GitHub Secret Scanning 审计日志字段变更与多项修复
Updates to GitHub secret scanning
审计日志字段语义变更将直接导致依赖 display name 过滤的企业级自动化脚本失效，务必在 11 月 12 日前完成适配或切换至 business_id。
This update covers improvements and bug fixes for GitHub secret scanning.
本次更新涵盖了对 GitHub 密钥扫描的改进和错误修复。
Update to audit log events
更新审计日志事件
On November 12, 2026, the business field in affected secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events will change from the enterprise display name to the enterprise slug.
在 2026 年 11 月 12 日，受影响的 secret_scanning_alert.* 和 secret_scanning_push_protection.bypass 审计日志事件中的 business 字段将从企业显示名称更改为企业 slug。
To avoid disruption to any automated workflows, you should update integrations that filter by display name before rollout to accept both formats or use business_id instead. The business field remains a string. Event names and numeric business_id values are unchanged.
为避免中断任何自动化工作流，您应在部署前更新按显示名称进行过滤的集成，使其接受两种格式，或使用 business_id。business 字段仍为字符串类型。事件名称和 numeric business_id 值保持不变。
Recent improvements and bug fixes
最近的改进和错误修复
- Custom pattern alerts: Existing open alerts stay open when a rescan finds that they still match an edited custom pattern, rather than being closed and reopened.
- Base64-encoded GitHub tokens: In private and internal repositories on github.com with secret scanning enabled, the existing revocation action (public preview) now supports encoded personal access tokens (classic), fine-grained personal access tokens, OAuth access tokens, and GitHub App user access tokens. GitHub automatically decodes the value.
- Dismissal-request webhooks: Payloads now include exemption_request.number, the repository-scoped request number also available in the REST API. Use the repository and request number together to correlate requests across integrations.
- Accessibility: The Request pending status on an alert is now keyboard-focusable without activating an action. The revocation flow announces progress to screen readers and moves focus to its completion panel when that panel appears.
- Bypass-request metadata: Fixed empty secret-type and location details in bypass-request API responses and webhook payloads for command-line pushes when another repository rule ran after secret scanning.
- Delegated bypass: Fixed push failures caused by existing organization-role entries in reviewer lists, and 500 errors when setting valid reviewer configurations for organization-owned repositories through the REST API.
- Custom pattern API: Requests rejected by the scanning service for invalid arguments now return 422 instead of 500, so your integration can distinguish these input errors from server failures.
- 自定义模式警报：当重新扫描发现现有打开的警报仍然匹配编辑后的自定义模式时，这些警报将保持打开状态，而不是被关闭并重新打开。
- Base64 编码的 GitHub 令牌：在启用了密钥扫描的 github.com 私有仓库和内部仓库中，现有的撤销操作（公共预览）现在支持编码的个人访问令牌（经典版）、细粒度个人访问令牌、OAuth 访问令牌和 GitHub App 用户访问令牌。GitHub 会自动解码该值。
- 解除请求 Webhooks：有效载荷现在包含 exemption_request.number，即也可在 REST API 中获取的仓库范围请求编号。结合使用仓库和请求编号以跨集成关联请求。
- 无障碍性：警报上的“待处理请求”状态现在可在不触发操作的情况下通过键盘聚焦。撤销流程会向屏幕阅读器播报进度，并在出现完成面板时将焦点移至该面板。
- 绕过请求元数据：修复了在命令行推送期间，当另一个仓库规则在密钥扫描之后运行时，绕过请求 API 响应和 Webhook 有效载荷中出现的空 secret-type 和位置详细信息的问题。
- 委托绕过：修复了由审阅者列表中现有的组织角色条目引起的推送失败问题，以及通过 REST API 为组织拥有的仓库设置有效的审阅者配置时出现的 500 错误。
- 自定义模式 API：因参数无效而被扫描服务拒绝的请求现在返回 422 状态码而非 500，以便您的集成能够区分这些输入错误与服务器故障。
Learn more
了解更多
Learn more about enterprise audit log events and the secret scanning REST API. Share your feedback in GitHub Community.
了解企业审计日志事件和密钥扫描 REST API。在 GitHub Community 中分享您的反馈。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力