Cardinal Cloud GitHub Frequently Asked Questions

​

Below is a list of commonly asked questions and answers for Cardinal Cloud GitHub.

Q. How can I get a GitHub Copilot license?

A. To obtain a GitHub Copilot license, you need to request an Azure subscription. The Azure ID is used to track expenses related to Copilot usage. Once the Azure ID is set up, University IT's Account Cloud Services team will configure it to monitor and allocate expenses associated with Copilot. See the cost per license in the Cardinal Cloud GitHub rates section. 

Q. How does license assignment work for GitHub Copilot?

A. Copilot is available only in Cardinal Cloud GitHub organizations linked to a cost center (an Azure subscription). In those organizations, organization owners can assign Copilot seats, and each seat is billed to that organization's cost center. In organizations without a cost center, Copilot isn't available. To get Copilot, see "How can I get a GitHub Copilot license?"

Q. Can organization owners control Copilot access for their own orgs?

A. Only in organizations that have a cost center. University IT decides which organizations can use Copilot, and limits that to organizations with a linked Azure subscription. Within those organizations, owners manage their own seats and are responsible for the cost.

Q. How do I join Cardinal Cloud Github?

A. Visit Join Cardinal Cloud GitHub, review the Before You Begin section, and follow the steps to join an organization. 

• Stanford Developers is the default Cardinal Cloud GitHub organization open to anyone who can successfully authenticate using Stanford credentials.​
• Stanford Medicine: Affiliates with Stanford Medicine should submit a help ticket to join Cardinal Cloud GitHub. 

Q. Why do I Need a GitHub Account with the Same Email Address?

A. Using the same email address to create a new GitHub account is important for the following reasons:

• Identity Verification: GitHub uses email addresses to identify and verify users. When an organization sends an invitation to an email address, GitHub needs to match that email with an existing GitHub account to verify that the invite is reaching the correct user.
• Account Linking: If the invitation is sent to an email that isn’t associated with a GitHub account, GitHub cannot link the invitation to a user profile. Without an account, there’s no way to provide you access to the organization’s resources.
• Security: Requiring a matching email address prevents unauthorized users from gaining access to an organization by ensuring that only verified users can accept invitations.
• Benefits: Internal members have organization-wide access and roles, while external collaborators have access limited to specific repositories.

Q. What should I do if I get the error message “Overwrite your linked identity”?

A.  If you receive the error message “overwrite your linked identity” when accessing a Cardinal Cloud GitHub organization, it means that you have already linked your GitHub account to a Stanford account (likely an SHC vs. SU account). To correct this, try canceling and starting a new browser session with the correct Stanford SSO. Alternatively, you can try logging in to both SSO accounts before logging in to GitHub, then choose your SU account when presented with the login chooser screen.

If you are still experiencing issues, please submit a Help request. ​​​

Q. Can I join Cardinal Cloud GitHub with my personal GitHub account?

A.  If you have an existing personal GitHub account, you can still keep your developer identity. When you are invited to join the enterprise agreement, you can either create a separate work-related identity or have GitHub associate the two for the duration of your Stanford engagement.

Note: Review Cardinal Cloud GitHub Storage Guidelines for information on storage limitations and restrictions in Cardinal Cloud GitHub. 

Q. How do I switch between my personal GitHub account and Stanford organization?

A. Users can toggle between their personal accounts or be in either the organization or enterprise. Click Organizations, Settings, and Switch settings context. ​

Q.  What are GitHub Actions minutes, and how does it impact GitHub storage?

A. GitHub Actions minutes are the compute time your workflows use, while GitHub storage refers to the disk space for artifacts generated by those workflows. Both are billed or limited separately, but extensive use of GitHub Actions often leads to increased storage consumption. Public repositories and self-hosted runners aren't billed. Private and internal repositories share a free monthly allowance across the enterprise. Beyond that, usage needs a cost center.

Review Cardinal Cloud GitHub Actions Minutes and Storage to learn more about the connection and how to optimize your usage of GitHub Actions minutes.​​

Q. Is a SUNetID required to access the Stanford Developers Organization?

A. Yes. Users must authenticate with their SUNet ID and password to access the Stanford Developers organization. 

​Note: If you are trying to join a Stanford Medicine organization, submit a help ticket. 

Q. Can my working group join Cardinal Cloud GitHub with an existing GitHub account?

A. Yes. If your working group already has a GitHub Free, GitHub Pro, or GitHub Team account, you will need to request to join the enterprise agreement. Your team identity will persist, and you’ll have continued access to code, gists, and other features.

Q.  Can repositories hosted in an organization be public?

A. Yes, individuals at Stanford have the option to make their repository public. The repository owner and their team are responsible for making decisions.

Q. Is Cardinal Cloud GitHub approved for high risk data or protected health information (PHI)?

A. No. University IT (UIT) and the Office of the Chief Risk Officer are engaging with the vendor to execute the necessary agreements to allow high-risk and protected health information (PHI) in the future. Until then, please limit your work to low and moderate risk data only. 

• Review the Risk Classification guide for information.
• If you still have questions, submit a Cardinal Cloud GitHub Help request.

Q. Why do I need Two-Factor Authentication?

A. GitHub requires all users, everywhere, to enable two-factor authentication (2FA) for accounts. This is enforced by GitHub and not by Stanford. Visit Configuring Two-factor Authentications for more information. 

Q. It seems like I’m prompted to authenticate quite often, frequently between GitHub and Stanford. I’m forced to provide two-factor authentication, too. Is this normal?

A.  Yes. When you start a working session with a Stanford GitHub organization, you’ll be prompted to authenticate. You’ll also get a GitHub authentication prompt when accessing your personal projects. Additionally, GitHub requires all personal account holders to add a second factor for authentication, separate from Stanford. As a convenience, using passkeys with GitHub will reduce a step.

Q. How do I identify the Owner of my GitHub Organization?

A. If you're a normal user and want to identify the owner of your GitHub organization, your access may be limited based on your role and permissions within the organization. However, here are some ways you can find out who the owner is. 

• On the organization’s page, click the People tab if it is visible. You’ll see a list of members and their roles. Look for users with the Owner role.
• If you can’t find your organization owner(s), submit a Cardinal Cloud GitHub Help request.

Q.  How do I transfer a GitHub organization to Cardinal Cloud GitHub?

A. GitHub doesn’t provide a direct feature to transfer an entire organization between accounts, but you can move each repository from the personal organization to the Enterprise account. However, you can achieve something similar by moving repositories and setting up teams, permissions, and integrations in the Enterprise account to mirror the original organization.

• Transfer Each Repository Individually:
  • Follow these steps to Transfer a Repository to a Cardinal Cloud GitHub Organization for each repository in your personal organization.
• Re-create Teams and Permissions:
  • Once repositories are transferred, follow these steps to re-create teams in the Cardinal Cloud GitHub organization with the correct permissions, as GitHub doesn’t transfer team structures.
• Move Webhooks and Integrations:
  • Manually set up any webhooks or integrations that existed in the personal organization into the new Cardinal Cloud GitHub account.

Q. How do I  create a new organization in GitHub at Stanford?

A. If you need to create a separate organization in addition to the provided list, please submit a Help request.

Please provide the following information:

• Name of the organization you want to create.
• Why you cannot join the existing organizations.

Q.  Is Cardinal Cloud GitHub replacing Stanford's GitLab?

A. No. Stanford GitLab remains the recommended code repository service and is not being replaced by GitHub. Visit Compare GitHub vs GitLab to learn more.

Q. When should I use GitHub vs GitLab?

A. Choosing between GitLab and GitHub depends on your specific needs, preferences, and the features each platform offers. Stanford recommends using GitLab for most projects. However, if your project involves contributions from a large number of members, including outside collaborators, or requires Microsoft-based plugins like Co-pilot or specific integrations that are only available in GitHub, then GitHub would be the better choice. Visit Compare GitHub vs GitLab to learn more. ​

Q. What is GitHub Advanced Security, and how do I get it?

A. Advanced Security includes Code Security (CodeQL code scanning) and Secret Protection (secret scanning and push protection) for private and internal repositories. It's billed per active committer: $30 a month for Code Security and $19 a month for Secret Protection. It's available only in organizations linked to a cost center. In other organizations, private repositories use a free baseline configuration with Dependabot alerts on. Public repositories get secret scanning at no cost. To request Advanced Security, submit a Help request with your Azure subscription ID.

Q. How do I set up a cost center for my organization or team?

A.  Follow these steps: 

1. Request a Cardinal Cloud Azure subscription. 
2. Submit a Cardinal Cloud GitHub Help request with the subscription ID and the organization or users to include. 
3. University IT links the cost center and can set monthly budgets and alerts for it. Charges for that organization then go to your subscription.

Q. What happens when the free Actions minutes run out?

A. The free allowance is shared across the enterprise and resets on the first day of each month. In organizations without a cost center, workflows in private and internal repositories stop once it's used up, until the next reset. Public repositories and self-hosted runners aren't affected. To avoid interruptions, link a cost center.

Q. Why did my workflow fail with a spending limit or budget message?

A. Your organization has no cost center and the shared free Actions allowance is used up for this month. See "What happens when the free Actions minutes run out?" To keep workflows running, request a cost center. To use fewer minutes, run CI on pull requests instead of every push, avoid frequent scheduled jobs, and use Linux rather than macOS runners (macOS costs about 10× as much).

Q. Who can I contact about my organization's GitHub costs?

A. Submit a Cardinal Cloud GitHub Help request. University IT reviews usage monthly and contacts organization owners about usage that isn't linked to a cost center.