June 2020 Summaries

Semmle's security research team, now part of GitHub, has been organizing innovative Capture the Flag (CTF) events to advance their mission of securing open source software at scale. Unlike traditional CTFs, these events require participants to use CodeQL to identify and address vulnerabilities, such as a remote code execution flaw in a container management platform, by tracking data flow and exposing vulnerable patterns. The recent "CodeQL and chill – The Java edition" CTF emphasized learning and practical application over mere competition, with participants like Kanav Gupta and Nguyen Jang excelling in their understanding and execution. The event highlighted CodeQL's capability to analyze code as data, enabling the detection of entire classes of vulnerabilities and aligning with security practices akin to digital forensics. The GitHub Security Lab continues to encourage open-source security engagement, inviting participants to future CTFs and offering resources for organizations and teams.

GitHub Actions offers a platform for automating workflows, allowing developers to deploy to any cloud, build containers, and automate tasks using familiar tools, fostering creativity and innovation. The article highlights Victoria Drake, a seasoned developer who draws inspiration from her childhood coding experiences to create useful GitHub Actions, such as Hugo-Remote and django-security check, which enhance deployment and security processes. Drake emphasizes the importance of building tools that streamline software development and secure applications, while acknowledging the cultural challenges of transitioning from legacy software to modern CI/CD practices. GitHub Actions facilitate this transition by being accessible and adaptable, allowing teams to use familiar technologies like Docker, which support polyglot environments without the need for specialized frameworks. The ongoing development of GitHub Actions aims to boost team productivity and improve project security, as developers continually seek new ways to automate and enhance their workflows.

GitHub is adapting to a remote-first workplace strategy, emphasizing the importance of culture and technology investments to support its remote workforce while maintaining office spaces for those who prefer in-person work. Lara Owen, Director of Global Workplace Experience, discusses the company's shift from traditional office roles to virtual operations due to COVID-19, highlighting the importance of asynchronous communication and mental health. The company's remote work approach includes initiatives like the Hubber Care series to foster engagement and fun, while also planning for a future where office spaces serve primarily as social hubs. GitHub prioritizes flexibility, encouraging employees to take time off to balance work and personal life, and emphasizes the importance of celebrating small personal milestones to maintain morale. The remote work series continues to provide insights and best practices for adapting to new work environments.

GitHub Actions streamlines the automation of software workflows, including continuous integration and delivery, by providing a wide array of actions for tasks such as building containers and deploying web services. To keep these actions up-to-date with the latest features and bug fixes, Dependabot now offers automatic version updates for Actions workflow files, eliminating the need for manual updates that could lead to outdated versions. Dependabot periodically checks for new action versions and sends pull requests to update workflow files, regardless of the current tagging system used. This feature is highly customizable, allowing users to set the frequency of updates and assign reviewers for pull requests. Enabling Dependabot for GitHub Actions requires a dependabot.yml configuration file in the repository, which also supports updates for other package ecosystems like Ruby’s bundler and .NET’s nuget.

GitHub Enterprise 2.21 introduces several new features and enhancements aimed at improving pull requests, issues, notifications, and overall platform performance. Notably, users can now convert existing pull requests into drafts and make multi-line suggestions during code reviews, which streamlines the development process. The update also allows for easier linking of issues to pull requests, enhancing visibility within project board views. A revamped notifications system increases the likelihood of timely responses by allowing users to customize filters and workflows. Performance improvements include faster backup and restore processes and the introduction of new repository permission roles, triage and maintain, for finer access control. Additionally, several API updates have been implemented, such as enabling deployment deletions and supporting scaling in Teams and Reactions APIs, while phasing out some legacy webhook events. These changes aim to foster innovation and efficiency on the platform while maintaining security and reliability.

The MLH Fellowship, powered by GitHub, is an innovative initiative launched by Major League Hacking in collaboration with prominent companies like Facebook, Amazon Web Services, and the Royal Bank of Canada, aiming to provide student developers with real-world industry experience through contributions to open source projects. In response to traditional learning pathways being disrupted by COVID-19, the program attracted nearly 20,000 applicants globally, ultimately selecting 144 students from 23 regions and 15 time zones to participate. These students are working in small groups, or "pods," on a diverse range of projects, from machine learning and data visualization to essential developer libraries, with full-time engineering mentors to guide them. The Fellowship not only enhances technical skills but also emphasizes the impact of software on industries such as finance, health, and technology, while promoting diversity and innovation in the open source community. Key figures from sponsoring companies view their involvement as an investment in the future of technology, supporting the development of the next generation of software developers and the evolution of open source culture.

Workflow templates simplify the initiation of GitHub Actions by providing users with examples of CI/CD and automation across various languages and platforms, and they can now be customized by enterprises and open-source software teams for their organizations. These templates are defined in a .github repository and utilize YAML files alongside a properties file for template-specific metadata. Organizations can implement rules to suggest suitable templates to specific repositories, such as those associated with particular programming languages or file patterns. Any repository within an enterprise account or public repositories across GitHub plans can use these templates, with matching templates appearing in a "Suggested" section for easy access. Users can customize these templates after setting them up, and workflow templates can be shared across public and private repositories within an organization, depending on the enterprise plan.

GitHub's Super Linter, developed by the GitHub Services DevOps Engineering team, is an open-source tool designed to automate code linting processes, ensuring consistency and best practices across multiple programming languages. Packaged as a Docker container and integrated with GitHub Actions, the Super Linter aids developers by automatically checking code for errors during pull requests and providing feedback through the Status API. This tool supports numerous languages, with default settings based on widely accepted standards, but users can customize linting rules to suit their specific needs. Ideal for monorepos, the Super Linter facilitates cleaner code and streamlined reviews, while encouraging community contributions to expand its capabilities and language support.

MLOps, or Machine Learning Operations, enhances collaboration among data scientists by automating processes such as testing, versioning, and tracking. As MLOps is still developing, practitioners often build tools from scratch, with some help from DevOps, although these can be generic and require custom code. GitHub Actions have been introduced as a solution, integrating data science and machine learning workflows with software development processes. An example includes using GitHub Actions to orchestrate machine learning pipelines, track experiments, and report results to pull requests. The flexibility of GitHub Actions allows for diverse workflow compositions, such as adding links to mybinder.org on pull requests. The ecosystem of MLOps and data science GitHub Actions is expanding, with tools for orchestrating ML pipelines, running Jupyter Notebooks, and tracking experiments. The community is encouraged to contribute new Actions, with ideas like data versioning and model deployment, and can refer to GitHub Actions documentation for guidance.

GitHub Education celebrated the Class of 2020 with a unique virtual graduation event, allowing over 2,600 students from more than 80 countries to participate in a global community celebration. The event featured a commencement speech by Vanessa Gennerelli, Director of Education at GitHub, who welcomed graduates into the GitHub community, described as a "common area in the cloud." Students showcased their achievements by submitting senior projects and participating in a digital yearbook, which included posts on DEV with projects like a 3D action game called "Space Cats!" by Michael O’Connell, a recycling app "Kerbit" by Sam Roebuck, and a navigation aid for blind sailing by Anish from Carnegie Mellon University. These projects highlighted the creativity and innovation of the graduates, who shared their work through pull requests in the graduation repository. The celebration underscored GitHub's role as a supportive platform for developers, encouraging them to bring positive change to the world.

Dependabot, integrated into GitHub, simplifies the process of keeping software dependencies up-to-date, addressing the challenge faced by 52% of developers who find updating dependencies painful. While initially focusing on automated security updates for packages with known vulnerabilities, Dependabot now offers version updates to regularly refresh all packages, enhancing security and reducing manual effort. Users can configure Dependabot through a dependabot.yml file in their repository, specifying the type of dependencies, their locations, and update frequencies. This new feature is in public beta and complements existing security alerts and updates, now renamed as Dependabot alerts and Dependabot security updates. By integrating with the National Vulnerability Database, Dependabot alerts users of vulnerabilities and proposes fixes via pull requests. Transitioning from Dependabot.com or dependabot-preview to GitHub-native Dependabot involves enabling both security and version updates through the repository's settings. These updates ensure the security of the software supply chain, are free for all GitHub repositories, and are part of GitHub's commitment to simplify dependency management.