@@ -89,8 +89,8 @@ Using semantic releases means that the users of your actions can pin their workf
 {% data variables.product.github %} provides tools and guides to help you work with the open source community. Here are a few tools we recommend setting up for healthy bidirectional communication. By providing the following signals to the community, you encourage others to use, modify, and contribute to your action:
 
 * Maintain a `README` with plenty of usage examples and guidance. For more information, see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-readmes).
-* Include a workflow status badge in your `README` file. For more information, see [AUTOTITLE](/actions/how-tos/monitor-workflows/add-a-status-badge). Also visit [shields.io](https://shields.io/) to learn about other badges that you can add.{% ifversion fpt or ghec %}
-* Add community health files like `CODE_OF_CONDUCT`, `CONTRIBUTING`, and `SECURITY`. For more information, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file#supported-file-types).{% endif %}
+* Include a workflow status badge in your `README` file. For more information, see [AUTOTITLE](/actions/how-tos/monitor-workflows/add-a-status-badge). Also visit [shields.io](https://shields.io/) to learn about other badges that you can add.
+* Add community health files like `CODE_OF_CONDUCT`, `CONTRIBUTING`, and `SECURITY`. For more information, see [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file#supported-file-types).
 * Keep issues current by utilizing actions like [actions/stale](https://github.com/actions/stale).{% ifversion fpt or ghec %}
 * Use {% data variables.product.github %}'s security features to communicate about vulnerabilities and how to fix them. For more information, see [AUTOTITLE](/actions/reference/security/secure-use#protecting-actions-youve-created).{% endif %}
 
 
@@ -35,9 +35,9 @@ App permissions are classified as repository, organization,{% ifversion fpt or e
 
 {% ifversion fpt or enterprise-installed-apps %}
 
-Any user, organization, or enterprise can create an app using any of the permission types. An app with enterprise permissions must be `public` or `internal` to be installed on an enterprise account. A `public` app can be installed by any enterprise, while an `internal` app can only be installed by the enterprise that owns the app or the enterprise of the organization that owns the app. There are no additional restrictions on which organizations or personal accounts an app can be installed on.
+Any user, organization, or enterprise can create an app using any of the permission types. An app with enterprise permissions must be `public` or `internal` to be installed on an enterprise account. {% ifversion fpt or ghec %}A `public` app can be installed by any enterprise, while an `internal` app can only be installed by the enterprise that owns the app or the enterprise of the organization that owns the app. There are no additional restrictions on which organizations or personal accounts an app can be installed on.
 
-There is one exception to installing an app across enterprises. If an app requests the "Enterprise organization installations" or "Enterprise organization installation repositories" permissions, the only enterprise that can install it is the one that owns the app. You cannot install the app on another enterprise, and you cannot add either permission to an app that is already installed on an enterprise other than the one that owns it.{% endif %}
+There is one exception to installing an app across enterprises. If an app requests the "Enterprise organization installations" or "Enterprise organization installation repositories" permissions, the only enterprise that can install it is the one that owns the app. You cannot install the app on another enterprise, and you cannot add either permission to an app that is already installed on an enterprise other than the one that owns it.{% endif %}{% endif %}
 
 When a user installs an app on their user account or organization, they see and grant the repository and organization permissions that the app requested.{% ifversion fpt or enterprise-installed-apps %} When they install it on their enterprise, they see and grant only the enterprise permissions that the app requested. {% endif %} They will also see a list of account permissions that the app can request for individual users. When a user authorizes an app to act on their behalf, they will see and grant the account permissions that the app requested.
 
 
@@ -70,7 +70,7 @@ Parameter name | Type | Description
 
 You can use query parameters to select the permissions for the {% data variables.product.prodname_github_app %} registration. For the URL query parameter, use the permission name as the query parameter name, and set the query value to one of the possible values for that permission set.
 
-For example, to select "Read & write" permissions in the user interface for `contents`, your query string would include `contents=write`. To select "Read-only" permissions in the user interface for `blocking`, your query string would include `blocking=read`. To select "No access" in the user interface for `checks`, your query string would not include the `checks` permission.{% ifversion enterprise-installed-apps %}
+For example, to select "Read & write" permissions in the user interface for `contents`, your query string would include `contents=write`. To select "Read-only" permissions in the user interface for `blocking`, your query string would include `blocking=read`. To select "No access" in the user interface for `checks`, your query string would not include the `checks` permission.{% ifversion ghes < 3.23 %}
 
 If the owning account is not an enterprise or an enterprise-owned organization, it cannot request enterprise permissions.{% endif %}
 
 
@@ -36,7 +36,7 @@ Anyone can install {% data variables.product.prodname_github_apps %} on their pe
 
 Organization owners can install {% data variables.product.prodname_github_apps %} on their organization.{% ifversion enterprise-installed-apps %}
 
-Enterprise owners can install {% data variables.product.prodname_github_apps %} on their enterprise accounts, if the application requests enterprise permissions. The app can be owned by the enterprise, an organization within the enterprise, or a third-party developer. Third-party apps must be public and cannot request the "Enterprise organization installations" or "Enterprise organization installation repositories" permissions.
+Enterprise owners can install {% data variables.product.prodname_github_apps %} on their enterprise accounts, if the application requests enterprise permissions. The app can be owned by the enterprise{% ifversion ghes %} or organization{% else %}, an organization within the enterprise, or a third-party developer. Third-party apps must be public and cannot request the "Enterprise organization installations" or "Enterprise organization installation repositories" permissions{% endif %}.
 {% endif %}
 
 {% data reusables.apps.repo-admin-install-restriction %}
 
@@ -24,10 +24,10 @@ When an enterprise owner installs a {% data variables.product.prodname_github_ap
 
 The {% data variables.product.prodname_github_app %} must request enterprise-level permissions. It can request other permissions as well, but only the enterprise permissions will be granted during installation.
 
-The app can be owned by your enterprise, by an organization within your enterprise, or by a third-party developer. To install a public app from a third party, use the installation link that the app's developer provides. You cannot install a private app that is owned by an account outside your enterprise.
+The app can be owned by your enterprise{% ifversion ghes %} or organization in your enterprise.{% else %}, by an organization within your enterprise, or by a third-party developer. To install a public app from a third party, use the installation link that the app's developer provides. You cannot install a private app that is owned by an account outside your enterprise.
 
 > [!NOTE]
-> There is one exception to installing a third-party app across enterprises. If an app requests the "Enterprise organization installations" permission, it can only be installed on the enterprise that owns the app. You cannot install this app on your enterprise if it is owned outside your enterprise. In EMU enterprises and GHES, enterprise's users count as being within the enterprise, so their apps can be installed on the enterprise.
+> There is one exception to installing a third-party app across enterprises. If an app requests the "Enterprise organization installations" permission, it can only be installed on the enterprise that owns the app. You cannot install this app on your enterprise if it is owned outside your enterprise. In EMU enterprises and GHES, enterprise's users count as being within the enterprise, so their apps can be installed on the enterprise.{% endif %}.
 
 ## Installing a {% data variables.product.prodname_github_app %} on your enterprise
 
 
@@ -61,7 +61,10 @@ Beyond the default detection of partner and provider secrets, you can expand and
 * **Custom patterns.** Define your own regular expressions to detect organization-specific secrets that aren't covered by default patterns.
 * **Validity checks.** Prioritize remediation by checking whether detected secrets are still active.
 {% ifversion secret-scanning-ai-generic-secret-detection %}
-* **{% data variables.secret-scanning.ai-detected-secrets-caps %}.** Use AI to detect unstructured secrets like passwords, or to generate regular expressions for custom patterns.
+* **{% data variables.secret-scanning.ai-detected-secrets-caps %}.** Use AI to detect unstructured secrets like passwords.
+{% endif %}
+{% ifversion secret-scanning-custom-pattern-ai-generated %}
+* **AI-generated regular expressions.** Use AI to generate regular expressions for custom patterns.
 {% endif %}
 
 {% ifversion secret-scanning-validity-check-partner-patterns %}
 
@@ -138,7 +138,7 @@ Automatically detect hardcoded credentials that have been checked into a reposit
 
 ### {% data variables.secret-scanning.ai-detected-secrets-caps %}
 
-{% data variables.secret-scanning.ai-detected-secrets-caps %}'s generic secret detection is an AI-powered expansion of {% data variables.product.prodname_secret_scanning %} that identifies unstructured secrets (passwords) in your source code and then generates an alert. For more information, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).
+{% data variables.secret-scanning.ai-detected-secrets-caps %}'s generic secret detection is an AI-powered expansion of {% data variables.product.prodname_secret_scanning %} that identifies unstructured secrets (passwords) in your source code and then generates an alert.{% ifversion fpt or ghec %} For more information, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}
 
 {% endif %}
 
 
@@ -49,7 +49,7 @@ You can apply various filters to the alerts list to help you find the alerts you
 |{% ifversion fpt or ghec %}|
 |`results`|Display alerts for supported secrets and custom patterns (`default`), or for generic patterns (`generic`) such as private keys, and AI-detected generic secrets such as passwords. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns), and for more information about AI-detected generic secrets, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).|
 |{% elsif ghes %}|
-|`results`|Display alerts for supported secrets and custom patterns (`default`), or generic patterns such as private keys (`generic`). See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns).|
+|`results`|Display alerts for supported secrets and custom patterns (`default`), or generic patterns such as private keys (`generic`){% ifversion secret-scanning-ai-generic-secret-detection %}, and AI-detected generic secrets such as passwords{% endif %}. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns).|
 |{% endif %}|
 |`secret-type`|Display alerts for a specific secret type (`SECRET-NAME`), for example, `secret-type:github_personal_access_token`. For a list of supported secret types, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-provider-patterns).|
 |`sort`|Display alerts from newest to oldest (`created-desc`), oldest to newest (`created-asc`), most recently updated (`updated-desc`), or least recently updated (`updated-asc`).|
 
@@ -48,7 +48,7 @@ When creating a security configuration, keep in mind that:
     > [!NOTE]
     > You can only enable extended metadata checks if validity checks are enabled.{% endif %}
     * **Generic patterns**. To learn more about scanning for generic patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts).{% ifversion secret-scanning-ai-generic-secret-detection %}
-    * **Scan for AI-detected secrets**. To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}
+    * **Scan for AI-detected secrets**. {% ifversion fpt or ghec %}To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}{% endif %}
     * **Push protection**. To learn about push protection, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection).{% ifversion push-protection-delegated-bypass-configurations-enterprise %}
     * **Bypass privileges**. By assigning bypass privileges{% ifversion push-protection-org-enterprise-exemptions %} or exemptions{% endif %}, selected actors can bypass{% ifversion push-protection-org-enterprise-exemptions %} or skip{% endif %} push protection. There is a review and approval process for all other contributors. See [AUTOTITLE](/code-security/concepts/secret-security/delegated-bypass).{% endif %}
     * **Prevent direct alert dismissals**. To learn more, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal).
@@ -90,7 +90,7 @@ When creating a security configuration, keep in mind that:
     * **Alerts**. To learn about {% data variables.secret-scanning.alerts %}, see [AUTOTITLE](/code-security/concepts/secret-security/secret-scanning).{% endif %} {% ifversion secret-scanning-validity-check-partner-patterns %}
     * **Validity checks**. To learn more about validity checks for partner patterns, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#checking-a-secrets-validity).{% endif %}
     * **Generic patterns**. To learn more about scanning for generic patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts).{% ifversion secret-scanning-ai-generic-secret-detection %}
-    * **Scan for AI-detected secrets**. To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}
+    * **Scan for AI-detected secrets**. {% ifversion fpt or ghec %}To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}{% endif %}
     * **Push protection**. To learn about push protection, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection).
     * **Prevent direct alert dismissals**. To learn more, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal).
 1. In the "{% data variables.product.prodname_code_scanning_caps %}" table, choose whether you want to enable, disable, or keep the existing settings for {% data variables.product.prodname_code_scanning %} default setup.
 
@@ -56,7 +56,7 @@ When creating a security configuration, keep in mind that:
     > [!NOTE]
     > You can only enable extended metadata checks if validity checks are enabled.{% endif %}
     * **Generic patterns**. To learn more about scanning for generic patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts).{% ifversion secret-scanning-ai-generic-secret-detection %}
-    * **Scan for AI-detected secrets**. To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}
+    * **Scan for AI-detected secrets**. {% ifversion fpt or ghec %}To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}{% endif %}
     * **Push protection**. To learn about push protection, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection).
     * **Bypass privileges**. By assigning bypass privileges{% ifversion push-protection-org-enterprise-exemptions %} or exemptions{% endif %}, selected actors can bypass{% ifversion push-protection-org-enterprise-exemptions %} or skip{% endif %} push protection. There is a review and approval process for all other contributors. See [AUTOTITLE](/code-security/concepts/secret-security/delegated-bypass).
     * **Prevent direct alert dismissals**. To learn more, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal).
@@ -98,7 +98,7 @@ When creating a security configuration, keep in mind that:
     * **Alerts**. To learn about {% data variables.secret-scanning.alerts %}, see [AUTOTITLE](/code-security/concepts/secret-security/secret-scanning).{% endif %} {% ifversion secret-scanning-validity-check-partner-patterns %}
     * **Validity checks**. To learn more about validity checks for partner patterns, see [AUTOTITLE](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#checking-a-secrets-validity).{% endif %}
     * **Generic patterns**. To learn more about scanning for generic patterns, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-generic-patterns) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts).{% ifversion secret-scanning-ai-generic-secret-detection %}
-    * **Scan for AI-detected secrets**. To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}
+    * **Scan for AI-detected secrets**. {% ifversion fpt or ghec %}To learn more, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).{% endif %}{% endif %}
     * **Push protection**. To learn about push protection, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection).
     * **Bypass privileges**. By assigning bypass privileges{% ifversion push-protection-org-enterprise-exemptions %} or exemptions{% endif %}, selected actors can bypass{% ifversion push-protection-org-enterprise-exemptions %} or skip{% endif %} push protection. There is a review and approval process for all other contributors. See [AUTOTITLE](/code-security/concepts/secret-security/delegated-bypass).
     * **Prevent direct alert dismissals**. To learn more, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal).