After almost every governance conversation, I get the same follow-up question: “Can you send the links again?”, so here are some common references around different topics: Enterprise governance foundations GitHub Actions governance and supply chain controls GitHub Advanced Security GitHub Copilot governance Of course these can be combined with other best practices, like the GitHub Well Architected…
I’ve been building an extension that gives you insights into your AI usage when coding — how many tokens you consume, which models you prefer, how you structure your prompts, and what your environmental footprint looks like. It’s called AI Engineering Fluency and I recorded a walkthrough video showing what it does. What it does After installing the extension, it reads local log files from your AI…
GitHub Copilot moves to usage-based billing on June 1 . We have already seen customers that will see their AI spend on Copilot go to 2x or 3x (median), with some even going 8x! And this is happening across all model hosters and vendors: Anthropic has been pushing people onto their Max tiers ($200/month) and metered Claude Code usage. Gemini, Cursor, Windsurf, and the rest are doing the same math…
Today GitHub released the GitHub Copilot App into technical preview. I’ve been using it as my daily driver for a while now, so I started a video series to share what I’ve learned. This post covers the intro to the app and a first look at using it for repository maintenance. The app is a standalone desktop experience — available on Windows, macOS, and Linux — built specifically for agent-driven…
Today I had a fun one, where I finally dove into something that was bothering me for days: since a couple of days I had been getting questions from my different GitHub Copilot sessions to close some GitHub nofications, and only from a very specific type of notification: deployment statuses. I noticed I got these accross different projects, so I was tempted to blame the use of a new tool that…
Over the past few years I’ve been building a collection of open source tools focused on GitHub, DevOps automation, and more recently AI tooling. Some have hundreds of dependents, others are still in the planning phase. I wanted to share an overview of these projects in one place, both to highlight the work I’ve been doing and to hopefully inspire others to contribute or build their own tools in…
A lot of the recent additions to the GitHub Copilot ecosystem add real value for individual developers, yet they also expand the security surface that an enterprise has to reason about. Most of these new entry points let a developer pull executable instructions, configuration, or full processes from any random repository on the internet, with very little or no central control. This post looks at…
I’ve been using the GitHub Copilot CLI as my main terminal assistant for a while now. It works great with GitHub-hosted models (Claude, GPT-4) but that means every command, every file you give it context about, every prompt goes over the wire to a cloud provider. And what’s worse: it means that the cloud provider is hosting the beefy LLM model for me, incurring a lot of compute cost. So I wanted…
Microsoft has stopped their partnership with Credly for hosting certification badges and instead centralized everything to the Microsoft Learn platform. However, if you still want to showcase your Microsoft Certification badges in Credly, you can do so by following these steps: Microsoft Learn steps Log in to your Microsoft Learn account. Navigate to the “Credentials” section of your profile. Open…
In this post, I will walk you through an example of different ways to use the GitHub Copilot Coding Agent to automate a coding task. The Coding Agent is a powerful feature that leverages AI to help you write, review, and refactor code more efficiently. It uses a prompt coming from one of the locations below and will then have a runtime inside of a secured GitHub Actions environment to execute the…
Some important changes are happening, which means you will need to start paying for the amount of Generative AI you use with GitHub Copilot. This will finally make the end-user think about the monetary cost of executing a request with a Large Language Model, so they realize this stuff is not running for free. In that sense we have been spoiled, so it is time to take up some ownership here for the…
Where the current focus on productivity is wrong The focus on having more productive engineers is not the right way to go. I see companies struggle all the time defining what productivity even is, and then they still tend to focus on lines of code accepted as a sense of productivity. Us engineers are busy all day with tasks like requirements engineering, architectural work, documentation, and…
TL;DR: Changing the narrative on GitHub Copilot from focus on engineers and productivity to focus on a sturdy (DevOps) foundation to be able to go faster. Next frontier: the rest of our organization Premise: current narrative is not helping In my opinion we need to shift the narrative on enabling engineers to use GitHub Copilot. Currently there is a lot of focus on the engineers that can produce…
Last Friday what we expected happened: a much used GitHub Action got compromised, read all about it here at the StepSecurity blog where they explain that they detected the issue and jumped into action: Step Security Blog . So what happened? What happened? An Action that was used by over 23.000 public repositories (and who knows how many more private repositories) suffered a compromise where an…
Today I shared my story on why and how we can protect ourselves against supply chain attacks. This talk was part of the DevCon Romania 2024 conference on the DevOps track. I find it important to share with folks how to think about our supply chains in the software we deliver, from dependencies we deploy to production, to everything that touches the code before it gets into the production…
This year I got to share my story on how I think you can successfully scale GitHub Copilot to thousands of developers. This talk was part of the GitHub Universe 2024 conference in San Francisco, one of my favorite conferences to go to every year. The vibe of the GitHub community is always so welcoming and inspiring! Every one is very open and approachable, and you never know who you might bump…
Need to use the Azure Inference AI SDK in Python against Azure OpenAI? Then this tip is for you! I ran into an issue converting the default examples to not run against GitHub’s Model endpoint but against an Azure OpenAI endpoint. The code example below says it all: configure your credential the correct way to get this to work. import os from azure.ai.inference import ChatCompletionsClient from…
GitHub Copilot is a great tool to help you write code. The next phase is starting now by enabling you to write your own extensions for Copilot! This is a great way to extend the capabilities of Copilot to your own needs. You can for example look in your own knowledge store for information, or even call into an API to get the information you need. All from within GitHub Copilot Chat itself! Some…
Learn how I use GitHub Copilot Chat to my benefit and see the end to end flow on creating a script to call into the GitHub API. I’m showing my prompts and the results, as well where Copilot failed to help me in one go. With spening more time on my propmt up front, I managed to get a much better result that with the first attempt! Video In this video I show how I use the chat feature to let Copilot…
I’ve recorded a video series on the lessons I learned to get the most out of GitHub Copilot. This series is called “Levels of Enlightenment” and can be found in this YouTube Playlist . An overview of these level of enlightenment can be seen in this image: Overview Learn about my journey using GitHub Copilot over the last year and a half. Each video in this series shows one of my lessons learned in…
Learn how I use GitHub Copilot to my benefit and see the end to end flow on a code refactoring example where I extract a script from a yaml pipeline (GitHub Actions) into a separate file. I’m showing my prompts and the results, as well where Copilot failed to help me in one go. With a follow up question and call, I still managed to get the result that I wanted! Video Slides The slides for this…
GitHub Advanced security has gotten quite a big update in public beta at the moment that helps with the rollout of Advanced Security features across your organization. It is called “Code security configurations” and it allows you to set up a default configuration for some or all repositories in your organization. Previous situation Up to now there where only three options during the rollout:…
When you start running CodeQL scans on your Azure DevOps environment on self-hosted runners, you’ll learn that you have to do one extra step and that is install (and keep up to date!) the CodeQL bundle on your self-hosted runners. If you don’t do this, you’ll get an error like this: Following the url in the error will bring you to the docs where you might notice the following three bullets: Pick…
It’s that time of the year again! Time to look back at the most viewed blogposts of the year. I’m always amazed at the number of views some of these posts get. I’m also amazed at the number of people that find my blogposts useful. I’m glad I can help out! Here is the overview: # Title Published Description Views 1. 2022 GitHub workflows not starting 🙀The most viewed for a reason! When your GitHub…
GitHub Advanced Security for Azure DevOps My newest LinkedInLearning Course is available now! This course is all about GitHub Advanced Security for Azure DevOps. It’s a great way to learn how to use the GitHub Advanced Security features in your Azure DevOps pipelines, with practical examples. There is even an example repository that you can use to follow along with the course. You can find the…
The GitHub UI displays a couple of helpful tips to use in triaging your Dependabot alerts which are super helpful. Unfortunately the User Interface does not show these filters in the filter bar yet, so I wanted to have a better overview of the filters I could use. I’ve listed them below: Only show alerts where your code is using the vulnerable calls of the dependency This is very helpful in…
GitHub Advanced Security for Azure DevOps (GHAzDo) builds on top of the functionality for GitHub Advanced Security and is giving you extra security tools to embed into your developer way of working. It’s a great way to get started with security in your Azure Pipelines and Azure repos and I’ve written about it before in this blogpost . Loading the alerts from the API’s Before starting with the…
I had the pleasure of speaking at Developer Week ‘23 in Nuremberg, Germany ( link ) this year. Below you can find the slides that go with my sessions that have all the links you’ve seen in the session. GitHub Actions: Beyond CI/CD With GitHub Actions you can do so much more then just CI/CD! I’ve validated the links on my blogposts, automated my issue management and provided easy configuration of…
A common issue we see with self-hosted runners is that they can leave behind files that were created or modified by the action. This is because the action runs in a container and the container is using a root user to do its work. The GitHub documentation says to run the the runner service as root as well, to have the most compatibility with most runners. This is not a good idea, as it can lead to…
Every time I need to write to the GITHUB_STEP_SUMMARY in GitHub Actions from the actions/github-script action (or from Typescript), I need to search for the blogpost that announced it’s existence. So I’m writing this blogpost to make it easier for myself to find it a lot easier, including some working examples. Photo by Markus Winkler on Unsplash The code for the summaries lives in the…
I will be speaking at GOTO; Aarhus link this year. Below you can find the slides that go with my sessions that have all the links you’ve seen in the session. Protect your Code with GitHub Security Features Creating modern software has a lot of moving parts. We all build on top of the shoulders of giants by leveraging closed/open source packages or containers that other people have shared. That…
Microsoft is bringing some of the GitHub Advanced Security tools to Azure DevOps. I have been playing with it for a while and they have presented the latest state at Microsoft Build 2023, which includes a Public Preview! . That means you can try it out yourself, and I can finally share my experiences with you! Since I teach a lot people on how to use this on GitHub, you can find some of the…
I had the pleasure of speaking at VS LIVE! in Nashville link this year. Below you can find the slides that go with my sessions that have all the links you’ve seen in the session. W19 GitHub Actions: Beyond CI/CD With GitHub Actions you can do so much more then just CI/CD! I’ve validated the links on my blogposts, automated my issue management and provided easy configuration of my trainings that…
During an innovation day at work, I needed to generate extra code and a new application. I wanted to check out the newly released Deployment Protection Rules that can help you with protecting when a job in GitHub Actions can roll out your application to an environment. Deployment protection rules need a new GitHub App that can be triggered when an environment is targeted. That App can then run its…
To enable CodeQL on GitHub Enterprise Server you need to make sure you have GitHub Actions setup and running, including your own set of self-hosted runners. You can read more about that in my previous post here . From that point you can get started to enable CodeQL. Of course, you’ll need to have it enabled in your license, and upload that license file to your server as well. Enabling starts at…
After scanning the GitHub Actions Marketplace for the security of those actions (read that post here ) I was curious to see what happens if I’d enable Secret Scanning on the forked repositories. I regularly teach classes on using GitHub Advanced Security (where secret scanning is part of) and I always tell my students that they should enable secret scanning on their repositories. I even have a…
Recently I’ve started to add the OSSF scorecard action to my (action) repositories. This is a GitHub action that will run the OSSF scorecard checks against your repository to see if you are following best practices, like having a security policy, using a code scanning tool, etc. Using this badge can give your users a quick overview of the security of your repository. OSSF stands for ‘Open Source…
Recently we had to call the GitHub GraphQL API for creating a new GitHub Project (with V2). Since this can only be done with the GraphQL API, we had to figure out how to do this. We found little bits and pieces of information, but no complete example. So we decided to write one ourselves. I hope this helps you as well. ProjectsV2 GitHub GraphQL API The new GitHub Projects simply do not have a REST…
I was giving a training today on GitHub Actions and learned something new! One of the attendees asked about being able to read and write to Repository Secrets without having admin rights. I had never tried this before, but it turns out it is possible! The premise: To be able to create actions on the repository you need to have Admin access to the repository: otherwise the UI will not be visible,…
My LinkedIn Learning course on GitHub Advanced Security (GHAS) has been released! In this course I teach you all about the features of Advanced Security: Dependabot Code scanning Secret scanning You can watch it with a LinkedIn Learning account (30 day trial is available) with this link: GHAS on LinkedIn Learning . Teaser for the training:
TL;DR The runner just downloads what you specified, by getting it from the tag The runner does not do SemVer at all. It’s up to the maintainer Even GitHub does not update (or create) all SemVer versions, so @v3 is not necessarily the latest thing for v3! The marketplace shows releases, not tags. If the maintainer does not actually release, it’s not visible It’s more secure to use a SHA hash…
When customers start using GitHub Enterprise with Actions and private runners, there are some common gotcha’s you can run into. In this post I’m sharing the ones I have encountered so far. Even Dependabot comes along, since that runs on Actions as well for GitHub Enterprise Server. List of topics: First of all: Don’t use self signed certificates on GitHub Enterprise The default actions in will…
Placeholder for sharing the slide deck for Techorama: session link Abstract: Attacks against your pipelines are more and more common these days. We’ll go over the attack vectors you need to be aware of and how someone could potentially misuse a simple setting to hijack your environment, with very large consequences. From breaking out of your shell scripts in the CI/CD pipeline, misusing typo’s in…
I have the pleasure of virtually speaking at dotnetsheff and these are the slides for it: Creating modern software has a lot of moving parts. We all build on top of the shoulders of giants by leveraging closed/open source packages or containers that other people have shared. That makes securing our software a lot more complex as well! In this session you’ll learn what possible attack vectors you…
I have been a fan of GitHub Actions since the beta in the end of 2019. And the more I use them and create my own, the more I have this growing itch to see how these actions are made, how active the community is, and what we can do to improve this ecosystem. So I decided to do some research and see what I could find out. I already have a (now inactive) Twitter bot that scrapes the GitHub Actions…
Check the GitHub status! Every once in a while there is an outage on e.g. GitHub Actions, and I see a lot of influx of users on this blogpost. So before you start reading this, check the GitHub status page to see if there is an outage. If there is, you can wait until it is resolved. If there is not, you can continue reading this post to see if you can find the cause of your issue. Outages can…
I wanted to describe how my flow usually works for creating a GitHub Actions . People often struggle to think of something to build because they start with an empty canvas: the action itself. That is not how I build up the action. For me the process is as follows: Have a need for something straightforward: like calling the GitHub API in a certain way. Create a small github-script for it to see if…
I have the pleasure of speaking at Code Europe and these are the slides for it: Creating modern software has a lot of moving parts. We all build on top of the shoulders of giants by leveraging closed/open source packages or containers that other people have shared. That makes securing our software a lot more complex as well! In this session you’ll learn what possible attack vectors you need to…
I had the pleasure of giving 3 sessions at NDC Security in Oslo on April 6th and 7th. After 2,5 years of not being at a conference in real person, this was the first time speaking in front of an audience and sitting in on sessions in real life! Super weird to do in this time of turmoil in the world, but when you sign up to speak, the conference organizers are relying on you to show up of course!…
I notice a lot of people getting lost in their GitHub notifications. Here is what you can do to get some control back! The default settings send you emails for everything. A lot of people then create an email rule to move all those emails to a specific folder, which means they will never look at those emails again! With some tweaking you can make the notifications work for you. If you want to see…