GitHub

A trust checklist for GitHub Actions

Every action you reference in a workflow runs on your runner, with access whatever token you hand it. `uses: some-org/some-action@v3` is an instruction to execute someone else's code. It deserves at least as much scrutiny as a production dependency, and receives considerably less.

GitHub

Can one agent start another? Queueing sub-tasks in GitHub Agentic Workflows

Consider a "dark factory" setup: a software factory with almost no people on the production line. A small number of people orchestrate the system, but agents do most of the work: planning, coding, reviewing, securing, deploying and reporting back. The goal is to define the factory itself as code.

GitHub

Ground your GitHub Copilot agent in a local clone instead of letting it guess

A long debugging session lost to GitHub Agentic Workflows. Not because the tool was broken, but because the agent kept inventing how it worked. The model was not being unreasonable. It was being asked an impossible question.

GitHub

Configure Azure Pipelines app in ghe.com

I recently helped a client migrate from Azure DevOps to GitHub Enterprise Managed Users with Data Residency (ghe.com for short). And as part of the migration we rewired the exiting Azure Pipelines from the old repository located on Azure Repos to the new one on GitHub.

GitHub

Auto-assign GitHub Copilot AI Credit budget to users

The deadline for GitHub Copilot Usage Based Billing is approaching rapidly. And today I've been busy setting up automation to assign each user their own bucket of Copilot AIC budget.

AI Featured

Measuring the Value of AI

The honeymoon is over. After months of aggressive rollouts, enterprises across the globe have given their employees access to AI coding assistants, copilots, and chat interfaces. And now the inevitable question lands on someone's desk: What are we getting for this?

GitHub

The why for Usage Based Billing for GitHub Copilot

Last month GitHub announced Usage Based Billing for GitHub Copilot. This completely changes the way its costs are calculated. A lot has already been written about the impact and a lot is still unknown.

GitHub

Github Copilot now available with Data Residency in the EU

With the current political climate there has quite a bit of buzz around Data Residency and Data Sovereignty. One of the gaps in GitHub with Data Residency, was that all Copilot data could still leave the region. This is now a thing of the past

GitHub Featured

GitHub Copilot will start training on your interactions

GitHub Copilot will start training on your data... You've probably seen this on your LinkedIn timeline in the past few days. Probably with alarming notes that this can't be controlled and that there is no policy for it. But this simply isn't true.

GitHub Actions Featured

Introducing Azure DevOps Marketplace tasks and actions: A Complete Rebuild for Speed, Stability, and Security

Introducing the Azdo marketplace project. Azure Pipelines tasks and GitHub Actions for publishing to the Azure DevOps marketplace.

GitHub Actions

Keep your examples in sync with your Action

Last month I added a few more GitHub Actions to the Marketplace and while working on them found that it was easy to forget to update my examples as the implementation of the Action evolved

GitHub Actions Featured

Automatic versioning for GitHub Actions authors

As a maintainer of 3 GitHub Actions, I've always struggled a bit with the versioning of them. GitHub's documentation provides guidance, but no easy way to verify you did everything right. Based on a quick scan of the actions on the marketplace I'm not alone, even GitHub's own actions have some.

GitHub Actions

Improved Dependency Submission for GitHub Actions

Recently someone brought to my attention that when pin your actions, Security Advisories for GitHub actions do not show up in the Dependency Graph. I set about a solution to solve that problem.

GitHub

GitHub Billing - Let Organization and Repository admins set the Cost Center in GitHub

We rely on GitHub Cost Centers to split the GitHub bill across the different entities that make up our company. What resource is tied to which cost center is managed in the GitHub Enterprise Settings.

GitHub Actions Featured

GitHub Actions learnings from the recent nx hack

You may have seen recent reporting around the compromise of the nx project. A malicious version of their package was published to npmjs which subsequently published GitHub tokens, crypto wallets and other sensitive materials of 1000s of users.

GitHub Actions

Authenticate Connect-MgGraph using OIDC in GitHub Actions

I'm running a number of maintenance scripts against our Azure EntraId to manage GitHub related things. Removing dormant users, asking users to setup their notification email correctly etc. For a long time, I ran these scripts with an interactive session, before moving them over to GitHub Actions. Recently

github copilot

Picking the right GitHub Copilot model

GitHub recently released documentation on all the large language models available in GitHub Copilot. The list is ever expanding, especially when you have previews turned on for your account. But its still hard for many people to pick the right model for their task.

GitHub

Create GitHub issue hierarchy using the API

The newly introduced GitHub Issues updates have added support for issue types as well as parent-child hierarchies. Unfortunately, the GitHub CLI hasn't yet been updated to support setting up this tree structure.

Visual Studio Code

Running Model Context protocol servers in a specific Node version inside Visual Studio Code

As you might know, I maintain a few Azure Pipelines extensions, for backwards compatibility many of these include Typescript targeting Node 16 still. Today I was playing around with Model Context Protocol (MCP) servers in Visual Studio Code Insiders and ran into an issue where the current active Node version

GitHub Featured

(repost) Protect the repository hosting your GitHub Action

This post, now 2 years old, is still very valid, especially in light of the changed-files hack recently.

Azure DevOps

Say goodbye to your Personal Access Tokens

We got rid of all Azure DevOps PAT usage and so should you. 📢 Big shout out to Jesse! Without his blog post and direct help, I was probably still renewing expired PATs manually. But let's start at the beginning.

GitHub

GitHub's new Billing - Assigning Cost Centers in Bulk

I've recently set up the internal cost centers to split our GitHub enterprise bill according to cost centers defined in GitHub. Cost Centers are part of GitHub's new Billing experience which is currently rolling out to GitHub Enterprise customers and which is also coming to GitHub for Teams.

github copilot

Use inline completions for more answers with GitHub Copilot Free

2 months ago, GitHub gave everybody their taste of GitHub Copilot with the limited free tier. You get 2000 completions and 50 chats. This is awesome! But 50 chats aren't that many. Did you know you can use your completions for simple chat answers as well? And this

GitHub

Troubleshooting GitHub Copilot keyboard shortcuts in Jetbrains IDEs

Over the past months I've delivered 100s of GitHub Copilot workshops. Ranging from 2 hour introduction talks, where I quickly walk through the main features of the product, up to day-long workshops with interactive hands-on. For most people it's pretty easy to get started.

GitHub

Scan all workflow artifacts for leaked secrets

In response to: Major GitHub repos leak access tokens putting code and clouds at riskBuild artifacts generated by GitHub Actions often contain access tokens that can be abused by attackers to push malicious code into projects or compromise cloud infrastructure.CSO OnlineLucian Constantin I've created a quick powershell