►
From YouTube: Getting Started with GitHub for Startups
Description
GitHub for Startups provides access to GitHub Enterprise, a powerful platform you can use to manage your DevOps lifecycle. But what does that mean? What can you actually do on GitHub? How do you get started? And how can you get the most out of the tools available to your organization? Join us for a live session as we walk through the first steps with GitHub, an overview of how GitHub uses GitHub, and tips and best practices to have the best experience on GitHub.
00:00 - Introduction
02:25 - About GitHub
03:29 - DevOps Today
11:10 - Issues and Projects
16:10 - Repos
25:00 - GitHub for Mobile
27:45 - Actions
44:58 - Codespaces
51:58 - Copilot
57:32 - Security
#GitHub #DevOps #GithubActions #CI/CD
Stay up-to-date on all things GitHub by connecting with us.
YouTube: http://bit.ly/subgithub
Blog: https://github.blog
Twitter: https://twitter.com/github
LinkedIn: https://linkedin.com/company/github
Insider newsletter: https://resources.github.com/newsletter/
Instagram: https://www.instagram.com/github
TikTok: https://www.tiktok.com/@github
Facebook: http://fb.com/github
About GitHub
It’s where over 100 million developers create, share, and ship the best code possible. It’s a place for anyone, from anywhere, to build anything—it’s where the world builds software. https://github.com
A
A
Let
me
know
you're
out
there,
we're
gonna
get
started
in
about
one
minute
for
reference:
I'm,
John,
Peck,
I'm
senior
manager
of
developer
relations
team
here
in
the
Americas
for
GitHub
and
I
am
looking
forward
to
speaking
with
you
all
today
about
how
you
can
get
started
with
GitHub
for
startups
and
I'm
going
to
take
you
through
kind
of
end
to
end
everything
we
do.
Hi
George,
hi,
Kathleen,
hi,
Michael,
awesome
all
right.
We
got
a
few
people
out
there,
let's
get
rolling.
A
Let
me
start
with
this
I
I,
always
like
to
prove
to
people
that
I've
been
there.
So
I
woke
up
this
morning.
I
dropped
on
my
startup
gear.
This
is
from
algorithmia.
That
is
a
binary
tree.
It
doesn't
show
up
great
on
camera,
machine
learning,
hosting
startup.
That
I
was
part
of
oh
four
years
ago
and
and
earlier
sold
off
to
data
robot.
A
This
is
gift
starter,
you've,
probably
never
heard
of
us,
but
but
give
us
a
shout
if
you
have
show
up
together
shared
gift
sharing
that
one
unfortunately
died.
The
market
death
about
eight
years
ago
for
the
last,
almost
four
I've
been
here
with
GitHub
and
I'm,
having
a
great
time
not
just
because
I
love
what
I
do
but
I
love
what
we
make.
So
let
me
see
if
I
can
get
some
screen
sharing
going
here
and
we
can
start
talking
alrighty.
A
A
Hopefully
you
all
know
who
GitHub
is
now,
otherwise
you
probably
wouldn't
be
here,
but
we're
complete
devops
platform
end
to
end.
You
know
what
we
do
is
we
really
make
sure
to
get
every
parts
of
the
devops
platform
there
for
you,
I'll
talk
a
little
bit
about
what
those
are,
but
you're
not
joining
up
here.
Just
for
hey
I
need
some
place
to
put
my
code
really.
A
Our
objective
is
to
help
you
build
scale,
deliver
plan,
automate
all
the
things
everything
you
need
in
your
ecosystem
to
be
successful
at
developing
whatever
product
you
are
creating
right,
and
so
you
know
I'm
going
to
go
through
a
little
bit
of
like
okay.
What's
devops,
you
know:
what's
the
state
of
it
today,
pretty
brief,
don't
worry,
I
won't
get
super
historic
on
you,
hey
we've
got,
we've
got
AI
in
our
platform.
A
A
A
So
we're
going
to
talk
about
that
and
how
you
can
make
it
better
we're
going
to
talk
about
security
right
right
now.
What
we
know
is
that
flaws
in
applications,
the
actual
code,
the
actual
way
the
application
works
like
other
stuff,
Edge
security.
All
of
that
that
matters
right
but
flawless
in
the
applications
themselves,
are
still
the
primary
attack
Vector
for
people.
So
you
know
it's
really
important,
that
you
have
your
code
secure,
but
there's
an
average
in
in
large
industry
of
One
Security
team
member
for
every
100
developers.
A
That's
just
not
enough
people
to
keep
up
if
they're
doing
it
manually
and
I'm
sure
that
many
of
you
out
there
in
the
startup
world
do
not
have
a
dedicated
security
person.
Nor
do
you
want
to
spend
that
headcount
on
that,
so
I'm
going
to
try
and
solve
that
for
you
as
well,
and
then,
of
course,
there's
AI
right.
How
do
you
work
that
into
your
actual
software
development
in
a
way
that
is
safe,
that
works
for
your
entire
team?
A
That's
there
at
the
tip
of
your
fingers,
and
that
is
then
going
to
be
part
of
the
entire
development
process.
So
right
now
you
know
only
10
of
the
companies
have
really
figured
out
how
to
actually
use
AI
in
some
way
in
their
organizations.
For
most
it's
not
complete
and
then
to
end,
let's
delve
into
how
that
can
be
part
of
the
platform
itself
and
how
it
can
help
you
along
all
right.
So
yeah,
let's
skip
over
this,
you
want
to
hear
more
about
the
platform.
A
If
you
know,
I
tend
to
just
kind
of
go
90
miles
an
hour
once
I'm
in
the
flow
I
will
check
back
in
that
chat
room
if
you've
got
any
questions
at
any
point.
Just
type
them
out
know
that
I'm
going
to
flip
over
every
couple
of
minutes
to
try
and
see
what's
going
on,
and
if
and
if
you
have
any
questions
starting
out
with
collaboration
right.
What
do
we
know
about
using
GitHub
right?
You
know
GitHub
has
I
should
say
you
know.
Obviously,
okay,
maybe
not.
Obviously
we
serve
10
I.
A
Believe
at
this
point
no
50
of
the
of
the
Fortune
100.
We
serve
hundreds
of
millions
of
developers
out
there.
Of
course,
we
have
hundreds
of
millions
of
repos,
both
public
and
private.
So
we've
got
some
experience
right.
You
know
we're
the
number
one
devops
platform
in
the
world
and
satisfying
both
individual
developers
and
startups
and
mid-tier
and
large
Enterprise
right
across
the
board.
From
that
we
get
a
huge
amount
of
data
right.
A
A
We
see
inner
sourcing
becoming
a
thing
across
the
companies
that
we
work
with
and
that
really
improves
their
collaboration
capabilities.
Let
me
Define
that
for
you,
if
inner
sourcing
hasn't
come
up
as
a
term
in
your
company,
most
of
us
are
are
familiar
with
open
sourcing.
Open
sourcing.
Is
this
sort
of
standard
that
okay,
you
put
code
out
there
you
make
it
publicly
visible.
Other
people
are
gonna
come
along
and
they're
gonna
help
you
out
right
by
exposing
the
code
to
as
many
developers
as
possible.
A
So
obviously
you
don't
want
to
open
source
all
of
your
company
code.
You
might
there's
a
few
companies
out
there
that
are
able
to
do
that,
but
for
most
companies
we
talk
to
you
know
they
do
need
to
keep
most
of
their
code
within
their
own
walls.
But
the
big
thing
there
is
making
sure
that,
as
you
create
code-
and
this
applies
to
documentation-
it
applies
to
automation.
It
applies
to
all
other
parts
of
your
devops
process.
The
more
people
inside
your
company.
You
can
give
access
to
that.
A
They
can
spend
five
minutes
because
they're
an
expert
doing
XYZ
and
unblock
you
later
on
you're
going
to
do
the
same
for
them,
which
is
way
better
than
the
two
of
you
having
to
step
away
from
your
core
project
for
three
days
to
learn
a
new
technology
and,
as
you
start
having
that
kinds
of
interactions
inside
your
company,
we
find
that
this
can
more
than
double
the
development
rate
inside
any
given
company.
So,
okay,
probably
enough
on
that,
but
I'm
huge
on
intersourcing,
as
you
can
probably
tell,
and
making
sure
that
collaboration
can
occur
effectively.
A
A
You
can,
if
you
want,
there's
nothing
blocking
you
we'll
still
connect
to
other
project
management
tooling,
if
you've
got
something
already
on
board,
but
there's
a
freedom
to
being
inside
your
devops
platform,
you're
working
on
your
code,
you
have
an
issue
right.
There,
that's
related
to
what
you're
doing
and
when,
for
example,
you
commit
you
see
changes
on
that
issue.
Everything's
tracked,
you
can
easily
pull
in
other
people.
A
A
A
A
A
list
right,
you
had
some
kanban
boards
on
individual
project
by
project
basis,
but
those
were
stuck
to
the
one
individual
project
and
the
thing
we
realized
is
that
we
wanted
to
be
able
to
have
people
create
multiple
different
code
repositories
have
issues
relating
to
each
of
those
individual
code
repositories,
but
we
want
to
create
big
views
which
would
be
hey.
You
know
this
product,
we're
creating,
depends
on
a
b
c
and
d
different
repos,
and
they
relate
in
some
way.
A
We
even
wanted
to
be
able
to
create
projects
that
might
not
be
linked
to
a
particular
code
repository
right,
and
so
this
is
where
this
idea
of
what
we
initially
called
projects
V2.
Now
we
just
call
it
projects
new
GitHub
projects,
where
you
have
multiple
issues
on
a
big
board.
They
come
from
different
projects.
A
You
can
set
up
different
views
and
different
filters
on
them.
Each
of
these
different
tabs
is
working
across
the
same
set
of
issues
from
multiple
projects
or
just
individual
entries
that
exist
Standalone
on
here,
but
there
are
different
ways
of
looking
at
this
data,
so
I
might
be
looking
for
a
particular
label.
I
might
be
looking
for
something
that
is
assigned
to
me.
I.
Don't
think
I
have
anything
on
this
particular
project
right
now,
but
I
could
put
a
tag
in
there.
I
can
visualize
them
as
a
kanban
board.
A
I
can
visualize
them
as
a
table.
I
can
modify
the
columns.
I
can
create
custom
columns.
New
pick
lists,
Etc
I
can
do
time,
prediction
on
these
and
lay
it
all
out,
and
these
are
all
Dynamic
drag
and
drop
all
of
that
good
stuff.
So
I
can
actually
grab
one
of
these
I.
Don't
have
edit
access
on
this
one
move
things
around,
put
it
into
other
columns
all
of
the
stuff
you'd
expect
from
kanban
board.
So
basically,
what
you've
got
there
is
you've
got
a
complete
project
management
system
with
the
things
you'd
expect.
A
Kanban
boards,
tabular
views,
tagging,
custom
data
types,
timelines,
the
ability
to
even
customize
your
own
workflows
and
and
how
things
should
be
placed
when
they're
ingested.
All
of
that
and
it's
attached
to
your
GitHub
repos,
so
you
can
drop
into
any
one
of
these.
You
can
go
and
you
can
look
at
the
issue
itself.
A
Let's
talk
a
little
bit
about
the
repos
themselves
right
and
then
why
those
exist.
The
way
they
do.
What
you'll
notice
here
inside
the
repos
is
that
first
off
there's,
you
know
tabs
for
everything
up
here,
going
Beyond
just
the
code
itself,
because
what's
a
repo
yeah,
it
stores
code.
Of
course
it
also
stores
other
files.
It
stores,
documentation,
Etc,
but
functionally
a
GitHub
repository
is
the
core
for
the
entire
project,
right
it
links
to
the
projects
board
and
the
issues
that
it
might
be
attached
to.
It
has
the
code
and
documentation.
A
It
has
certain
special
things
like,
of
course,
if
you
create
a
readme,
that's
going
to
show
job
is
essentially
the
home
page.
If
you
will
of
the
repo
one
point
there.
As
you
start,
a
new
repository
in
order
to
improve
the
experience
of
your
collaborators
always
make
sure
you
have
a
really
good
readme
in
there
describing
what
the
project
is,
why
it
exists,
who
the
lead
developers
are
on
it
and
what
other
things
it
relates
to
and
just
link
them
out
here.
So
people
know
how
things
tie
together.
A
Of
course,
you
also
want
some
documentation
as
to
if
this
is
a
code
project,
how
you
set
it
up,
how
you
actually
install
it
Etc.
All
of
that
should
be
right
inside
your
readme
as
well.
Now
I'm
going
to
talk
a
little
bit
later
about
code
spaces
which
helps
you
not
have
to
do
all
those
manual
steps,
but
you
still
want
a
description
here
like
how
you
can
actually
get
started
with
this
right.
So
you've
got
all
that.
A
That's
all
great
the
by
the
way
in
this
in
issues
in
all
of
it,
it
supports
Rich
tagging.
It
supports
full
markdown
Etc,
the
rich
tagging
bit
though
I
really
want
to
hone
in
on.
If
I've
got
an
issue
that
I
create
and
I
at
mention,
somebody's
username
they're
going
to
get
a
notification
in
whatever
manner
they
have
set
up
the
notifications
to
preferentially
occur
for
most
people
that's
going
to
be
email,
although
we
do
have
other
mechanisms.
A
I'll
talk
about
those
in
a
second,
too
I
can
mention
somebody
inside
a
markdown
file
and
that's
going
to
link
to
their
profile
and
all
that
kind
of
stuff
and
I
can
do
things
like
in
issues.
I
can
mention
another
issue
by
hashtag.
It's
going
to
Rich
embed
the
title
of
it,
linkable
to
that
et
cetera.
So
that's
just
the
tip
of
the
iceberg,
but
everything
ties
together
inside
all
of
our
comments.
A
Markdown
Etc,
where
you
can
use
this
not
just
again
as
code
storage,
but
it's
also
a
free-flowing
way
of
getting
around
to
different
issues,
seeing
their
state
in
real
time,
different
people
notifying
folks,
Etc
right.
The
other
thing
is
that
in
the
repo
itself,
you've
got
the
code
itself.
Of
course
you
can
pull
that
down.
You've
got
that
link
to
the
issues,
but
you've
got
everything
else.
You've
got
pull
requests
for
example,
and
do
I
have
a
slide
on
pull
request.
I,
don't
so
I'll
just
talk
through
it.
A
A
pull
request
is
a
wrap
up
of
a
batch
of
changes
right
so
I
go
ahead.
I
change
a
bunch
of
code,
hopefully
on
a
branch
and
then
I
submit
that
set
of
changes
as
something
I
want.
Somebody
else
to
review,
that's
called
a
pull
request
right
and
I
will
mention
by
the
way
again
this
mindset
of
inner
source
of
creating
collaboration
across
your
company.
You
want
anybody
who
has
permission
to
you
know
see
this
code
is
a
trusted
member
of
your
company.
A
You
want
them
to
be
able
to
potentially
make
changes,
but
you
don't
want
them
to
be
able
to
force
those
changes
in
without
any
sort
of
review.
Now.
I,
don't
think
I
have
permission
to
change
the
settings
on
this
one.
So
I'll
show
you
on
a
different
repository.
We
have
what
is
called
Branch
protection
rules
and
we've
implemented
those
as
rule
sets.
A
That
pull
request
then
will
surface
itself
here
and
I've
got
a
bunch
here
that
actually
come
from
our
security,
tooling,
which
also
automatically
submits
pull
requests.
So
you
won't
see
any
real
names
on
this,
but
ignore
that
for
the
minute
and
what
that
pull
request
does
is
it
contains
a
bunch
of
commits
in
this
case
there's
just
one
change.
You
can
see
the
changes
that
occur
inside
the
code
right
there.
A
It
tells
you
what
checks
have
been
executed
on
it.
I'll
talk
about
Automation
in
our
next
step
and
how
that
works
in
here
I
can
walk
through
the
list
of
files.
I
can
see
the
Delta
between
them,
obviously
for
stuff
like
package
lock,
it's
not
automatically
going
to
show
me,
but
I
can
load
it
even
though
that's
going
to
be
large
and
then
I
have
the
option
to
review
these
changes
and
either
approve
them
and
let
them
go
through
if
I've
satisfied
the
number
of
minimum
approvers.
A
By
doing
that,
my
pull
requests
will
move
along
and
and
make
itself
ready
to
merge
or
even
Auto
merge
if
I've
set
it
up
to
do
that,
but
I
can
also
go
in
and
I
can
say
hey
this
isn't
good
enough.
Yet
there's
something
wrong
with
it.
I
want
to
request
changes,
describe
it
out
here
and
submit
that
note
right
inside
this
view.
A
The
developer,
who
submitted
that
pull
request,
is
going
to
get
a
notification
station
they're
going
to
see
what
I'm
talking
about
and
then
they're
going
to
come
back
in
and
they
are
going
to
go
ahead
and
fix
it.
I
can
even
I
won't
demonstrate
it
here.
I
can
even
put
in
requests
on
particular
line
level
changes
in
code
to
give
them
context.
So
I
can
say
right
here
this
section
of
code
that
yeah
it
needs
to
change.
You
know:
do
you
think
this
is
a
good
idea?
A
Instead,
the
experience
of
making
changes
becomes
continuous.
Where
I
do
the
work.
I
need
to
do.
I
create
a
pull
request,
I
name
other
people
to
come,
look
at
it
or
they
get
automatically
named
by
virtue
of
the
settings
in
the
repository
and
their
relationship
to
me
inside
the
organization
people
come
in.
They
look
at
that
code.
They
maybe
make
changes,
suggest
changes.
You
can
also
do
that.
A
We
all
put
our
approvals
in
and
the
thing
moves
on
forward,
and
that
is
such
a
better
experience,
because
it
means
that
I
as
a
developer,
I
can
stay
in
flow
on
the
things
I
want
to
work
on
I
put
together
a
bunch
of
changes,
I
submit
that
pull
request
and
I
move
on
to
my
next
task.
Sometime
later,
maybe
tomorrow,
maybe
later
in
the
day,
I
got
my
timing.
A
I
just
check
in
on
that
PR
and
I
see
how's
it
going
have
people
looked
at
it
or
I
get
Auto
notified
that
everybody's
approved
this
and
then,
when
it's
ready
either
it'll
automatically
update
if
I've
set
it
to
or
I,
can
put
in
manual
blocks.
I
could
even
manual
override,
if
I'm
an
admin
to
go
ahead
and
put
those
changes
in
and
it
flows
forward,
and
what
this
means
is
that
everything
inside
your
Repository
has
been
reviewed
by
other
people
has
been
tested.
A
I'll
talk
about
that
Automation
in
just
a
second
has
passed
is
good
to
go
and
it
all
occurs
in
the
background
for
me,
I
don't
have
to
think
about
it
or
waste
manual
blocking
time
to
get
that
work
done.
I
code
I
send
I,
go
to
something
else.
I
code
I
send
if
I'm
someone
whose
primary
job
is
to
review
other
people's
work.
I'm
getting
you
know
notifications
throughout
the
day
when
I
choose
to
go
into
my
email
and
take
a
look
at
them.
A
All
of
these
I
want
to
be
able
to
unblock
people
immediately
throughout
the
day.
So
I
can
get
out
of
a
meeting.
I
can
open
my
phone
there's
going
to
be
maybe
two
or
three
notifications
on
it.
From
the
GitHub
for
mobile
app
I
can
click
right
through
in
there
I
can
see
the
code
changes.
I
can
do
exactly
the
same
things.
A
I
just
showed
you
on
desktop,
except
I'm,
doing
it
in
the
palm
of
my
hand,
in
that
couple
of
minutes
before
I
go
on
to
my
next
meeting
right
now
to
some
people
that
sounds
terrible,
I've,
certainly
gotten
that
reaction,
in
which
case
just
don't
use
it.
You
know
go
and
use
the
desktop
experience,
but
other
people
will
really
love
this
because
it
means
they
don't
now
have
to
carve
out
a
separate
hour
in
their
day
to
go,
sit
down
and
review
everything
and
it
means
people
are
unblocked
faster.
A
A
So,
let's
move
on
from
core
repositories
and
inner
sourcing
and
let's
move
on
to
some
of
the
productivity
features
in
the
platform
right
we're
going
to
talk
about
automation,
we're
going
to
talk
about
code
spaces
if
you've
heard
of
it,
if
not
you're
in
for
a
good
treat.
What
do
these
bring
us
right?
What
do
we
think
about
as
we're
focusing
on
productivity
tools
as
GitHub
right
we're
thinking
about
how
you
can
deploy
faster,
how
you
can
have
the
option
of
a
ready-made
solution
for
anything?
A
A
If
you
don't
already
have
one
to
do
a
particular
thing,
for
example,
how
you
work
with
your
IDE,
how
you
deal
with
pulling
down
and
setting
up
your
projects,
see
that
in
a
second
and
of
course
you
know
what
was
the
ultimate
goal
of
these
right.
You
know
we
prioritize
reuse
over
creating
new
redundant
code.
We
saw
that
with
the
whole
intersourcing
Motif.
We
want
to
reduce
the
number
of
tasks
you
actually
have
to
do
by
automating.
All
of
the
things
that
can
be
automated
and
just
overall
make
you
more
efficient
right.
A
So
first
thing
I
want
to
talk
about
in
that
vein.
Is
GitHub
actions.
Now
going
back
to
our
view
here,
you
will
have
seen
at
the
top
that
there
is
a
folder
for
actions
in
here
and
what
actions
are
is
they
are
complete
available?
Automation
right
inside
your
repository
and
again
folks,
any
questions
go
ahead.
Hit
me
with
them
in
in
chat.
I,
know
I'm
going
a
million
miles
an
hour
here,
but
I
want
to
hear
it.
A
If
you
touch
on
any
of
these,
if
you've
had
problems
with
any
of
these
or
if
you
just
aren't
aware
of
this
yet
send
me
a
message
I'll
check
in
on
those
what
what
actions
does
is.
It
brings
complete
automation
right
into
the
repository
itself,
so
that
you
don't
have
to
step
away
to
another
tool
and
so
that
all
of
the
management
and
control
of
like
who
can
automate
what
Etc.
That
is
all
something
that
you
can
manage
inside
your
devops
system
itself.
So
you
don't
have
to
have
redundant
user
identities.
A
You
don't
have
to
do
things
like
send
an
email
to
the
only
person
who
has
access
to
your
CI
CD,
saying:
hey
I,
just
added
this
stuff.
Can
you
please
fix
it?
Instead,
automation
becomes
sort
of
in
flow
process.
Let
me
give
you
a
concrete
example
of
this,
which
I
think
is
an
experience
a
lot
of
us
have
had,
which
is
that
you
know
maybe
I'm
going
along
well
and
I've
got
a
good
test
suite
for
my
project.
I
know
just
having
a
good
test.
A
It's
going
to
test
everything
and
it's
going
to
make
sure
that
everything
passes
and
it's
good
to
go,
and
then
it's
going
to
actually
send
it
out
to
production
right
for
many
of
us
all
of
that
occurs
off
of
our
core
devops
platform.
So
our
experiences
we
code,
we
submit
the
changes.
You
know
we
work
with
others
to
resolve
any
conflicts
and
to
make
sure
we're
all
happy
with
the
code
release.
But
then
it
goes
over
the
CI
CD
and
then
we're
getting
maybe
emails.
Maybe
we
have
to
go
look
at
another
system.
A
Otherwise,
my
new
features
aren't
going
to
work
right
or
you
know,
I
wrote
the
test
and
the
test
ran
properly
locally,
but
because
there's
some
slight
configuration
change
in
my
CI
CD
in
terms
of
How
It's
actually
being
executed,
it
doesn't
work
in
the
CI,
CD
and
I've
got
to
go
back
and
forth
between
those
two
systems
and
figure
out.
Why?
Right?
We
want
that
all
to
be
a
single
integrated
process.
A
So
here's
what
you
are
able
to
do.
Github
actions
exists
right
inside
your
code,
repository
yes
as
a
tab,
but
also
as
a
set
of
files
inside
this
dot,
GitHub,
workflows,
folder.
So,
ultimately,
every
piece
of
automation
you
write
for
your
project
is
a
piece
of
code
right
code
is
configuration,
makes
everything
better
because
it's
easy
to
manage.
You
can
see
the
changes
to
the
automation
itself
right
next
to
your
code.
Changes
so
you
can
dip
them.
A
You
can
see
the
history
you
can
see
when
I
added
a
test
I
also
at
the
same
time
added
this
piece
in
the
automation
to
fire
that
test
properly
all
that
kind
of
good
stuff.
It
makes
postmortems
really
easy
because
I
can
say:
okay,
I've
got
an
existing
version
that
works
so
I
have
another
version
later
that
doesn't
work.
Give
me
the
diff
and
I
can
see
the
code
changes
right
next
to
the
environment.
Changes
right
next
to
the
automation,
changes
all
in
a
single
view,
so
I
can
be
like.
A
Oh,
it's
very
clear,
I
added
this
feature
here,
but
I
didn't
add
the
environment
variable
to
support
it
right
inside
that
diff
right.
So
it
makes
that
all
really
easy,
and
it
also
makes
it
easy
to
share
and
for
other
people
to
understand
and
work
with,
because
what
I
don't
want
is
I.
Don't
want
a
piece
of
automation
that
runs
either
on
my
own
machine
and
only
exists
there,
or
only
inside
separate
CI
CD
system,
where
other
people
can't
see
the
the
automation
itself.
What
you
want
is
something
exposed
and
available
to
everybody.
A
So
they
can
see
what's
actually
happening
inside
the
system,
so
if
they
need
to
make
changes
with
the
correct
permissions,
of
course,
they
can
suggest
those
changes
so
that
if
they
want
to
make
a
variant
of
their
own
for
some
other
project,
they
can
just
copy
that
configuration
move
it
into
theirs
and
adjust
it
as
necessary.
Right
so
code
is
config.
A
Is
is
wonderful,
right
comment
if
you
disagree
and
what
we
did
is
we
wanted
to
have
both
code
is
config
and
we
wanted
to
have
you
know
a
visual
UI
on
top
of
this,
but
have
it
all
contained
inside
the
repo,
so
you
can
have
as
many
different
configurations
as
you
want
as
many
different
pieces
of
automation.
We
call
them
workflows
inside
that
workflows,
folder.
They
can
have
different
triggers,
so
you
know
you
can
say.
When
should
this
occur,
it
can
occur.
A
Obviously,
on
code
changes,
you
know
whether
that's
a
change
to
a
file,
a
push,
whether
it's
a
pull
request
being
approved,
but
they
can
also
trigger
on
other
stuff
they
can
trigger
on
cron
they
can
trigger
on
web
hooks.
They
can
trigger
on
other
actions
being
completed.
So
you
can
chain
things
they
can
trigger
on
a
change
to
an
issue
state,
so
I
move
an
issue
to
done
and
that
fires
off
the
thing
that's
going
to
check
and
push
out
my
code,
so
you've
got
all
kinds
of
different
variety
of
triggers.
A
You've
got
built-in
Runners,
which
are
automatic,
Cloud
scaled
Runners
that
we
provide,
for
you,
know
Linux
for
Mac
OS
for
Windows,
most
recent
version
as
well
as
historic
versions,
so
you
can
pin
it
to
the
one
you
want.
You
have
built-in
secrets,
so
you
don't
want
to
put
your
secrets.
Obviously,
inside
your
automation,
code
itself,
those
are
configured
in
your
repository
for
humans.
They
are
right
once
and
then
you
can
never
read
it
again.
A
Of
course,
unless
you
save
it
somewhere
in
your
password
manager
for
the
automation,
it
can
automatically
pull
those
named
secrets
and
embed
them
into
the
workflow
they're
automatically
redacted
from
logs
and
all
that
kind
of
stuff
for
security
purposes.
Right
and
then
you
can
have
you
know
whatever
jobs
you
want
and
these
jobs
are.
A
You
know
a
combination
usually
of
scripts.
You're,
writing
yourself
and
pieces
of
automation.
You
pull
from
elsewhere
right,
where
is
elsewhere.
If
you
go
and
you
search
for
GitHub
actions
Marketplace,
you
will
find
out
there.
What
are
we
up
to
today?
19
802
results.
This
was
19
760
last
night
when
I
checked
it.
If
I
can
recall
correctly.
So
this
is
both
the
largest
ecosystem
of
Open
Source
automation,
components,
but
also
the
fastest
growing
ecosystem.
We
add
somewhere
between
three
and
five
hundred
actions
every
single
month
into
this
ecosystem.
A
A
Okay,
what
you're
going
to
see
is
you're
going
to
see
inside
this
Marketplace
and
Marketplace
is
kind
of
a
weird
term,
because
these
are
all
free,
like
you,
don't
have
to
pay
a
way
to
get
that
source
code
through
open
source
right,
but
it's
Marketplace
in
the
sense
that
lots
of
people
can
contribute
and
anybody
can
consume
so
who
contributes
you've
got
first
parties
you've
got
AWS
itself,
actually
contributing.
You
know
the
eks
on
Far
gate
action,
for
example.
A
You
can
see
that
nice
little
verified
check
mark
because
there's
somebody
we
know
and
trust
you're
also
going
to
get
people.
You
know
individual
developers
and
separate
development
groups
contributing
stuff
as
well,
and
you
know
those
don't
always
have
the
check
mark.
That's
one
of
the
ways
you
can
visually
see
you
the
difference,
but
what
is
common
between
all
of
those
is
I
can
punch
into
any
of
these
I
can
see
how
I
would
use
this
action
and
without
going
into
technical
detail.
A
Most
of
these
are
more
or
less
you
know
copy
and
paste
if
I
want
to
deploy
to.
You
know:
AWS
fargate
I'm,
just
going
to
literally
copy
this
step
and
I'm
going
to
paste
it
into
my
code
in
the
deploy
phase
of
that
workflow
I'm,
going
to
configure
a
couple
of
Secrets,
as
mentioned
inside
my
repository,
but
otherwise
what
this
is
going
to
do
is
it's
going
to
you
know
pick
up
my
container,
send
it
out
to
fargate,
get
it
hosted.
A
You
know
using
the
the
IAM
that
I've
defined
right,
so
I
can
see
basic
stuff
like
that,
but
I
can
also
see
you
know
how
many
other
people
are
using
this.
How
many
contributors
are
there?
Usually
this
is
you
know
a
half
dozen
to
a
dozen
or
more.
In
this
particular
case,
AWS
uses
a
single
Consolidated
account
for
deploying
it.
So
you
see
you
know
the
one,
but
you
can
also
then
drop
down
into
the
repository
itself
that
it
comes
from.
A
But
I
will
say
personally
my
experience
with
that
has
been
bad.
Github
actions
changes
this
game
entirely
because
every
single
action
out
there,
every
single
automation,
component
I,
can
drill
down
to
the
open
source.
Repo
I
can
again
see
who's
contributing
to
it.
I
can
drop
an
issue
onto
that
project.
If
I
have
a
problem
with
it,
I
can
even
Fork.
It
modify
the
code
in
some
way
that
I
think
fixes
a
bug
or
increases
the
functionality,
and
then
I
can
submit
a
pull
request
to
that
team,
because
it's
an
open
source
repo
right.
A
That
team
can
then
see
the
pull
requests,
make
any
minor
changes
to
make
it
functional
the
way
they
want
it
to
be,
and
then
merge
that
into
their
project.
What
does
that
mean
for
you
as
a
software
development
team
right?
It
means
that
you
are
no
longer
going
out
finding
components
wondering
whether
they're
going
to
die
wondering
whether
we're
well
supported
finding
a
bug
saying
you
know
what
we
either
can't
fix
this
bug,
or
in
many
cases
we're
gonna.
A
If
we
have
access
to
the
source
code,
make
our
own
internal
copy,
modify
it
to
work
and
then
forevermore
we're
stuck
with
these
two
different
versions.
The
public
known
version
and
the
one
that
we're
internally
supporting
over
time
that
builds
up-
and
you
have
a
lot
of
your
engineering
time,
spent
supporting
these
variations
of
the
automation,
components
that
you've
created
or
just
writing
your
own
and
having
to
support
those
right.
The
experience
with
GitHub
actions
is
that
you
write
your
core
workflow.
A
What
steps
are
going
to
occur
where
you
can
drop
in
your
own
scripts,
where
you
need
to
there's
certain
things
you're
going
to
do
that
are
custom,
but
then,
when
you're
doing
those
standard
things
attaching
a
test
harness
and
running
it,
you
know
building
out
a
container
going
and
deploying
something
to
a
particular
service
provider.
Etc
I'm,
just
going
out
to
the
actions,
Marketplace
I'm,
finding
the
components
I
need
I'm,
dropping
those
in
and
I'm
very
quickly
assembling
a
complete
workflow.
A
That
does
all
the
things
I
need,
but
relies
on
this
open
source
community
that
code's
not
going
away,
and
if
there
is
a
problem
with
it,
I
just
let
somebody
know
and
most
of
the
time
they're
going
to
come
along
and
they're
going
to
fix
it
and
I'm
just
going
to
update
to
the
new
version.
So
this
is
a
beautiful
experience.
A
A
Let's
see
what
the
launcher
update
looks
like
I.
Think
most
of
these
are
going
to
be
one
step,
so
the
visualizations
aren't
actually
going
to
be
very
interesting.
But
if
I
had
multiple
jobs
in
here,
they'd
be
visually
chained,
I
would
see
the
interaction
between
them.
I
would
see
Branch
points
Etc
if
I'm
running
on
multiple
workers.
At
the
same
time,
Etc
I
can
drop
into
any
one
of
these
and
see
what
actually
occurred
inside
of
it,
this
one's
too
old,
but
we're
in
a
more
recent
execution.
A
What
I
would
see
here
is.
Yes
there
we
go
a
complete
log
of
everything
that
happened.
I've
got
stuff,
that's
coming
both
from
my
components:
I've
dropped
in
as
well
as
my
own
scripts,
echoing
data
back,
so
I
can
go
down
here
and
I
can
really
drill
down
to
exactly
what's
occurring
at
every
step
in
this
process.
I
can
also
do
things
like
rerun
all
the
jobs
if,
for
some
reason
it
failed
because
of
an
external
State
problem,
I
can
just
say:
go
ahead
and
re-execute
it.
A
We
even
have
the
option
to
up
the
debug
level
when
we
rerun.
So
what
does
that
do
for
me
right
A,
lot
of
the
time
when
I
have
some
piece
of
automation
execute
and
it
fails.
I
have
to
go
stand
up
a
mock
environment
for
that
or
delve
deep
into
the
CI
CD
system
to
figure
out
exactly
what
the
problems
were
and
that
again
is
thrashing
between
different
systems.
It
makes
my
life
hard
by
being
able
to
execute
with
debug
when
I
rerun
a
job
right
inside
the
built-in
automation
system.
A
I
get
deeper
logging,
I'm
able
to
see
things
that
I
wouldn't,
except
maybe
by
going
back
to
an
IDE
and
now
in
many
cases
I
can
understand
what
the
problem
is
and
fix
it
immediately
without
even
having
to
step
into
my
IDE
I
can
just
look
through
the
Now
new
debug
log
find
Environment
variables
missing
whatever
it
is,
go
ahead.
Add
those
in
and
re-execute
I'm
good
to
go
right,
so
super
smooth
all
right,
so
speaking
of
Ides
I
promise
you
I
would
get
to
this
other
thing:
that's
super
cool!
A
You
know
what
let
me
step
back,
because
I
did
forget
to
mention
one
thing:
I
told
you
how
you
can
add
automation,
obviously
we're
going
to
do
that
for
all
the
standard
stuff
we're
going
to
do
that
for
integrating
our
standard
cicd
we're
closing
our
deployments
going
Etc,
but
on
the
integration
end
I
did
want
to
mention
one
thing:
you'll
see
down
here:
there's
the
subjects
haven't
completed.
Yet
when
I'm
looking
at
a
pull
request.
So
again,
I've
submitted
a
bunch
of
code
I've
racked
up
into
a
pull
request.
A
A
So,
for
those
things
that
are
set
to
trigger
when
I
make
a
code,
change
and
I
can
configure
inside
repo
or
inside
an
org
hey
these
things
always
have
to
run
on
every
PR
right,
so
I
can
say:
you're,
basically
not
allowed
to
move
forward
with
a
set
of
code
changes
unless,
like
the
security
scan,
is
run.
This
testing
Suite
whatever
it
is,
I
need
right
those
surface
themselves
right
inside
the
pull
request.
So
again,
this
is
our
hub
for
collaboration
on
a
set
of
changes.
A
I've
got
people
reacting
and
saying
this
code
good
to
go
in
the
single
pane
of
glass.
I've
also
got
my
automation,
reacting
and
saying:
hey
these
checks
didn't
run,
or
these
checks
failed.
Etc
I
can
go
ahead
and
I
can
look
at
the
details
of
any
of
those
right
inside
there
again.
This
one
is
too
old
and
I
I've
got
my
caches
falling
out,
but
I
can
see
what
the
results
of
it
were
and
why
it
did
or
didn't
pass
and
I
can
set
up
blocks.
A
So
I
can
say
things
like
okay,
this
particular
automation,
this
particular
set
of
tests.
This
is
optional.
You
can
still
push
the
pull
request
through.
It's
just
informational
I
could
say
on
other
ones,
hard
block
if
this
set
of
tests
doesn't
pass.
You
are
not
allowed
to
submit
this.
This
pull
request
and
move
it
forward.
I'm
an
admin
here
so
I
have
override
capability.
A
You
can
assign
that
as
you
want,
but
for
General
developers
who
don't
have
the
admin
privilege
what
they'll
see
at
that
point
is
they've
got
to
go
back
and
resolve
that
before
it
can
move
forward.
Why
is
that
so
powerful,
because
now
you're
not
worried
about
things
leaking
into
your
production
systems
without
having
gone
through
all
of
the
possible
Pro,
the
required
test
procedures
right
and
they're
visible
in
the
same
pane
of
glass
that
you're
going
to
do
all
of
your
normal
work
anyway.
So
it's
not
thrashing
for
you.
A
You're
just
again
submitted
my
code
created
a
pull
request.
I
get
back
notifications.
Other
people
approve
it.
I
click
through
that
one
PR
I
can
see
all
their
reactions
to
it.
I
can
also
see
what
the
automation
has
done
in
reaction
to
that
and
I
have
a
single
place
where
I
can
continue
to
move
forward
that
and
get
it
out
into
the
world
Okay.
So
we've
talked
a
lot
about
automation.
A
What
do
I
mean
by
that
for
most
of
us
when
we
go
to
start
working
on
our
code?
What
we're
doing
is
we're
pulling
this
down
locally
right,
we're
going
to
clone
the
code
down
to
our
machine,
we're
going
to
open
up
our
local
IDE,
whatever
our
favorite
is,
and
we're
going
to
start
working
on
that
code.
But
it's
never
that
simple
right!
It's
never
just
pulled
down
the
code
and
start
working
right.
A
If
you've
worked
on
a
significant
project,
you
know
that
that
takes
minutes,
and
then
industry
averages
here
it
takes
between
two
hours
and
two
days
on
average
to
go
from
I've
got
the
code
to
I've
done
all
the
things
I
need
to
do
to
really
start
developing.
What
do
I
mean
by
that
I
mean
setting
up
your
environment
variables
I
mean
separating
your
Python
2.7
virtual
environment,
from
your
python,
3.8
virtual
environment,
making
sure
they
don't
Collide
walking
through
all
those
manual
steps
of
configuring.
A
The
background
processes
of
the
test
engines,
everything
that
needs
to
be
local,
the
local
server
instance
so
that
I
can
properly
code
and
see
the
results
and
iterate
on
what
I'm
doing
right.
So
that's
a
huge
blocker
Plus.
It
means
I'm
locked
to
individual
machines.
Right
I
set
up
my
laptop
to
work
with
this
project
and
I've
done
all
that
work,
and
now,
if
later
in
the
day
next
week
over
the
weekend,
an
emergency
occurs.
If
I
don't
have
that
physical
machine
with
me,
I
can't
actually
work,
because
the
setup
time
is
too
long.
A
I
wanted
to
eliminate
these
problems
right.
So
we
created
this
thing
called
code
spaces
with
code
spaces.
You
can
be
in
the
repo
itself
and
you
can
say
instead
of
running
locally
I'm,
going
to
run
with
a
code.
Space
I
can
create
a
new
one.
I
happen
to
have
one
here:
that's
that's
hibernated,
so
I'm
going
to
restore
that
you
can
think
of
code
spaces
like
remote
machines,
in
the
sense
that
I
can
stop
and
start
code
spaces,
and
it's
very
much
akin
to
closing
my
laptop
right.
A
I
can
be
doing
work
in
here
and
I
can
stop
the
code.
Space
and
I
can
come
back
two
weeks
later
and
my
cursor
is
right
where
it
was
working
on
the
same
thing.
It
was
now
for
most
projects,
this
spins
up
in
less
than
15
seconds,
even
for
a
fresh
one.
If
it's
configured
properly,
we
support
something
called
pre-builds
where
you
can
set
it
up.
So
there's
always
a
code
space
ready
to
go
with
the
latest
changes
inside
it.
What
do
I
get
with
the
code
space?
A
The
default
experience
is
vs
code
inside
the
web
browser.
This
is
fully
featured
vs
code
IDE.
It
just
happens
to
be
running
inside
by
the
web
browser
container,
but
that's
not
the
only
experience
if
you're
using
local
vs
code,
if
you're,
using
using
local
visual
studio,
if
you're
using
jetbrains,
if
you're
using
Vim,
you
can
still
take
advantage
of
code
spaces.
A
The
exact
experience
on
each
one
is
a
little
bit
different,
but
ultimately,
what
you
get
is
you
get
your
IDE
and
your
IDE
as
it
makes
changes
is
making
changes
on
a
remotely
executing
container,
which
has
the
whole
project
set
up
in
it.
Now.
What
do
I
mean
by
setup
I
mean
when
I
hit
that
button?
It
didn't
just
do
the
code,
it
did
all
of
the
things
necessary
to
set
up
this
project.
A
I
talked
about
code
is
config
earlier
and
why
it's
so
amazing
right,
there's
this
Dev
container
folder
and
it
contains
Docker
file
in
the
dev
container
Json,
which
are
all
the
things
about
this
project
that
need
to
happen
to
get
a
running,
IDE
right
and
development
environment.
So
you
know
that's
everything
from
hey.
A
What
terminal
settings
we
want
to
what
extensions
are
are
in
the
browser
to
you
know
what
ports
are
going
to
be
open
and
available
for
me,
the
local
loopback
test
on
all
of
that
stuff,
and
this
merges
in
with
your
own
personal
preferences.
So
if
I
have
a
particular
color
scheme
or
that
sort
of
thing
that
I
want
I
can
configure
that
as
well.
That'll
be
for
me
and
it'll
emerge
in
with
the
project
Dev
container
to
actually
stand
up
my
code
space
properly
when
I'm,
actually
in
there.
A
A
Etc
I
go
ahead.
I
code,
I
can
start
up.
My
test
server
or
I
can
start
up
in
debug
mode.
It's
going
to
open
up
a
separate
tab
if
I'm
working
on
a
web
application
and
show
me
that
web
view
of
the
test
server
running
inside
the
container,
so
I
can
iterate
go
back
and
forth,
see
my
changes
in
the
application
itself.
A
So
this
is
immensely
efficient,
gets
me
boom
right
into
developing
and
actually
I'm
going
to
go
back
on
what
I
said,
because
I'm
here
and
I
want
to
save
time.
I'll
do
security
last,
because
I
want
to
show
you
copilot
right.
So
what
is
Copilot
copilot
is
something
that
sits
alongside
you.
It's
it's
an
AI
that
really
is
able
to
hone
in
on
what
you're
trying
to
do.
Give
you
full
code
blocks
suggestions
and
do
it
in
a
secure
way,
right,
co-fil
it
for
business
or
our
primary
business.
A
Where
you,
you
write
some
code
and
you
run
it
through
an
AI
and
then
the
AI
ends
up
getting
retrained
on
your
code
and
then
your
code
shows
up
in
somebody
else's
suggestion
somewhere
right.
There
have
been
some
historic
events
where
that's
not
so
good.
We
make
sure
that
doesn't
happen
by
giving
you
your
own
ephemeral
prediction
environment
and
then
deleting
it
right
after
so
your
code
that
you
pass
in
to
the
AI
to
give
you
suggestions,
doesn't
go
anywhere,
doesn't
get
used
for
retraining,
doesn't
leak
into
other
people's
suggestions.
A
All
of
that
so
you've
got
speed
of
AI
and
you've
got
the
security
behind
it.
Knowing
that
your
code
isn't
being
shared
with
other
people
right
mechanically,
what
does
it
do?
What
does
this
look
like
to
a
developer?
Well,
I'm
sitting
there
and
I
got
my
code.
You
know
I
got.
This
is
a
it's
a
silly
little
thing
that
shows
a
bunch
of
IQs
and
images
right,
okay,
but
ultimately,
I
can
see.
A
There's
a
bunch
of
you
know,
post
endpoints
in
here,
and
each
of
these
shows
you
know
a
particular
haiku,
for
example,
so
get
Haiku
by
ID
does
pretty
much
what
you
would
expect.
You
know
if
you
go
to
the
web
app
and
you
say,
slash
22,
it's
going
to
show
you
Haiku
number
22
and
it's
going
to
show
you
the
image
and
and
the
icon.
Next
to
it
right.
I
won't
bother
spinning
it
up
right
now,
because
I
want
to
show
you
what
compiler
does
I
decided.
A
A
Usually
it's
giving
me
complete
code
blocks
in
fact
yep.
Here
we
go
so
it's
suggested
an
entire
code
block
right
here
for
how
I
might
satisfy
that
problem.
Some
interesting
things
to
pick
out
about
this
right.
First
off,
it's
aware
of
the
other
functions
I've
already
defined
here,
so
it
sees
my
pattern.
It
sees
how
I'm
doing
it
right.
It
sees,
for
example,
that
I'm
generally
using
the
index
template
to
render
this,
so
it
assumes
I
probably
want
to
use
the
index
template
again.
A
It
sees
that
the
index
template
takes
an
array,
not
just
a
singular
item
right
so
even
though
getting
a
random
Haiku
is
going
to
return.
Presumably
one
Haiku.
It
embeds
that
inside
an
array
for
me
to
satisfy
what
it
knows
to
be
the
pattern.
Sorry
right
here
that
the
template
is
going
to
expect
by
default.
It's
using
math.floor
but
I
want
to
show
you
something
else,
really
cool
about
how
it
deals
with
context.
Let's
say:
I
have
a
random
library
of
some
Port
sort
and
I
import.
It.
A
Okay,
so
now
we
have
a
library
imported
called
random
right.
That's
all
it
knows
from
the
context,
but
I'll
say
that
same
thing
again
get
a
random
Haiku
and
when
it
makes
the
prediction
this
time.
Yes,
it
saw
that
I
had
a
library
called
random,
and
so
it
made
some
assumptions
and
said:
hey.
You
probably
want
to
use
that
Library
instead
of
math.random.
Otherwise,
why
would
you
have
imported
it?
So
it
actually
changes
its
suggestions.
Contextually,
based
on
what
you
see.
That's
core
copilot,
it's
amazing!
It
will
double
your
development
speed.
A
A
You
know
remembering
a
basic
pattern
and
that
sort
of
thing
it
does
that
for
me,
I'm
still
responsible
for
the
high
level
architecture
and
thinking
my
job
is
not
going
away
because
as
a
developer,
I
need
to
shape
how
things
are
working
together
and
I
need
to
write
some
of
that
custom
code
and
that
what
it
creates.
But
it's
taking
the
boring
bits
away.
A
So
I
have
to
be
searching
the
web
and
cutting
and
pasting
I
just
get
the
audit
suggestions
that
it
thinks
will
be
relevant
and
then
I
modify
those
to
fit
my
needs
by
the
way.
It's
also
making
sure,
as
it
does,
that
none
of
this
is
cut
and
paste
literal
duplication
of
anything
out
there.
These
are
all
novel
suggestions.
We
redact
the
training
Set
from
the
suggestion
set.
So
even
it
comes
up
with
an
incidental,
exact
match.
Generally
speaking,
it's
not
going
to
show
it
below
a
certain
minimum.
A
Like
hello
world
is
always
hello
world
right,
but
otherwise
it's
giving
you
new
stuff.
So
you
don't
have
to
worry
about
accidentally
duping
somebody
else's
code.
Now
there
is
an
evolution
of
this,
which
I
won't
have
time
to
fully
show
you
but
experimental.
This
is
in
beta
right
now,
publicly
technically
at
feature
preview,
I
think
so
not
the
same
set
of
legal
guarantees
and
all
that
kind
of
stuff,
but
wonderful
to
play
with
look
for
copilot
chat.
A
It's
also
an
extension
for
vs
code
with
copilot
chat,
I
get
an
interactive
interface,
so
I
can
select
a
bunch
of
code,
for
example,
and
say
make
this
in
fact,
I
think
we
have
a
hot
key
for
it.
Secure
no
okay,
I
can
say
something
like
make
this
more
secure
to
analyze.
That
code,
that
I've
selected
and
it's
going
to
say.
A
Okay
here,
is
what
you
can
do
to
protect
against
cross-site
scripting,
a
bunch
of
other
things
right,
so
I
can
understand
some
of
the
security
problems
that
might
be
here,
and
it's
giving
me
in
fact
a
full
rewrite
of
the
application.
With
the
security
options
in
place.
I
can
say
something
like
explain
if
I
just
don't
know
what
this
code
does.
Maybe
it's
in
the
language
I,
don't
read:
maybe
it's
somebody
else's
thing
that
I
just
want
to
know
it's
going
to
give
me
a
full
description.
A
I
have
taken
these
and
cut
and
pasted
them
directly
into
documentation.
They're
often
so
good,
and
you
know,
I
can
even
do
things
like
say,
create
a
test
Suite
and
because
this
is,
you
know,
half
of
our
job
as
developers
testing
what
we
create
right
and
it's
going
to
give
me
a
basic.
You
know
test
harness
it's
bringing
in
super
test.
It's
going
to
create
some
suggested
tests.
A
A
A
Okay-
and
that
brings
us
to
the
very
last
thing-
I
will
talk
about,
and
here
I'm
not
going
to
do
so.
Much
live
live
demo
because
we
just
don't
have
time
but
security
right
throughout.
All
of
this,
you
want
to
make
sure
that
the
code
you're
creating
doesn't
have
security
flaws,
as
it
goes
out
the
door
right.
So
what
are
the
security
things?
And
what's
our?
What's
our
mindset
on
how
you
do
security
right?
The
most
important
thing
I
want
you
to
take
away
from
this.
A
A
We
want
to
attack
the
security
aspect
right
at
the
point
of
development,
which
is
why
Dependable
is
sitting
there
and
it's
analyzing,
as
you
submit
code,
depend
about
focuses
on
the
safety
of
the
modules
that
you
bring
in
the
packages
you
bring
in
from
other
places,
because
that's
where
a
lot
of
security
involvabilities
come
from
and
a
lot
of
them
are
really
simple.
It's
just
hey.
This
particular
version
of
a
package
I
brought
in
is
not
secured.
A
A
Let
me
know
if
it
knows
what
the
compatibility
level
is
often
we
can
actually
give
you
a
percentage
there,
which
is
like
think
of
it
as
how
what's
the
chances
that,
if
I
make
this
change,
I'm
going
to
have
to
go
and
refactor
other
code,
and
if
it
has
a
high
compatibility
score,
which
is
one
of
the
things
we
get
from
all
the
public
data
that
we're
allowed
to
see
with
our
public
repos.
You
know
you
can
click
the
button
and
you
can
just
accept
the
security
change.
Your
application's
secure
from
day
Zero.
A
Now,
you're,
not
gonna,
get
a
security
review
later
kicking
it
back
and
you
can
move
forward
with
your
day.
It's
just
that
simple
and
then
the
last
thing
I
will
say
on
security.
Is
we
do
have
an
advanced
Security
package,
which
is
an
add-on,
but
this
goes
into
the
other
things
Beyond,
just
the
dependencies
you're
using
it
goes
into.
Are
there
no?
A
Are
there
any
security
tokens
anywhere
in
your
code
that
need
to
be
redacted,
it'll,
actually
block
security
tokens
from
getting
off
your
physical
box,
which
is
great,
and
it
also
will
analyze
novel
code.
So
Advanced
security
can
actually
look
at
the
code.
You
just
wrote
and
submitted
analyze
it
from
an
executional
standpoint.
Tracing
execution
pass
through
and
say
things
like.
Does
this
have
the
potential
for
SQL
injection?
Does
it
have
any
code?
A
Loops
any
circular
object
dependencies
that
sort
of
thing
and
let
you
know
right
away
so
that
you
can
again
fix
that
within
a
day
before
it
ever
gets
to
the
end
of
the
Sprint.
All
right,
that's
about
all
the
things
I've
got
time
for,
but
I
hope
you've
had
a
great
time.
I
hope
you've
learned
some
things
today,
I'm
going
to
stick
around
for
a
couple
of
minutes
just
in
case
there's
any
final
questions,
but
otherwise
go
forth.
Be
awesome.
Developers
enjoy
the
power
which
is
GitHub
and
definitely
Circle
back
with
us.