►
From YouTube: GitHub in the enterprise: Velocity and the developer experience - GitHub Universe 2020
Description
Presented by Erica Brescia, COO, GitHub
The ability to quickly deliver secure, high quality software is critical to remaining competitive in virtually any market. Enterprises of all sizes are looking for ways to create an advantage and GitHub has a simple formula for success. Join Erica Brescia, COO, to hear how GitHub is helping enterprises increase velocity by focusing on the developer experience.
For more from GitHub Universe 2020, visit https://githubuniverse.com
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
Hello
and
thanks
to
all
of
you
for
joining
us
back
here
for
day,
two
of
github
universe.
What
a
fantastic
first
day
we
had
yesterday,
we
showed
you
how
to
ship,
even
faster,
with
auto,
merge
on
pull
requests.
Actions
has
a
brand
new
workflow
visualizer,
protected
environments
and
deployment
approvals,
making
it
a
full-featured
ci
cd
platform.
A
We
announced
corporate
sponsors
enabling
organizations
to
help
support
the
open
source
projects
they
rely
on
github
enterprise
server.
3.0
is
coming
soon,
with
full
support
for
the
tools
that
developers,
love
actions,
packages,
code
scanning
and,
more
and
last
but
not
least,
what
I
know
many
of
you
are
excited
about.
We
unveiled
dark
mode
for
github.com,
as
nat
said
yesterday,
delivering
the
best
possible
developer.
Experience
is
at
the
heart
of
everything
we
do.
It
drives
every
feature
we
ship
every
decision
we
make.
A
While
we
have
incredibly
talented
people
on
our
team,
their
creativity
can
never
match
the
collective
knowledge
and
the
skill
of
the
global
developer
community
as
the
home
to
so
many
of
the
world's
developers.
We
tap
into
emerging
trends
and
best
practices
to
build
the
platform
for
all
developers,
with
the
goal
of
making
their
lives
easier
with
each
and
every
new
ship.
At
the
end
of
the
day,
that
means
helping
developers
do
what
they
do
best.
A
It
means
removing
distractions
and
automating
away
as
many
mundane
tasks
as
possible,
so
that
developers
can
focus
on
their
craft
and
have
an
awesome
experience
doing
it.
We
talk
to
developers
all
the
time
and
we
also
hear
from
businesses
of
all
sizes.
Everyone
wants
to
improve
their
ability
to
deliver
software.
A
In
our
experience
for
businesses,
it's
fairly
simple,
you
accelerate
velocity
and
improve
quality
and
end
up
with
a
happier
team
to
boot
by
focusing
on
the
developer
experience.
So
what
does
that
really
mean?
A
great
developer?
Experience
boils
down
to
three
key
components:
first,
developer
workflow,
including
frictionless
collaboration
and
automating
manual
tasks,
so
developers
can
stay
in
flow.
A
So,
let's
talk
about
developer,
workflow,
github
centralizes,
your
workflows
around
your
developers
around
the
software
they
build.
Most
developers
just
want
to
write
great
code
and
for
it
to
have
an
impact.
Ci
cd
testing
issue,
management,
refactoring
and
so
on
are
seen
by
many
developers
as
more
of
an
annoyance
that
gets
in
the
way
and
interrupts
their
flow
according
to
research
by
uc,
irvine
and
humboldt
university
in
germany,
it
takes
an
average
of
23
minutes
to
enter
an
optimal
creative
state
or
what
we
call
flow
or
to
re-enter
it
after
a
distraction.
A
So
staying
in
flow
is
critical
for
developer
productivity.
It
also
just
feels
good
to
be
cranking
away
at
something
with
deep
focus.
I
know
I
certainly
love
that
feeling.
The
intuitive
collaboration
and
automation
features
we've
built
into
github
help
developers
stay
in
flow,
allowing
your
team
to
do
so
much
more.
To
put
some
numbers
around
this.
The
2019
dora
report
found
that
elite
and
high
performing
devops
teams
are
automating,
significantly
more
work
than
low-performing
teams.
A
Github
defined
one
of
the
most
foundational
code,
collaboration
workflows
when
we
created
the
github
pull
request,
providing
an
interface
and
workflow
for
sharing,
suggesting
and
reviewing
code
changes
throughout
open
source
and
private
repos
prior
to
the
pull
request,
developers
literally
emailed
their
disks
to
one
another.
You
had
to
hope.
The
person
on
the
other
side
knew
what
to
do
with
your
code
and
what
it
did
before.
A
You
could
even
attempt
to
merge
that
one
feature
set
the
benchmark
for
how
we
approach
supporting
developer
workflows
start
with
highly
repetitive
developer
tasks,
make
them
significantly
easier
and
a
joy
to
use
and
iterate
from
there.
For
example,
yesterday
we
announced
the
latest
feature
on
top
of
pull
requests.
Auto,
merge,
auto
merge,
accelerates
time
to
merge
and
allows
more
work
to
happen
in
parallel.
A
No
more
time
spent
tracking
down
pull
request,
authors,
updating
out
of
date,
branches
and
waiting
for
tests
to
pass
just
so
you
can
click
the
merge
button.
Once
all
requirements
are
met,
your
pr
can
merge,
rebase
or
squash
automatically,
so
the
developer,
who
is
waiting
to
go
back
and
merge?
The
pr
herself
auto
merge,
is
handling
that
for
her
now
and
she's,
already
writing
more
code
opening
another
pr,
creating
a
new
release
or
pairing
with
another
developer
for
developers.
This
is
hopefully
a
finely
moment
for
enterprises.
A
Now
you
can
just
set
consistent
requirements
across
your
organization
for
merging
pull
requests
and
instead
of
a
developer
having
to
come
back
and
merge
each
one.
We
do
it
for
you
and
all
of
those
auto
merge.
Pr's
will
have
universally
applied
security
and
compliance
review,
reducing
security
risks
and
the
potential
for
human
error
all
while
allowing
your
developers
to
focus
their
energy
on
work
that
truly
adds
value.
A
Improving
workflow
isn't
about
one
feature
capability,
though.
Keeping
developers
focused
on
high
impact,
work
extends
to
every
facet
of
the
developer,
experience
we're
helping
developers
stay
connected
and
productive
with
our
native
github
mobile
apps
for
ios
and
android
need
to
merge
a
pr
but
you're
away
from
your
desk
just
swipe
to
merge
on
your
phone
with
github
code
spaces
developers
get
a
fully
featured
cloud-hosted
dev
environment
that
spins
up
in
minutes
directly
within
github,
so
they
can
start
contributing
to
a
project
or
switch
between
projects
without
delay.
A
Codespaces
dramatically
reduces
the
overhead
of
managing
dev
environments
and
switching
contexts,
allowing
developers
to
stay
in
flow
and
focus
on
the
code.
It
saves
companies
time
in
running,
managing
and
overseeing
hardware
across
your
developer
environment.
That's
all
running
in
the
cloud
now
it
gives
your
developers
flexibility
and
drives
collaboration
within
your
organization.
A
Teammates
can
jump
in
quickly
to
work
with
others
on
a
project
even
when
they
only
have
a
limited
amount
of
time,
just
spin
up
an
environment
in
an
instant
and
they're
good
to
go,
and
it
simplifies
access,
eliminating
reliance
on
institutional
knowledge
or
specific
individuals
and
ensuring
the
work
can
be
done
whenever
and
by
whomever
is
needed
from
an
I.t
perspective.
Codespaces
also
reduces
the
amount
of
time
and
effort
spent
on
fleet
management
by
shifting
dev
environments.
The
cloud
there's
no
longer
a
need
to
provision
and
maintain
developer
environments
on
local
machines.
A
This
also
has
the
potential
of
reducing
the
hardware
requirements
for
your
dev
boxes,
as
the
amount
of
processing
actually
happening
locally
is
minimal.
Great
software
development
workflows
include
more
than
developers
and
they
don't
stop
when
the
human
leaves
the
room.
Great
workflows,
do
the
work
for
you.
They
bring
in
the
right
people
at
the
right
time
they
fail
intelligently
and
they
self-monitor
that's
how
you
increase
developer
velocity
through
smart,
interconnected
workflows
and
while
we're
building
those
capabilities
into
code.
Heavy
workflows,
we're
also
building
this
philosophy
into
your
infrastructure.
A
In
less
than
a
year,
actions
has
become
the
number
one
ci
solution
on
github
in
both
public
and
private
repositories,
but
that's
just
where
it
starts
across
all
open
source
repositories.
Repos
that
use
actions
on
pull
request,
cprs
merge,
1.2
times
faster
and
the
number
of
merged
prs
increased
by
1.3
x.
That's
34,
more
poll
requests
merged.
This
is
huge
in
terms
of
improving
developer
velocity
and
the
scales
exponentially
with
your
team.
A
According
to
3m
building
with
github
allowed
them
to
go
from
400
deployments
in
60
days
to
6
000
deployments,
that's
a
15
times
increase
in
ships.
The
open
source
community,
including
teams
and
companies
around
the
world,
has
come
together
to
build,
share
and
improve
on
actions
that
simplify
workflow
automation.
There
are
now
over
6
000
community
actions
in
the
marketplace,
helping
developers
automate
everything
from
testing
to
incident
management
to
kubernetes
deployments.
A
As
with
any
other
code,
you
can
fork
and
modify
actions
to
meet
your
needs,
then
share
them
with
others,
so
they
can
continue
to
iterate
on
what
you've
built
a
number
of
github
partners
are
creating
what
we
call
verified
actions,
which
means
that
we
have
verified
the
source.
The
actions
your
organization
is
using.
Let's
check
out
some
demos
from
our
partners.
B
At
servicenow
we're
excited
to
announce
our
newly
published
servicenow
cicd
github
actions
as
part
of
our
ongoing
commitment
to
the
servicenow
developer
experience
these
new
actions
help
developers
quickly
set
up
and
configure
ci
cd
pipelines
for
apps,
built
on
the
now
platform,
using
github
to
accelerate
app
delivery,
we'll
start
by
creating
an
actions
workflow
for
an
app
linked
to
our
github
repo.
Using
the
example
template
built
on
the
newly
published
github
actions.
B
After
that,
we
create
a
pull
request
and
watch
our
first
ci
build,
get
triggered
automatically
when
our
build
passes.
We'll
merge
our
pull
request
and
confirm
that
the
push
to
our
main
branch
triggered
a
release,
build
which
automatically
validates
and
deploys
our
app
to
our
production
instance,
and
that's
how
easy
it
is
to
get
started
with
ci
cd
for
now
platform.
App
development
for
a
full
demo
visit
our
landing
page
on
the
github
universe
site.
Take
advantage
of
streamlining
your
development
workflow
today
with
servicenow
cicd
github
actions
published
on
the
github
marketplace.
C
C
We
recently
launched
an
integration
that
provides
cv
analysis
from
our
continuous
profiler.
The
data.continuous
profiler
provides
method
level
spans
that
provide
insights,
on
which
parts
of
your
code
base
run.
How
often
and
for
how
long,
a
cve
analysis
or
common
vulnerabilities
and
exposures
analysis
provides
insight
on
what
vulnerabilities
exist
in
your
application,
but
vulnerabilities
are
everywhere.
That
doesn't
mean
each
vulnerability
is
even
exploitable.
C
They
also
come
in
many
flavors.
For
example,
it
could
be
a
library
in
your
container
image,
repo
or
a
package
that
you
don't
really
call.
There
are
many
ways
for
them
to
exist
in
your
app,
but
not
be
relevant.
What
you
really
need
to
care
about
is
which
vulnerabilities
are
invoked
in
production
and
are
exposed
to
user
traffic.
C
Our
new
integration
provides
a
way
to
map
the
vulnerabilities
with
how
often
they're
invoked
and
from
which
parts,
for
example,
here's
a
time
series
view
of
how
often
some
of
these
vulnerabilities
are
invoked
now
to
get
this
working.
Customers
need
to
first
create
a
dependency
graph.
This
creates
a
mapping
between
the
customer's
application
and
the
vulnerability
database.
C
Once
this
is
generated,
they
then
need
to
upload
this
dependency
graph
to
datadock.
For
the
actual
analysis,
this
workflow
creates
some
onboarding
friction.
The
easiest
way
to
reduce
this
friction
is
to
automate
today
we're
excited
to
announce
the
launch
of
datadog's
first
github
action
on
the
marketplace.
C
With
this
new
github
action,
we
can
easily
onboard
with
our
cve
analysis
workflow.
It's
also
easy
to
add
to
your
ci
cd
pipeline
and
keep
the
cve
analysis
updated.
Here's
a
quick
demo.
We
have
a
sample
application
here
with
a
workflow.
The
workflow
has
several
steps.
The
first
couple
of
steps
invokes
other
github
actions
in
order
to
set
up
your
environment.
This
is
easily
done.
Next.
We
use
the
environment
variables
to
parse
and
store
the
deployment
version.
We
then
call
our
github
action.
C
This
runs
a
series
of
scripts
and
requires
no
user
input
if
it
notices
a
new
deployment
version,
it
generates
and
uploads
a
new
dependency
graph.
Here's
a
data
flow.
Whenever
there's
a
code
merge
the
ci
cd
pipeline
takes
over.
If
all
the
tests
pass,
the
action
is
invoked.
This
then
generates
and
uploads
a
new
dependency
graph
and
kicks
off
the
datadoc
cv
analysis
process.
The
cve
data
is
updated,
based
on
a
new
dependency
graph.
C
This
keeps
the
cv
analysis,
data
synchronized,
with
new
deployments,
with
github
actions,
we
were
able
to
reduce
the
onboarding
friction
for
this
workflow
customers
can
now
get
access
to
an
end-to-end
cv
analysis
with
just
a
few
clicks.
We
were
also
able
to
solve
this
problem
faster
by
leaning
on
github
actions,
rather
than
changing
our
application
code.
This
is
because
github
actions
are
just
easy
to
use
and
require
almost
no
overhead.
C
D
D
I
have
already
found
the
get
the
openshift
workflow
that
I'm
going
to
set
up
now
to
deploy
to
my
openshift
environment,
I'm
going
to
replace
some
of
the
values
that
you
can
use
here
to,
for
example,
use
your
container
registry
and
then,
of
course,
the
two
secrets
pointing
to
your
openshift
cluster.
In
your
openshift
token
as
well,
you
can
also
use
your
username
and
password,
but
that's
pretty
much
all
you
need.
D
I'm
gonna
commit
that
to
my
repository
and
that's
going
to
trigger
a
build
that,
as
you
can
see,
it's
just
getting
started
right
now,
but
that's
pretty
much
all
you
have
to
do
and
this
application
now
will
land
in
my
openshift
cluster.
I'm
gonna
very
quickly
walk
you
through
the
secret
as
well
as
you
can
see.
I
have
the
registry
password
and
the
two
values
for
my
openshift
environment,
the
server
and
the
token.
But
that's
it
like
it's
that
simple
and
now
that
the
build
is
complete.
Let's
see
the
url
for
that
application.
D
A
A
Github
actions
enhance
the
developer
experience
through
developer,
focused
workflows
by
producing
shared
and
secure
ways
to
automate
away
the
manual
steps
to
shipping
software
actions
allows
developers
to
focus
on
writing
code
and,
in
turn,
delivering
great
products
to
your
customers,
whether
they're,
internal
or
external,
but
great
developer
experiences
require
more
than
the
best
features
and
an
uninterrupted
workflow.
They
also
need
to
deliver
peace
of
mind.
A
Securing
software
is
truly
a
team
effort.
Discovering
reporting
and
remediating
vulnerabilities
is
a
full-time
job
and
not
one.
Everyone
is
equipped
to
do
well.
We've
captured
the
expertise
of
world
leading
security
experts
in
our
products,
so
that
addressing
security
concerns
becomes
a
streamline
part
of
automated
workflows,
rather
than
something
developers
need
to
do
on
the
side.
A
Of
course,
security
isn't
just
about
preventing
bad
actors
from
breaching
your
code.
It's
also
about
ensuring
that
human
error
doesn't
expose
you
or
your
customers
to
risk
on
a
random
sample
of
over
500
advisories
across
six
package
ecosystems.
We
found
that
only
17
percent
of
security
vulnerabilities
are
from
malicious
behavior
put
another
way.
83
percent
of
vulnerabilities
are
simply
the
result
of
human
error
mistakes
that
anyone
could
make
and
it
could
happen
anywhere
in
any
company.
A
Vulnerabilities
are
hard
to
identify
and
expensive
and
time
consuming
to
remediate
with
github.
You
have
an
entire
community
of
security
researchers
helping
you
find
and
fix
vulnerabilities
in
applying
this
tooling
and
expertise
to
open
source
software.
Suddenly
the
whole
supply
chain
becomes
more
secure
for
us
all,
given
that
so
much
of
today's
software
is
built
on
open
source,
we
believe
in
both
securing
the
software
supply
chain
and
frequently
scanning
code
before
deployment
to
prevent
vulnerabilities
and
their
variants
from
making
their
way
into
production
code.
A
A
We
can
look
at
the
process
of
patching
vulnerabilities.
As
an
example
of
how
this
works
in
favor
of
developers,
repositories
that
automatically
generate
a
dependable
pull
request
patch
their
software
13
days
sooner
or
1.4
times
faster
than
those
who
don't
that's
huge
when
it
comes
to
security,
if
you're
not
already
using
dependable,
you
should
spend
some
time
checking
it
out.
A
As
I
mentioned,
we
have
an
incredible
team
of
security
researchers
and
we've
built
their
expertise
directly
and
intuitively
into
the
github
enterprise
platform.
Github
enterprise
server
customers
now
have
access
to
github's
advanced
security
suite,
which
includes
codeql
code
scanning
as
part
of
their
server
deployment.
The
combination
of
advanced
security
and
our
supply
chain
security
features,
including
dependabot,
offers
companies
with
an
on-prem
deployment
platform
to
help
secure
their
use
of
open
source,
simplify
security
and
automate
their
application
security
practices.
A
And
yesterday
we
announced
the
beta
availability
of
secret
scanning
in
github
enterprise
server
3.0
to
help
prevent
credentials
and
other
protected
information
from
being
accidentally
exposed
or
giving
systems
access
to
potential
intruders
security,
advisories
codeql
code
scanning
secret
scanning
and
dependabot
all
work
together
to
secure
your
code
end
to
end
security
is
not
just
about
tools.
It's
also
about
the
community
working
together.
A
Github
brings
the
power
of
the
community
to
help
secure
software,
including
yours,
into
our
platform
through
the
security
lab.
Take
postmates,
for
example,
who
leverage
codeql's
code
scanning
to
do
what
literally
no
other
developer
focused
security
tooling
can
do.
Github
security
features
meet
developers
where
they
are
in
the
source
code,
and
we
also
have
a
fantastic
partner
here
with
us.
Who's
working
to
provide
additional
security
capabilities
to
github
customers
through
their
own
integrations.
E
Hi,
I'm
matt
from
bridge
crew,
the
cloud
security
platform
for
developers
with
the
advent
of
devops,
git
ops
infrastructure
as
code
becoming
staples
of
our
day-to-day
there's,
no
better
place
than
github
to
start.
The
development
team's
security
journey
bridge
crew's
mission
is
to
enable
security
where
code
happens,
and
we
do
this
through
frictionless
infrastructure
as
code
scanning,
automated
remediation
and
runtime
scanning.
E
But,
most
importantly,
we
do
all
of
this
right
within
the
developers
existing
workflows.
Let's
take
a
look
at
that.
We'll
start
with
terry
go.
Our
intentionally
vulnerable
set
of
terraform
manifests
for
infrastructure
as
code
security
training.
Here
we
have
multiple
infrastructures
and
multiple
different
types
of
terraform
resources.
By
cloning
that
locally
we
can
see.
We
have
a
couple
of
azure
app
services.
E
As
you
can
see,
bridge
crews
already
scanned
this
pr
and
found
issues
with
our
infrastructure's
code
security
posture,
which
is
highlighted
by
scrolling
to
the
bottom
of
the
pull
request.
We'll
find
the
bridge
crew
set
of
checks.
Clicking
details
will
take
us
to
a
single
page
where
we
can
see
all
the
issues
and
suggested
remediations.
E
E
Clicking
on
the
individual
pull
request.
Comments
also
takes
us
to
guidance,
so
individual
developers
on
the
team
can
see
context
as
to
why
that
change
needs
to
occur
while
we're
in
the
platform.
Let's
look
at
existing
issues
within
our
main
branch,
as
you
can
see,
app
service,
1
and
2
suffer
from
the
same
issue.
Here
we
can
click
into
them
to
see
the
same
remediation
suggestions
and
even
though
they're
already
in
our
main
branch,
we
can
click
remediate.
E
A
Accelerating
velocity
is
critical
to
keeping
pace,
but
doing
so
without
investing
in
security
can
create
additional
risk.
We
want
to
help
teams
ship
more
secure
code
faster
and
a
developer,
focused
approach
supported
by
the
community
with
the
right
tools
and
the
right
partners
is
the
best
way
to
get
there.
A
Github
is
where
the
world
builds
software
over
50
million
developers,
trust
github
to
collaborate,
test,
build
and
deploy
code,
including
over
70
of
the
fortune
50..
In
fact,
in
the
last
year,
over
60
million
new
repos
were
added,
and
over
1.9
billion
contributions
were
made.
Those
are
some
seriously
big
numbers.
The
stability
and
resilience
of
our
global
platform
is
critical
to
providing
developers
with
a
platform
they
can
count
on.
Github
enterprise
is
built
on
the
same
principles
as
github.com
and
as
a
result
benefits
from
the
years.
A
We've
spent
optimizing
the
platform
to
be
trusted
reliable
and
resilient
from
day.
One
we've
focused
on
building
great
products
and
experiences
for
the
developers
who
spend
their
days
or
their
nights
on
github
from
pull
requests
to
code
spaces.
Actions
to
codeql
and
everything
in
between
our
vision
is
to
build
the
home
for
all
developers,
whether
they're
working
on
a
fun
side,
project
or
building
mission.
A
Critical
software
for
fortune
500
developers
benefit
from
working
in
a
collaborative
community
built
around
code,
one
that
scales
with
each
new
project
allows
for
expertise,
sharing,
cross-team
problem
solving
and
code
and
workflow
reuse.
By
replicating
this
experience,
in-house
enterprises
can
benefit
from
the
practices
that
have
helped
the
open
source
community
grow
and
thrive,
call
it
intersourcing
or
digital
transformation.
A
It
boils
down
to
empowering
developers
to
work
the
way
they
work
best
collaboratively
and
free
from
unnecessary
distractions,
regardless
of
your
goals
for
this
year,
whether
it
be
to
improve
your
workflows
or
to
achieve
your
vision
of
digital
transformation,
investing
in
a
top-notch
developer,
experience
will
be
key
to
your
success.
One
that
embraces
the
developer.
Workflow
seamlessly
addresses
security
and
compliance
and
provides
access
to
a
scalable,
reliable
platform
built
for
developers,
we're
here
to
partner
with
you
to
accelerate
developer
velocity
and
deliver
world-class
software
and
we're
excited
for
what
the
future
holds
for
us
all.