August 2020 Summaries

GitHub Actions offers a powerful platform for automating workflows, allowing developers to connect with familiar tools and innovate freely by deploying to any cloud, building containers, and more. The story highlights Eddie Jaoude, a senior full-stack developer and GitHub Star, who shares his journey with GitHub Actions, emphasizing the importance of open-source in honing technical and communication skills. Eddie developed an HTML table generator GitHub Action that converts JSON files to HTML tables with configurable options, aiming to simplify and enhance the customization of GitHub profile Readmes. He actively participates in the tech community by live streaming his development process and sharing insights via his YouTube channel, illustrating the platform's flexibility and the support available from the GitHub community. Eddie's experience underscores the accessibility and enjoyment of using GitHub Actions, encouraging others to explore the platform through resources like the GitHub Learning Lab and the Marketplace, which hosts numerous Actions, including those contributing to the COVID response through the Karuna Project.

Integrating static analysis into the developer workflow is a practical approach to implementing security principles such as DevSecOps and shifting security left, as discussed in Maya's post. Static analysis security testing (SAST) analyzes code for vulnerabilities, traditionally occurring late in the development cycle, but shifting it to the main developer workflow allows security issues to be identified and resolved during everyday code reviews. However, challenges such as tool speed, precision, and integration into pull request workflows can hinder adoption, requiring careful monitoring and configuration to avoid slowing down CI processes and causing high false positive rates. GitHub code scanning, powered by the fast and precise CodeQL engine, exemplifies this integration by providing in-line pull request feedback and configurable queries, while storing configuration as code within GitHub Actions workflow files to maintain visibility and version control.

The exploration of memory safety illusions in interpreted languages reveals how vulnerabilities in the underlying C/C++ code can expose higher-level applications to security threats. Despite the perceived safety offered by higher-level languages, fragile attack surfaces often exist in the C/C++-based runtime systems and third-party libraries accessed via Foreign Function Interfaces (FFIs). Historical cases, such as Perl's format string vulnerabilities and PHP's unserialization attacks, highlight how bugs at the lower level can escalate into exploitable vulnerabilities. Similarly, Python's CVE-2014-1912 demonstrates how memory safety assumptions can be misleading, as developers might inadvertently introduce vulnerabilities by trusting the language's inherent safety mechanisms. This series aims to educate developers on recognizing potential attack surfaces and implementing defensive programming practices to mitigate risks, promising future installments that will delve into contemporary attack vectors within modern interpreted language ecosystems.

GitHub's employee resource group for marginalized genders, the Adacats, initiated a mentorship program to address career advancement challenges faced by its members, launching a pilot in July 2019 with 10 mentor-mentee pairs in the engineering department. The program aimed to facilitate career growth in GitHub's dynamic environment, receiving feedback that highlighted the need for more structured guidance and better communication between managers, mentors, and mentees. In response, the program was renamed the Adacats Mentorship Program and expanded to include detailed documentation, growth plans, and structured manager interactions, emphasizing overall growth rather than just promotions. The initiative, which rolled out company-wide in May 2020, underscored the importance of iterative learning, manager involvement, and sponsorship training to better support marginalized groups. Despite initial challenges, the program was positively received, leading to promotions, team transitions, skill development, and increased participation, demonstrating the effectiveness of mentorship in fostering career growth.

After months of preparation, GitHub successfully upgraded its production environment to Ruby 2.7, addressing over 11,000 deprecation warnings and replacing unmaintained gems to ensure a deprecation-free codebase. This upgrade was significant due to changes in keyword argument behavior introduced by the Ruby Core team, which required extensive coordination across 40 teams and numerous gem updates. The transition was facilitated by a dual-boot setup allowing backwards compatibility with Ruby 2.6, enabling smoother integration of changes. The upgrade resulted in a notable improvement in performance, including faster application boot times and reduced object allocations, enhancing overall system efficiency. GitHub's meticulous deployment process, which involved gradual traffic increases and comprehensive testing, ensured minimal user impact and no downtime. This effort not only reinforces application health and stability but also supports ongoing contributions to the open-source community, with GitHub emphasizing the critical importance of staying current with software updates to maintain a robust and resilient application infrastructure.

Rahul Chhabria, Director of Product Marketing at Sentry, highlights the importance of application monitoring as a competitive advantage, emphasizing how Sentry's integration with GitHub enhances this capability. By using Sentry's GitHub Action, developers can streamline their deployment processes by automatically notifying Sentry of new releases, uploading source maps, and identifying the specific commits responsible for errors. This integration facilitates faster error resolution, freeing development cycles and ensuring a more seamless experience for customers. The collaboration between GitHub and Sentry exemplifies a synergistic approach to building software, focusing on writing better code and maintaining customer satisfaction.

Securing open source software is a collective responsibility, and the Metasploit Framework exemplifies this effort by providing a comprehensive open source penetration testing toolkit. Maintained by Spencer McIntyre, Metasploit aids security professionals and internal teams at Fortune 500 companies and government agencies in identifying and demonstrating vulnerabilities, thereby improving security measures. A major challenge for Metasploit involves managing external dependencies and ensuring payloads function in various constrained environments without relying on third-party libraries. To address security issues, the project employs tools like Snyk for monitoring dependencies and GitHub's GPG integration for secure code contributions. The framework's integration into CI/CD pipelines supports developers in maintaining secure projects by testing for vulnerabilities throughout the software development lifecycle. As Metasploit progresses towards version 6, it aims to be "secure by default," incorporating changes like default traffic encryption.

GitHub Actions empowers developers by automating workflows and enhancing creativity, as demonstrated by Keirron Stach, also known as Hookkshot, who capitalized on this tool to streamline game development processes. Inspired by his passion for gaming and software, which began with creating a website for a Sims character at age 10, Hookkshot developed a GitHub Action called discord-dispatch-deploy to expedite the deployment of game builds to Discord, thus reducing the wait time for feedback from testers. Despite challenges such as mastering Docker interactions, Hookkshot found the process rewarding, learning to leverage Docker images for efficient code deployment in separate environments. His journey highlights the fun and ease of using GitHub Actions for continuous integration and deployment, inspiring others to explore the platform through resources like the GitHub Learning Lab and GitHub Marketplace.

Open source software, which forms the foundation for 99% of code, is celebrated in The ReadME Project—a new initiative designed to highlight the personal and professional stories of the individuals behind these projects. Aimed at shedding light on the often unseen communities of maintainers and developers, the project seeks to share narratives of growth, challenges, and lessons learned, featuring profiles of contributors like Henry Zhu, Samson Goddy, Sonia John, Ovilia Zhang, and Dirk Lemstra. Readers are encouraged to nominate inspiring developers and unsung contributors whose work has been impactful, with the goal of merging these stories with their own experiences. Acknowledging both the remarkable and imperfect nature of open source, the project invites feedback and contributions to foster an engaging community space, with plans to experiment with new projects and continuously spotlight the creativity and perseverance of those powering open source.

GitHub's Professional Services Engineering team has open-sourced a new project called Rally + GitHub, designed to integrate GitHub Enterprise Server with Broadcom’s Rally project management. This initiative ensures that developments in GitHub are reflected in Rally by checking for Rally User Stories or Defects in pull request titles, bodies, or commit messages, and validating their existence and status in Rally. The project was created in response to the deprecation of legacy Services integration with Rally in GitHub Enterprise Server, which left users without integration capabilities after the release of version 2.20. Users are encouraged to set up Rally + GitHub with their existing Rally instances and contribute to the project by sharing experiences or opening issues, with guidance available in the project's README.md.

Architecture decision records (ADRs) are an effective method for documenting the rationale behind decisions within a codebase, and have been increasingly adopted since 2017, particularly in long-lived codebases like those in enterprise settings. At GitHub, the mobile team uses ADRs to record decisions affecting iOS and Android codebases, enhancing long-term clarity and communication. ADRs are not just for immediate reflection but serve as a reference for future revisions, allowing developers to recall their mindset at the time of the decision. They facilitate better team understanding and communication by detailing the decision-making process, including alternatives considered and pros and cons, which helps in onboarding new team members and reduces the need for explanatory meetings. By writing ADRs, teams can achieve a collective responsibility for maintaining decisions, promoting decision socialization and improving the quality of pull request reviews. As teams grow, ADRs help manage the increasing complexity of communication lines and serve as a valuable tool for both current and future team members, ensuring a sustainable and well-documented code evolution.

DevSecOps is an approach that integrates security into the DevOps process, making it a shared responsibility across development teams to prevent outages and data loss by addressing security requirements earlier in the lifecycle through the practice of "shifting left." This involves conducting security testing during the development phase rather than at the final deployment stage, enabling quicker identification and resolution of vulnerabilities. GitOps complements DevSecOps by using Git as the single source of truth for managing infrastructure, configurations, and applications, allowing for automated and error-free deployments. By incorporating security into the development workflow and utilizing Git for version control and automation, teams can enhance their ability to address security issues promptly and maintain a consistent and secure development pipeline. These practices reflect a broader trend where security becomes an integral part of the development process, empowering developers to proactively manage security risks.

GitHub Actions, a tool designed to automate workflows, has been instrumental in helping initiatives like Karuna 2020, founded by Anand Chowdhary, to alleviate the impact of COVID-19 in India. By leveraging GitHub Actions, Karuna 2020 has been able to streamline numerous processes, such as automating the distribution of dry ration kits and ensuring privacy by automatically blurring faces in photos of aid recipients. This automation has saved hundreds of volunteer hours, allowing the team to focus on broader impact efforts. The open-source nature of GitHub Actions has enabled Karuna to build transparent and efficient systems for nonprofits, providing free guides, tools, and APIs to help other organizations better manage resources. Anand emphasizes the significant role GitHub Actions has played in maximizing their impact, showcasing how technology can drive social good by automating critical tasks without the need for dedicated servers.

GitHub is hosting a virtual event called GitHub ¡Presente! aimed at the Latin American community, scheduled for Tuesday, August 25, at 18:00 BRT / 16:00 CDT. The event will be led by Priscila Heller from the Enterprise Support team, with contributions from Pedro Lacerda, who will discuss security, and Arthur Neves, who will explain how GitHub utilizes its own platform. Special guests include Felipe de Morais, who will talk about his development career and the AfroPython community; Cynthia Zanoni, addressing the challenges faced by newcomers to GitHub and how the Womakerscode community supports open-source contributions; and Paulo Silveira, who will explore how non-developers can benefit from GitHub's features. The event will conclude with a networking session, offering attendees the opportunity to connect with GitHub employees and people with similar interests.

GitHub Actions provides developers with the tools to automate workflows, enabling innovation and creativity by deploying to any cloud, building containers, and automating messages. Daniel Dennis, a passionate developer from Kenya, shared his journey into software development, which began with a high school boot camp and led to his creation of the Ruby Gemer Action to manage Ruby gem updates efficiently. He highlights the simplicity and accessibility of GitHub Actions, despite initial challenges with yaml, and emphasizes the extensive documentation now available. Daniel's enthusiasm for GitHub Actions was further fueled by his participation in the GitHub Actions Hackathon, where he plans to continue contributing and enhancing the Ruby-powered Action for broader community acceptance. GitHub encourages developers to explore its Learning Lab and Marketplace for a variety of Actions, while also celebrating developers like Daniel who actively contribute to the platform's growing ecosystem.

The transition to remote work, increasingly adopted by tech companies like GitHub even before the COVID-19 pandemic, involves several key practices to ensure team productivity and wellbeing. GitHub's CTO, Jason Warner, and Laura Heisman emphasize the importance of trust, clear communication, appropriate tool usage, and accommodating global teams with time zone considerations. Trust is cultivated through regular, empathetic communication and transparency about personal life challenges, which enhances team cohesion. Effective communication channels are essential to avoid misunderstandings and micromanagement, while tools like institutional memory, video, email, and chat support efficient operations. Global teams benefit from overlapping work hours or hand-off approaches to maintain workflow continuity. Leaders are encouraged to model balanced work habits, prioritizing mental health and personal time, demonstrating to their teams the value of life outside of work. These practices aim to help various professionals, from executives to hobbyists, navigate remote work effectively.

The fourth annual GMTK Game Jam, a 48-hour game-making competition, achieved a record-breaking 5,400 submissions and 18,300 participants on itch.io, centered around the theme "Out of Control." The event showcased a diverse range of games with innovative mechanics and high-quality designs. Among the highlighted entries are games like "A Key(s) Path," which utilizes unique movement mechanics, and "Shield Bearer," which creatively interprets the theme. Other notable games include "KEYHOARD JOTTEL" with its retro aesthetic, "Lost Signal" with challenging controls, and "Super Corgi Drifter" with its charming PICO-8 showcase. The competition not only celebrated creative game design but also encouraged participation and learning in game development. Participants and enthusiasts can explore all submissions and gain insights into game design through the GMTK Game Jam author's YouTube channel, with the broader context of open-source games from various game jams further enriching the gaming community.

GitHub has evolved into a comprehensive development platform by incorporating native continuous integration and continuous deployment (CI/CD) capabilities with GitHub Actions and facilitating DevSecOps implementation using GitHub Advanced Security. The post examines the OWASP DevSecOps Maturity Model (DSOMM), focusing on how to achieve Level 1 maturity by utilizing GitHub's native tools for software composition analysis (SCA), static application security testing (SAST), dynamic application security testing (DAST), and secret scanning. DSOMM provides a framework for incrementally enhancing security programs from Level 1 to Level 4, with Level 1 involving basic implementations of static analysis tools and baseline settings for DAST without modifying tools or settings. At this level, scans should not block builds due to potential false positives, and it emphasizes the importance of immediate feedback to developers. GitHub's Advanced Security allows teams to adopt these practices easily, offering tools like Dependency Graph, Dependabot alerts, code scanning, and OWASP ZAP scans, while encouraging teams to advance to Level 2 maturity within six to twelve months.

In July, GitHub.com experienced a significant service disruption due to a Kubernetes incident where production Pods were marked as unavailable, resulting in reduced capacity and service downtime. The issue stemmed from a container exceeding its memory limits, leading to its termination, compounded by a DNS maintenance operation that prevented Kubernetes from fetching new container images, causing Pods to fail to start. Efforts to mitigate the situation initially exacerbated the problem, but services were restored after utilizing cached DNS records. In response, GitHub plans to enhance monitoring, reduce dependency on the image registry, improve DNS change validation, reassess Kubernetes deployment policies, and develop a more incremental approach to deployments as part of a broader reliability initiative.

GitHub has introduced new features to enhance the management and security of self-hosted runners within GitHub Actions, focusing on enterprise-level needs. Enterprise self-hosted runners allow resources to be shared and managed across multiple organizations under one enterprise account, streamlining the setup process similar to that of individual repository or organization runners. Additionally, self-hosted runner groups provide granular control over access by enabling administrators to specify which organizations or repositories can use particular runners, thus facilitating the allocation of resources like GPUs to the projects that specifically require them. These groups leverage custom labels for precise runner selection, offering a flexible approach to managing workflows, whether it involves separating production deployments or handling private versus public projects. For those new to GitHub Actions, resources such as self-paced learning courses are available to help users get started, and the GitHub Roadmap provides an avenue for users to learn about upcoming features and share feedback with the product team.

The Semantic Code team has significantly enhanced GitHub's language support system for code navigation by introducing CodeGen, which automates much of the previously labor-intensive pipeline, making it more resilient and cost-effective. This improvement broadens the range of programming languages supported on GitHub by simplifying the process of transforming source code into a format suitable for analysis, using a new system that auto-generates language-specific syntax datatypes. The previous approach required writing and maintaining two grammars per language, a process prone to errors and inefficiencies due to its manual nature and the challenges of aligning with tree-sitter's syntax nodes. By implementing named child nodes, generating Node Interface Files, and employing Haskell's generic metaprogramming framework, the new system enhances precision and reduces the engineering workload, enabling the addition of new languages like Java and CodeQL with precise Abstract Syntax Trees (ASTs). This transformation has not only improved the scalability and maintainability of the language support system but also opened up opportunities for community contributions and further advancements.

The GitHub dependency graph is a tool designed to help developers manage and understand their software dependencies, which are crucial for both security and compliance. With the rise of open-source usage, projects often rely on numerous dependencies, making it challenging to track and maintain them. GitHub's dependency graph identifies both direct and transitive dependencies by parsing manifest and lockfiles, allowing developers to visualize these dependencies in an acyclic graph format. This method enables developers to detect vulnerabilities and compliance issues early in the development process, without requiring additional configuration. The graph is enabled by default for public repositories and can be activated for private ones. Developers are encouraged to keep their dependencies healthy by specifying them clearly in manifest files, using lockfiles to maintain consistent versions, regularly reviewing updates, and removing unnecessary dependencies to reduce security risks. Tools like Dependabot further assist in managing vulnerabilities and ensuring dependencies are up-to-date.

GitHub Actions, a tool for automating software development workflows, can be enhanced through the use of self-hosted runners, which offer greater flexibility and control over the execution environment by allowing users to deploy on physical servers, virtual machines, or container images. These self-hosted runners can be utilized on-premises or on cloud platforms like Google Cloud, with patterns explored for scalability via App Engine, persistent deployment on Google Compute Engine, and integration with Kubernetes through Google Kubernetes Engine. Additionally, Anthos enables hybrid deployment strategies, allowing users to manage applications across various infrastructures securely. While these configurations offer benefits such as increased resource availability and integration with secure organizational data, they come with experimental support and security considerations, especially when used in public repositories or with privileged security contexts.

GitHub Actions has introduced new features to enhance workflow management for pull requests (PRs) from repository forks, addressing concerns about privilege escalation in private repositories and improving automation for public repositories. The update includes three new settings for private repositories, allowing users to run workflows on forked PRs with proper permission controls at the enterprise, organization, and repository levels. For public repositories, a new `pull_request_target` event has been added, granting workflows access to read/write tokens and secrets by running them against the base of the PR, thereby enabling maintainers to safely automate tasks like labeling or commenting. Additionally, a new `workflow_run` event allows one workflow to trigger another upon completion, facilitating complex automation sequences and further analysis of continuous integration outcomes. These innovations aim to streamline processes, provide flexibility, and maintain security, with further details available in the GitHub documentation and community discussions.

Open source software plays a crucial role in modern software development, with 99% of codebases incorporating open source components, which can introduce both innovation and security risks. GitHub has been proactive in enhancing open source security by acquiring tools like Dependabot and Semmle, establishing the GitHub Security Lab, and forming the Open Source Security Coalition to address vulnerabilities and promote best practices. This coalition, which includes major tech companies such as Google and Microsoft, has now evolved into the Open Source Security Foundation (OpenSSF) to unify efforts in securing open source software. GitHub's continued commitment to open source security is evident through its investment in new security features and ongoing collaboration with the open source community, aiming to protect and enhance the global software ecosystem.