GitHub GitHub Galaxy 2023, 11 Apr 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Increasing developer velocity with GitHub Enterprise

Description

Increase developer velocity, redefine collaboration, and secure your code by automating entire workflows with GitHub Enterprise. Learn from Glenn Wester, Principal Solutions Engineer at GitHub, and Sarah Khalife, Principal Solutions Engineer at GitHub, about how to reduce context switching and lower costs in your organization. You’ll leave this session with an understanding of how leveraging innersourcing, AI, and GitHub’s developer-first tooling across your tech stack can give teams better workflows and streamlined processes.

Stay up-to-date on all things GitHub by subscribing and following us at:
YouTube: http://bit.ly/subgithub
Blog: https://github.blog
Twitter: https://twitter.com/github
LinkedIn: https://linkedin.com/company/github
Instagram: https://www.instagram.com/github
TikTok: https://www.tiktok.com/@github
Facebook: http://fb.com/github

About GitHub
It’s where over 100 million developers create, share, and ship the best code possible. It’s a place for anyone, from anywhere, to build anything—it’s where the world builds software. https://github.com

A

All right, ladies and gentlemen, thanks so much and welcome to the final day final hour, I, think of Galaxy 2023, so happy to have you here. um So I am uh happy to present to you all our final session increasing developer velocity with GitHub Enterprise. We've got some great folks here. Gonna share some tips and tricks and tools by which you can get your developer. Teams up to speed, moving faster um I am John, Peck and uh Glenn.

A

If you don't mind going forward a couple of slides here, we're going to jump into some housekeeping things, so I'm manager of Enterprise advocacy here at GitHub in the Americas uh about 25 years as a developer and I'll be helping out today by monitoring this chat between our two Distinguished Principal Solutions Engineers, but before we get to them a few housekeeping tips. Just things to know, there is in front of you a chat option, go ahead and drop those questions in there drop them in the chat or drop them in the Q.

A

A we'll pull them out, we'll try and make them uh at stop points. In the presentation surface, the most important questions answer everything else that we can't get to live in the chat if we can get to it. I also want to point out: you should have on your screen somewhere a request, a demo or schedule a meeting with us option.

A

So if there's something you want to go deep with us on that, we haven't talked about here, you just want to get more involved and GitHub Enterprise go ahead and whack that button and I'll make sure that somebody gets back to you all right with no further Ado I'd like to pass off the mic to Sarah Khalifa. Take it away, hey.

B

Everybody thanks John nice to meet you all I'm Sarah khalifam, the Enterprise Solutions engineer from uh I'm in California right now, so I'm in San Francisco. Let us know where you are all coming from in the chat would love to hear from everybody from all over the place. I am a Solutions engineer.

B

I've been at GitHub for about three and a half years previous to that I was a software engineer, working on cloud platform deployments microservices, so I can speak to a lot of the different components that we'll be chatting about today and then my awesome background that I. Actually it's a really I love. This photo because I actually took this photo and it's from an island in Greece and Rhodes uh and I was I was lucky enough to be there on a peaceful beautiful day and there wasn't any many tourists.

B

So I was lucky enough to take this beautiful picture and I'll pass it over to Glenn.

C

Cool. Thank you, sir I'm Gonna Take Back Control over here start sharing my screen again.

A

Love that screen Inception.

C

It's a live demo, hey everybody! uh We are super excited to have you here. um My name is Glenn and yes, Sarah and I are sitting next to each other, presenting from GitHub HQ in San Francisco. um If you're ever in San Francisco drop us a line. We love to have you at our office.

C

We have a pretty awesome office here, yeah, so I'm in Solutions engineer on the Enterprise team here in the west, I had the pleasure of working with our largest customers uh companies who I deeply admire some of the largest companies in the world, a lot of innovation happening in this area, yeah and then just a little bit about me. I've been working at GitHub. Now for about three and a half going on four years, it's been a pretty wild ride since 2019.. uh The volcano that you see in the background.

C

So while I'm not on the computer, I like to do adventurous things and um that's not movie Magic, there that's um 1200 feet from the volcano. So back in 2021, that's the gelding, a dollar eruption in Iceland and if we have any Icelandic Icelandic folks on the call right now, I probably uh didn't pronounce that correctly. But uh if you want to go there right now by the way that volcano is dormant, so you'll have to wait for another earthquake and for that to re-erupt, but I highly recommend it.

C

And after that I like cycling and mountain biking and running and doing all that fun stuff. So we have an exciting agenda for you today. The name of the talk is accelerating your development with GitHub Enterprise, and we have a lot of exciting things to share with you. Github has changed significantly since even I joined in 2019 and we're building a lot of excellent products here for you to use and to make you more productive. So we segmented this into three different buckets here of developer productivity, with copilot, developer efficiency, with actions and then Wesley.

C

You know, security is uh Forefront for everybody, our Advanced security, offering so without further Ado. Let's jump right into it, so I just want to remind folks that it's the most exciting time for GitHub today we're larger than ever and in January we announced that we are now over 100 million developers, and that number is probably small. Now it's probably way way bigger and we work with pretty much every company on Earth, whether it be for private source code.

C

You know that they're doing behind the firewall, with our Enterprise products, or also two for their open source program office or their open source source code. In some capacity we work with pretty much every company and it's you know extremely exciting.

C

So, first, what we're going to tackle is developer productivity. What we want to do is that we want to accelerate software development developers today are tasks for doing more than ever and there's fewer times to. Actually, you know do what you're paid to do, which is developing software, so we want to make the time that you do spend developing software as efficient as we possibly can, and that's exactly where our mind's at so I know. This is like a Hot Topic right now.

C

There's a lot of excitement, um even though uh every you know every demo I give might be touching other parts of our product. Everybody always asks me about co-pilot and if you read Twitter or if you read Hacker, News or read anything you're going to be hearing about it. So let's talk about what this is and how this can help you so simply stated. Github copile is an extension that weighs within vs code or neovim or Visual Studio desktop or the jetbrains Ides.

C

What we've done is that we partner with openai on a model called codex codex, is a derivative of GPT that we specifically trained on GitHub source code. So all the public source code that exists within GitHub is what we train this model on and what it helps you do is that it's your AI pair programmer so think about like intellisense when it first came out.

C

This is a generational Improvement to that, meaning that it doesn't just autocomplete the line that you're currently coding in it can create entire methods and synthesize results that go well beyond what intellisense could ever do, and this is extremely helpful. The way in which it does this is it grabs context from your file, so you don't have to tell copilot what language that you happen to be developing in it doesn't require per repo configuration.

C

Copilot is automatically able to determine what language your files and start offering you suggestions based upon what's in that file. What it does too is that it understands contextually, what's in your file and what you're naming everything and really what it's doing is that it's doing a combination of like a web search, stack, Overflow and then like an autocomplete and we're really excited about it.

C

I want to engage with the audience here too, if you've been using copilot we'd love to hear about what it's helping you with what languages you use it for and does it help you program faster.

C

So what we initially launched was copile for individual beta, and then we went GA with co-pilot for individual and then more recently, we developed an Enterprise product called copile for business. What this lets you do is that this lets you enforce policy controls across your entire organization. There might be certain settings and you might want to manage billing for the entire organization. That's using this.

C

It gives you basically some control over how people are using copilot, and we highly recommend that, if you're a current getup Enterprise customer to reach out to GitHub- and we can walk you through what those features are, um so we make assignment very quickly- they can authenticate through work and then also too, we've added some very helpful features like filtering public code matches.

C

What this uh option is is that you can enforce this at the organization level, and what we'll do is that we'll block suggestions that match 150 characters or more, and if you want to learn more about that, please reach out to the GitHub team, so without further Ado, I'll, stop sharing, slides and we'll hop into like a quick demo here.

C

So hopefully everybody can see my screen. Okay, so here I, just have vs code showed very familiar to everybody. Everybody uses code and myself included the language that you're seeing here is C Sharp. That's what I learned and that's what I started developing in. So that's what I'm most comfortable in. So that's what that's what you get today, not JavaScript! Sorry, everybody!

C

If you want to get started with copilot, you simply install the extension and then once you authenticate through GitHub, now you're ready to rock. What's really neat about this too. Is that again, there's no configuration you'll see a little icon down here that a co-pilot symbol. That's there there we can disable it if we wanted to. But why would you want to do that?

C

We want to keep it enabled here um so yeah there's not so the coolest part about copilot is that I don't need to give you instructions about how to start using it, meaning that if I just start typing like I'm, going to create a programming language list.

C

This is going to be a new with the strings, let's just say, for example, so immediately what copilot is going to do is that it's going to read the line that I'm. Currently writing in this case I'm going to be asking it. You know, I'm, writing a programming language list. So what does it do immediately?

C

It says: okay, we want to add C sharp as a programming language, so you can kind of see already that it's already reading what the file is and then creating a result, essentially a suggestion based upon what I think so that I want. What you can do too, is that you can either hover over it and then you can open this and copilot or you can just simply hit command enter or control enter rather, and what it will do is that it will synthesize different results.

C

So, let's just say you want to go more in depth, so in that screen right there I could hit Tab and then added the programming language list, but immediately it's reaching out and giving me different suggestions. You know: okay, great, you want to create a programming language list. Well, here are all the programming languages that you might want to add and there's different solutions that it's synthesizing and then I can select the one that I want so I'm just going to accept this first one so immediately.

C

It just saved me some time from having to go out and like maybe grabbing that list, and then we can keep doing that. We can keep hitting tab here to add new programming languages, for example, but you can also break out of this too. Instead of just starting the program, you could say Hey, you know, copilot I want a method that determines the.

C

That determines the validity of a credit card. Number I know it's kind of random, but immediately it's suggesting an entire um algorithm entire method here for me and again, I can hit command enter, maybe see what other results I can synthesize, and you can extend this into anything that you might want to do as part of programming.

C

um So you can already see that saving me a bunch of time. Let's just do one more to like a method or, let's see um create me a web server and c-sharp, for example, so what it will do is I'm going to hit command enter here, it's going to say: okay, here's a web server, here's! What I'm doing we have a request response.

C

We can start a web server and then you know um you know we'll have to import the uh the library for that if we wanted to there system.net- and you can already see that it's just saving me a ton of time. We suggest to you that you read through everything that co-pilot is suggesting to you make sure it makes sense, make sure that you test it and before I jump back into the slides. There's one more thing: I want to show you just one more thing, so what we launched recently is something called copilot X.

C

You know people are asking us about gpt4 and what's going on with that, um so what GitHub recently launched is that we have co-pilot X now, don't be scared if you can't find this yourself, this is an early preview since I work at GitHub, I have access and we'll have access for everybody in a beta, we'll drop the link into the channel. If you want to sign up for OE access, we haven't started accepting anybody just yet, but we will soon when it's ready, but what we have here is even a generational improvement from copilot.

C

You know what I've shown you before was mostly just you know: either you start coding or you can start to type a natural language comment and then we'll generate things like create me: a web server and c-sharp, but here you're getting a more chat, bot style interface and even has suggestions here. So, let's just say that we want to generate unit tests for the code, so what it will do here is that it will start to do that. For me, you can already see this is already actually pretty awesome.

C

It's starting to generate things for me um and then in the beginning, here too I'm your co-pilot I'm here to help you get things done faster. You might want to highlight too okay that code that you just generated for me, I'm, going to highlight that and hey explain this selected code. So what it's going to do is that it's going to explain now what it's, what it generated and what this code means. This might be extremely helpful for you too, just if you happen to be learning a new language.

C

You know it's often the case that whatever language that you're programming in for work is not the language that you know the best. You might need some assistance on reading some existing code or if some previous engineer wrote something that you just don't understand you know, maybe you can ask copyle to ask it to explain something to you.

C

uh We even will extend it too and fixing bugs that if you're having trouble fixing a bug, we can start to have co-pilot X suggests a bug fix for you essentially, but I would say the best part about it is that there are no rules. You can ask copilot anything and you type this in into the box. um So I would just say you just interact with it like you would any other chatbot style interface.

C

So we're really excited about this I'm going to cut back to the slides here. um Please reach out. If you have any questions and I'll take a pause here and see. If we have any questions from the group John or Richard, do we have any questions.

A

We've got some great great comments going on a couple of questions in there too, so I'm going to make a couple call outs on the uh the comments. First, um a couple of people I mentioned these. If you're terraform, they use it for bash, so Glenn's done a great job. You know showing this off in a standard programming language, but you know this works for some of your infrastructure management. This works, for you, know bash scripting. That sort of thing so really a wide variety of what co-pilot can do.

A

Also there's a comment in there about folks using it for scientific pipelines and so uh I dropped it in as a comment, a little link to another product. We have code spaces which actually allows for instantaneous stand-up of development environments and the specific one I gave you. There was a Jupiter notebook in code spaces, so the combination of code, spaces and copilot super powerful, because what you can do is you can stand up this instant environment.

A

You can even have a Jupiter notebook already in there and you've got co-pilot riding along helping you out with building all of that scientific code. Inside of it, so a couple of the questions Glenn that I want to get to and I'll go fast through this, because I know we're tight on time today. But you know Corbin's asking: if you create a comment, implementing an algorithm will auto-complete the entire algorithm right. Maybe you can help me answer this.

A

You've, you've demoed a couple simple examples of hey: ask for a comment: kind of gives you what what you want, but uh just reading a little bit into Corbin's question there I'm wondering if he means you know along the lines of hey, tell it. This is how I want you to implement a specific algorithm or call out an algorithm by name in a comment and have it give you a prompt back for code that might solve for that algorithm.

C

Yeah, that's a great question and just explain a little bit about like how codex was trained and what it can do. So it's it's read all the public source code on GitHub for all public repositories and that's what it's based on. So it's going to learn the methods that are out there.

C

You know to implement like a web server or determining the ability of a credit card number I know it's like a weird method that I suggested there, but that's one of them. So what it will do is that either it will take an existing method, kind of verbatim that exists within public source code or I'll synthesize, a new method based upon the context that it has and what you're trying to get at and when you hit you know, control enter there and you open it in copilot and it's synthesizing your results.

C

Those could be entire method blocks that exist within public source code or it could be creating its own based upon what it thinks that you want and um so I hope, that's helpful there it's going to then you know it's not going to say that this has been copy and pasted from public source code, or it's just going to synthesize results. You can read through it and then select, which one will be most helpful.

A

Awesome, thank you, Glenn um also one other question: I want to I want to note before hopping on to the next topic. um Chris is asking: does co-pilot come free with GitHub um so to just to answer that real quick um there's, a personal version and there's a GitHub uh co-pilot for Enterprise version?

A

Those both have slightly different pricing depending on whether you're using it for your own use or you want your entire business to have it um and I would say you know personally, I think the the business costs are are quite reasonable when you consider that it's it's something in the order of 20 bucks a month, I can't remember exactly uh per head, but what we've seen, of course, is and Glenn's got this proof once up on the screen here that it in many cases will double your developer speed.

A

So most developers I know um they do like to take a salary. That's a little bit more than twenty dollars a month. uh So we like to think of this as a pretty strong net positive for most businesses.

C

Yeah and just to clarify that John so uh Copart for individual is ten dollars, uh copile for business, 19 per seat, um you know and ten dollars. You know this coffee was six bucks. I think hope. I would help me more than two thousands there. We go cool um any more questions John before we jump back into slides here, I.

A

Think we should jump onto the next topic and uh I'll save everything else for the wrap up at the end. Thank you.

C

So Sarah, if you just go back to that previous slide, there I just want to share to you like a lot of folks, especially in the Enterprise. Just ask us like how we can demonstrate this value. I would just say just do a simple time box experiment, you know take an hour on a Friday, maybe like a one. You know like a hack, Day lunch and learn type deal and just give two groups a task so grab 10 people have five of them.

C

Use copilot have five of them, not use copilot and then just measure the length of time that it takes them to complete. Something like we did, that for implementing a web server in JavaScript and the group that had co-pilot did it 55 faster. So you know we can kind of put a finer point and empirically verify that it does help you complete things quicker, and you can do this. You know, don't take our word for it.

C

You can run this experiment at your own company with your own engineers cool and then just a couple more things on copilot, so yeah. What we're also seeing too, that we're seeing a higher acceptance rate?

C

You know nothing like in you know these llms and these large language models and within you know this new AI world nothing static, we're constantly improving our own algorithm and our own model and copilot X is wielding gpt4, where the previous one was wielding gpt3, and what we're just saying is that we're already seeing a higher acceptance rate too from when we first launched this, so folks are accepting what we're suggesting to them at a quicker rate and it's being more helpful. Essentially. So it's already improving, even though we just launched this product.

C

Excellent and then yeah I don't have to tell everybody on this talk. um You definitely know if you read Twitter about the benefits, we're just always like curious to see every single day, like the new things that people are using this for and how they're finding it useful there's something always interesting every day, so, okay cool, so we're going to move on to the next part, which is developer efficiency, we'd. Also love to hear too from the folks. Have you used GitHub actions so for the uninitiated?

C

You'll have a tab within your get a repository called actions. What's actions so actions is our integrated CI CD offering I can think of it like an integrated Jenkins, but what we do is that we power it with the community of GitHub, meaning that all the files and all the CI CD scripts that you're going to need to piece together a complex. You know build into POI script.

C

Well, you know we can use the power of GitHub in the community and both third-party and first parties will write these reusable pieces of workflows in the form of yaml. In fact, the get a marketplace right now has 17 000 different workflow files that you can pull down. So if you need to build in a certain language and then deploy to a certain web service- and you need to do winting and all these kind of pieces, it's not the developers, don't know how to write a you know build into POI script.

C

The limiting factor is usually time and you can piece together right, complex, CI, CD script by using these different pieces. Let me just talk about compute real quick too, like what do we run this on? Oh and I just realized that our slide has seven thousand yeah. We have seventeen thousand. This is an old slide. We pulled it from an old deck. The correction, oh.

A

C

000, sorry, it's probably 19 000 by the time I said that um so what computers do these run on so by default, you can always run on GitHub posted Runners. We have mac Linux and Windows computers, so you can run this on. um In fact, here we actually have more powerful Runners uh right now. They're in beta I would say too. If you have specific needs for compute, like we work with all kinds of Institutions that say that they need like certain gpus and certain memory and certain SSD reach out to the GitHub team.

C

We have more powerful options if it exceeds what you need for the default hosted. Runners I want to remind folks too that if you use GitHub at work with GitHub Enterprise that you have 50 000 minutes to draw upon each month, so you and your team can use this compute that's allocated to you and that will reset monthly so definitely use it. You know we see a lot of folks use it for Max, because those tend to be pretty expensive, but you can also run this on your own Hardware as well like.

C

Let's just say that you have a bunch of machines or you have a preferred cloud provider. You can spin up this cute compute and you can install what we call the self-hosted runner with GitHub actions that hook that up yourself and run it on your own preferred cloud provider um and, lastly, I just want to mention too that if you need it to be dynamic, meaning that if you want the compute to be ephemeral, we have a solution called the actions running controller that can dynamically spin up and tear down compute for cell hosted Runners.

C

If you don't want to mention all that again GitHub, we can provide this to you through the GitHub, self-hosted, Runner I'm, sorry, the GitHub hosted Runner and again we support Mac, Linux and windows.

C

Okay, so without further Ado I'm going to pass it to my colleague Sarah to do a demo of actions and take over other presentation.

B

Awesome we're switching over Mike, so you can see we have a little bit of a no worries, so we had a little bit of a knuckle here. Sorry about that so who here has actually used GitHub actions um Post in the chat, if you have used it, what are some of the scenarios that you used it for? Let us know we're really interested.

B

um As Glenn said. Github actions allows you to do a couple of different things. You can see this actions tab, that is in your repositories and you can click on new workflow. This is how you can use a lot of the starter workflows that we have built out for you. We have um actions available for cicd. We have actions available just for automation. You can literally automate everything and anything that is related to a GitHub event with GitHub actions.

B

The nice thing about it is it understands what the current state of that repository is so because we know what language you're using. We can actually give you some suggestions on what the starter workflow should be. So in this example, here I have a Docker file in my environment. I have some JavaScript code: I have some HTML code, so it's actually suggesting that different configurations here of what is um publishing a node.js package or running and deploying a node.js package.

B

If you see here by OCTA demo, This Is, My Demo organization- and we actually have some pre-prescribed starter workflows that we created that are enterprise-wide or org-wide and make it more standardized in the way that we're building our own actions so GitHub actions today. Think of it as one action is the actual workflow, the one step that is running within a workflow, but a workflow allows you to have multiple actions Associated to it.

B

So in these examples we have different octodemo JavaScript workflow, so we can standardize that way that we're building JavaScript applications and deploying them. We can standardize how we're building out an node.js project versus some deployments or running our reusable code scanning capabilities. All of this can be integrated with GitHub actions today.

B

So, let's go into a an example here and see: what's going on, let's jump into this configuration file here, so what I just did I just let's configure a GitHub action, and let me zoom in here so everybody can see what's going on all right. So today, with GitHub actions, GitHub actions are yaml files, so it allows you to have a more humanly readable type of automated workflow that allows you to have auditability Associated to it, because it's it's pipeline as code and it's stored in git.

B

um So therefore you have the git history Associated to it, and it's stored specific to that repository. So you can find the right context at the right time for that GitHub action. You can have different triggers. In this example. The trigger is a release trigger, so you can have different types of release: different types of events that happen to a release in this case it's creating a new release, triggers these jobs, think of jobs as running asynchronously, and then the steps are synchronous. So you can have multiple jobs that run asynchronously.

B

You can have a matrix build where you can have three different jobs. As Glenn mentioned, you can have an Ubuntu OS or a Mac OS, or even a Windows OS operating system. So you can actually have three different jobs that kick off to run across all operating systems to test on one application, making your own life a little bit easier.

B

The steps here are just checking out the action setting up npm, CI and npm tests, and you can see here I have a set of different, a different job where I'm publishing my npm package. So those are some examples of what GitHub actions look like today, as Glenn mentioned, you can build your own workflows or your own actions, but you don't have to there's a GitHub Marketplace associated in this example here.

B

Actually, if you just go to the marketplace overall, you can see every action or app that is associated to GitHub, but in let's focus on the GitHub actions. Components here are GitHub actions has, in this case, 17 900 17 911 results coming back for publicly available GitHub actions. These GitHub actions are not black boxes. You can see exactly. What's going on in um they're open source, so you can see what's happening within the action itself and they're reusable, so you can reuse them. As you know, you don't have to rebuild from scratch.

B

So in this example here say: I want to run something related to Containers, so I can just search container actions. In this example. I could see. I have an Azure container registry. Build I can use my anchor container scan for scanning. My container or I can leverage some of the other existing actions out there to build out and Cloud native deployment with my GitHub actions pipeline with this in mind, GitHub actions, think of them as reusable CI, CD tools, plus plus, because you don't have to only focus on running CI CD.

B

You can do automations like labeling something as stale, so you can look up, sale actions, so you can say okay. This is a sale issue, let's close all sale issues, because they've been open for the last couple of months. Probably don't want any issues that are open for last couple of months with any activity, so you can Leverage The closed sale issue. In this example. Here actions runs on a compute, so, as Glenn mentioned today, you can run your own self-hosted actions, runners or you can use our existing actions Runners.

B

So in this example, you can see what I'm setting up from an Enterprise level capability to set up those different Runners I. Can click on new self-hosted, which I'm hosting on my own premise, environment or in my own cloud, environment or I, can use the GitHub hosted ones and if I create a new GitHub hosted, one I can actually configure what type of images we want. What type of sizes we want and some configurations Associated to Enterprise level settings such as having static IP addresses with GitHub options.

B

Today, we've seen a tremendous growth in the way that people are thinking through not only CI CD, but the way that you're doing like git, Ops or anything related to a GitHub event. There's automations Associated to that.

B

So, let's jump back into our overview here.

B

Github actions today really are cicd plus plus. In my mind, they are convertible. To make a welcoming a new contributor or to run your build job for your JavaScript projects. You can create release, notes and draft release notes and make it easier to create that release process.

B

You can set up reminders to look at issues and pull requests again, so you don't have to you know, forget about something, and then you never see it again unless you go into your PRS or your issues um view there, and it really allows you to build out your pipeline in a more efficient way sitting natively into your GitHub repository.

B

Several scenarios that we've seen over the last couple of years is that GitHub actions are used more and more in Cloud native deployments, for example, you can deploy to Azure AWS gcp. We work with these vendors directly to build out starter workflows, to make it easier for you to start leveraging GitHub actions right off the bat. We don't think it's necessary to build every single action yourself, because somebody else probably has done it already. So why not create that reusable marketplace where you can find these actions much more easily.

B

We've also seen infrastructures code I saw in the chat earlier that some people were using um copilot to write some terraform. Well, we work directly with hashu Corp today with GitHub actions to implement your terraform deployments with GitHub actions. So then you don't have to worry about going to terraform Enterprise or if you do, you can automate some of that testing and validation that needs to be done beforehand, leveraging the GitHub actions pipeline there um GitHub actions are versatile.

B

You can do many things, so I am very curious to see what type of questions that might have come up in the chat while I was presenting so John before we jump into the next session. I wanted to open it up and see. If there's any good questions out there.

A

Absolutely tons of activity some really great use cases. You know everything from Enterprises. We've got Scott talking about how he's actually using GitHub actions triggered by submitted issues to build teams um and analyze. His repos, which is great, uh we've got some folks talking about how they're using this, for you know their personal blogs uh to do everything from you know: generating uh featured images uh with image magic inside them.

A

um We've also got some folks asking about migration right, one person's coming from bamboo another person's coming from Jenkins. uh Maybe it's a good time to talk about the actions importer.

B

Yes, that is an amazing question, so today, GitHub actions has grown so fast and exponentially that uh we are trying to catch up with a lot of our migration tools, so over the last, maybe a year and a half, maybe even two years, we released our GitHub actions importer. So if you're using something like Circle CI get lab, CD or Jenkins, you can use the GitHub actions importer to help you import some of those actions Pipelines.

B

What I would actually recommend, though, is as you're doing those Imports I, wouldn't blatantly just translate from one to another. I would do some cleanup because you're already changing the way your pipeline is going to be running where it's going to be running, how it's going to be running. You might as well clean up and make those pipelines a lot more efficient.

B

So what we normally recommend is to actually have a plan beforehand, plan that strategy or what that migration will look like, make sure you're doing your cleanup you're, making your pipelines a little more efficient. So when you bring them over to GitHub actions, you already have not only the translated code over it, but also just a cleaner pipeline that reduces the amount of minutes that you're running reduces the amount of time you're waiting to get your results back.

B

If you're running it like a build job or a test job or scanning job, um but the GitHub actions importer is available for you to use today. I don't have the link right now on me, but if somebody can put it in the chat that'll be great. If not, uh you can always search for GitHub actions. Importer and it'll come right up in the Google in the GitHub documentation.

A

Very cool, thank you. Sarah uh we've got so much coming in I can't even keep up with it, but I'm going to pick out two more groups of questions here and then hopefully save some more for the end and folks we will have a QA at the end. Just so you know, um and also as a quick reminder some folks have asked. um Yes, this will be available for replay next week uh on galaxy.github.com, so you can come on back and we'll have records there all right.

A

So the next one I want to jump into Sarah uh we've got one person, we've got Anna, you know talking about how she deploys across different Cloud platforms and and orchestrates them all through actions. But we've got somebody else asking you know what about deploying on-prem and my mind. There immediately goes to both self-hosted Runners and it goes to you know the ability to do Implement a proxy, for example, inside the action. Maybe you can talk more about that.

B

Yeah, those are great questions, so definitely seeing multi-cloud deployments with GitHub actions. um I actually did a kubernetes uh kubecon conference, uh kubernetes cncf conference that happened um twice a year, one in the US and one in Europe I actually did a multi-cloud deployment example.

B

um As one of my sessions there, probably two three years ago, around leveraging GitHub accidents actions Matrix build to deploy to three different clouds. If you wanted to or not necessarily three different clouds, but three different deployment types. So if you wanted to deploy to Azure web services and AKs, you could do that with GitHub action. If you wanted to deploy to AKs eks. At the same time, you can do that with GitHub action. So those are great examples.

B

um Yes to your point, John, you can run GitHub actions on-prem.

B

So, for a lot of cloud deployments, most of the time for Enterprises that are very regulated, they have strict very restricted environments where they have to have things running on-prem to deploy on-prem so many cases, the larger Runners are one option, but the southwestern Runners are usually more desirable option for that case, so you can use Southwestern Runners to deploy on-prem, but today, with larger Runners, you also have the ability to create a static set of Ip ranges for those larger Runners that allow you to, you know, have an allow list of those IPS in your maybe firewalls that allow to a specific you know, deployment Place deployment environment that you're deploying on-prem to allow those GitHub Runners on the cloud to directly deploy to the on-prem, maybe Cloud environment, that you're running locally and, as John said, you can configure different proxy layers.

B

You can configure how you decide that you want to use your GitHub, larger Runners on cloud or the cell phone cell ones, that you want to maintain your own environment and set up the firewalls Associated to that. If there are more specific questions around this, I would love for you guys you can request a demo and then we can actually go and bring in that direct account team that is working with your company to really talk about the different ways you can deploy. Those.

B

John, you might be Newton or am I am I.

A

Thanks for calling that out, um all right, I'll wrap up with one last question here on secrets and we'll move on to Advanced security right.

C

A

Off I've got uh one one individual uh Ashish, um mentioning that you know win uh secrets are echoed back out to the output they're replaced with with Triple Star right. So we should talk about why that is a security feature and then also uh I think they're wondering if they can get a workaround, uh because for some reason they need to be able to log out that secret I've also got somebody else David.

A

um You know mentioning they're using multiple deploy environments uh using secrets and having some issues there. So maybe we can talk about both the variety of different ways that people can access Secrets, whether that's the ones that are stored in the the host to repo, but also third-party secret managers, and how they can connect to those uh using Marketplace actions.

B

Great questions so John to your point. Yes, there is a variety of maintaining secrets on the GitHub end as well, so you can have environment Secrets or repository Secrets or Global secrets, so different layers or I guess different levels of secrets that you can maintain maintain within GitHub. But what we normally recommend is to use something like a hashicor vault and integrate directly with that. So you don't have to necessarily directly maintain secrets in GitHub but maintain them in a vault that is specified for secret management. There's also oidc configuration.

B

So today you don't need to run necessarily Secrets directly within the GitHub repositories. You can also configure actions to leverage oidc. So therefore, you can maintain your secrets in like uh Google's secret management tool or in hashicor Vault or in AWS secret management or even azures, and directly work through oidc to configure tokens that are short-lived or that have a specific our back associated to them.

B

If you are interested in that there is a great documentation or how oidc works and how you can integrate that with GitHub action in our documentation and I highly recommend um maintaining some of those Secrets there, rather than maintaining them in GitHub. But nonetheless, maintaining them in GitHub does provide some security as well. So you don't necessarily need to hold them somewhere outside, but for Enterprise level type of workloads. We highly recommend using a Secret store that is meant for secret management.

B

So if you can easily rotate them, maintain them- and you know, connect back to them without having to worry about, maintain them specific in a repository or having the admin burden of maintaining them in a repository or in an org.

B

There are some security best practices as well or security, hardening around GitHub actions. If you do decide to use them on Prem or in cloud and as well also available in our docs. So that's somewhere, you can look up security hardening for actions and it'll. Give you all the best practices that we have there.

A

Awesome thanks Sarah and um just to address some things that are coming through on the secrets. Question two in the chat right now before we move on um lots of folks offering ways that you could export your secrets uh into logging.

A

um The one thing I'd say about that is: even if you're you know basically forwarding them or anything. uh You know, there's always a risk anytime. You do that. So please absolutely make sure that, however you're outputting that you're encrypting that output, something to keep them secure.

A

If what you're looking to do is just verify that your workflow run is using the right, Secrets I'd suggest simply truncating outputting, the last or first three of your secrets, so that you can match it up against what you know without creating a new security risk all right um with that, we'll try and answer anything else we can at the end, but Sarah I don't want to stop you from moving on to Advanced security right.

B

Yeah, actually so talking about secret leakage is uh one of the biggest items that we do want to talk about in general. It's very easy and very common to accidentally put secrets in plain text in your repository and we highly highly recommend against maintaining any secrets. Even if you believe there are low level secrets, we highly recommend do not store plain tech secrets in your GitHub repository.

B

So how can you prevent that? How can you really do that is by leveraging some of our Advanced security features so jumping into it? um I wanted to give like an overview and Baseline of where our mentality is where our vision is and how we kind of start building a lot of the tooling that we're building for advanced Security in that developer flow a lot more seamlessly.

B

So we did a study actually um from 2016 to 2020 that, even though the number of lines of code are increasing and people's awareness of security threats are also increasing, so is the number of vulnerabilities. So, despite everybody being a lot more aware about secrets and vulnerability management and being a lot more aware of recent security exploits that were happening, the lines of code and the lines of security threats Associated to that code are increasing at the same rate.

B

What we really want to do to resolve, that is to really have a not only reactive but proactive ways of maintaining that earlier on in the development cycle.

B

What we've noticed is that if you increase your security and understanding and embedding that more natively in the development phases earlier earlier on, then you'll have a complete reduction of vulnerabilities and security attacks that might happen later on in the stages nobody likes having uh you know, you're deploying something to production and you're about to deploy, or you maybe already deployed it, and then the pen test team comes back and says: hey I noticed like we can easily uh introduce a SQL injection in this.

B

You want to detect that way earlier on as fast as you can and as soon as you can to make those fixes, while you still have the right context in the development phase, not two months later, when you're in production- and you completely forgot about that- one feature- you've built- maybe two months before, um so what so? What can GitHub do today? How can we really do that GitHub Advanced security is meant to be a developer, focused type of security process that allows you to build Security natively in your development flows.

B

We Believe GitHub sits where the developer sits, you're, interacting with GitHub day in day out you're, creating a pull request. You're, adding your code changes you're, creating GitHub issues to track the projects. If you want native within GitHub, there's just so much that you could do today with GitHub that it's where developers sit to leverage co-pilot, for instance, to leverage code, spaces and actions and all the different components that come through within the developer ecosystem that sits on GitHub.

B

So what we really wanted to do is really built a native security flow within the day-to-day work that you're doing with GitHub, um but enough slides, um I think I've slided enough. Let's go back into some live demos, and let me ask that, if some of these, so today, what you can see is that there's a security tab available in your GitHub repository when you actually click on that security Tab and let's give that overview for us. So when you click on that security tab, you can see. You have your dependabot alerts.

B

Your code scanning alerts, your secret scanning alerts, and we actually give you some overviews and, like hey, do you have a security policy enabled do you have some of your security advisors enabled? So those are different components that you could see within that security tab with Advanced security? There are additional components that you might not see if you don't have advanced Security today, code scanning and secret scanning are the two core components that we'll be chatting about, but there's also dependency review that allows you to incorporate some pull request Integrations with the pendabot.

B

That is also part of advanced security. When we go into advanced security, we can actually see some of our secrets here in secret scanning.

B

Today we have 70 plus vendors that we work with directly to get the different marriages and different patterns for their secrets, if you're using Google API token, if you're using an Azure AWS token, uh a stripe, API key will work directly with those vendors to gather the regex information, that's associated to be able to detect those secrets that are in plain text and accidentally pushed into your GitHub repository so back to your points earlier on.

B

If you have some secrets in your configuration files and and you accidentally committed them into your GitHub repository, this is a great thing to this, to kind of turn on and discover those Secrets, but Secrets is a common term or secret scanning is a common thing that we think about being reactive.

B

What we really want to do to prevent anything like this happening is to be a lot more proactive. So how do we do that today? We actually allow for push protection, so you can enable push protection if we go back into your settings under the code and security and analysics Analysis section here, you can see that there are a couple different settings that we can configure. One of this is push protection. Push protection allows you to block a push from coming in, if there's a secret that is detected in that push.

B

So if you're working locally in your machine, it will actually say hey this commit, or this push is not able to come into the github.com ecosystem until you resolve this secret there's ways to bypass it, because we don't want to create a complete stop Gap.

B

We want to make sure that there are ways that, if need, people need to push against a secret just for production level reasons they can, but it will all be audited and you'll be able to see all of that in that security tab across the board of all the secrets are being detected. So if anybody accidentally goes and deploys the SQL without realizing or if they're going and bypassing push protection, they'll all be available in the secret tab.

B

Here with Secrets, we've noticed that secret s in general have been the largest exploits over the last several years. Just because, if somebody is able to access in your GitHub repository doesn't always mean they have access to your AWS environment, but if they accidentally discover or if they are able to discover that AWS client key in that in that repository. That is when you might get some Bitcoin miners, spinning up random servers across your AWS environment, and you know racking up a lot of dollars.

B

That might not have necessarily been uh been a good practice in the first place so for having that proactive and reactive detection really allows you to have that auditability across the board. Helping you fix those vulnerabilities a lot faster and get you a better understanding of what's going on within the Secret side of things, but with GitHub actions. Sorry with GitHub Advanced Security. Today, you don't only see Advanced security around secret scanning. We you could see when we talk about code scanning. That's the other aspect.

B

Code scanning today is a platform that allows you to detect vulnerabilities across the board around any other tooling and our own internal tooling.

B

um That allows you to detect SAS type of vulnerabilities, so today, code scanning is the platform that you can integrate with with third-party tools or use code ql code ql is a query language that allows you to do an analysis and a pattern: detection across your code base to detect different vulnerable patterns.

B

So if we go into an example here, we can actually click on show paths and see where this SQL injection was created, where it was actually introduced in the source and where it's being exploited in the um in the exploit section here, when it's running an execute query, and you can see that data path flow through the environment through your code base to detect okay, maybe it's the best place to fix this security vulnerability in Step number seven.

B

So maybe I need to run some sanitization here, but there are multiple paths: it's not one path to that sink or One path. To that exploit. There are three- or in this case there are six different paths that are available to detect like hey. This vulnerability is not only being introduced in the string name, but it also might be introduced in the string off tan that is being um uh received in this public attack result here.

B

So what you want to do is actually detect and understand where the variances are and find the common denominator across all of them to fix that vulnerability.

B

So I gave a really quick overview of code scanning, but code scanning in the specific environment I'm talking about code ql, so I gave a really quick overview of code ql. What you can also see is a recommendation, an example, an Integrations directly with a pull request, so you can enforce that at the pull request level. You can do this not only with code ql, but any third-party scanners. You decide to integrate with code scanning code scanning today again bringing that Community aspect.

B

We work with so many vendors and partners and platforms to make sure that we understand that it's not one path fits everybody's scenario. It's multiple paths, fit everybody's scenario so or fit multiple people's scenarios. So in this case here we work directly with our community to bring in the right Partners to integrate with our code scanning platform. So if you want to do container scanning, if you want to do uh infrastructures code scanning, you can do all of that.

B

But again going back to our overview here. I will pause and see. If there's any questions um that are of interest, and then we can jump into an example scenario of how you can leverage both code scanning and secret scanning and also incorporate actions to build out a pipeline.

A

Awesome thanks, hey one thing that somebody did bring up that might be worth addressing. They were mentioning how they've used that advanced security for producing their own serif files uh and apologies. If you covered this already, I was looking at questions pretty heavily, but maybe you can talk a little bit more about the relationship between serif files and GitHub security.

B

Yes, that's a great question so today, when you go in the security, Tab and you're going to code scanning, you can actually configure multiple tools. If you decide to integrate with serif, you can integrate directly with the code scanning API and then the results will be a visible right in the security tab, as well as your pull request. So you get that exact same experience as you get with code ql with serif integration from third-party tools.

B

So if you had more than one tool, you'll be able to see all of those tools in one place and be able to actually break down. In this case, we have a couple other tools.

B

None of them are producing results in this in this example here, but you can see all the tools and filter down with them to see what results they have regarding the serif inputs that you're rece that you're pushing through so with the serif integration, it's so easy to integrate with third-party tools, but at the end of the day, code ql also produces serif. So if you have a third-party platform that you want to push all of the results to, you can use code ql to push out serif outputs as well.

B

So it's more of a two-way communication. In that sense, awesome.

A

Thanks um and then someone else asked uh you know and Glenn put a draw a link into the chat here, so you can look for that there, but um just to reiterate, you know: are there ways to end Mass retroactively turn this on for all of somebody's private recalls right. So maybe you can talk a little bit about Enterprise account level and organization level controls.

B

Yes great questions, so we recently released a one-click turn on for your co2l analysis and you can explore ways to incorporate third-party tools. So today we have a default setup where, if it's a language that doesn't really need any compilation. So if it's a compatible language that we can turn that default setup on, you can enable that default setup to be turned on across your code base. So this can be done at the org level and then actually, let's jump into a live example of what the Enterprise settings look like.

B

So when you go into your Enterprise settings here is the view that you see for your actions, Enterprise settings. But if you go into your code, security analysis, here's where you can see all of the configurations that you have for your Enterprise level security features. So you can see what you can enable the advanced security capabilities and availability across everywhere, or you can even enable secret scanning across everywhere, um and if you dive deeper into the security features, you can actually set up new custom patterns with secret scanning as well across the Enterprise.

B

So that's something I didn't really touch on when we quickly went over the secret scanning items. So there are different level policies that you could set up at the Enterprise level at the org level and at the repository level.

A

Brilliant and um you had a little bit of a live demo, you wanted to run right at the end here. I think we're at about eight minutes, so I think we've got time for that or a scenario rather uh and then we'll take general questions after.

B

Yeah great so just to recap, with Advanced Security today we talked, we touched on two major items: Secrets getting code scanning. The last item: I did not touch was the security overview. So if you go to your overview of your octo demo of your repository of your organization um at the org level, you'll be able to see a security tab as well, and that will give you your security over your cost of board. So that's something I would highly recommend you. We can do an even deeper diaper, deeper dive demo.

B

um If you request a demo, we can jump into more of a succinct demo that covers all the different aspects of secret scanning codes, getting security overview and some of the dependency reviews all around Advanced security. So that being said, the comfortable items that we covered were secret. Scanning code scanning quickly touched on security overview. But how do you incorporate some of these in a example scenario? So today uh your typical workflow- and this is my personal experience. So this is my typical workflow I introduced some code changes I, create a pull request.

B

I build my action or I build I use. Github actions to build my image and run my image and then I merge the pr everything tests all the tests pass and then I assume my development is completed. Then my create team comes in. My security scan comes in and everything starts. uh You know this is fine everything's on fire, but we're gonna figure it out. I'm missing a couple: deadlines: I'm, I'm, struggling to figure out okay. What did I even do like two months ago or when did I even build this feature?

B

Is it this specific feature? Was it the specific PR I can't even remember anymore, because you compile so many features and certain PRS? If you have multiple PR or feature you just there's different ways of doing development that by the time you get your secret security scanning and your automation to do the deployments to your production, environment, you're kind of out of context.

B

So what I would actually recommend will do an improved workflow where you can incorporate your parallel security scans? You can leverage GitHub actions to do this or you can leverage Jenkins Circle CI, whatever CI CD tool you want, but incorporating that parallel security scan at the time of the pull request.

B

So today it might take a little more work to standardize that, but it will save you so much time and effort and frustration to be honest because you don't want to notice it later on and not be able to fix it because you forgot what you did, but if you notice it earlier on it's in the pull request, it's right when you're ready to receive feedback.

B

That's really when you want to incorporate a lot of your scans, then this improved scenario: I'm, introducing a PR I'm building my job um I'm building my I'm running my build job, so I can build my application and then, if I'm, using container based environments, I will run my container scanning because I'll build an image in during my build job, I can run my dependency scans. So some of the s-bomb capabilities that you might have heard of throughout these last couple Galaxy sessions are depending about capabilities, are dependency review.

B

Our static code analysis, you can use codeql, you can incorporate code scanning third-party Partners as well as well as infrastructures code, maybe something like Prisma or tfsec. If you're using some of these third-party tools, you can integrate directly with code scanning to incorporate your infrastructure's code scanning your containers codes. Again, your static analysis and your SCA analysis all happening in that pull request. So you get all of your results, all of your scanning done as with the right context at the right time, and you don't have to remember what you did two months later.

B

You can now know what you did at that pull request and fix it within that pull request, and then everything goes well and you're merging your test. All of your scans pass you're good to go. You're fine, deploying your image you're, not missing your deadlines and you're, incorporating everything earlier on in the life cycle.

B

um That was my example scenario and I actually did this. Similarly again at kubecon, um there is a sample of this somewhere outside in the internet and it's at the kubecon 2022 North America conference uh links. So if you are interested- and you want to find out more about it, I can send you that link or you can request a demo and we can go through and do more deep Dives across all of the scenarios that I talked about today um and that's that's.

B

What I had uh John Arthur, let's open it up to q, a yeah.

A

Awesome thanks and we've only got about four minutes left, so this will be a little bit a little bit tight. um One thing that has come up in this kind of the intersection of co-pilot and security right, so I, wanna, I, wanna jump in on this. Does GitHub co-pilot help reduce or prevent security vulnerabilities.

B

uh Glenn all right now I could definitely take that. So there are ways that you can leverage copilot to help. You write better code today think of copilot as your co-pilot, not as an autopilot, so you can leverage copilot to find writing something. So in today's GA available products um there are ways that you can just look through and synthesize different ways of writing something to eliminate that SQL injection you can even prompt it to say: hey. Maybe I can do this without SQL injection happening, um but there are new co-pilot.

B

X features are coming out. That can maybe help a little more, so I don't know Glenn. Do you want to take that on yeah.

C

Just one more additional comment there that if you're already using a language right now to discover vulnerabilities within your code base like code ql, for example, you can also use copile to supercharge that ability, meaning that, if you're having difficulty because then everybody's a security researcher, um you know and not everybody knows maybe exactly how to type to find a vulnerability but supercharged with copilot. Essentially, um you can increase your ability, then, to find code.

C

Ql vulnerabilities by using the autocomplete functionality of copilot, so I would say to you like it will sort of enable you to use your current tools even better than how you're doing it today um and then, as Sarah mentioned, we're coming out with uh beta features right now with regards to maybe making more secure by asking co-pilot to do it. For you.

B

Yeah we've seen many scenarios where generative AI has just been changing the way that we're thinking through things and vulnerability management and just how we're analysis and doing an analysis across our code base, so I mean we are still figuring out the best ways to handle a lot of things. So, at the end of the day, the things that you're seeing with copilot today are just the beginning.

B

um So just keep an eye out and see what you know what we learn and come back with in the next couple of months. The next couple of years.

A

All right, awesome, folks, um Glenn, if you could move us forward to that survey, slide it's time for us to wrap up. We have hit uh just about one o'clock, so I want to thank everybody who jumped on today.

A

If we didn't get a chance to follow up on your questions, um just hit that button there to uh you know, get a demo from us to dive in deeper we'll do our best to get back to you and answer what questions you have uh fill you in with more information on GitHub Enterprise, um also a reminder that all the recordings are going to be available next week once again right here at galaxy.github.com.

A

So with that we're going to close out, ask you to uh hit that that survey link that you're, seeing up on your screen right there love to hear your feedback, what you thought of today's sessions on all of galaxies so far so go forth. Let's build from here! It's been great having you and Sarah Glenn. Thank you. So much for an amazing session today.

B

Thank you all have a galactical time over the last couple of days so enjoy the rest of the sessions. If you didn't get to watch them, make sure you jump on and watch them next week, thanks.

C

I'll see you next time. Thank you.