Merge branch 'main' into main

Author: Gabriel-Xu

.github/workflows/create-changelog-pr.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6.0.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: 'Ensure ${{ env.CHANGELOG_FILE }} exists'
         run: |

.github/workflows/first-responder-v2-prs-collect.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       # Add to the FR project
       # and set type to "Maintenance"

.github/workflows/moda-allowed-ips.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Update list of allowed IPs
         run: |

.github/workflows/reviewers-content-systems.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Add content systems as a reviewer
         uses: ./.github/actions/retry-command

.github/workflows/reviewers-dependabot.yml

@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Add dependabot as a reviewer
         uses: ./.github/actions/retry-command

.github/workflows/reviewers-docs-engineering.yml

@@ -49,7 +49,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       # Detect PRs that only changed package-lock.json (no engineering source files).
       # These are usually cross-platform `npm install` churn from contributors

.github/workflows/reviewers-legal.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # Fetch 2 commits so tj-actions/changed-files can diff without extra API calls
           fetch-depth: 2

content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise.md

@@ -194,7 +194,7 @@ Across all organizations owned by your enterprise, you can allow members with ad
 
 ## Enforcing a policy for renaming protected branches
 
-By default, repository administrators can rename branches that are targeted by enterprise-level rules, provided the new branch name is still targeted by those rules. You can restrict this ability to enterprise owners only.
+By default, repository administrators can rename branches that are targeted by enterprise-level rules, provided the new branch name is still targeted by those same rules, or the administrator has permission to bypass the rule in question. You can restrict this ability to enterprise owners only.
 
 {% data reusables.enterprise-accounts.access-enterprise %}
 {% data reusables.enterprise-accounts.policies-tab %}

content/admin/upgrading-your-instance/troubleshooting-upgrades/index.md

@@ -6,5 +6,6 @@ versions:
 children:
   - /restoring-from-a-failed-upgrade
   - /known-issues-with-upgrades-to-your-instance
+  - /rotating-the-signing-key-for-upgrade-packages
 shortTitle: Troubleshoot an upgrade
 ---

content/admin/upgrading-your-instance/troubleshooting-upgrades/known-issues-with-upgrades-to-your-instance.md

@@ -17,6 +17,8 @@ category:
 
 {% data variables.product.company_short %} is aware of the following issues that could impact upgrades to new releases of {% data variables.product.prodname_ghe_server %}. For more information, see "Known issues" in the [{% data variables.product.prodname_ghe_server %} release notes](/admin/release-notes).
 
+If you see the error `The file provided is not a valid GitHub Enterprise Server package` when attempting an upgrade, you may need to rotate the GPG signing key on your instance. For more information, see [AUTOTITLE](/admin/upgrading-your-instance/troubleshooting-upgrades/rotating-the-signing-key-for-upgrade-packages).
+
 {% data variables.product.company_short %} strongly recommends regular backups of your instance's configuration and data. Before you proceed with any upgrade, back up your instance, then validate the backup in a staging environment. For more information, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/configuring-backups-on-your-appliance) and [AUTOTITLE](/admin/installation/setting-up-a-github-enterprise-server-instance/setting-up-a-staging-instance).
 
 ## Lifting the pause on upgrades to version 3.15 and above