites: needs (job dependency)
GitHub Advanced Security (GHAS)
A set of features protecting code, secrets, and dependencies across the SDLC. In late 2024 it was reorganized into two independent, separately licensed products—Code Security (CodeQL/code scanning) and Secret Protection (secret scanning/push protection). Dependabot and dependency/supply-chain features are free. Public repos are largely free; private/Enterprise require a product license.
Prerequisites: Dependabot、push / pull_request events、Encrypted secrets and variables (secrets / vars)、Code Security
Related: Code scanning
Issue
Tracks and discusses bugs/requests/tasks one at a time; integrates with Labels/Assignees/Milestones.
push / pull_request events
Core CI events triggered by code pushes or PR open/update; narrow scope via branches/paths (and *-ignore) filters.
Dependabot
Alerts on vulnerable dependencies and auto-opens PRs for security/version updates.
Dependency graph
Parses manifests/lockfiles to list the packages a repo depends on, including transitive dependencies; it underpins Dependabot alerts and Dependency Review.
Prerequisites: Dependabot、Dependabot alerts and security updates、Dependency Review
strategy.matrix
Auto-expands one job definition into multiple variations (OS×version, etc.); add with include and drop with exclude.
Prerequisites: Job
Related: include / exclude (matrix)
permissions (token scope)
A key declaring the GITHUB_TOKEN’s permissions; default to least privilege (e.g., contents: read) and elevate only jobs needing writes. Grant id-token: write when using OIDC.
Related: GITHUB_TOKEN
Step
An individual task composing a job; run: executes a shell command and uses: invokes an action. Steps run top to bottom.
GitHub Enterprise Server (GHES)
The self-hosted edition of Enterprise, deployed on an organization's own data center or private cloud. Keeping data in-house helps meet compliance requirements, but features arrive via periodic feature releases and some cloud-only capabilities (e.g., certain security features) can lag or be unavailable. Administrators operate their own upgrades and backups.
Prerequisites: GitHub Enterprise、Organization、Releases
Team
A unit grouping members within an organization to grant repo permissions; can be nested, inheriting the parent.
Prerequisites: permissions (token scope)
Related: Organization
Environment and protection rules
A unit representing a deploy target; supports required-reviewer approval, a wait timer, deployable-branch restrictions, and environment-scoped secrets/variables—gating production deploys.
GitHub Enterprise
For large organizations: groups multiple orgs centrally; comes as Cloud (GitHub-hosted) and Server (self-hosted).
Prerequisites: Organization
Policies (member capabilities)
Org/enterprise settings governing what members can do (repo creation, visibility, forking, Actions usage, enabling GHAS, etc.). Enterprise policy cascades to lower orgs/repos—a separate layer from rulesets (guardrails on code changes).
Prerequisites: fork、Ruleset、GitHub Advanced Security (GHAS)、Visibility (Public/Private/Internal)
Cache (actions/cache)
Saves/restores regenerable data (e.g., dependencies) by key to speed up builds; restore-keys allows partial-match restore. Differs in purpose from artifacts (outputs to keep).
Prerequisites: Artifact
inputs (workflow inputs)
Parameters received via workflow_dispatch or workflow_call; define type (string/boolean/choice/number/environment), required, default, options, and read via inputs.<name>.
Prerequisites: Workflow
Related: workflow_dispatch、workflow_call (reusable workflow)
needs (job dependency)
A key controlling job order; needs: [A, B] declares "run after A and B complete." It is also the path to read prior jobs’ outputs.
Prerequisites: Job
on: (trigger declaration)
The key that declares the events triggering a workflow—push, pull_request, schedule, workflow_dispatch, repository_dispatch, workflow_call, etc.
Prerequisites: push / pull_request events、repository_dispatch、schedule (cron)、Workflow
workflow_call (reusable workflow)
A trigger declaration that lets other workflows call it via uses:; callers pass with: inputs and secrets: (inherit allowed) and can read outputs.
Prerequisites: Encrypted secrets and variables (secrets / vars)、Workflow
Related: secrets: inherit、inputs (workflow inputs)
Code Security
The core of GitHub's Code Scanning feature, which statically analyzes (SAST) source code to detect vulnerabilities; the default engine CodeQL builds a code database and uses dataflow analysis (source→sink) to find dangerous paths (third-party SAST tools can also be integrated). Note that "GitHub Code Security" is a subscription product plan introduced in 2025 (bundling Code Scanning, Copilot Autofix, etc.), not a rename of the Code Scanning feature itself.
Prerequisites: Code scanning、Autofix (Copilot Autofix)、Dataflow analysis (source→sink)
Prevention-first and gate-based
Prevention-first keeps problems from entering at the source (e.g., Push Protection). Gate-based blocks vulnerable items via required checks before merge/deploy (required Code Scanning/Dependency Review). Not exclusive—combine in layers.
Prerequisites: Code scanning、push / pull_request events、Secret scanning
Related: Dependency Review
Issue templates
A predefined form shown when creating a new issue. Beyond the older Markdown-based format, YAML-defined issue forms add structured inputs (text fields, dropdowns, checkboxes), letting you require fields and auto-apply labels to standardize submissions. Stored under `.github/ISSUE_TEMPLATE/`.
Prerequisites: inputs (workflow inputs)、Issue、Markdown、YAML
Related: Assignee、Labels (GitHub)
LICENSE
A file stating terms for use/modify/redistribute; a public repo with none defaults to all rights reserved.
Organization
An organization account that centrally manages members and repositories, with Teams, billing, and permissions.
Related: Team
Releases
Publishes a specific version tied to a tag, with release notes and assets.
Secret scanning
Detects API keys/tokens in commits/pushes; push protection blocks leaks up front.
Prerequisites: push / pull_request events
YAML
A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.
Prerequisites: JSON
License (seat)
A per-user allocation. Monitor license usage and reclaim unused seats; with SCIM/EMU, departed users’ seats free up automatically.
Prerequisites: SCIM (provisioning)、LICENSE
Ruleset
Guardrails that enforce branch protection, required reviews, and required status checks across orgs. A layer distinct from policies (member capabilities), governing code changes.
Prerequisites: Code review (Pull Request)
env: (environment variables)
A key defining environment variables at workflow/job/step levels; narrower scopes take precedence.
Prerequisites: Secret scope (env > repo > org)、Environment and protection rules、Job、Step
Dependency Review
A gate-based prevention that inspects a PR’s added/updated dependency diff before merge and blocks vulnerable deps or disallowed licenses; can be a required check.
Related: Prevention-first and gate-based
Secret Protection
Formerly secret scanning. Detects/blocks secrets (API keys, tokens) committed or about to be committed. Enabled at repo/org. Since a leaked secret remains in history, revoking (rotating) the token is mandatory.
Prerequisites: Encrypted secrets and variables (secrets / vars)、Secret scanning
Assignee
One or more users assigned as responsible for an issue or pull request. Filterable with the assignee: search qualifier, and used to surface a person's own tasks in notifications and dashboards. Distinct from a reviewer, who is asked to review the change's content rather than own the work item.
Related: Issue templates、Labels (GitHub)、Issue、Search qualifiers
GitHub Enterprise Cloud (GHEC)
The GitHub-hosted cloud edition of the Enterprise plan. GitHub operates the infrastructure, and new features and security updates typically land here before the self-hosted edition (GHES). A data residency option lets an org choose the storage region.
Prerequisites: GitHub Enterprise、GitHub Enterprise Server (GHES)
Related: Data Residency
Star
Bookmarks a repository (saved to your Stars list) and signals interest; it does not notify you.
Code scanning
Statically analyzes code (e.g., CodeQL) to find vulnerabilities and bugs (GHAS).
Related: GitHub Advanced Security (GHAS)
Code review (Pull Request)
Commenting on a diff in a Pull Request and approving or requesting changes; required reviews and CODEOWNERS-required reviewers enforce quality before merge.
Prerequisites: Environment and protection rules
Actions cost optimization
Reducing Actions consumption via paths/branches filters, concurrency, caching, minimizing matrices, and right-sizing runners—cutting waste without lowering quality.
Prerequisites: Cache (actions/cache)、concurrency、strategy.matrix、paths / branches filters
Deployment scenarios (GHEC/EMU/Data Residency/GHES)
Deployment options chosen by requirements: GHEC with EMU (fully managed IDs), GHEC with Data Residency + EMU (pinned data location), GHEC with personal accounts, and GHES (fully self-hosted).
Prerequisites: GitHub Enterprise Cloud (GHEC)、GitHub Enterprise Server (GHES)、Managed services (management boundary)
Related: Data Residency
Fine-grained PAT
A Personal Access Token with fine-grained permissions, repo scope, and expiry. Issue with least privilege + expiry, revoke on leak; orgs can require approval/restrict it.
Prerequisites: Policies (member capabilities)、permissions (token scope)、Issue、Personal Access Token (PAT)
GitHub Support
The channel for outages, bugs, and GHES system failures that admins can’t resolve via settings/permissions. First triage issues into "admin-solvable" vs "Support case."
Prerequisites: permissions (token scope)、GitHub Enterprise Server (GHES)、Issue
Identity provider (IdP)
A corporate auth platform (Entra ID, Okta, etc.) that handles authentication via SAML SSO and, combined with SCIM/team sync, centrally manages accounts and groups.
Prerequisites: SCIM (provisioning)、Team synchronization、Team
GitHub usage metrics
Reports that surface consumption—Actions minutes, Packages/Codespaces storage, and license (seat) usage—for billing and optimization, viewed in enterprise/organization billing and usage reports.
Prerequisites: License (seat)、Usage report、LICENSE、Organization
Action types (JavaScript/Docker/composite)
Three types: JavaScript (Node.js, cross-platform, fast), Docker container (bundles an environment but Linux-runner only, slower start), and composite (a bundle of steps).
Prerequisites: Composite action、Environment and protection rules、Step
Job outputs
Maps step outputs to a job’s outputs so dependent jobs read needs.<job>.outputs.<name>; passes short values to another job.
Prerequisites: $GITHUB_OUTPUT、Job、needs (job dependency)、Step
Larger runners
GitHub-hosted runners with more CPU/memory or static IP ranges; used for fixed-IP needs or heavy jobs.
Prerequisites: GitHub-hosted runner、Job、needs (job dependency)
schedule (cron)
A trigger for periodic runs via a cron expression; cron is UTC-based with minimum-interval limits and load delays, and stops if the repo is inactive.
Prerequisites: Expressions (${{ }})
Delegated bypass / delegated exceptions
A mechanism to temporarily bypass a block (e.g., Push Protection) or grant a policy exception with approval; control who may approve via access management and record for auditability (not a permanent waiver).
Prerequisites: push / pull_request events、Secret scanning
Dependabot alerts and security updates
Dependabot alerts notify of known dependency vulns (Advisory/CVE); security updates auto-create PRs to safe versions; version updates keep deps current regardless of vulns (the two differ).
Prerequisites: Dependabot
EPSS (Exploit Prediction Scoring System)
A score estimating the probability a vulnerability is actually exploited; combined with severity (CVSS) to prioritize "severe and likely-exploited" issues.
Prerequisites: Issue
Related: CVSS (severity)
Shift left
Moving security earlier in development to prevent problems before they grow—Push Protection, dependency scanning, pre-merge analysis. Later fixes cost more. Prevention doesn’t replace detection/remediation (use layers).
Prerequisites: push / pull_request events、Secret scanning
Supply chain security
An umbrella concept for securing the software supply chain (dependencies and artifacts). On GitHub it encompasses the dependency graph, Dependabot (alerts and updates), dependency review, and SBOM export, covering transitive dependencies as well as direct ones.
Prerequisites: Dependabot、Dependency graph、Dependency Review、SBOM (Software Bill of Materials)
Labels (GitHub)
A tagging feature attached to issues and pull requests to classify by type, priority, or status. Colors and descriptions are freely defined, and labels can be filtered with the label: search qualifier or used as Actions trigger conditions. Repos/orgs ship with default labels (bug, enhancement, etc.).
Prerequisites: Issue、Search qualifiers
Related: Assignee、Issue templates
Markdown
A lightweight formatting syntax (.md) used widely in Issues, PRs, comments, and READMEs.
Prerequisites: Issue
Related: README
fork
Copying a repository into your own account on GitHub; the start of contributing to OSS.
GitHub Connect
Links GitHub Enterprise Server/Cloud with GitHub.com to enable license sync, unified search, and using Actions from the server.
Prerequisites: GitHub Enterprise、GitHub Enterprise Server (GHES)、LICENSE
Metered billing
Products billed by consumption on top of per-seat fees—Actions minutes, storage, Packages, Copilot, GHAS, etc. Use usage reports to find heavy-consuming orgs/repos.
Prerequisites: License (seat)、GitHub Advanced Security (GHAS)
Related: Usage report
Secret scope (env > repo > org)
Secrets are scoped at org, repository, and environment levels; on name clashes the narrowest scope wins (env > repo > org). Limit which repos can use org secrets, and centralize shared credentials at org level for easy rotation.
Prerequisites: Environment and protection rules、Encrypted secrets and variables (secrets / vars)
Artifact
Stores files (build outputs, test reports) against a run; save with upload-artifact, fetch with download-artifact. Auto-deleted after retention. The standard way to pass files between jobs.
Prerequisites: Job
Related: Retention
Composite action
An action bundling multiple steps (run: and other actions’ uses:); invoked as a single step via uses: in a workflow.
Configuration variables
Non-secret settings defined at repo/environment/org level and read via the vars context; use secrets for sensitive values (variable values can appear in logs).
Prerequisites: Contexts、Environment and protection rules、Encrypted secrets and variables (secrets / vars)
Expressions (${{ }})
Expressions evaluated inside ${{ }} for if: and value interpolation; mind static (parse-time) vs runtime evaluation and never leak secrets into expressions/logs.
Prerequisites: Encrypted secrets and variables (secrets / vars)
GitHub-hosted runner
An ephemeral VM that GitHub provisions, updates, and tears down; clean per job, suited to general CI. Usage-billed (with free minutes).
Prerequisites: Job
$GITHUB_OUTPUT
A special file to set a step output; write echo "name=value" >> "$GITHUB_OUTPUT" and read within the job via steps.<id>.outputs.<name>. For passing short values.
GITHUB_TOKEN
A temporary, scoped credential auto-issued per workflow run; scope it to least privilege via permissions (e.g., contents: read) and elevate only jobs needing writes. Avoid long-lived PATs.
Related: permissions (token scope)
if (conditional) and status functions
Controls whether a job/step runs via an expression; status functions success()/failure()/cancelled()/always() express failure-only, always, etc.
Prerequisites: Expressions (${{ }})、Job、Step
include / exclude (matrix)
include adds a specific matrix combination (or attaches values); exclude drops unneeded combinations.
Related: strategy.matrix
secrets: inherit
A setting by which a reusable-workflow caller forwards all of its secrets at once.
Prerequisites: Encrypted secrets and variables (secrets / vars)、Workflow
Related: workflow_call (reusable workflow)
Toolcache
A mechanism to check preinstalled language runtimes/tool versions on GitHub-hosted runners; consult alongside runner image release notes.
Prerequisites: Cache (actions/cache)、GitHub-hosted runner、Releases
YAML anchors / aliases
A YAML feature to reuse repeated fragments within one file (anchor &, alias *, merge key <<); expanded by the parser before evaluation. Not for cross-file sharing (use reusable workflows for that).
Prerequisites: Workflow、workflow_call (reusable workflow)、YAML
Alert dismissal and ownership
Dismiss alerts only for false positives/accepted cases with recorded reasons (careless dismissal leaves risk). Clarify ownership so who responds/remediates is clear, preventing neglect or duplicate work.
Autofix (Copilot Autofix)
Auto-suggests fixes for detected vulnerabilities that developers review and adopt; since suggestions can be wrong, validate before merging.
CVSS (severity)
Common Vulnerability Scoring System—a standard scoring vulnerability severity. For prioritization, combine with EPSS (exploit probability), reachability, and asset criticality.
Dataflow analysis (source→sink)
CodeQL analysis showing the path of "where a dangerous value enters (source) and where it can be exploited (sink)," revealing the cause, blast radius, and where to add validation/sanitization.
GitHub Security Advisory (GHSA)
Vulnerability info in the GitHub Advisory Database backing Dependabot detection. A repository security advisory lets you fix a vulnerability in your own project privately and then publish it.
Prerequisites: Dependabot
Grouping and auto-dismiss (dependency updates)
Grouping combines related dependency updates into one PR to cut noise; auto-dismiss drops low-risk alerts by conditions (too loose dismisses real risk). Configure update strategy in dependabot.yml.
Prerequisites: Dependabot
SARIF
The Static Analysis Results Interchange Format. Uploading a third-party SAST’s SARIF to GitHub surfaces results as Code Scanning alerts in one UI, coexisting with CodeQL.
Prerequisites: Code scanning
Security manager (role)
A role overseeing security policy, managing alerts, and approving exceptions; granted independently of code-write access, at least privilege to the right people.
GitHub App
A first-class actor for automation and integrations on GitHub. It installs per-repository and grants only the fine-grained permissions it needs, making it the recommended least-privilege choice for automation and integration development over an OAuth App. It calls the API as an installation rather than as a user, and gets its own bot identity.
Prerequisites: needs (job dependency)、permissions (token scope)
Related: OAuth App
OAuth App
An integration method that acts on behalf of a user against GitHub. At authorization the user grants a chosen scope, and the app then operates with that user's permissions—so, unlike a GitHub App, it cannot be scoped down per repository with fine-grained permissions. It is also distinct from a PAT (Personal Access Token), a user's own simple token.
Prerequisites: permissions (token scope)、Personal Access Token (PAT)
Related: GitHub App
README
The entry-point description of a project (overview, usage, contributing); written in Markdown.
Related: Markdown
GitHub Copilot
AI coding assistance across IDEs, the CLI, and GitHub.com; humans must review and decide on suggestions.
Custom repository role
A custom repository role bundling only the needed permissions when the built-in Read–Admin levels don’t fit—useful for least privilege.
Prerequisites: permissions (token scope)
Related: Repository roles
Data Residency
Storing GitHub data in a specific geographic region (GHEC with Data Residency), used to meet regulatory/compliance requirements.
Related: Deployment scenarios (GHEC/EMU/Data Residency/GHES)、GitHub Enterprise Cloud (GHEC)
Enterprise teams
A higher-level team that manages membership, roles, and policy (governance) across multiple organizations within an enterprise; define a team once and assign it to many organizations. Nesting and parent-permission inheritance are features of organization-level teams, not enterprise teams.
Prerequisites: Organization、Team
Organization roles (owner/member/security manager)
Roles governing the org: the owner (whole-org control), regular members, and carved-out roles like security manager. Owner is powerful—grant sparingly.
Prerequisites: Security manager (role)、Organization
Repository roles
Per-repo access levels—Read / Triage / Write / Maintain / Admin—plus custom repository roles for fine-grained control. Assign by team, not per individual.
Prerequisites: Team
Related: Custom repository role
SCIM (provisioning)
Syncs IdP user create/update/delete to GitHub, auto-provisioning/deprovisioning accounts. A user disabled in the IdP is auto-removed from GitHub, preventing leftover access—distinct from SAML (authentication).
Support bundle / diagnostics
A set of diagnostics GHES generates, provided to GitHub Support for investigating cases (outages, bugs, system failures).
Prerequisites: GitHub Support、GitHub Enterprise Server (GHES)
Team synchronization
Maps IdP groups to GitHub team membership and auto-reflects group changes into teams, centralizing group management in the IdP; can conflict with manually added GitHub members.
Prerequisites: Team
Usage report
A report showing metered consumption by org/repo and trend, used for budgeting, chargeback, and cost-optimization decisions.
Related: Metered billing
Action input (INPUT_/getInput)
How to read with:-passed inputs inside an action—via the INPUT_<NAME> env var, or @actions/core getInput in JavaScript actions.
Prerequisites: Action types (JavaScript/Docker/composite)、inputs (workflow inputs)
ACTIONS_STEP_DEBUG
A secret that, when set, enables step-execution debug logging; used to investigate failures the normal logs don’t explain.
Prerequisites: Encrypted secrets and variables (secrets / vars)、Step
Fork-PR run approval
A setting requiring approval before Actions first run on a PR from an external fork; prevents unreviewed external-code execution and secret abuse.
Prerequisites: fork、Encrypted secrets and variables (secrets / vars)
Immutable actions
Makes a released action version unchangeable so a referenced version cannot be swapped later; with SHA pinning, strengthens supply-chain safety.
Prerequisites: SHA pinning、Releases
paths / branches filters
Filters narrowing what triggers push/pull_request; paths/paths-ignore by file and branches/branches-ignore by branch, avoiding unneeded runs to save cost.
Prerequisites: push / pull_request events
Re-run failed jobs / Re-run all jobs
Re-running only failed jobs vs retrying the whole run; use the former when a specific matrix variant fails and the latter for flaky failures.
Prerequisites: Job、strategy.matrix
Self-hosted runner
A runner where you install and register the runner app on your own machine/cloud; for special hardware, internal-network access, or large caches. State can persist, so use on public repos is risky.
Prerequisites: Cache (actions/cache)
SHA pinning
Referencing a third-party action via uses: owner/repo@<full commit SHA>; since tags are reassignable, an immutable SHA is safest against tampering. Avoid floating refs like @main.
Starter workflow
A scaffold (template) for creating new workflows; placed under workflow-templates in the org .github repo for members to copy. Independent after copy—original updates don’t propagate.
Status badge
An SVG badge in the README that shows at a glance the latest result (pass/fail) of a workflow for a given branch/event.
$GITHUB_STEP_SUMMARY
A special file where appended Markdown renders as a rich job summary (test tables, coverage, links) on the run page.
Workflow commands
Special output commands to interact with the runner—log annotations (::notice::/::warning::/::error::), secret masking (::add-mask::), log folding (::group::).
Prerequisites: Annotations、Workflow
workflow_dispatch
A manual trigger from UI/API/CLI; define inputs with type/required/default/options to accept parameters at start.
Related: inputs (workflow inputs)
.github/workflows
The default directory holding workflow YAML in a repository; YAML placed here is recognized as Actions.
Agent Mode
Given a goal, autonomously iterates plan → edit → verify via build/test → fix, deciding which files and commands it needs.
Prerequisites: needs (job dependency)
Copilot Chat
A conversational surface to ask questions and request code generation, explanation, fixes, and tests in natural language; you can pass a selection or file as context.
Prerequisites: Contexts
Duplication detection
A safeguard that blocks/suppresses suggestions matching public code to reduce licensing concerns; an aid—post-adoption license-check responsibility remains.
Prerequisites: LICENSE
Output ownership and licensing
Ownership/responsibility for adopted code rests with the adopting user/org; output may match public code, so mind licensing and use duplication detection.
Prerequisites: Duplication detection、Alert dismissal and ownership
Custom secret patterns
Regex-defined patterns to detect an org’s proprietary tokens/internal keys not caught by default patterns. A too-loose regex raises false positives—tune via tests.
Prerequisites: Encrypted secrets and variables (secrets / vars)
SBOM (Software Bill of Materials)
A "bill of materials" listing included dependencies/versions in standard formats (SPDX, CycloneDX). Exportable from the dependency graph for compliance and supply-chain transparency (not a vulnerability list itself).
Prerequisites: Dependency graph
Validity check
Verifies whether a detected token is still live (active) via provider APIs and prioritizes alerting for high-confidence secrets—focusing attention rather than chasing revoked/dummy values.
Prerequisites: Encrypted secrets and variables (secrets / vars)
Wiki and repository insights
A Wiki manages long-form project docs and the README shows an overview. Insights visualize repository health—contributions, traffic, and the dependency graph.
Prerequisites: Dependency graph、README
GitHub Mobile
The official phone app to check notifications and triage/review Issues and PRs; Copilot Chat is also available on mobile.
Prerequisites: Copilot Chat、Issue
.gitignore
A file listing files/patterns to exclude from tracking (build outputs, dependencies, secrets).
Prerequisites: include / exclude (matrix)、Encrypted secrets and variables (secrets / vars)
Managed services (management boundary)
A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.
Milestone
Groups issues/PRs by release/deadline and shows completion and due dates.
Prerequisites: Releases
Related: Issue
Personal Access Token (PAT)
A scope-limited token used instead of a password for Git auth (fine-grained recommended).
Remote (origin)
A named reference to where a repository is stored; the clone source defaults to origin.
Prerequisites: clone
Search qualifiers
Keywords like is:/label:/author:/assignee: that narrow a search by type/state/owner; multiple combine with AND.
Related: Assignee
upstream
The conventional remote name for the original (forked-from) repo; your fork is origin.
Prerequisites: fork、Remote (origin)
Twelve-Factor App
A set of principles for cloud-native apps: externalize config to env vars, keep processes stateless, treat logs as event streams, design for disposability, and keep dev/prod parity. A guide to scalable, portable applications.
Prerequisites: Encrypted secrets and variables (secrets / vars)
clone
Copying an existing repository, with its history, to your machine (git clone).
Code of conduct
A document defining expected behavior for community participants and how violations are handled; with CONTRIBUTING and a license it supports healthy OSS governance.
Prerequisites: LICENSE
GitHub Discussions
A space for conversations like questions and ideas; use Issues to track work.
Prerequisites: Issue
Enterprise Managed Users (EMU)
Dedicated users a company manages centrally via its identity provider; separate from personal accounts.
Prerequisites: Identity provider (IdP)
Third-party Vault integration
Connecting to an external secrets manager (e.g., HashiCorp Vault) via OIDC and fetching credentials dynamically at runtime—avoiding long-lived storage in GitHub and reducing exposure.
Prerequisites: Encrypted secrets and variables (secrets / vars)
Action use policy
An org/enterprise setting governing which actions can run: disable all / allow all / GitHub-authored only / GitHub + verified / an allow list of specific actions. Can also require SHA pinning for external actions.
Prerequisites: SHA pinning
action.yml (metadata)
The required metadata file at an action’s root; defines name, description, inputs, outputs, runs (using = node20/docker/composite), and branding. Must match runs.using to the implementation to start.
Prerequisites: inputs (workflow inputs)
Annotations
Summarized error/warning displays on the logs that jump to the offending line, aiding failure diagnosis.
concurrency
Limits same-group runs to one at a time; with cancel-in-progress: true a new run auto-cancels in-progress older runs, validating only the latest and saving cost.
fail-fast
A matrix-strategy setting; true (default) cancels the rest on one failure, false runs all combinations to completion. Use false to diagnose.
Prerequisites: strategy.matrix
github context
A context holding event/repository info; reference github.ref (branch/tag) or github.event (event payload).
Prerequisites: Contexts
$GITHUB_ENV
A special file to pass a runtime-computed value as an env var to later steps; append like echo "KEY=value" >> "$GITHUB_ENV".
Prerequisites: Step
IP allow list
An org setting accepting access only from approved IP ranges; since GitHub-hosted source IPs vary, combine with larger runners’ static IPs or self-hosted for fixed IPs.
Prerequisites: Larger runners
Major-version tag (@v4)
A tag consumers reference like @v4; providers move the major tag to the latest commit each release so consumers auto-receive fixes.
Prerequisites: Releases
max-parallel
The cap on concurrent matrix jobs; used to manage cost and runner capacity.
Prerequisites: strategy.matrix
repository_dispatch
A trigger started by external systems via API (POST) with a custom event name; used for external integration.
Retention
How long logs, artifacts, and runs are kept; set at repo/org level and tunable via retention-days at upload. Manageable via the REST API and affects storage billing.
Related: Artifact
Run history
The list of a workflow’s past runs; used to find when/from which change it began failing and to isolate causes.
Prerequisites: Workflow
Runner group
A unit grouping self-hosted runners to control which orgs/repos may use them; can restrict a sensitive runner to specific repos.
Prerequisites: Self-hosted runner
runs-on
The key selecting the runner for a job; specify a GitHub-hosted label like ubuntu-latest or a self-hosted label.
Related: Job
Script injection
A vulnerability where embedding untrusted input (PR title, issue body) directly into a run: shell command lets an attacker’s command execute; mitigate by routing values via an env var with quoting, plus validation, least privilege, and vetted actions.
Prerequisites: Issue
Service containers (services:)
Spins up sidecar containers (DB, queue) only during a job; supports port mapping and health checks, enabling integration tests without an external DB.
Prerequisites: Job
Agent session
The unit managing Agent Mode work; you can check progress, pause, and resume.
Prerequisites: Agent Mode
GitHub Copilot CLI
Brings Copilot to the terminal—command suggestions/explanations, shell-script generation, file operations via natural language; installed/authenticated separately from the IDE extension.
Prerequisites: GitHub Copilot
Copilot Code Review policy
A policy to roll out Copilot code-review assistance to org standards; it does not replace human review.
Prerequisites: Code review (Pull Request)
Content exclusion
A setting that keeps specific files/repositories out of Copilot’s context and suggestions to protect sensitive or policy-restricted code; admins set it at repo/org level, and excluded targets get no suggestions.
Prerequisites: Contexts
Context gathering and prompt building
Input processing that selects relevant info from around the cursor, open files, and related files to build the prompt; excluded files are left out.
Prerequisites: Contexts
Reducing context switching
Asking Chat about unfamiliar APIs/errors to reduce switching to a browser or docs, preserving development flow.
Prerequisites: Contexts
Copilot-supported editors/IDEs
GitHub Copilot installs as an extension in Visual Studio Code, Visual Studio, JetBrains IDEs, Neovim, and more; completion and Chat run inside the editor.
Prerequisites: GitHub Copilot
Inline suggestions
Suggests a grayed-out "continuation" from the cursor context; not applied to the code until accepted (confirmed).
Prerequisites: Contexts
Instructions files
A standing config file that supplies coding conventions and review standards so Copilot reviews/responds with consistent criteria.
Suggestion lifecycle
The loop: context change → prompt → model generates → present candidate → accept/reject → next suggestion with new context; accepted content influences the next context.
Prerequisites: Contexts
Modernizing legacy code
Assistance to rewrite old syntax/deprecated APIs/verbose code toward modern style; adopt after verifying semantic equivalence via tests.
Prerequisites: Semantic equivalence
Copilot org policy (feature availability)
An enterprise/org-level setting managing who can use which Copilot features and how; spans the IDE and github.com and is above individual settings.
Prerequisites: Policies (member capabilities)
Probabilistic generation
The LLM trait of generating output probabilistically; output can vary for the same context and isn’t always optimal (not a bug).
Prerequisites: Contexts
Prompt file
A file of reusable standard instructions for consistent Chat responses; distinct in use from always-applied instructions files.
Prerequisites: Instructions files
Subscription (seat) management
Managing Copilot seat assignment/removal and usage retrieval; automatable via the REST API in addition to the UI, used for onboarding/offboarding seat operations.
Prerequisites: License (seat)
Semantic equivalence
That behavior is unchanged before/after refactoring or modernization; verified via tests to prevent "a working but different thing."
Spaces (Copilot)
A place to bundle related code, docs, and instructions as shared context to give Copilot consistent context.
Prerequisites: Contexts
Sub-agent
A subordinate agent to which subtasks are delegated for large tasks/growing context, optimizing each agent’s context usage.
Prerequisites: Contexts
Validating AI output
A required practice of checking Copilot output before adoption—via code review, testing, security scanning, and fact-checking—including validating generated tests themselves.
Prerequisites: Code review (Pull Request)
Security rulesets and enforcement boundaries
A mechanism defining and enforcing required features/checks/remediation SLAs org-wide; enforcement boundaries set scope (whole enterprise / specific orgs / repo sets). Works only when enforced, not merely defined; can enforce multiple pillars together (cross-suite).
Prerequisites: Ruleset
GitHub Marketplace
A marketplace to find and install apps and Actions workflows that integrate with GitHub, extending capabilities like CI/CD and code quality.
Prerequisites: Workflow
GitHub Projects
A flexible planning/tracking tool spanning issues and pull requests (Projects v2). It offers board/table/roadmap views, custom fields, and built-in automation.
Prerequisites: Issue
Infrastructure as Code (IaC)
Defining infrastructure declaratively as code (templates) so it is reproducible and version-controlled—preventing manual drift and enabling review, automation, and consistent multi-environment builds. On AWS, CloudFormation and CDK are the main tools.
Prerequisites: Environment and protection rules
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
Principle of least privilege
A design principle that grants each identity (person, app, or service) only the minimum permissions needed to do its job. Excess privilege widens the blast radius of a mistake or breach, so it is continuously tightened through IAM roles, policies, and permission boundaries.
Prerequisites: permissions (token scope)
GitHub Sponsors
A way to financially support OSS developers/projects; separate from Star (a free bookmark).
Prerequisites: Star
Staging area (index)
Where you place the changes to include in the next commit; added with git add.
Prerequisites: include / exclude (matrix)
TLS
A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.
Prerequisites: Managed services (management boundary)
Visibility (Public/Private/Internal)
A repo audience: Public = anyone, Private = permitted users, Internal = within the same Enterprise.
Watch
Subscribes to a repository update notifications; distinct from Star.
Prerequisites: Star