Public actions via GitHub Connect are available again from 3.20.6 (#62878)

Author: isaacmbrown

content/admin/configuring-settings/configuring-github-connect/about-github-connect.md

@@ -31,6 +31,8 @@ To enable {% data variables.product.prodname_github_connect %}, you configure a
 
 After you configure the connection between {% data variables.location.product_location %} and {% data variables.product.prodname_ghe_cloud %}, you can enable individual features of {% data variables.product.prodname_github_connect %}.
 
+If you're connecting to an enterprise on **{% data variables.enterprise.data_residency_site %}**:
+
 {% data reusables.github-connect.what-is-available-ghecom %}
 
 | Feature | Description | More information |

content/admin/configuring-settings/configuring-github-connect/enabling-github-connect-for-ghecom.md

@@ -23,7 +23,7 @@ You can access additional features and workflows on {% data variables.location.p
 ## Prerequisites
 
 * **Administrative access:** You need administrative access to both an enterprise account on {% data variables.enterprise.data_residency_site %} and a {% data variables.product.prodname_ghe_server %} instance.
-* **Version requirement:** Your {% data variables.product.prodname_ghe_server %} instance must run {% data variables.product.prodname_ghe_server %} 3.12 or later.
+* **Version requirement:** To enable {% data variables.product.prodname_github_connect %} for {% data variables.enterprise.data_residency_site %}, your {% data variables.product.prodname_ghe_server %} instance must be on version 3.12 or later. Certain individual features of {% data variables.product.prodname_github_connect %} require later versions. See [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/about-github-connect#github-connect-features).
 * **Proxy configuration:** If using a proxy server, allow connectivity to the following {% data variables.enterprise.data_residency_site %} hostnames (replace SUBDOMAIN with your enterprise's subdomain).
 
    * `{% data variables.enterprise.data_residency_domain %}`

content/admin/data-residency/feature-overview-for-github-enterprise-cloud-with-data-residency.md

@@ -95,9 +95,7 @@ To allow people to use namespaces that match actions you have used from {% data
 
 You can use {% data variables.product.prodname_github_connect %} to connect to {% data variables.enterprise.data_residency_site %} from {% data variables.product.prodname_ghe_server %}.
 
-* {% data variables.product.prodname_server_statistics %} is not available.
-* {% data variables.product.prodname_dotcom_the_website %} actions are not available.
-* Automatic user license sync requires {% data variables.product.prodname_ghe_server %} version 3.15 or later.
+{% data reusables.github-connect.what-is-available-ghecom %}
 
 To enable {% data variables.product.prodname_github_connect %}, you must configure your {% data variables.product.prodname_ghe_server %} instance to connect to your {% data variables.enterprise.data_residency_site %} subdomain. See [AUTOTITLE](/enterprise-server@latest/admin/configuring-settings/configuring-github-connect/enabling-github-connect-for-ghecom).
 

content/admin/managing-github-actions-for-your-enterprise/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect.md

@@ -20,6 +20,8 @@ category:
 
 By default, {% data variables.product.prodname_actions %} workflows on {% data variables.product.prodname_ghe_server %} cannot use actions directly from {% data variables.product.prodname_dotcom_the_website %} or [{% data variables.product.prodname_marketplace %}](https://github.com/marketplace?type=actions). To make public actions from {% data variables.product.prodname_dotcom_the_website %} available on your enterprise instance, you can use {% data variables.product.prodname_github_connect %} to integrate {% data variables.product.prodname_ghe_server %} with {% data variables.product.prodname_ghe_cloud %}.
 
+If your cloud deployment is on {% data variables.enterprise.data_residency_site %}, {% data variables.product.prodname_github_connect %} can still resolve public actions from {% data variables.product.prodname_dotcom_the_website %}. This requires {% data variables.product.prodname_ghe_server %} version 3.20.6 or later, or any feature release from 3.21.0.
+
 {% data reusables.actions.self-hosted-runner-networking-to-dotcom %}
 
 Alternatively, if you want stricter control over which actions are allowed in your enterprise, you can manually download and sync public actions onto your enterprise instance using the `actions-sync` tool. For more information, see [AUTOTITLE](/admin/managing-github-actions-for-your-enterprise/managing-access-to-actions-from-githubcom/manually-syncing-actions-from-githubcom).
@@ -34,7 +36,7 @@ If a user has already created an organization and repository in your enterprise
 
 Before enabling access to public actions from {% data variables.product.prodname_dotcom_the_website %} for your enterprise, you must:
 * Configure {% data variables.location.product_location %} to use {% data variables.product.prodname_actions %}. For more information, see [AUTOTITLE](/admin/managing-github-actions-for-your-enterprise/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server).
-* Enable {% data variables.product.prodname_github_connect %}. For more information, see [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/enabling-github-connect-for-githubcom).
+* Enable {% data variables.product.prodname_github_connect %}. For more information, see [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/enabling-github-connect-for-githubcom) or [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/enabling-github-connect-for-ghecom).
 
 {% data reusables.enterprise-accounts.access-enterprise %}
 {% data reusables.enterprise-accounts.github-connect-tab %}

data/release-notes/enterprise-server/3-20/0.yml

@@ -32,7 +32,7 @@ sections:
       notes:
         # https://github.com/github/releases/issues/5765
         - |
-          Site administrators can enable GitHub Connect to resolve open source actions from GitHub.com, even when their GHES instance is connected to a data-resident enterprise on GHE.com. This enables hybrid deployment scenarios during migration to GHE.com. This feature is in public preview and subject to change.
+          Site administrators can enable GitHub Connect to resolve open source actions from GitHub.com, even when their GHES instance is connected to a data-resident enterprise on GHE.com. This enables hybrid deployment scenarios during migration to GHE.com. This feature is in public preview and subject to change. **Note: This feature was temporarily disabled in 3.20.1 and is generally available from 3.20.6.** [Updated: 2026-08-21]
 
     - heading: Code scanning
       notes:

data/release-notes/enterprise-server/3-20/1.yml

@@ -43,7 +43,7 @@ sections:
     - |
       When applying a hotpatch or running a configuration with `ghe-config-apply`, the configuration run could fail with "ERROR: Restoring CodeQL Action release tags" if internal Git services were not yet fully available. The error message "SpokesAPI::TwirpServerError: unavailable" appeared in logs.
     - |
-      On instances connected to GitHub Enterprise Cloud with data residency, the "GitHub.com actions" setting appeared in the GitHub Connect configuration despite this feature not being available for data residency deployments.
+      On instances connected to GitHub Enterprise Cloud with data residency, the "GitHub.com actions" setting appeared in the GitHub Connect configuration despite this feature not being available for data residency deployments. **Note: This feature is available from 3.20.6.** [Updated: 2026-08-21]
     - |
       On instances with GitHub Actions enabled, errors appeared in logs related to missing Elasticsearch field mappings for workflow runs. The workflow run data included an `archived` field that was not defined in the Elasticsearch index mapping.
     - |

data/release-notes/enterprise-server/3-20/6.yml

@@ -1,10 +1,13 @@
 date: '2026-08-05'
 sections:
+  features:
+    - |
+      Site administrators can enable GitHub Connect to resolve open source actions from GitHub.com, even when their GHES instance is connected to a data-resident enterprise on GHE.com. This feature is now generally available. See [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/enabling-github-connect-for-ghecom). [Updated: 2026-08-21]
   security_fixes:
     - |
       **HIGH**: A path traversal vulnerability allowed an unauthenticated attacker to delete the user storage directory on the GitHub Enterprise Server instance, including Git LFS objects, release assets, attachments, and avatars, via the unsanitized X-GitHub-Request-Id request header. Exploitation required network access to the instance and worked when private mode was enabled. GitHub has requested CVE ID [CVE-2026-17556](https://www.cve.org/cverecord?id=CVE-2026-17556) for this vulnerability, which was reported via the [GitHub Bug Bounty program](https://bounty.github.com/). 
     - |
-      Some internal, auto-generated secrets were not redacted when users compiled a support bundle. 
+      Some internal, auto-generated secrets were not redacted when users compiled a support bundle.
   bugs:
     - |
       On a {% data variables.product.prodname_ghe_server %} cluster upgrade, if all Consul server nodes restarted concurrently, the cluster could lose its Nomad leader and fail to recover, causing the upgrade to loop and fail rather than complete. 

data/reusables/github-connect/what-is-available-ghecom.md

@@ -1,6 +1,3 @@
-{% ifversion ghecom-github-connect %}
-If you're connecting to an enterprise on **{% data variables.enterprise.data_residency_site %}**:
-* Server Statistics is not available.
-* {% data variables.product.prodname_dotcom_the_website %} actions are not available.
-
-{% endif %}
+* {% data variables.product.prodname_server_statistics %} is not available.
+* Automatic user license sync requires {% data variables.product.prodname_ghe_server %} version 3.15 or later.
+* Actions from {% data variables.product.prodname_dotcom_the_website %} require {% data variables.product.prodname_ghe_server %} version 3.20.6 or later, or any feature release from 3.21.0.