►
From YouTube: Propelling your DevOps to new heights | GitHub InFocus
Description
DevOps makes building and shipping software faster, friendlier, and more collaborative—and automates almost all of the process. Successful DevOps implementation depends on many factors to be successful, including collaboration, tooling, transparency, and measurement. Join Senior Technical Advocate at GitHub, John Peck, and Principal Solutions Engineer at GitHub, Glenn Wester, in this interactive session where we'll discuss best practices, efficient techniques, and challenges you might face when rolling out DevOps in the Enterprise.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
B
B
B
So
just
some
quick
housekeeping.
This
is
a
forum,
so
we
love
participation
from
you.
So,
as
we
ask
questions,
if
you
want
to
type
in
any
answers
into
the
chat
box,
please
do
so.
We
encourage
it
also
too
we'd
love
for
you
to
share
your
opinion
on
anything.
So
if
you
want
to
raise
your
hand,
we
can
meet
you
and
have
you
share
kind
of
live
with
us.
B
We'd
love
that
and
we're
covering
a
lot
of
things
today
and
we
sort
of
are
limited
to
how
much
we
can
show
as
part
of
like
a
talk
like
this.
If
you
want
a
demo,
if
you
want
to
go,
die
dive
deep
on
anything
that
we
show
you
here
today,
please
reach
out
to
our
team
we'd
love
to
set
up
some
time
and
we're
fully
international.
So
it
doesn't
matter
what
time
zone
you're
in
doesn't
matter
where
in
the
world
you're
located.
B
Github
is
an
enormous
team
and
we
love
demoing
for
you.
So
please
let
us
know
so
without
further
ado,
we're
going
to
get
into
some
introductions
here.
I
will
be
myself
and
john
that's
driving
the
talk
today
get
to
know
us
real,
quick,
quick
touring
tests
so
yeah
sorry,
my
name
is
glenn,
I'm
based
in
the
bay
area,
I'm
a
principal
solutions,
engineer
here
at
github
and
I'm
happy
to
be
presenting
to
you
today.
B
I've
been
with
github
now
for
about
three
years
formally
a
pm
at
microsoft,
and
I've
also
worked
with
xamarin
before.
If
we
have
any
c-sharp
developers
on
outside
of
work,
I
love
to
explore
the
natural
world.
This
is
a
that's,
not
movie
magic.
That's
a
real
volcano
behind
me.
That
was
a
year
ago
a
volcano
called
gildinga
dollar.
B
If
we
have
any
icelandic
books
on
I'm
sorry,
I
probably
pronounced
that
incorrectly,
just
fyi.
If
you
go
there
right
now,
it's
dormant
so
don't
like
see
this
photo
and
then
go
there
and
then
say:
okay,
it
was
a
dud
make
sure
you
check
the
volcano
forecast
before
and
yeah
it's
something
I
really
recommend
checking
out
at
least
once
in
your
lifetime
yeah.
Why
is
there
a
photo
of
my
leg
in
the
hospital
there
yeah?
So
just
real,
quick,
very
unexpectedly,
I
I
deprecated
my
achilles
tendon.
B
A
Glenn,
I
I
sympathize
with
you.
That
is
super
painful,
but
also,
let
me
be
the
first
to
welcome
you
to
the
github
club
for
folks
who
presented
with
broken
body
parts.
You
reminded
me
of
an
event
four
years
ago
where,
if
you've
been
at
developer
week,
san
francisco,
you
would
have
seen
me
in
a
sling
after
a
snowboard
accident,
where
I
severed
three
ligaments
in
my
right
arm.
So
I'm
I'm
patched
up
good.
I'm
sure
you
will
come
back
strong
as
well,
hello,
everyone,
I'm
john
peck.
A
So
more
than
happy
to
be
joining
you
all
here
today,
I'm
currently
one
of
those
folks
who
spends
a
lot
of
time
talking
to
various
enterprises
all
the
way
through
small
businesses
about
github
and
what
we
do
and
how
we
can
solve
their
technical
problems.
So
if
you
do
take
us
up
on
that
offer
to
jump
in
and
come
talk
to
us,
I
may
be
one
of
the
faces.
You
see
live
from
seattle,
all
right
with
that
I'd
love
to
start
with
our
first
question
and
again
just
toss
these
into
chat.
A
You
know
we'll
take
a
look
after
and
try
to
keep
my
eyes
on
it
as
we're
talking,
but
you
know
I
started
out
a
user
of
github.
Of
course,
before
I
was
an
employee,
a
big
fan
boy,
just
just
love
everything.
They
do
really
accelerated
my
development
process.
I
got
involved,
you
know,
because
a
friend,
so
I
was
working
with
a
problem
and
said:
hey
here's,
this
repo,
it's
a
django
component,
if
I
recall
at
the
time,
said,
hey,
go
jump
in
and
contribute
to
this
and
interact
with
the
author.
A
It
was
a
wonderful
experience
got
my
problem
solved,
managed
to
help
them
out.
So
I
want
to
hear
those
stories
from
you
right.
We
love
hearing
from
our
community
what
projects
on
github
are
the
ones
that
right
now,
for
you
are
really
inspiring
and
exciting.
What's
what
are
things
you're,
contributing
to
what
are
the
things
you're
using
regularly
on
a
day-to-day
basis,
drop
those
into
chat
and
we'll
address
those
later
on.
B
Cool
thanks,
john,
so
yeah.
I
want
to
share
one
of
mine
as
well
before
we
get
into
the
material
and
again
we
have
a
pretty
good
session
for
you
here
here
today.
So
the
name
of
the
talk
is
propelling
your
devops
new
heights,
like
what
does
that
mean
how
far
it
can
give
devops
take
us
so
yeah
we
have
the
sort
of
the
privilege
to
work
with
really
the
most
cutting
edge
teams
on
earth.
Like
you
know,
new
technology
just
doesn't
come
out
of
thin
air.
B
It
really
comes
from
a
lot
of
hard
work
from
a
lot
of
folks
that
put
their
brains
together
and
are
shipping,
and
we
just
love
seeing
too
about
where
this
takes
folks
and
what
we
can
do
and
I'll
just
make
it
clear
like
we're
not
bound
to
earth
either.
In
this
case,
the
sky
is
not
the
limit.
The
reason
why
I'm
showing
this
chart
is
just
because
you
know
we're
down
here
in
the
troposphere.
This
is
where
we
fly
our
planes,
and
this
is
where
we
live.
This
karman
line
up
here.
B
B
This
fact
blows
my
mind,
and
it
just
makes
me
sort
of
really
excited
for
the
future
and
we're
just
really
proud
about
the
work
that
we're
doing
here
and
specifically,
what
I'm
talking
about
is
the
ingenuity
mission,
which
is
like
a
complimentary
mission
to
curiosity
so
for
those
folks
that
haven't
seen
it
before
there
is
a
helicopter
flying
around
mars.
That
was
brought
as
part
of
the
perseverance
mission
that
was
recently
launched
and
landed,
and
this
is
still
flying.
It's
flowing
something
like
17
different
times.
B
So
not
only
is
it
like.
The
drone
have
a
drone,
it's
that
it's
also
extremely
successful.
This
is
a
demonstrator
just
to
make
sure
that
we
can
operate
aerodynamically
and
you
know
low
density
atmospheres.
We
have
to
test
this
before
we
can
send
something
bigger
and
before
we're
flying
around
helicopters
on
mars
and
guess
where
that
code
is.
This
is
driven
by
a
open
source
flight
control
framework
written
by
jpl,
one
of
the
teams
that
we
work
with
they
use
both
github
enterprise
server,
which
is
a
on-premises
local
enterprise
instance.
B
So,
if
you
want
to
like
host
your
own
github.com,
you
can
do
so
behind
your
firewall
on
your
own
metal
and
they
also
use
github
enterprise
cloud
too
for
their
open
source
contributions
driven
by
github
actions
which
we'll
get
into
in
a
little
bit
but
yeah.
This
just
really
inspires
me
to
see
people
collaborating
to
see
the
power
of
open
source
to
see
what
happens
when
we
put
our
brains
together
and
have
a
powerful
engine
to
drive
it,
and
you
can
go
download
this
code.
B
This
is
all
open
source.
Maybe
you
can
fly
your
own
helicopter
around
your
apartment,
something
like
that
and
driven
by
github
action,
so
rapid,
iteration
and
driven
by
open
source.
So
I
just
want
to
share
that.
It's
something
that
inspires
me
and
if
you
want
to
see
more
science
stuff,
we've
already
talked
about
this
in
previous
github
universe.
Chats,
but
another
just
sort
of
amazing
achievement
is
the
event
horizon
telescope
image,
the
first
image
of
a
black
hole,
a
bunch
of
radio
astronomers,
collaborating
within
github's
platform
and
producing
something.
A
Awesome
thanks
for
very
much
appreciate
that
give
me
just
a
second,
as
we
deal
with
the
slide
sharing
business
here.
So
you
know
when
we
look
at
projects
like
that,
we
look
at
these
amazing
things
that
we've
launched
into
into
space
and
beyond
to
other
planets.
How
do
those
projects
come
about
right
development
operations?
Devops
is
the
process
of
planning
and
executing
on
these
awesome
kind
of
projects?
It's
how
we
go
about
creating
the
products
that
bring
these
amazing
results
into
humanity
right
and
the
github.
A
We
spend
a
lot
of
time
thinking
about
devops.
It's
really
tempting,
though,
to
first
jump
right
into
tooling
right,
the
specific
technologies
which
make
all
this
collaboration
and
automation
possible,
but
we
also
have
to
remember
that
these
technologies
are
meaningless
unless
there's
a
culture
which
is
welcoming
to
and
supportive
all
of
those
practices
that
the
tooling
is
trying
to
support,
it
isn't
just
something
you
can
buy
and
install
this
culture.
It
takes
thoughtful,
dedicated,
directed
effort.
You
know
we
have
a
highly
collaborative
culture
inside
github.
A
We
take
our
responsibilities
toward
our
peers
and
toward
the
larger
developer
community
quite
seriously,
and
so
what
I'd
love
to
do
is
take
a
few
minutes
to
share
some
of
the
guidelines,
some
of
the
cultural
standards
that
we
live
by
daily
by
the
way.
These
are
just
a
few,
some
of
my
hand-picked
favorites.
A
So
first
off
don't
work
in
a
vacuum.
So
when
you
start
a
project,
you
have
to
assume
that
the
people
around
you
are
going
to
know
more
collectively
than
you
do
individually.
You
have
to
accept
that
you're
going
to
make
mistakes
and
somebody
out
there
in
the
world
is
always
going
to
be
able
to
spot
a
typo
that
you
might
happen
to
be
blind
to
or
another
slightly
more
efficient
way
to
code,
a
particular
algorithm,
or
perhaps
remember
some
timid
of
knowledge
that
is
going
to
change
your
entire
approach
to
a
project.
A
A
These
different
branches
are
variations
of
the
product
where
we're
trying
out
experiments,
we're
iterating
and
we're
refining
on
new
ideas,
and
we
know
all
the
while
that
we're
not
damaging
the
main
copy
of
the
product
as
we
experiment,
each
individual
project
might
have
dozens
or
even
thousands,
of
different
branches
made
by
different
people.
Each
one
represents
a
different
set
of
experiments
which
may
or
may
not
end
up
becoming
part
of
that
final
product.
A
Then,
when
somebody
finally
decides
that
an
experiment
is
successful,
that's
worth
bringing
back,
they
don't
just
force
that
set
of
changes
back
into
the
hole.
Instead,
they
ask
branches
become
part
of
the
primary
copy.
By
way
of
this
thing,
we
call
a
pull
request
and
it's
called
that
very
intentionally,
because
it
is
a
request,
not
a
demand.
It's
basically
saying
to
our
collaborators:
hey,
take
note
of
the
changes
we're
proposing.
Please
discuss
the
solution,
suggest
alterations,
find
flaws
and
help
me
fix
them.
A
This
is
where
that
magical
collaboration
happens
where
you
can
bring
in
resources
across
your
company
across
your
peer
group.
People
you've
worked
with
before
folks
who
are
subject
matter,
experts
on
what
you're
doing
and
they're
going
to
help
you
ensure
that
your
solution
is
properly
analyzed
and
reviews
it
does
what
it
should
and
it
gets
benefits
from
all
of
those
contributors
that
choose
to
jump
in
now.
In
order
to
be
able
to
rely
on
those
individuals,
you
have
to
be
able
to
trust
them,
and
that
starts
by
exhibiting
trustworthy,
behavior
yourself.
A
So
one
of
the
things
we
say
is
assume
positive
intent
and
exhibit
it
be
respectful
and
helpful
in
all
of
your
interactions
and
also
expect
the
same
of
others.
If
you
misstep,
acknowledge
it
correct
it,
and
if
you
see
mistakes,
make
sure
that
you're
critiquing
the
code,
the
content,
not
the
people
who
made
it.
This
kind
of
interaction
gives
us
the
freedom
to
work
openly
and
to
solicit
help
from
others
by
the
way
for
any
managers
that
are
out
there
in
the
audience.
A
This
is
on
you
to
drive
if
your
team
doesn't
have
a
culture
of
innate
support
and
respect.
You
need
to
make
this
your
very
first
priority,
because
everything
else
on
the
team
stems
from
this
seed
and
by
the
way
this
doesn't
mean
that
non-managers
get
a
free
pass.
No,
we
need
to
live
this
truth
daily.
We
need
to
exhibit
love
for
our
peers,
even
if
we're
fiercely
debating,
what's
going
to
be
the
best
approach
to
a
problem.
A
Now,
collaboration
is
extremely
important,
but
we
also
know
that
heads
down
focused
time
is
critical
toward
doing
our
most
productive
work
when
we're
in
a
state
of
flow
and
our
mental
state
is
fully
encompassed
by
some
engaging
task,
and
then
we
get
interrupted
by
something
else.
That
requires
our
brain.
It's
a
challenging
problem.
A
What
this
means
is
you
set
aside
time
to
focus
and
remain
intentional
about
when
and
how
you
leave
your
door
open
in
our
digital
world?
This
means
things
like
blocking
time
on
your
calendar
to
work
on
specific
projects.
Turning
off
your
chat,
apps
muting
your
phone
deciding
on
specific
times
when
you
check
your
email,
whatever
it
is,
that
works
for
you
to
be
able
to
go
heads
down
when
you
need
to,
but
then
set
meetings
very
intentionally,
have
defined
outcomes
for
those
and
assign
pre-work
give
people
the
code
the
things
they
need
to
review
beforehand.
A
What
are
your
favorite
techniques
for
making
sure
that
you
get
that
focused
time,
but
you
also
remain
collaborative
and
interactive
with
others.
Let
me
share
a
few
that
I
rely
on
personally,
because
I
want
to
make
sure
that
I'm
staying
on
top
of
my
responsibilities
to
others
without
becoming
overwhelmed,
while
also
giving
myself
that
necessary
focus
time.
A
First
off,
I
use
recipient
defined
notification
channels.
What
do
I
mean
by
that?
I
mean
I
know
how
I
work
where
I
work.
What
tools
I
tend
to
be
in
how
it's
best
to
message
me.
So
I
decide
whether
I
want
to
be
notified
by
email
by
chat
by
mobile
app,
some
other
third
party
plugin.
When
other
people
need
to
reach
me.
I
need
to
do
things
like
I
go
into
my
repos
and
very
intentionally
choose
what
kinds
of
notifications
I'm
going
to
get.
Maybe
for
this
particular
project.
A
I
only
need
to
know
about
every
major
release,
but
for
this
other
thing
I'm
intimately
involved
in
I
need
to
know
about
every
single
change,
the
code
I
set
those
intentionally.
I
also
make
clear
to
my
peers
when
I'm
available
and
when
I'm
not,
I
set
work
hours.
I
put
those
blocks
on
my
calendar.
I
change
my
slack
status
message
intentionally
and
I
do
reassure
my
peers
when
they
tell
me
about
something
high
priority
that
I'm
going
to
respond
and
give
them
a
specific
timeline
for
when
and
how
deeply
I'm
going
to
respond
to
that.
A
Before
going
back
into
focus,
I
also
make
use
of
distributed
responsibility,
meaning
that,
for
example,
when
I
have
a
pull
request-
and
I
name
an
approver-
I'm
not
just
naming
an
individual,
I'm
naming
a
team,
I'm
using
a
round
robin
or
a
load
balancing
strategy,
so
that
that
burden
of
response
is
spread
out
across
a
group,
whoever
the
individual
most
able
to
respond
to
can
do
so.
Give
me
the
reviews
and
approvals
I
need.
No
one
person
is
taking
all
the
hits
and
having
all
of
their
time
consumed.
A
I
also
make
sure
to
put
expectation
up
front
inside
every
project
we
define
who
the
core
team
members
through
code
owners,
we
define
how
we're
going
to
review
new
contributions,
what
sort
of
assistance
we
most
need
from
people
coming
in.
We
set
those
expectations
ahead
of
time
and
define
what
information
we
need
from
contributors
as
they
create
a
review,
pull
requests,
issues,
etc.
A
This
minimizes
noisy
communication
and
streamlines
the
entire
process.
So
these
techniques,
let
me
stay
productive
and
focused
when
I
need
to
they
also
build
a
stronger
team.
Overall,
we
know
we
can
rely
on
each
other.
We
know
this
collaboration
won't
break
our
flow
or
slow
our
individual
work,
but
we
also
are
going
to
collaborate
in
an
effective
manner.
We
deliver
faster,
but
we
stay
connected
to
others
and
we
celebrate
our
collective
work.
A
This
works
wonderfully
for
projects
where
you
have
dedicated
working
teams
where
everybody's
in
agreement
about
what
the
techniques
should
be,
but
we
also
want
this
to
go
further.
We
want
to
make
it
possible
and
appealing
for
anyone
across
the
entire
company
or
even
in
the
world,
to
discover
and
utilize
and
contribute
to
any
project.
How
can
we
make
that
happen?
A
First,
off
utilize,
open
knowledge
repositories
right.
We
have
a
philosophy
that,
when
it
comes
to
our
work,
unless
there's
a
specific
legal
or
security-related
reason,
not
to
anything,
we
create
is
visible
to
the
entire
company
by
default
and
sometimes
even
public
to
the
entire
world.
This
is
the
code.
We
write
it's
the
plans
we
make
even
this
very
presentation.
Right
from
the
day
we
started
working
on
it.
Anyone
in
the
company
could
come
in
see
the
presentation
comment
on
it
contribute
their
ideas
now
at
first.
A
Together,
we
end
up
building
a
better
product
and
by
the
way
no
one
individual
has
to
feel
like
they're,
bearing
the
full
weight
of
that
or
pretend
that
they're
perfect.
We
know
this
is
a
group
product
I
might
be
driving
it
primarily,
but
we're
receiving
contributions
from
everyone
and
we're
double
checking
each
other's
work,
and
that
makes
me
feel
a
lot
safer
and
more
confident
in
what
I'm
creating
now
making
these
repositories
open
is
great,
but
it
also
isn't
enough.
We
need
to
actively
welcome
contributors
to
come
and
contribute.
A
So
inside
each
repository
we
define
our
contribution
policies
through
things
like
our
maintainers.md.
Through
things
like
issue
templates,
we
actively
tag
issues
in
ways
that
are
going
to
invite
action.
We'll
say
hey.
This
is
a
good
first
issue
for
somebody
just
starting
out
on
this
project
or
we'll
say
this
bug
really
needs
help.
Can
somebody
with
a
certain
kind
of
expertise,
jump
in
then,
when
people
do
we
actively
celebrate
those
contributions?
We
publicly
recognize
the
hard
work
of
our
peers
as
we
do
so.
We
learn
each
other's
expertise.
A
We
learn
our
problems,
solving
approaches
and
we
observe
actual
work.
This
enables
us
later
on,
to
go
and
request
help
from
others
and
to
give
back
effectively
we're
building
these
working
relationships,
which
are
based
on
our
shared
interests,
our
active
work
and
incorporate
all
of
our
disparate
capabilities.
A
These
spontaneous
relationships
really
pay
off
over
time
when
I
know
that
I
can
reach
across
the
company
for
five
minutes
of
assistance
from
an
expert
on
some
subject
that
I've
worked
with
before
and
that
ends
up
saving
me
two
days
of
ramping
up
on
a
new
concept
myself
later
on,
I'm
going
to
reciprocate
when
they
need
help
both
of
our
projects
are
going
to
accelerate.
Because
of
that,
so
a
question
for
you,
I
let
you
know
about
the
first
project
that
I
was
involved
with
and
how
I
got
welcomed
into
it.
A
I
want
to
know
how
you
got
engaged
with
your
very
first
or
your
favorite
open
source
project.
What
did
people
do
to
welcome
you
into
that?
What
did
they
do
to
reciprocate
your
assistance
later
on
all
right,
I'm
going
to
leave
you
with
one
last
thing
to
think
about
open
source,
isn't
just
about
the
code
that
makes
up
your
product,
it's
also
about
the
planning
and
the
documentation,
and
it's
also
about
the
testing
and
delivery
at
github.
A
A
We've
seen
this
to
be
an
incredible
productivity
boost
on
average,
each
developer
saves
about
25
minutes
per
day
when
they
start
using
automations
as
part
of
their
daily
workflow
and
glenn.
Here's
where
we
get
back
to
you.
I
think
this
is
one
of
the
main
topics
that
you're
going
to
touch
on
in
your
section.
So
I'm
looking
forward
to
hearing
about
it.
A
Yeah,
that's
truly
all
over
the
board.
There's
a
few
stickies
style
tools
that
I'm
a
fan
of,
but
if
you're
thinking
about
actually
diagramming
out,
you
know
I
got
to
tell
you,
it
seems
really
simple,
but
I
tend
to
just
use
google
slides.
I
open
up
a
new
slide
deck.
I
use
the
basic
shapes
and
that
sort
of
thing
for
diagramming
and
you
can
have
a
whole
bunch
of
people
collaborating
at
the
same
time.
They
can
be
commenting
on
it.
They
can
be
adding
in
their
own
contributions.
A
Yeah,
we
can
definitely
get
into
that.
In
fact,
you
know
what
I'm
gonna,
I'm
gonna
leave
that
on
hold
and
I'm
gonna
recommend
a
blog
issue
that
just
came
out
if
you
search
for
friendly
forking,
there's
a
great
little
article
about
how
forks
work
and
why
they're
important
that
just
came
out
on
the
github
blog
so
I'll
leave
that
for
you
there
excellent.
B
Looking
good
cool,
thank
you
for
confirming
yeah,
so
we
just
talked
a
lot
about
culture
on
the
back
half
here
we're
going
to
talk
about
how
we
can
practically
practically
apply
this
now
and
with
regards
to
tooling.
So
what
we're
specifically
talking
about
is
github's
automation
engine
now
for
those
folks
that
are
not
developing
on
github
right
now.
Github
actions
is
our
automation
engine
and
it's
more
of
a
platform
that
is
just
strictly
ci
cd
and
we're
going
to
get
into
that.
I
was
born
in
the
80s.
B
I
got
to
do
some
back
to
the
future.
You
know
so
this
comes
in
the
form
of
workflows.
Now,
workflows
can
really
be
anything.
So,
of
course
we
can
lint.
We
can
test,
we
can
do
ci
cd,
but
also
too
there's
other
tasks
that
you
have
to
do
associated
with
software
development
that
are
not
just
limited
to
ci
cd.
So
really
you
can
do
anything
you
can
bind
to
any
web
hook
or
event
that
happens
within
github
and
we'll
jump
into
some
examples
in
just
a
moment.
B
So
one
of
the
ones
that
we
use
at
github
is
something
called
sale
issues
and
if
you're
in
your
repository,
you
can
do
this
anytime
by
just
navigating
to
the
actions
tab
and
once
you're
there,
you
can
start
to
immediately
add
new
github
actions.
Now,
let's
take
a
look
at
the
marketplace
and
see
which
type
of
actions
that
we
can
that
we
can
wield
here
so
marketplace
by
the
way.
These
are
all
free
and
open
source
by
design.
B
So
if
there's
any
action
that
you
want
to
explore
or
kind
of
click
into,
you
can
fork
it.
You
can
clone
it,
you
can
make
it
your
own.
You
can
modify
it
what's
really
great
about.
This,
too,
is
that
we
have
such
a
variety
now.
You
know
when
we
first
launched
actions
a
few
years
ago.
Yes,
we
had
something
like
you
know-
maybe
a
few
thousand,
but
we
just
seen
such
tremendous
growth
in
the
amount
of
actions
that
we
have
now
we're
approaching
thirteen
thousand
almost
there.
B
So,
even
if
you
took
a
look
at
this,
you
know
even
just
six
months
ago,
I
would
revisit
it.
And
what
we're
doing
here
is
that
we're
really
trying
to
save
developers,
time
everybody's
capable
of
writing
a
yaml
file,
and
you
know,
writing
a
cicd
script.
But
the
limiting
factor
is
is
that
we
sort
of
task
developers
are
doing
more
than
ever
and
just
like
with
open
source.
B
What
we
want
to
do
is
that
we
want
to
wield
what's
already
been
built
and
built
on
top
of
it,
and
the
reason
why
that's
important
is
just
because
again,
the
limiting
factor
is
is
that
we
don't
have
time
to
write,
always
a
complex
csd
script
and
as
we're
aware,
this
is
getting
more
complex,
there's
more
testing
and
linting
and
security
related
tasks.
That
has
to
be
done
as
part
of
the
build
process
and
it's
becoming
a
non-trivial
effort
to
write
a
cicd
script.
B
So
I
highly
encourage
you
to
revisit
the
get
a
marketplace
and
look
at
the
amazingness
that's
going
on
here
and
if
we
click
into
one,
for
example,
we
can
see
here
that
we
have
a
verified
creator,
which
means
that
we
have
verified.
This
action
was
created
by
this
organization,
called
red
hat
actions
and
also
too,
if
you
ever
want
to
see.
What's
going
on
with
regards
to
what
this
action
is,
what
the
source
code
is,
you
can
clone
this?
You
can
bring
this
into
your
own
environment.
B
You
can
look
at
the
code,
you
can
see
the
issues.
This
is
github,
you
know.
So,
if
you,
if
you
find
something,
that's
wrong
and
you
want
to
file
an
issue,
you
can
absolutely
do
that
if
you
want
to
pick
something
or
add
functionality,
fire
up
a
pull
request
and
talk
to
the
developer,
so
this
is
what's
so
cool
about.
It,
too,
is
that
it's
not
set
in
stone.
B
So
yeah
also
too
just
in
case
no
one's
aware
it's
the
number
one
ci
system
on
github,
which
is
a
really
big
deal.
You
know
a
lot
of
folks
are
coming
from
a
lot
of
things
like
jenkins
and
they're.
Coming
over
to
github
actions,
there
are
huge
advantages
to
using
a
ci
cd
system,
that's
integrated
directly
into
where
the
developers
are
working.
B
It's
not
under
the
system
that
you
need
to
log
into
or
another
box
or
another
kind
of
platform,
the
same
place
where
you're
going
to
be
building
the
application
is
right
next
to
your
issues,
which
is
right
next
to
your
code
base
and
your
discussions,
which
is
right
next
to
your
security
issues.
So
is
there
a
huge
advantages
to
not
having
to
keep
jumping
around
between
different
platforms
and
different
systems.
B
B
I
also
want
to
make
you
aware
too,
just
in
case
you're,
not
already
that
we
also
have
a
package
registry
as
well,
so
our
package
registry
is
a
great
way
to
promote
your
packages,
just
like
I
was
saying
before
too.
There
are
huge
advantages
to
this
being
right
within
github.
Now
I
just
want
to
show
off
like
a
great
example
of
a
successful
gita
package
in
this
case
is
going
to
be
linux.
B
I
want
to
show
you
real,
quick,
like
an
example
of
like
a
very
successful
one.
Here
we
have
oracle
linux.
You
can
see
that
it's
been
downloaded
in
this
case,
something
like
one
and
a
half
million
times
extremely
successful.
It's
a
great
way
to
promote
this
and
again
it's
right
from
within
your
github
organization.
People
can
browse
your
packages,
they
can
download
it
and
the
sort
of
content
delivery
network
is
hosted
by
github,
so
you
don't
incur
any
bandwidth
costs
there
and
we
go
to
here
in
chat
too.
B
If
you
have
a
package
or
if
you
have
an
action
that
either
you've
written
or
you
deployed
a
package,
please
drop
into
the
chat
we'd
like
to
check
it
out,
and
that
brings
me
to
another
question
for
the
group
we'd
love
to
hear.
What's
your
favorite
gift
of
action
again,
there's
so
much
going
on
there
and
we've
seen
such
a
sort
of
explosion
of
all
these
different
actions,
we'd
love
to
hear
which
ones
are
your
favorite.
B
B
B
So
as
part
of
this
talk
we're
going
to
be
talking
about
where
he
can
run
so
like
how
he
can
wield
good
objections
and
where
they're
actually
going
to
be
performing
the
compute,
we
want
to
run
efficiently.
So,
of
course,
we
want
to
be
practicing
intersourcing,
we
don't
want
to
be.
You
know,
duplicating
any
efforts.
We
want
to
be
sharing
as
much
as
we
can
across
our
organization
and
then
like
what's
sort
of
top
of
mind
and
what
I
spent
on
majority
of
the
time.
B
I
get
a
ton
of
questions
of
this
every
single
time
we
talk
to
a
company,
is
they
want
to
run
securely?
So,
of
course
we
want
to
ship
fast,
but
we
also
want
to
ship
with
high
quality,
and
it's
sort
of
the
forefront
of
everybody's
mind
that
we
want
to
shift
these
security
operations
into
our
development
pipeline,
and
the
reason
being
is
that
nobody
likes
to
be
surprised
about
anything
security
related.
You
know
talking
to
a
lot
of
developers,
it's
not
that
they
don't.
You
know
that
they,
like
inherently
hate
fixing
security
things.
B
It's
just
that
they
don't
want
to
be
surprised
by
it.
They
want
to
be
able
to
say
okay,
I
have
a
few
security
things
to
take
care
of,
and
you
know
for
that
to
be
accounted
for
within
their
sort
of
standard
workday.
So
you
don't
wait
until,
like
the
very
end
like
when
you're
right,
ready
to
deploy,
and
then
you
find
out,
you
have
these
security
things
that
you
have
to
fix.
B
It's
really
helpful
for
the
developers
to
understand
that
they
have
these
things
so
that
way
they
can
raise
it
with
their
manager
and
bring
it
up
in
their
stand
up
and
that
they
have
enough
time
to
address
them
before
you
go
and
deploy
and
we'll
show
you
how
you
can
use
github
actions
and
the
new
security
features
within
github
to
help
you
manage
that
complexity
yeah.
So,
let's
just
talk
about
running
really
fast
about
how
you
can
run
github
actions
and
how
that
actually
works.
B
B
If
we
have
any
github
enterprise
customers
on
the
call
right
now,
you
and
your
team
have
50
000
minutes
to
draw
upon,
which
is
quite
amazing.
We
see
in
practice
a
lot
of
folks
sort
of
dedicate
that
towards
the
mac,
runners,
yeah
and
just
for
clarity.
We
have
mac
learning
some
windows,
computers
at
your
disposal.
These
are
ready,
24
7,
so
you
can
use
them
whenever
you
like-
and
I
want
to
make
you
aware
too,
that
very
soon
we'll
have
more
powerful
runners
coming.
B
So,
if
there's
any
specific
hardware
that
you
need
right
now,
we
have
pretty
baseline
specs
for
our
github
hosted
runners.
However,
we're
going
to
have
much
more
powerful
machines.
So
that
way,
if
you
want
to
you,
know
quicken
your
build
time
anything
like
that,
we'll
have
great
options
there
and
another
option
too,
is
our
self-hosted
runners.
B
B
You
can
run
it
on
your
own
hardware
and
choose
your
favorite
cloud
provider
of
your
choice,
and
I
want
to
make
you
aware
too
that
recently
we
shipped
the
ability
for
these
to
be
ephemeral.
So
we
have
a
custom,
kubernetes
runner
controller
that
you
can
take
advantage
of
and
when
they're
done
executing
their
jobs,
you
can
tear
them
down
and
not
waste
any
compute
there.
B
So
we'll
make
sure
that
we
drop
a
couple
links
into
the
channel
for
how
you
can
adopt
that
and
please
let
us
know
if
you
have
any
questions
about
it
so
before
we
jump
into
security,
I
just
want
to
make
it
make
you
aware
too,
that
we
really
highly
encourage
everybody
to
share
as
much
as
you
can.
You
know
when,
like
a
software
engineer,
is
joining
your
company,
there
should
be
a
series
of
actions
that
are
provided
to
them
so
that
way
they
know
how
to
build
your
software.
B
We
can't
underscore
enough
that
we
really
want
to
share
as
much
as
we
possibly
can,
because
everybody
at
your
company
can
benefit
from
it,
especially
when
folks
put
a
lot
of
hard
work
into
creating
these
workflows,
and
we
recently
launched
a
feature
that
I
just
wanted
to
call
out
that
you
know
kind
of
solves
a
duplication
of
workflow
files
issue
that
we
had
before.
So
what
specifically
I'm
talking
about
is
a
reusable
workflow.
B
This
is
a
workflow
that
you
can
keep
within
your
organization
within
a
repository
that
people
can
consume
and
you
only
have
to
update
it
in
one
spot.
So,
let's
just
say
that
you
have
sort
of
like
a
you
know,
workflows
repo
as
part
of
your
github
organization,
the
workflow
files
live
within
the
the
github
folder
under
workflows,
and
everybody
at
your
company,
then
within
that
organization,
can
then
reference
that
workflow
file
and
what's
amazing
about
this
too,
is
that
this
only
has
to
be
updated
in
one
spot.
B
You
can
then
have
everybody
just
consume
this
one
workflow
to
handle
this
one
piece
of
functionality,
and
then
that
can
be
updated
if
you
decide
to
change
the
winter
that
you
want
to
use
or
the
technique
or
anything
like
this,
and
you
don't
have
to
update
every
file
manually.
So
we
really
highly
encourage
everybody
to
take
advantage
of
this.
There
are
things
that
we
should
be
sharing
across
the
entire
organization,
and
you
don't
have
to
do
any
duplicate
or
manually
updating
of
all
the
ammo
files.
B
So
turning
it
to
the
group
again,
we
love
to
hear
about
a
process
right
now
that
you'd
like
to
automate.
You
know
we
understand
that
not
everybody
has
like
100
automation
again,
given
the
amount
of
workflows
that
have
been
added
recently.
You
know,
maybe
somebody
types
it
into
the
chat,
maybe
there's
a
workflow
that
we
can
suggest
to
help
you
automate
that
task
and
make
it
more
efficient.
So
we'd
like
to
hear
what
you're
doing
currently
manually
and
we
can
see
if
we
can
get
that
automated
as
well.
B
B
So
we
want
to
make
sure
that
we're
scanning
frequently
and
we
want
everybody
to
be
able
to
work
during
normal
hours.
So
we
want
to
find
out
about
any
security
related
tasks
that
they
have
to
do
as
quickly
as
we
possibly
can.
One
thing
I'll
say
about
this
too,
is
that
we
really
want
to
lean
on
our
automation
systems.
We
want
them
turning
away
and
performing,
builds
and
scanning
everything.
B
B
We
want
to
make
sure
too,
that
you
know
that
we're
enforcing
these
things
and
that
they're
taken
seriously,
so
we
can
enforce
as
a
branch
protection
on
any
repository
any
check
that
we
want
to
make
sure
that
has
to
be
passed
before
we
allow
the
promotion
of
code
into
main
branch.
So
we
will
touch
upon
that
as
well,
so
I'm
going
to
jump
back
into
github's
interface,
but
I
just
want
to
show
you
this
overview
slide,
because
this
is
a
multi-faceted
security
approach
that
we
have
here
at
github.
B
B
This
is
something
that
pretty
much
every
piece
of
software
on
earth
is
doing
now,
like
you
know
whether
we
like
it
or
not.
It
really
just
helps
us
get
software
at
the
door
fast,
but
we
want
to
consume
it
in
a
responsible
way.
What
we
call
securing
your
software
supply
chain,
so
the
components
that
make
up
your
enterprise
software
and
what
I
mean
specifically
about
this-
is
that
there
are
vulnerabilities
filed
against
these
open
source
dependencies
in
the
form
of
cv,
e
c
w
e's
nbds.
B
We
just
want
to
make
sure
that
we're
not
consuming
something
that
has
something
that
can
be
exploited
and
github's
made
it
extremely
easy
for
you
to
manage
that
one
more
thing
too.
This
is
an
advanced
icon
here,
so
on
top
of
the
sort
of
standard
license,
cost
for
github
enterprise,
the
advanced
bits
or
additional
costs
on
top.
I
just
want
to
make
that
clear,
but
we've
added
a
ton
of
security
features,
specifically
secret
setting
code
scanning
and
the
security
overview,
which
we'll
show
you
in
just
a
moment
so
secret
scanning.
B
This
is
something
that
we
see
all
the
time
that
people
accidentally
commit
tokens.
These
are
really
things
that
will
ruin
our
day.
We
don't
want
them
out
shipped
into
our
software.
Some
folks
are
savvy
enough
to
decompile
your
application
and
scrape
your
keys.
We
want
to
know
about
if
we're
shipping
a
key
into
our
code
base,
and
we
make
it
really
easy
for
you
to
do
so
and
then
also
too
for
code
scanning.
We
want
to
make
sure
that
we're
getting
the
results
of
any
code
scanning
tool
that
we
use
in
front
of
the
developers.
B
B
We
want
to
make
sure
that
our
company
is
shipping
high
quality
code,
and
we
can
enforce
this
as
a
requirement
that
if
you
have
something
like
high
and
critical
vulnerabilities
that
you
can't
push
past
it
that
these
have
to
be
resolved
before
we
can
allow
that
code
into
main
branch
and
also
the
security
overview.
We
want
to
understand
the
state
of
security.
You
know
a
lot
of
folks.
You
know
sort
of
struggle
with
this
problem
because
there's
so
many
dependencies
there
are
so
many
scanning
words.
B
Most
folks
are
just
drowning
in
these
and
we
have
to
sort
of
start
to
wrap
our
head
around.
How
bad
is
this
problem?
Where
do
we
begin,
and
maybe
we
can
start
with
the
critical
ones
first
and
then
work
our
way
down
into
like
the
high
end,
criticals
high
and
medium.
So
what
I'm
going
to
do
is
I'm
going
to
jump
back
into
the
interface
here
and
I'm
going
to
show
you
first,
the
security
overview.
B
B
You
can
really
glean
a
lot
of
interesting
insights
about
the
state
of
security
within
your
organization
and,
even
just
in
you
know,
seeing
this
panel
once
it's
just
really
incredible.
So
what
I'm
showing
you
here
is
that
this
is
the
state
of
security
across
all
the
repositories
as
part
of
this
organization
and
again,
you
might
want
to
assess
risk
and
be
like
well
hey,
like
we
have
a
lot
of
high
end
criticals
that
we
need
to
go
and
address.
B
We
can
also
detect
too
what
features
are
enabled.
So
if
someone
doesn't
have
something
like
dependable
enabled,
we
can
go
and
very
quickly
realize
that
and
maybe
go
talk
to
those
repository
owners
and
have
them
enable
it
and
what
I'm
showing
you
specifically
here
is
the
code
scanning
alerts,
the
depend
about
alerts
and,
in
this
case
the
secret
scanning
alerts.
B
So
again,
this
is
across
all
the
repositories
we
can
sort
by
risk
and
if
we
dive
into
one
of
these,
for
example,
like
a
secret
scanning
alert,
we
might
be
able
to
understand
like
what
the
secret
type
is.
So,
let's
just
say
that
you
know
we
have
257
google
api
keys,
that
are
being
you
know
that
are
currently
within
our
code
base.
B
I
wanted
to
mention,
too,
that
we
also
added
the
ability
recently
to
add
a
custom
pattern
as
well
for
regex.
So
let's
just
say
that
you
have
a
secret
or
token
format
in
mind.
You
can
now
add
it
as
a
custom
pattern,
and
we
can
make
you
aware
immediately
about
any
keys
that
match
that
pattern.
Make
the
developer
aware
and
again.
B
B
It's
something
it's
a
mistake
that
github
makes
that
microsoft
makes
that
everybody
makes,
and
I
would
say
the
more
that
you
commit
the
more
likely
you
are
to
commit
a
secret
accidentally,
everybody's
super
busy
and
they're
trying
to
get
features
at
the
door,
and
it's
something
that
we
see
all
the
time.
And
it's
not
like
we're
getting
on
people's
case
for
doing
this.
B
We
just
want
to
make
sure
that
we
protect
our
company's
resources
and
don't
accidentally
commit
any
secrets
so
for
code
scanning
2
we're
going
to
get
into
this
in
a
little
bit.
We're
going
to
jump
into
depend
about
next,
so
dependable.
As
part
of
that
that
chart
that
I
was
just
showing
you
this
helps
you
address
any
open
source
vulnerabilities
that
you're
consuming,
as
part
of
you
know
the
libraries
that
make
up
your
application.
B
This
is
the
constant
battle
that
there's
always
something
that's
going
to
be
disclosed,
that
there's
always
going
to
be
a
new
alert
and
we
want
to
make
sure
that
we
stay
on
top
of
this,
and
this
is
pretty
laborious.
So
github
has
made
it
very
easy
for
you
to
start
to
address
these,
so
you
will
get
a
dependable
alert
for
an
open
source
dependency
that
you're
consuming.
B
So
if
you
click
into
a
dependable
alert,
not
only
do
we
notify
you
that
you
have
a
cve,
that's
filed
against
your
open
source
dependency,
but
then
also
too,
we
provide
you
with
a
security
update.
When
we
first
launched
this
feature,
you
know
we
gave
the
developers
the
option
they
would
have
to.
You
know
open
up
the
pull
request
and
bump
the
package
version,
and
that
was
work
that
they
could
then
choose
to
ignore
to
do
so.
What
we
did
is
that
we
made
an
acquisition
for
dependable
and
we
integrated
into
our
platform.
B
You
can
configure
dependable
by
adding
a
dependable
yaml
file
to
your
github
folder
to
just
always
grab
the
latest
version.
However,
it's
our
recommendation
that
you
grab
the
version
that
has
all
the
open
cvs
filed
against
it
resolved
because
the
latest
versions
of
dependencies
haven't
had
sufficient
time
with
the
community
to
vet
it,
as
you
know,
something
that's
secure
that
might
be
introducing
new
vulnerabilities,
and
maybe
you
want
to
let
it
sort
of
sit
with
the
community
more
time
and
get
more
eyes
on
it.
B
B
Okay.
So
now
I
want
to
jump
into
code
scanning,
which
is
sort
of
super
top
of
mind.
So
you'll
see
here
at
the
top
two
of
our
repository
that
we
have
a
security
tab
if
we
click
into
the
security
tab
and
go
into
the
code
scanning
alerts
and
again
don't
worry
if
you
don't
have
all
these
options.
You'll
have
to
be
future
flag
for
this.
If
you
get
of
event,
security
again
reach
out
to
our
team
and
we
can
get
you
set
up
with
this.
B
One
thing
I
want
to
make
clear,
too,
is
that
koql
is
an
engine
that
we
suggest
and
came
from
an
acquisition
from
a
company
called
semel
which
is
based
out
of
oxford
england.
They
developed
this
engine,
it's
been
extremely
successful,
low,
false
positive
rate,
and
we
can
run
a
series
of
default
queries
against
your
code
base
to
search
for
known
vulnerabilities
within
the
language
that
we're
scanning,
for.
B
I
just
wanted
to
make
it
clear
that
think
of
this
more
as
like
a
sort
of
security
hub-
and
you
can
add
any
scanning
tool
that
you
like
so
the
ver,
the
sort
of
format
of
the
vulnerabilities
comes
in
the
form
of
something
called
serif.
It's
like
a
json-like
file
format
for
vulnerability
data,
but
bring
what
you
have.
If
you
have
an
existing
security
tool
that
you
love,
we
can
pipe
in
those
results
and
give
you
the
same
rich
developer.
Experience
that
I'm
about
to
show
you
as
part
of
codeql.
B
B
What
we
hear
from
a
lot
of
folks
is
that,
when
security
is
on
another
system,
when
it's
in
another
sort
of
interface,
when
it's
just
like
kind
of
needlessly
dumping,
you
know
a
million
issues
into
jira
tickets,
it's
kind
of
disjointed
from
where
we're
developing
it's
not
it's
like
kind
of
over
there
and
some
folks
choose
to
ignore
it.
Then
they
do
something
like
a
biannual
security
build
like
when
they
have
like
40
000
alerts
and
we'll
just
say
that
we'd
rather
fix
one
than
delay
it
and
just
like.
B
So
I'm
going
to
click
in
and
show
more
details.
So
the
first
thing
that
a
developer
is
going
to
do
is
put
a
break
point
on
that
line
66
and
start
to
wrap
their
heads
around.
What's
going
on
here,
because,
as
we
know,
if
we
have
any
developers
that
are
on
the
call
right
now,
the
security
fix
is
not
always
a
single
line
fix.
It's
not
like,
you
would
just
hit
one
character
and
then
okay,
now
it's
fixed
and
we
can
move
on
with
our
with
our
work.
B
You
know
we
have
to
understand
the
full
story
about
what's
going
on
here.
We
need
to
understand
where
the
string
is
entering
the
application,
which
methods
and
classes
it
touches
and
then
eventually
where
it's
executed
on
the
database.
So
in
this
case
it's
a
query
built
from
user
control
sources.
You
know
classic
sql
injection.
We
need
a
bigger
picture
about
what's
going
on
here
and
because
code
ql
executes
a
compilation
time.
B
We
can
provide
a
rich
recommendation
for
how
you
should
fix
this.
We
can
show
you
an
example
of
a
bad
fix
of
sql
injection
and
a
good
fix
again.
It's
sort
of
it's
another
task
that
we're
sort
of
burdening
developers
with.
They
also
now
have
to
be
sort
of
security
experts.
Our
security
experts
at
our
companies
can
provide
this
and
modify
this
recommendation
if
they
want
to
to
give
developers
a
path
forwards.
B
B
One
more
thing
I'll
mention
about
this
too,
is
that
we
can
also
write
custom
rules,
so
we
can
drop
into
the
chat,
the
cwes
and
all
the
coverage
that
we're
looking
for
within
all
the
languages
that
we
support
and
co.
Ql
supports,
c
and
c,
plus
plus
c
sharp,
go
java,
javascript,
python,
ruby
and
we'll
be
adding
support
soon
for
more
languages.
B
B
I
just
wanted
to
add
one
more
thing.
Just
space
themed
here
nasa
discovered
a
critical
bug
within
their
flight
code.
This
fly
code
was
written
in
c
and
I'm
just
sort
of
like
underscoring
that
again
it
doesn't
matter
what
company
you
work
for.
What
team
you're
working
on
everybody
makes
mistakes
and
it's
something
that
happens.
B
They
had
an
issue
where
they
weren't
checking
the
size
of
an
array
before
passing
it.
They
weren't
checking
the
size
of
the
array
before
performing
an
operation
on
it,
and
you
know
that
can
be
bad
because
we
can
pass
an
incorrect
size
array
and
then
have
like
you
know
an
exception
that
could
happen
so
anyways
the
team,
our
team
at
github,
previously
seml,
wrote
a
query
to
then
track
this
down
within
their
code
base.
B
They
found
like
sort
of
like
I
think
it
was
like
24
other
logical
instances
of
this
happening.
They
had
to
point
the
deep
space
dish
network
at
the
curiosity
mission
that
was
in
route
to
mars,
to
hop
fixes
essentially
to
make
sure
the
software
inherited
the
software
fix,
while
the
rovers
were
enroute
to
mars
in
anyways.
I
just
want
to
share
it
because
it
was
something
that
was
kind
of
fixed.
B
As
the
mission
was
already
shipped,
they
were
able
to
update
the
software
in
a
very
low
bandwidth
way
and
it
saved
the
entire
mission
later
in
integration
testing.
I
said
that
they
hypothesized
that
the
parachutes
wouldn't
have
opened
had
they
not
had
hop
fixes
so
anyways.
It's
just
one
of
my
favorite
examples
is
sort
of
that.
We
really
do
have
to
check
our
code.
B
It
is
mission,
critical
and
in
certain
cases
it
can
save
an
entire
mission.
So
just
real
quick
to
recap:
here
we
want
to
run
securely.
We
want
to
enforce
branch
protections,
we
want
to
run
securely.
We
want
to
shift
as
many
security
operations
into
our
development
pipeline.
We
want
to
run
everywhere.
We
can
either
take
advantage
of
github's,
hosted
or
self-hosted
runners,
and
we
want
to
run
efficiently.
We
want
to
make
sure
that
we're
sharing
as
much
of
these
workflows
as
we
possibly
can
so
john
I'm
going
to
turn
it
to
you
for
a
second.
A
Have
so
many
questions,
we're
certainly
not
going
to
get
to
them
all
in
the
next
seven
minutes,
so
I'll,
try
and
feed
you
a
few,
and
let
me
know
what
you
want
to
take
and
what
you
want
me
to
take.
You
know
first
off
we've
got
a
couple
of
questions
about
actions
are
marketplace
actions
limited
to
public
repositories,
and
we
should
probably
mention
reusable
or
closed
there
as
well.
I'm
guessing
and
also
folks
want
to
know
are
all
the
marketplace,
actions
that
are
available.
B
B
They
want
to
maintain
their
own
instance
behind
their
firewall
of
github
and
we
have
an
on-premises
server
product
and
by
the
way
too,
if
you're
a
subscriber
to
github
enterprise,
we
give
you
a
seat
on
both
platforms,
so
some
folks,
like
kind
of
run,
a
hybrid
model,
they
have
some
repositories
that
they
keep
on
premises
and
they
put
the
rest
on
github
enterprise
cloud.
Github
enterprise
gives
you
a
seat
on
both
all
right.
B
So
to
answer
your
question,
of
course,
the
github
marketplace
actions
you
can
pull
those
down
and
bring
them
onto
your
server.
We
also
have
synchronization
too,
that
if
you
did
want
to
consume
actionsfrom.com,
we
have
a
secure
mechanism
called
getupconnect,
where
we
can
connect
your
github
enterprise
server
instance
to
github
enterprise
cloud
for
a
variety
of
reasons,
one
of
which
to
transmit
actions.
So
if
you
did
want
to
pull
them
down,
you
can,
in
addition
to
for
security
updates.
B
Some
folks
will
air
gap
github
enterprise
server,
but
that
is
a
little
bit
tricky
because
then
they're
still
consuming
open
source
dependencies,
but
they're
not
aware
of
the
vulnerabilities.
Then
we
have
a
secure
mechanism
that
connects
a
github
enterprise
server
to
github
enterprise
cloud
for
the
purposes
of
transmitting
that
vulnerability
data
to
make
sure
that
you're
not
consuming
vulnerable
versions
of
open
source
dependencies
by
air
gapping
and
for
those
server
customers
that
are
on
right
now.
I
really
highly
highly
recommend
turning
that
on
so
now
actions
are
not
just
public.
B
You
can
absolutely
create
ones
that
are
private
as
well,
and
we
see
this
all
the
time
again.
We
really
want
to
encourage
folks
to
share
as
much
as
they
possibly
can
and
that's
one
mechanism
that
you
can
use.
You
can
write
your
own
private
actions.
One
more
thing,
too,
is
that
if
you
don't
want
folks
just
consuming
any
action
that
is
on
like
our
marketplace,
you
have
control
the
administrators
of
your
github
instance,
both
in
enterprise
cloud
and
an
enterprise
server.
B
If
you
want
somebody,
that's
curating
which
actions
that
you're
using
we
have
built-in
controls.
Now,
where
somebody
could
just
out
sort
of
designate,
a
single
repository
where
you
can
have
like
a
you
know,
a
curated
actions
repository
essentially
and
then
your
administrator
can
say:
well,
only
actions
can
be
pulled
from
this
one
repo.
B
A
Nice,
nice,
okay,
so
there's
another
question
too
here
on
arm
based
runners
and
I'll.
Take
that,
if
that's
cool,
which
is
that,
to
my
knowledge,
we
don't
have
a
public
roadmap
for
cloud
based
or
github
hosted
arm-based
runners,
but
you
can
install
a
self-hosted
runner
on
an
arm
architecture.
I
myself
have
an
nvidia
developer
board
in
the
other
room
that
I
run
a
self-posted
runner
on
to
ship,
my
machine
learning
jobs
off
to
so
for
anyone
who
hasn't
done
it
yet
self-esteem
runners
are
really
awesome.
A
They
let
you
use
the
same
mechanisms
inside
your
repo
itself
for
creating
visualizing
tracking
logging,
those
workflows
but
the
actual
activity.
The
actual
processing
can
occur
on
a
device
that
you
specify
you
install
a
self-posted
runner
client
there
and
then
specify
in
the
repo
that
it
will
connect
to
that
particular
device
for
certain
workflows.
So
that's
your
your
work
around
for
for
arm
based
runners.
There.
B
This
is
for,
like
m1
max,
like
that
seems
to
be
like
very
popular
and
something
that
we're
working
on
right
now.
So
first
off
we'll
have
shortly
and
I'll
say
shortly
generically
that
we
are
working
on
m1
support
apple.
You
know
the
apple
silicon
for
self-hosted
runners
and
then
we
will
have
get
a
posted
runners,
two
that
are
on
m1
in
the
in
a
bit
right
now.
B
It's
we
have
some
hardware
ordered
for
it
and
it's
something
that
we
would
like
to
host
within
our
device
cloud
and
it's
something
that
we're
working
on
very.
We
know
everybody
wants
the
m1
max
and
they're
really
hard
to
get
and
they're
pretty
expensive.
It's
something
that
our
team
is
working
on
and
please
keep
us
informed
about
what
you
need
there
hardware
wise,
because
we
are
building
this
cloud
to
be
most
useful
for
you
and
your
feedback
helps
us
shape
sort
of
what
machine
types
we
pick.
So
thanks
for
letting
us
know.
A
Awesome
thank
you
for
that
that
update
that's
super
exciting
to
hear,
especially
as
a
heavy
mac
user
myself.
Of
course
I
wanted
to
address
another
comment
in
here.
Someone
said
dependable
is
nice
and
works
on
private
repos,
but
code
scanning
does
not,
as
far
as
I
know
so,
glenn.
My
understanding
is
that
their
route
to
that
would
be
through
github
enterprise
addiction.
Right.
Do
you
know.
B
Excellent
question
so
yeah,
that's
a
very
astute
observation,
a
lot
of
the
things
that
github
ships
is
also.
We
allow
open
source
repositories
where
our
platform
really
promotes.
Like
again
we
we
love
open
source.
We
know
it's
the
engine,
that's
really
driving
a
lot
of
amazing
initiatives
and
we
make
a
lot
of
things
available
for
free,
so
yeah.
If
you
have
a
public
repository,
you
can
use
specifically
code
scanning,
there's
one
important
distinction
between
that
and
github
advanced
security.
B
So
if
you
do
want
to
do
private
source
code
scanning-
and
you
want
to
see
the
security
overview-
and
you
want
to
do
private
secret
scanning-
we
highly
highly
recommend
reaching
out
to
our
team.
That's
part
of
our
github
advanced
security
offering
so
it
will
be
specifically
just
code
scanning
for
public
repositories
that
you
have
access
to.
But
the
bigger
suite
of
tools
at
your
disposal
for
private
repositories
is
something
that
we
future
flag
enable
through
the
advanced
security.
A
B
And
one
more
thing
too:
we
have
more
great.
If
you
want
to
pull
in
the
security
thread,
we
have
experts
that
will
be
presenting
tomorrow.
I
highly
recommend
checking
out
both
of
these
both
from
a
customer's
perspective
and
then
also
too.
If
you
have
any
security
questions,
please
bring
them
to
the
sessions
tomorrow.