GitHub Demo Days, 5 Oct 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: One more thing automated? 10 less things to do! Automating the Software Development Life Cycle

Description

James Ha, Solutions Engineer, shows how GitHub Actions is far more than just CI/CD. Through progressive layers of automation, James shows how you can control who can deploy your code, label and track progress, and even provide bot interactions so that your contributors follow proper workflows before deploying to Production.

https://github.com/learn/devops

A

A

Welcome thank you for joining us on this lovely friday. Wherever y'all are at today, we're going to be doing a demo day of github we're going to be talking about give actions great functions. Now you can do there not just around ci cd, which of course is important for many of us, but also just automation in general. You know: what can we do with issues? What can we do with labels? What we can do for assignment of people? The platform is so extensible and well used by thousands of users and customers for our enterprise product.

A

We're really excited to share it with you. My name is james haw. I'm a solutions. Engineer I'm based here in atlanta, georgia in the united states, I'm joined by my moderator, mr dean. Would you mind introducing yourself buddy, uh of course,.

B

Hey folks, I'm dean steropoulos also a solutions engineer here at github, I'm gonna look to moderate the chat currently pulling up the chat box right now feel free to ask any questions. I'm gonna look to answer some of those, maybe ask james some of those questions and then just shoot over relevant links. So let's have some fun.

A

Most excellent, thank you so much dean. That's right! Guys! We want to keep interactive, so please feel free to ask questions along the way and uh we'll be sure to answer them as we can all right, I'm going to be sharing my display now, all right. So the code I'm going to use of this also is in a public github repository that we will share with you a little bit later in the call and they'll have the exact same source code, because I know people always want to see the references and how it works.

A

So today we want to talk about and see what can we do with github in terms of auto magically doing some cool need for little things across our software development life cycle, so for today's demo, I'm actually going to use an issue ops to go and create me some prerequisite material for this, and, while I'm going through this, I want you to think about things.

A

You know I mean how are different ways that you could use this to automate, maybe in your company or just in personal projects, you're working on um whether it be hey every time. I want to make a new pull request. May I want to comment a specific uh message or add a little trademark at the bottom of it or denote certain type of material form or start on something? Why not do that and get up? Why not standardize that?

A

So it's a repeatable process and that's what we're doing here so with this issue, I'm actually going to go ahead. This is actually used for demos of github itself to our different customers. Here, I'm going to go ahead and give this demo name so today, I'll just call it twitch.

A

Nowadays and I'm going to go ahead and copy that value into my issue body, I'm gonna go ahead and submit this issue.

A

So when I'm doing this, we're actually gonna see a couple fun little things pop up here in the background, so for those not familiar with github actions that much a lot of it is going to be driven through what you see here, the actions, tab and we'll go through how actions themselves work. But, as you can see, this little spinning icon has shown me that something's actually in progress as we can see in the little handle, and we actually go look at this get a action.

A

The workflow file, which is just yaml format, supplies something you're very familiar with if you've used different tools or platforms such as azure, devops or jenkins, you can see here the language behind github actions, we'll dive into this. For some of the different examples we use, because we have a about five or so workflows that run off this, but at a high level. I want to explain a few of these different concepts. We're gonna see so at the top. We're saying hey on so this on event.

A

Basically lets us specify what type of github activity we want to trigger this workflow from so in our case, we're going to trigger it from whenever an issue and of what type of specific event for that issue is opened and then going down here for the steps we give the workflow file itself a name.

A

Then we have this job section. So that's how we can break out the work that's going to occur for our github action, so we have different jobs here, we're going to define different uh events that are going to occur, so these different jobs. My first one is called act on issue. They would say what exactly is going to happen.

A

So the cool thing with your actions, if you're not aware you have an option to run these in our github hosted cloud, so these are run for you um for our public repositories, it's actually free and with our free accounts and different levels of team accounts, and then eventually, enterprise customers, there's a certain amount. You can use for private reboots per month as well. But basically, what happens is in this situation. I'm going to run this just on an ubuntu vm somewhere out there. I don't worry about infrastructure or anything like that.

A

I just tell it what I want to do so in this scenario. We're actually going to be putting in a conditional this. If statement right here- and I actually use this quite often- it's pretty intuitive- if you've done really any form of development right. When do we want certain things to happen. In this scenario, I'm saying hey if the event that triggered this, because whenever you're inside to get up action, the cool part is, you can pass through the different context of what is occurring.

A

Would you do this with this give event the issue if the title of it and we're using this constructor here starts with demo or if the title of itself starts of reset for another process. I want to use it's going to go and follow through these steps. If this does not match, then no worries. My issue is not going to be affected by any means, so the steps here in this first really high level part that we're doing all we're going to do is just check out the code.

A

This action slash, checkout and then we're going to go through and actually run a command of different scripts that actually exist in my repository. So the great part about checking this out this code in our repository analysis in the vm, and we can actually modify it as we need to.

A

So that's what we're going to do, I'm just going to go through and actually run a couple of different scripts that I'll show you and those scripts are actually going to make changes to this project itself and kind of add in some commits really without me ever having to put my hands on the keyboard. I can do that right from a git of issue, a couple other things you may be noting, though hey what's that thing called secrets right there that seems like it may be useful.

A

I see there's a reference, a couple different places, so we'll get up actions and really any sort of ci, cd or automation engine when using workflow files odds are we have to interact with different systems and how we do that through secrets, api keys connection, strings etc, but the biggest challenge is: how do we actually secure those? You don't want that to leak and you don't want to just have it available in plain text.

A

Obviously, so the great thing about actions is, we have a built-in secret store that you can use and then specifically reference interaction files without ever having to hard type them in themselves, um and I'm gonna actually show you what it looks like in the experience, but in the chat. Y'all. Let me know is that ever an issue for anyone before trying to figure out the best way to manage your secrets, making sure none of them get out there or available for others to consume maliciously or not. I would love to hear any thoughts about that.

A

So I'm going to go to my settings. I'm gonna go to my secrets and you can see here. I've actually have two different secrets to find, so one is my azure creds, which we'll take a look at. This can be great because we're gonna be deploying a web app to azure right from github without ever having to touch the azure portal at all, and this azure creds is going to help me do that.

A

So I just populated this from my azure portal, I generated an azure sda key and I put that into github and, as you can see, there's no option to actually view it. I can only update it, so these are read only secrets you can see if I want to make a new secret. I also can do that. I just give it a name.

A

And then I give it a value, and once I add it, it's now there and available. Once again, I can't actually modify it. I can only update it, so I want you to make sure you're always taking advantage of the opportunity, because that gives you a great way to one manage these and make sure no one is uh abusing your secrets that may be available or insecure somewhere. That's at the repository level, but a cool part about github is at the enterprise and get a organizational level. You can also define these different secrets.

A

So I'll show you what that looks like here. If I go into organization, if I go into settings we can see. We have similar things here. Oh for actions. We can manage some of those different controls, but for secrets we can do the same thing. However, we can actually have secrets at an organizational level, and this is really cool, because then these secrets can be shared to different users and different repositories across my github organization.

A

As you can see, some of these secrets are available to all users all repositories and some are only available to really specific repositories. So you can see there when you try to update this. I can say what type of repos do I want to have access to the secret and they're good of actions. I think this is awesome. I think this allows you to have better control over how people are maybe rolling their qa keys, pre-prod keys and, of course, keys like production.

A

We want to make sure those are always being controlled by the right people, so I'm going to switch back over here to my repository see their hyper chain labs. I see you mentioned that uh similar to docker secrets, possibly I believe so in some form of management and in the github context. So what's great about is whatever value you need in there that needs to be securely stored and encrypted. So I go back into my get issue we created earlier, I'm going to click on the one we've just made.

A

As you can see, this was made six minutes ago. Negative action that we saw run in the background, went ahead and actually made a comment for me as well saying: hey, we actually created a new feature branch.

A

If I click on this, let me navigate here to my branch so great and we can actually see some files were even modified six minutes ago. That's weird, I didn't actually do anything as a developer, besides just creating an issue based off a template. Now, if I go here, we can actually see in my views.

A

The change was actually made to this index c html file itself.

A

Let's actually take a look at that commit so what actually happened there, so I have scripts there in my uh folder structure here that I can reference they're, just bad shell commands literally, so I'm just doing a git checkout, I'm doing some uh just simple regex replacement. I replace the value customer, that's in the original file, with the name of whatever branch I'm using so in this case twitch dash demo days, and then I commit that in check it back gun and now it's available for my entire repository in this new branch.

A

So once again, you can do so many cool things with actions, because at the end of the day, it's just a virtual machine so uh definitely feel free to experiment and see different possibilities. You have with it all right. So, let's go back to our demo, so I'm going to go and create a pull request and actually include a link to do that right from this issue, just to speed up the process right here, I'm actually using a pull request template to actually provide some information on how to use this. So it's telling us hey.

A

How do you want to deploy it's going to be based off the use of labels and then how do you actually tear down and remove these resources? Here's some different options as well by removing labels. So I'm going to create this pull request.

A

I'm actually going to be switching context, you're all between two different accounts. Okay, so I have my github user account that is both the owner of this repository and organization and namespace, as you can see, then we'll be using another account.

A

That's actually just a general user here.

A

That's this account that you'll see it's called a phenomenal excuse, the pun, so we're going to do a couple different things me switching context just to show I want to building controls essentially against, who can actually deploy to my repository right and you'll, see exactly why here, so I'm going to go to that pull request that james made earlier all right.

A

So there's a couple different cool things I want to do you know what I think I just want to go ahead and deploy this thing into qa or prod, because why not I'm sure it works, I'm not going to review it or anything like that. So I'm going to click on the label, because that's why it's giving me directions here. Do okay! Let me just go ahead and try to deploy to prod. Let's see what happens so once I click that label we're going to see a few different things occur.

A

So we just see that this notification here we can see some checks. I have started from getting actions, so these gift actions checks are going to be intrinsically linked to this pull request from which they are triggered off of so that's a great thing about actions. You can use them to automate and mandate what has to pass in your ci cd.

A

If I go back up here to actions, we can see that this just ran. You can see it's called deployment on pull request label, which is exactly what happened. I'll, show you a quick look at this workflow file and exactly how we're going to build in some different controls. So quite similarly we're running this on specific types of activities. So in our case it's on a label activity right and then, whenever that label activity is being used, we're actually going to pass it through as a local variable.

A

That's going to be available to the rest of my scripts in here and my first job. Actually, I'm just doing a permission check. So I'm simply wanting to see is the person that actually performed this activity. The github actor is what's referred to, so the person actually put that label on there are they actually the repository owner? uh If not, then this step fails and if that step does fail, we're going to do a couple of things extra here. So if it fails, we see that hey.

A

They are not actually the gift of repository owner we're going to actually go right down here and make a comment saying: hey someone attempted to trigger this. That was not supposed to be done and also since it failed we're going to go down here and do a couple of things too, such as removing the label as well, because I don't want that clutter to add up anymore. So let me show you what actually happened at the pull request, so we can go back here.

A

So we go down to the comment history and I like doing this for my actions just to give some context and uh history and visibility into what is actually occurring. We can see oh great, so my gift of actions bought commented 43 seconds ago, saying: hey someone tried to deploy. This was that user phenomenal and they are not the repository owner and in our scenario trying to deploy to prod that's going to be stopped, so no steps further were taken and even went ahead and just removed that label just to clear that clutter as well.

A

So that's an example of okay. How do we build in some controls or guidance around who can do what in our repository? But let's see what this user actually can do, so I'm gonna go back and click on labels. Let me just for testing purposes: let's just deploy the dev right, let's get somewhere safe, that we can test this out and these changes and make sure nothing is going to break our code all right. So now, if I do the same thing as we saw earlier, we can see these checks have just kicked off again.

A

I'm going to go over to my actions tab, because I want to show you this in real time, because it does happen pretty quick, at least for these pretty lightweight actions I have available for me. You can see first we're going to be going through and using a permission check.

A

And then you can see it actually went to the next step where it says the label was applied, so you can see a check actually did fail, but that's okay, because the check itself, it was just seeing whether or not actually a repository owner, as you recalled earlier, the following steps we have actually, though I'll show you, the workflow file are going to say whether or not hey, even if I'm, not a repository owner. What can I actually do in terms of deployment? So remember this job called permission.

A

Let's scroll down here, go to my next job called deployment. You can see. We have one. That's called the deployment uh to label base to dev. So what happens is basically the label dev if it is okay, we're going to create some more content down here to, let us know what's going on and then we're actually going to be doing a few different things and creating what we call a github deployment event.

A

So deployments in github are really cool and we're going to be using these heavily in the demo because it basically lets you define a space and a name for where you want to deploy your code to it's really more of just a container and a logical way to structure and create updates to okay, something actually failed. Let's update that deployment has failed. Oh it's passed. Here's where it's at here's, even a url for it and just further leveraging the part of the github community.

A

I actually needed a way to get the branch name of the pull request I'm triggering this from, but there was no way out the box to do it. At least that I could find so what I did actually is just reference: a pull request from a user out there in a public, github repo that they published in the marketplace for others to consume, which is really the power of the github marketplace.

A

I'll show you all that real quickly, because in these uses, tags you'll see throughout all they are, is just a url slug to a github repository.

A

So you can see this is someone's repo shout out to matthew coleman and we can actually see hey. This is published to the marketplace, and here it is in the good marketplace. Give us a couple details on how to use it. Obviously, the original repo where it came from, but if you go to the marketplace in general, you can see there's over 5400 github actions available for your use, which is an incredible drop. I think dean and myself can both attest to that.

A

um We haven't been here too long at github, probably under a year both, but when this first launch it was ga in november or so and over. I think the past really two months or so we've added at least two or 2500 actions.

A

So that's a great part of such an open platform and solution that anyone can contribute to you from large companies as you're, seeing here from companies such as docker, ansible, amazon, azure to just general users, as we saw there with someone adding in some nice functionality that they found a use case for all right. So going back to our script here we can see the deployment was kicked off, I'm actually using this github action from an actions repository.

A

I definitely recommend you checking out this github actions organization and the repositories that they have available for use because those are made officially by github themselves, and there is a plethora of actions available for your use cases. This one is called give script. I love it because I can just run simple um js scripts from my github action workflow file without having to go into machine or enter bachelor commands or reference a script file, etc.

A

You can just run these different commands, such as create issues or comments or labels and we'll actually use that quite heavily in the solution as well right so going back here, I'm using my github script action.

A

I'm actually going to go ahead and create a deployment I'm just going to pass it a couple different, you know require parameters and contexts, as you can see here, and the main one I want to note is this payload? So this is really great because uh you can basically pass it a payload of information to be included along with the base parameters. It has so I'm going to pass a couple things here, I'm going to pass in the pull request number.

A

This is originating from the label that we used to kick off this deployment, as well as the branch name itself as well and you'll see why that's valuable for us here in a bit and then. Lastly, here I'm going to go ahead and actually just go ahead and assign this person to the pull request because hey you decided to pick up this deployment. So I'm going to put a little bit of onus on you to track and be a part of this pull request. Then.

A

So, if I go back to my pull request.

A

Let's click in here. Okay, we see a couple. Things have been happening as we went through that so first, let's start from the top down. So earlier we tried to attempt a trigger to prod that was blocked because of our permission, script that we saw in there in that job. um So that was stopped. We removed that label you're not able to do the activity all right. Fine.

A

I actually am giving people the flexibility to deploy to dev if they would like to, though excuse me so what's happened is actually you get a warning message saying: hey someone's trying to deploy a dev, it's this user phenomenal, they aren't a repo owner, but the deployment will continue because it's just dev, I'm not too worried about it in this situation.

A

So it's saying that we're going to go ahead and grant approval for this they're requesting a deployment event and then down here. It's saying that we've actually gone ahead and made a deployment for the specific id that was created in that previous issue.

A

For that deployment event activity and I'm actually going to be the one that's going to be deploying these based on the context of my account as the organization and repository owner a couple other things happen, but I do want to backtrack and show you those throughout the process, and I see we have a message from false that said: nice yeah. I think that was prior reference to me, the marketplace and some of the scripts actions.

A

They are really nice and we'll actually take a look at a couple that I worked on myself because I just had a really specific use case for information and that's out there as a public kind of action as well. So if we go back to our actions tab, let's see what happened so our actions tab. We can see that there was this additional event triggered deploying this dot net application.

A

So I click this. We can go in and take a look at the workflow file as well. A couple things happen you will recognize, but the first I want to note is hey this actually triggered on a deployment. One thing I want to specify in order to prevent you, know circular actions from just running continuously. You cannot trigger an action from another action in most pretty much all scenarios.

A

However, what we did in this scenario is we actually created a deployment event that a plan gets sent to your get a repository, and now that deployment is something we can use to trigger a following action. I think this is a clean scenario of how to do that. Obviously, because deployment events are very encapsulated and tied to a reference, a sha or a pull request in this situation, and that's how we're going to actually pull in that payload of information that we set earlier as well. If you recall, so, we look in here all right.

A

So on the deployment event, this was triggered on great. We can see for the event deployment. We can actually grab. Remember that payload that we identified so I identified a payload in there for an issue number a reference tag, a label and then or just a regular property off that deployment is the id. I also want to grab that as well. I'm going to find a couple more environment variables that I want to reference and use within the following jobs.

A

I'll have, and those include references to what is the web app name for dev, qa and prod for the different environments as well, as was the azure resource group name in my azure subscription that will be created as well as hey what azure location do we want to try this out of so for me, being based out of atlanta, georgia will use the east u.s region all right so similar what we had before we're going to be doing a permission check again.

A

um It's just going to say: hey is the person that's going to be responsible for this event or the actual repository owner, and it is because this can be triggered in the context of my user account. That's where the deployment's running from the deployment technically is not being triggered by the phenomenal user we had earlier. They simply made the request in there and then me as a repo owner is the one that's actually going to be running this in the github actions context anyways.

A

Obviously, I didn't have to actually do or touch the keyboard much outside a couple button clicks, so we go down here, we're going to go to the steps that actually do a deployment to the different environments. So our first step here we're going to be deploying to dev be a label, so we can see in this first label. It's basically saying: hey you're, going to deploy to dev all right and we're going to be doing a couple different updates here.

A

If I go down here, I'm actually going to go ahead and update the deployment status. So it's going to go from just being a blank deployment to being in progress, and it's going to update a couple of values in here as well. You can see I actually grabbed that deployment id as well that passed from the github event.

A

Next, I'm going to create a comment: that's what we saw saying: hey someone's requesting to make a deployment to this environment and here's the id for that deployment as well and scrolling down here we're going to be using a couple, different github actions and commands from both.net. As you can see. Actionstep.Net.

A

That's going to give us access to these different run options for version 31.101, and it's actually going to go and publish this application and to actually make the deployment we're actually using this other github action by the azure group themselves called login, and here's where I'm going to use my github secrets we specified earlier, if you remember, for my azure credentials right because obviously needs a subscription tied to it, because it's not free to host web apps, at least in this situation.

A

So it's going to create the resource group for me, based on the name I spoke about earlier, I'm going to go ahead and make a deployment as well.

A

Let me scroll down here a bit more once that deployment is done, it's going to go ahead and log me out of azure. I actually have a step in here, because I want to check and make sure the response that azure website I just deployed is valid and available once again. Another git of action, the community from this user and all it is- is hey what a response code do you want to have?

A

I want just a simple 200 and do you want a timeout for how long we're going to wait for it, etc, but another good check to know okay. My deployment made its way through azure with no issues. I'm now checking it with a different uh step and job from get actions, and then I'm going to go ahead and update the deployment. So basically, this is another, if condition so.

A

Basically, if all the steps in this job pass and are successful, this condition is going to go ahead and run and once again we're just using the github script action and we're going to go and update the deployment status to be a success because it has been deployed to azure successfully. We've done some different checks and then we're actually going to go ahead and apply uh some comments and then add a label as well as that pull request.

A

If it would have failed for any reason and those steps, then we would do another update, but we have updated to a failure for some reason and then add another comment as well for visibility into that failure.

A

I'm going to go back to my poor quest any questions from the audience on that. Does that make sense.

B

Folks keep those questions coming in yeah.

A

Feel free, y'all, there's a lot of goodness in here, and uh sometimes we just get kind of lost in how cool it is, but we'll be happy to dive into any different areas. So now I'm back at my pull quest where this really all started from then we went through and looked at a lot of different things that occurred and you see as I'm scrolling down a couple. Different things happened right, so we can see some of the comments that are made all right, someone's making a dev deployment.

A

It was triggered by this user, but they went ahead and tried to make a request. It seems like things went through and then some of those update comments I mentioned before hey this was successfully deployed to azure awesome and here's that deployment that we made and we go and click this link for view deployment.

A

We should see a live azure website, so it's just a simple bookstore, very lightweight, but went ahead and carried in that change. I made via my issue, ops, to update the title there. You can see it's a live website and we see when the book's actually available.

A

There is accelerate by nicole forsgren, which is now a phd at github and she's part of our you know: developer velocity research, team very bright and that's a really awesome book so definitely recommend that if you've never checked out before all right, so I'm going to go back to my pull request. So, okay, we saw a couple of things we saw. A user can just make a simple dev deployment, that's fine, but what other checks have you built in and how is that really going to help me manage this entire life cycle?

A

Because you can see, I also applied the label after the deploy to dev. So now it's the azure dev live, so you know that hey deployment worked, and this was actually added on there. Let me actually try, so I'm back in my owner context, I'm saying: okay, we made a dev deployment. That's probably good enough for me to deploy to prod right. I don't really care. Whoever has any saying that I'm just gonna go and click this deploy to prod label.

A

So I go to click that and let's see what occurs when we do so.

A

I'm gonna go over to my actions. Tab. We see another deployment event just occurred for deployment on pr label in our actions. Tab- and this is currently running. So we click on this. Let's look at a few different things that are occurring.

A

All right, so it looks like the permission check worked, because that makes sense right because I am a repo owner uh and we see that step the permission check it passed, but some other checks seem to fail here. Oh this one called validate prior requirements. We actually skipped over that and looks like this update pr for being failed for prod actually ran instead.

A

So what I'm doing- and this is just a single use case I have- but I want you to think about hey. How can we apply some of these different practices to some of our internal processes? Maybe our company, or just my team of developer friends on a open source project, possibly so what we're doing is we're making a check for permissions right, we're saying: hey: are you the repository owner?

A

If you are great, that's one step that needs to pass, however, down here, I'm doing a step called validate prod requirements, and why do I do this? Because I want to make sure? Okay, if you are trying to deploy to prod, I want to make sure you're, at least up into qa, with a successful deployment and, as you saw earlier, whenever a deployment is done successfully, it will actually create a label saying azure, dash environment name live so in this situation, I'm checking first off if the label that triggered this ends with prod.

A

This is another cool constructor you can use for these if and conditional checks. Okay, it's true right. The label I did was deploy to prod and if it contains in the pull request, all the labels that array that's possibly available if any of their names include azure qa live, then, okay, cool, it's a valid deployment, because we're saying this has already been deployed up to qa.

A

However, if not, then we're actually seeing something that I just found out about not too long ago is you can actually check the steps for different activity inside your github job and if the outcome of that step was passed or failed or success, you can also use that as a parameter too, which I think is great. So what I'm doing here is if this previous step project you see this id reference here- is skipped, go ahead and run these following commands here.

A

In addition, to, of course, is hey, was it actually uh was the permission, check a success and then was the label that triggered this entire workflow run ending in prod, so, based on my check, there is hey: is this actually a valid user? Okay, they are, but was the previous step. The validate product commits skipped. It was and once again verifying that this deployment is trying to go into prod. So what happens here? Is this triggers and it's actually going to create a comment and remove a label that we applied earlier.

A

So let me go back here. It's validated that all occurred, because once again, we want to make sure that we're following the proper procedures whenever companies are deploying secure code. So let's go down here a little bit. You can see okay, it looks like two minutes ago, so it's showing that I had a deployment trigger. It was me two prod.

A

The requirements were not met, so that deployment was actually stopped and then I once again built in the bot just asked hey: can you go and remove that label, because obviously that was not successful deployment and we're only deployed to dev here still, okay,.

B

A

Fair enough, fair enough, let's go and try that keyway deployment, though we saw before that we're blocking um the just regular phenomenal user account from deploying the keyway based on that repo owner check.

A

So I'm actually going to do something I'm going to actually pull up, and let me share my phone because I want to show how we can do deployment when we have some things built in like this right from our mobile experience with the github and while I'm getting this set up, I hope people out there know there's an app for both uh ios and android for github. It's actually quite awesome and really convenient to just check your repository see what's going on uh in regards to your source code, okay,.

A

So I'm gonna pull this up here sharing. This is over.

A

Sorry I get that the full screen make sure you can see it all right. So essentially, I'm gonna go to my home tab. I'm gonna go look at my pull request.

A

I apologize if some people are having issues from it. Let me just go through this real quick. Let's go into my specific repo that we've been working on, I'm going to look at the pull request on that repo.

A

I'm going to go ahead and update it update the label. That is right from this experience.

A

So I'm going to update my deploy to qa label.

A

I apologize sometimes screen sharing is not the most fun here, but I believe I've got it done. So let me go back here and we can see at least wasn't touching the pull request.

A

Let's verify that happen, okay, so we should now see that the deploy to qa label has appeared, and we can see that I went ahead and added that about 35 seconds ago from my mobile app. So I don't have to be on my keyboard or at my desk or in the office of virtual or otherwise, at this point in time to approve or make some different deployment options or moderate the software to the life cycle. For my team.

A

So I'm going to scroll back up, it sees all right that label has just been deployed and we can actually see. Hey, looks like some more comments in here that that was actually granted access to. So it's going to go and deploy up to keyway and we'll see how that works.

A

But once again looks like our deployment step was passed because hey permission check worked and we can actually see the label um worked as well and deployed off to keyway, because I have the right permissions. There were any checks that we're building in for prod specific protections.

A

So we can see the employment of the keyway itself is also triggered off. Give it some time to go, and you can see throughout the process of my pull request. What's actually going to be occurring, look back at the pr level we go here. We can see in our show environments, now, hey a new deployment was created and the status was just updated as well into pending, as we saw in those previous steps, which I think is great.

A

We can kind of see in real time what's happening um in addition to, of course, making comments if you'd like to along the way letting people know hey who's, deploying what what's been approved, um as well as seeing this environment being pushed up into our environment.

A

So let me go back to that action, it's very similar to what we saw before that y'all noted now, this time. Instead, it's going to be triggering the qa deployment, because once again we're doing a check in that situation to make sure that the label, whatever was applied and brought over for our deployment event, actually matches up with qa itself so for our qa deployment yep. If the deployed environment label that was passed through vr payload equals this go and run these following steps.

A

So great modularity to you, know, reuse code or create different branching situations of how a script or action file is going to run. I'm sure you also think of plenty of different use cases for that, whether it be spin up a certain type of environment or container or images or create certain types of pull, requests or features or comments for team members.

A

Depending on different scenarios, you may be in the process of doing but same steps as we saw before it's going to go ahead and log into azure deploy out there and once it's successful, it's going to go ahead and update my pull request comment as well, so let's go back here to this label and while this is actually updating, I want to show you all how simple it is to code a github action with one that I have done for this exact situation.

A

So another public ghetto, repo and really simple action out there, I'm happy to have some contributors. People look at it. Definitely collaboration is the spirit here at github and open source in general.

A

So I'm going to go ahead and show you this action, so I had a need to get the deployment id whenever I'm going to point to specific environments, and this is necessary because in order to actually update a deployment itself, I need that deployment id. But it's not something you can actually pull off the fly every single time.

A

You can pass in some different pieces of information, but there are certain steps in my script, where I actually need to just be able to grab it intrinsically and actually sort by whichever one matched the label I had, because I could have several different types of deployments as well. So what this deployment action does just a simple javascript and all I'm doing down here- is I'm going to just pass in different reference tags, uh something called environment name.

A

So it's going to be based off that label we have and then from there I'm just going to do a simple recovery of hey. What are all deployments? These are actually returned in an array for my environment and then from there I'm going to filter down and then actually get the id. I need in order to do the needful and then update this and we'll see why I'm doing this and what exact process here in a little bit all right. So I think we just saw our successful deployment to qa yep.

A

That's what we've been told anyway. So let me go verify that as well awesome. So we can see here our azure websites, qa, was also successfully deployed- that's great, to see all right, so, lastly, we're going to do this deployment prod, let's just verify that our checks we had before are now passing, because we do have a tag here that says: azure qa is live great.

A

You want to verify that so now, even though I'm a repo owner- and that is added, I should be able to actually make this deployment of prod happen after going through the checks I've defined in this scenario. Obviously there's several levels of granularity yell could make right. It's the pull request. Mergeable is a specific type of user, for example, or maybe you're referencing a list of users that are available for that plenty of flexibility in this model, because essentially, if any is just code, it's reusable and it's consumable all right.

A

So we're doing a couple of things here. We see our permission checkmate before actually ran successfully, and then here the validate prior requirements also ran successfully so great. So we know that hey, it's gonna be able to go into prod and we can see it since this step. Wasn't skipped it actually passed that the following step, the updated for a failed production deployment, is no longer an issue.

A

So, let's go down here same thing. We had before it's going to go and kick off a deployment event go back into my pull request. We should be able to see the same thing we've been used to so we're seeing here. I went ahead and made a deployment request, and now we went from two active environments: devon, qa to one penny environment. That's the production environment that we're wanting to work on. So this is going to run the same way you did before.

A

But right now I want to answer the question uh I usually have of. How do I manage these things, especially when it comes to test environments? They may be consumption based on containers or azure or maybe another cloud.

A

It can be a pain if some of you all have this experience of managing those and making sure that you're not having a large consumption of your subscription credits, especially using on a free tier or school, to your company tier available.

A

So I try to build in a couple different ways for me to manage that and be able to kind of just tear these down as needed. So I'm going to go over here, I'm going to go and tear down one of my environments. So let me try this so I'm going to go ahead and click this azure dev live.

A

This label is applied once the device live doing so there, so I'm going to go ahead and unlabel that go to the action tab, we're going to see that action was just triggered off here for azure teardown, so another workflow file that we've set up this time on a unlabel event for your pull request, which I think is a cool scenario, because in this case I just want to really drive this off labels themselves, but you can probably draw a soft assignment common specifically right if a specific type of comment is added in there for deploy made by a specific user, go ahead and run a certain type of action.

A

In our case, we're going to run this on the unlabel event for the pull request.

A

What happens down here is a couple more checks, one I want to make sure someone's tearing down resources, I'm just going to make sure they're a repository owner. We just have that check and they're available and then for my dev environment. It's going to run through and say: hey the label checks out. It's the same label we're going to go through and run these azure login scripts.

A

It's actually going to go through and delete some of these different resources that we had earlier and then I go here and click on this deployment id event. This is what I actually need that uh that action. I specifically wrote myself for um so gibbs great, because if you need something just build it inside github wear it through actions. We have a great api set as well as web hooks as well.

A

um So in this case you want to grab the deployment id, I'm actually going to store that as a variable here for the outputs of this specific step based on the id. Once again, you can reference different steps and your actions by their id, which you can specify.

A

Then, if I scroll down here, we're actually going to go ahead and update the status of that environment as well uh that deployment. That is obviously we're using deployments a lot. So I just want to kind of remain and keep a level of consistency when things are going around through that process. So let me go back to my pull request.

A

Twitch demo days, let me scroll down, see our have been deployed, so these statuses should update here shortly, as you can see, it looks like prod was also deployed itself there, all right great. So once again we have three versions of a reading site that have been able to be deployed and able for us to check and validate throughout our process, maybe running different levels of checks or linters or may selenium manual testing or anything else. uh You can definitely have that added in there and I see there we have it james, harry's yeah.

A

I love him that man, you obviously have the the longer names. I think you win in this situation, but mine was always easy to fill out on scantrons in the sats. That was always a great uh perk. I suppose all right, so we can see we went ahead, went through did our tear down their deployments toward different environments.

A

I'm going to go back up here to my actions.

A

You see some different components have ran in there as well. Actually, let's take a look at this agitator down. My step might have actually had to fail.

A

uh You know what actually it's using a different version, but that's no issue that I'm actually show y'all something. Let's do something not on the fly per se, so no worries so shoot. One of my tear down steps for azure failed bummer, but this is actually a good use case to show something called manual triggers with git of actions.

A

um This came out maybe two or so months ago, and there was a need from users and a lot of our enterprise customers of how do I actually just run a git of action when I need to run it, I don't want to necessarily trigger it off a timer or specifically off a give event per se.

A

So I'm going to go here and to where it says, azure cleanup and I can actually run this workflow as you can see right from the ui, which is pretty cool and a couple things about the way this works I'll, show you the workflow file over here, so workflow file, so very simple, uh get a workflow file as you're used to seeing I'm sure. uh In this case we actually specify a couple things, so I actually have specified a cron schedule.

A

So I can run this every night at midnight, so hey every night at midnight go ahead and destroy this azure resource group. It's just a test environment. Once again, I don't want you to run in my subscription or you can use this workflow dispatch event as well, uh and it's really not even an event. It's really just a trigger. I should say- and it accepts a couple different parameters. You can specify one being inputs, so we say hey a single input, for this is going to be this.

A

It's called azure resource group, and this is what you can then reference later on inside of the different scripts itself. So what we're going to do is basically say if this azure resource group value is required. That's the description of it once this is entered in and ran the github actually can use that value and run whatever script you have. So I want to go back to my actions. Let me go and run this. Let's go ahead and clean up all those azure environments.

A

Azure cleanup yes and hey, I just saw a question in there. Apologies don't want to mess up your name, but is that nitin? um You can add, of course, yeah definitely additional inputs to manual triggers uh for that as well. I'm sure dean, it's probably a couple references. We can show you for that, but you can as many as you want. You probably saw that in the workflow file. Please add one uh that will show up here, but you can add several actually, which is pretty cool.

A

So we're going to add. In the name of my azure resource group, we're going to run this workflow file. You can see okay. That was successfully requested, at least that's right. Just writing it right from the ui, and this step is going to do a couple things once again, I'm doing another permission check. I reuse this component, but I think it's good because I just want to make sure you're who you say you are, whenever you're trying to do some operations, maybe such as deploying to prod or removing or deleting environments or values.

A

This is pretty cool, though, because there's a step, it's called needs, so we're basically saying this step, and this job can only run if this previous job permissions passed right. So you can build independencies to your different job. So definitely note that we use that throughout the solution as well.

A

Okay looks like this is going ahead and going to be running for us.

A

Go ahead and finish up and sadly enough, I think all those pretty environments we uh set up along the way might be going bye-bye, but that is what we wanted in this scenario, I always had to have a contingency plan all right, so I think my azure environments go in there. Let me see these are still available. They still are, and you see I'm really just running an azure cli command right from my virtual machine itself. That's another cool thing about this: your clies!

A

You need out there for anything such as terraform, azure, heroku et cetera. You can always install those usually on the runners and then see how those are referenced and be able to just run the commands, as you would normally. um So it's another really beautiful part of the negative actions infrastructure. It's really simple super easy to get started with and there's a large ecosystem of providers to look at and also is actually finishing and running. Let me show you our marketplace: let's take a look at some of these actions that we were referencing earlier.

A

I highly recommend you all take a look at the github actions marketplace. There's a large plethora of different actions to look at, but a couple of different ones that we have here ah this one. I wanted to look at there's one called the azure cli action, so this is great. You can go even look at the exact repo it came from. You can see it's from a verified creator and you actually hey the source code of how it actually works.

A

So maybe some more information about exactly uh how the script runs, but essentially we're doing a couple things here, so we're going to be able to log in azure and then check out different azure resources. That's a great part, because then we can use this additional script here, the azure cli script and just run whatever commands we need in this example, they're using az account show look at the storage in our example.

A

We're actually using this to tear down resources so really powerful and definitely recommend you looking into this, for whatever cloud of choice that you're using out there, but the azure integrations. I've worked with released have been pretty pretty useful. Okay. So let that finish up running.

A

I want to show a couple more things actually just came out this week regarding github actions, especially for managing your enterprise and github organizations, so you're going to get an organization, I'm going to click on the settings, I'm going to go over here to my actions section and a couple things we've had questions of before for managing your organization or a team of people. Actions and open source obviously is great. It's really consumable, but obviously the question of security, knowing where things are coming from and what things we trust has always been a question.

A

So we'll get of actions. You've had a couple permissions before for organizations, you can say: hey what organizations there will actually to use actions all of them, maybe only a subset of them. You want to select only a couple repositories that can use it or hey. They can use actions, but only they can use local actions so only actions that they basically include in the repository once again just code. You can reference it locally as well, but it might make your repo bit heavy in a lot of situations or now.

A

This is awesome because you can say: hey you selected actions that match specific criterias. We had a blog post about this literally. I think earlier this week, it's not last week, um but I definitely recommend you checking this out. It could be really useful for your enterprises, your organizations in terms of what you need, so you may say, hey actions created by github itself.

A

You know we have specific repositories out there, that we manage and create actions for such that check out, that you saw or maybe set up nodes set up, uh azure things of that nature, or only allowed on from the marketplace creators that are actually verified, meaning that their github organization is a verified organization. um The way that happens is a company will basically say: hey we own this domain, so we are, actually you know, azure.com or hashicorp.com, etc, or should even specify a list of actions.

A

You want people to use as well so try to play around this. You can use a nice little mix of different actions as well uh to suture your use cases also something I wasn't too familiar with recently- was just the ability to be able to retain logs of artifacts as well and specify the time frame for it. You can't go over 90 days, but if you're worried about things such as your storage consumption definitely feel free to, I guess bump this usage down as well all right.

A

Once again, I know we did talk about secrets now. You can set this up at both the org and uh local level of your users. Okay. So let's get back here so let's say my job completed, I'm seeing no errors.

A

So if we can verify here's my resource group- oh no! Well it was a nice one lasted, but it looks like we lost it, but that's what we wanted. um The resource group itself was destroyed and I'm no longer too worried about uh my azure subscription being drained. You know midway through the month, which I think maybe some of y'all have in that situation. But that's happened to me one too many times and of course, once you actually need it for piloting or testing something you can't anymore.

A

You have to wait at least a week or two all.

B

A

So we went through a lot of different steps. There y'all in terms of github actions. We saw going from an issue itself to a pull request to labeling to comments and different activities being occurred, both inside of github as well as externally with you.

B

A

Spinning up in azure etc. I know we have a few minutes left here and happy to stay on any questions on what y'all see and actions in general or really just to get a platform in total. There's a lot of wealth of information out there but happy to field anything from y'all. I really appreciate the feedback and, while we're doing that, I'm going to go ahead and show you the public repo, where you can also view the source code.

A

If you'd like, I did promise you that I just pasted in the chat there uh from username j train, choo choo so feel free to take a look at that.

A

And copy it fork it, whichever you'd like always, welcome and open to uh pull requests for improving some of these solutions.

A

All right, if any questions feel free to, let us know, y'all, I'm going to walk through a couple more things with actions that we sometimes get questions on uh from customers in terms of maybe writing and managing and the flexibility behind them. So one great thing right is: we want to make sure that actions they can encompass cicd as well as automation as you're, seeing here, but I did a couple things where I did a deployment to that for deployment qa.

A

How do I actually make sure what I did is um required right before this can be merged into our main branch? So I'll go here, I'm using a branch protection rule you're, probably familiar with this. If you use it up in the past or on a big team, but basically branch protection rules, you can define a name pattern, see what branches this will apply to, and basically these rules you set up will protect your branch, uh hence the name so before anyone tries to merge into my main branch.

A

We have to follow these certain parameters, so I'm going to require hey. At least one person has to approve the pull request of a review or you can have multiple or certain status checks that have to pass before merging, so these status checks.

A

These are what's going to be your ci cd, we have a checks, api you integrate with, and a lot of providers out there do in this field, so jenkins, travis circle et cetera or it's an api, so you could also integrate with it and make updates to the get a pull request as things are happening, but what we can do is get them actions they automatically show up here, which is great. So if I want to say hey before we can merge this pull request.

A

A couple different things have to pass so as to deploy to dev properly has to deploy a prod properly. We want to make sure there weren't any issues with that.

A

If I save those changes, those now be applied and we can ensure that those are required checks before you ever merge a pull request. So let me go back here. Let's take a look at.

A

That all right, you can see they're showing up here as well as hey. These are some checks that need to occur and be finished up before you can. Even merge right emerge is being blocked, so definitely uh consider that when you're working with github actions, when you're trying to automate and building controls for your ci cd and sdlc process all right well everyone. We really appreciate your time me and dean will be on here. For a few minutes, I think um really dean.

A

If you wouldn't mind I'd love to hear some of your experiences recently with github actions, it's been a really big and open platform. I think we have a couple announcements here. We can share um for me one big one is hey: it's actually on beta, forgive enterprise server. So if you're an enterprise customer out there for enterprise server, please look at our latest release. That is 2.2.0.

A

We'll drop a link in here in the chat, but uh you can join the beta for this uh just reach out to probably your account team, but it could definitely be a really cool solution, really excited to see actions on github enterprise and for our last few minutes here, y'all I'm actually going to pull up for those two on our public roadmap. If you do recall, uh maybe some of y'all did not know.

A

This github now has a public roadmap, so this will be showing you a list of different activities and items and features that are being come into our product over the next quarter or two. So there's a repository as shared in chat. It's called information. You can see about it and read about how it works now, we're lining it out and different tags we're using for it.

A

If I go over here to my project board I'll show you kind of break down some things coming down the pipeline, hey nathan, I see you asked: um are these new features added to the give docs? Yes, they definitely are github docs website. um I was using it today. Actually, I think I use it every day for different references to material, so we keep really good job of updating those and making sure that any new features are reflected out there, including a couple new things we are releasing.

A

The beta, such as you may have seen container registry and a couple of new features for get actions as well, updating the apis et cetera. So you can always rely on the github docs for that we're assuming a few things that have been coming out, especially in terms of actions, and this is going to be by end of calendar year. What we have currently scheduled we're going to be having manual, pre-rules and workflows. This is something we've heard from a lot of customers about.

A

As well as workflow, visualizations being able to really see a picture of what's going on in the stlc process,.

A

As well as additional things we're having here some things, such as looking at get action, events in the audit log forget of enterprise cloud, so some additional controls are going to be adding and to get it as well, all right, everyone all right, no rush to to leave or anything like that feel free to join us. If you have any more questions, I do want to shout out, there should be a link to our sales contact down below on twitch.

A

If you need to look at anything as well or reach out to us, you can see this bright little image says contact, get up sales and feel free to reach out for any questions or inquiries for pal. We can better serve your enterprise all right. My friends appreciate it hope everyone has a safe weekend, wherever you're at in the world night day or evening, and uh see you next time thanks everyone and thank you to dean for being a great.

A