►
From YouTube: Secure cloud development and delivery - Universe 2022
Description
Presented by: Chris Johnson
Chris Johnson will talk about how Eli Lilly and Company adopted GitHub's services to create a better development environment for the company's engineers and increase speed of delivery to Eli Lilly's cloud pipelines across the enterprise. Chris will share the benefits that Eli Lilly has gained by working with GitHub and how value was obtained in key areas across Eli Lilly, including custom development environments with Codespaces, security with Dependabot and GitHub Advanced Security, and GitHub Actions for building and deploying to cloud environments.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
A
My
name
is
Chris
Johnson
I'm,
a
tech
lead
at
Eli
Lillian
company,
and
one
of
the
things
that
I'm
very
passionate
about
is
creating
new
solutions
to
help
simplify
processes,
and
that's
why
I'm
really
excited
to
share
with
you
the
benefits
that
Lily
has
seen
in
adopting
GitHub
Services.
It
really
has
simplified
our
existing
processes
and
made
everything
easier
to
manage.
It
was
also
surprisingly
easy
for
us
to
get
started
and
roll
out
these
services
for
our
users
and
I'm
wanting
to
show
you
how
it
can
help
reduce
your
Enterprise
headaches
as
well.
A
Now,
some
background
on
Eli,
Lilly
and
Company
Lilly
was
founded
over
146
years
ago
in
Indianapolis,
and
it's
still
headquartered
there.
Today
we
have
more
than
36
000
employees
worldwide
and
have
research
and
Manufacturing
sites
in
more
than
seven
countries
with
our
products
marketed
in
over
120
countries
in
the
world.
If
you'd
like
to
learn
more,
go
to
lily.com
I
wanted
to
highlight
this
first,
because
github's
security
model
and
repository
hierarchy
structure
has
allowed
Lily
to
easily
enable
new
services
that
GitHub
has
launched.
A
Cloud
computing
has
been
a
major
challenge
for
Lily
in
the
last
few
years
to
stand
up
securely
across
our
whole
Enterprise
because
of
codespace's
security
model.
The
isolated
ephemeral
compute
inside
github's
Cloud
was
a
major
win
with
our
information
security
team.
This
provided
a
remote
development
environment
external
to
Lily,
where
packages
and
libraries
could
be
installed
which
weren't
being
installed
locally
on
Lily
connected
devices.
Access
to
code
spaces
was
also
managed
through
a
mix
of
organizational
controls
and
the
inherited
security
model
for
the
repositories.
A
It
offered
a
simple
self-service
solution
to
a
problem
that
Lily
has
struggled
with.
Since
we
were
moving
to
the
cloud
and
the
value
we
saw
with
code,
spaces
came
immediately
and
from
our
research
it
organization,
they
went
from
two
weeks
of
onboarding
a
new
developer
to
a
project
down
to
just
15
minutes.
Our
research
organization
had
stood
up
their
own
cloud
compute
offerings
before,
but
when
code
spaces
was
available,
they
immediately
switched
over
and
they
saw
a
better
development
experience,
reduced
Cloud
costs
and
no
more
worrying
about
the
cloud
infrastructure,
maintenance
or
those
headaches.
A
With
that.
We
also
found
value
you
for
code
spaces
in
the
area
that
we
didn't
think
of
initially,
which
was
working
with
our
external
contractors.
Previously,
we
would
have
had
to
onboard
them
to
Lily,
set
up
and
manage
a
special
compute
environment,
which
was
also
costly
and
required
a
lot
of
Maintenance.
This
was
not
a
great
developer
experience
for
our
contractors,
working
with
Lily,
but
thanks
to
code
spaces,
we've
been
able
to
retire
those
existing
development
environments
and
have
them
use
and
deliver
their
work
directly
through
code
spaces.
A
It
gave
us
insights
into
vulnerabilities
for
our
internal
projects
since
enabling
these
features
organization
wide.
We've
worked
very
closely
with
GitHub
as
our
partner
in
how
to
troubleshoot
and
remediate
some
of
these
vulnerabilities
at
scale.
We
partnered
with
GitHub
through
their
Fast
Track
program
and
has
given
us
a
great
deal
of
insight
and
suggested
patterns
as
well
that
we've
implemented
to
get
a
better
handle
on
managing
our
17
000
repositories.
Security
is
always
an
ongoing
journey
and
having
GitHub
as
a
partner
has
really
helped
in
reducing
our
threat
landscape.
A
Lily's
gone
through
a
few
iterations
of
internal
Cloud
pipeline
to
help
standardize
and
accelerate
our
users
to
deliver
their
Solutions
faster
to
their
customers
when
working
in
a
central
I.T
services
for
a
large
organization
such
as
Lily
we've
taken
on
the
mindset
of
the
customer
of
my
customer,
and
we
work
to
make
sure
that
our
customers
look
good
and
deliver
value
to
their
customers
so
that
we
all
succeed
together.
Our
partnership
with
GitHub
has
made
it
so
easy
on
us
to
deliver
value
to
our
internal
customers,
and
this
is
seen
especially
in
GitHub
actions.
A
The
process
was
taken
around
10
to
15
minutes
for
the
jobs
to
start
up
and
then
another
10
minutes,
depending
on
the
size
of
it,
to
actually
deploy
to
a
specific
cloud
account
for
that
project.
Overall,
this
process
was
very
managed
opinionated.
It
required
a
large
amount
of
support
to
maintain
and
troubleshoot
issues.
There
was
also
security
concerns,
as
well
with
this
architecture
and
with
those
issues
we
promptly
shut
down.
Our
Cloud
pipeline
in
favor
of
cloud
pipeline
version
2.
A
our
Cloud
pipeline
V2,
was
a
more
Cloud
native
approach
to
setting
up
pipelines
that
would
connect
back
into
GitHub.
It
was
more
self-service,
less
opinionated
than
the
first.
We
also
provided
ourselves
a
lot
of
starter
templates
for
our
users
to
help
streamline
some
of
their
Cloud
security
practices.
A
We
saw
a
lot
better
performance
around
deployments,
which
were
now
only
taking
around
10
to
15
minutes.
On
average,
there
was
still
less
for
us
to
maintain,
but
it
still
required
the
main
pipeline
to
be
maintained
and
updated
for
major
versions
and
a
lot
of
Consulting
on
how
to
actually
use
it.
Now
Lilly
has
a
lot
of
different
hosting
options,
as
different
parts
of
our
business
have
different
requirements
and
different
vendors
that
we
work
with.
A
If
we
try
to
scale
and
support
other
offerings,
we
would
need
to
replicate
that
functionality
in
each
Cloud,
which
goes
against
these
principles
of
staying
dry
or
don't
repeat
yourself
when
you
find
yourself
repeating
a
solution,
it's
better
to
take
a
step
back
and
refactor
it.
So
that's
exactly
what
we
did.
We
took
a
step
back
and
we
looked
to
see
what
GitHub
was
offering
for
deployment
to
the
cloud.
Of
course
it
was
actions,
but
what
was
new
in
the
actions
for
this
past
year
was
GitHub
actions
oidc
provider.
A
This
solution
was
a
major
win
for
us
and
with
the
collaboration
of
our
cloud
and
our
information
security
teams,
we
were
able
to
roll
this
pattern
out
to
all
of
our
Cloud
accounts.
This
allowed
for
our
developers
to
fully
take
advantage
of
the
self-service
model
and
deploy
any
way
they
want
and
to
whichever
Cloud
they
want
to
so
long
as
it's
all
running
through
GitHub
actions,
our
goal
was
to
be
less
opinionated
and
reduce
our
amount
of
support
needed
for
our
Cloud
Pipelines
with
GitHub
actions.
A
That's
been
extremely
easy
and
our
developers
are
much
happier
using
actions
from
our
early
performance
results
on
projects
that
have
migrated
from
our
V2
pipeline
to
our
new
V3
actions
pipeline
are
pretty
impressive,
they've
gotten
down
to
an
average
of
just
three
minutes
per
deployment
compared
to
the
10
minutes
that
they
were
seeing
on
our
average
project
size,
and
even
our
larger
projects
that
were
taking
20
minutes
to
deploy
are
also
taking
just
three
minutes
to
deploy.
So
our
customers
are
delivering
value
faster.
A
Working
with
GitHub
and
adopting
the
solutions
that
they
have
rolled
out
has
given
us
a
better
development
experience,
faster
deployments,
a
more
secure
environment
and
significant
Cloud
compute
savings,
as
well
as
a
larger
organization.
The
ability
to
simplify
and
enable
our
developers
is
usually
a
challenge.
However,
where
we've
partnered
with
GitHub
they've,
made
it
extremely
easy
for
us
to
deliver
to
our
customers
next
year.
A
We're
going
to
be
running
a
proof
of
concept
for
GitHub
co-pilot
and
we're
excited
for
universe
and
to
see
what
is
coming
up
next
for
us
to
adopt
where
Lily
has
partnered,
with
GitHub,
with
code
spaces
actions
and
all
their
other
services.
We're
very
excited
for
the
future,
and
thank
you
all
for
joining
this
session
today.