March 2022 Summaries

GitHub has enhanced its technical interview process by implementing a "take-home" challenge that mirrors real-world work scenarios and seamlessly integrates with the GitHub platform. Candidates receive a repository containing the exercise, which they complete using their preferred tools and submit via a pull request. The process is automated with the Interview-bot, which anonymizes submissions to reduce bias. Each candidate's work is evaluated based on a standardized rubric, ensuring objective and consistent assessments. This innovative approach not only respects candidates' time by imposing reasonable time limits but also aligns closely with daily operations at GitHub, creating a more authentic and equitable evaluation of candidates' skills.

Starting a career as a developer can be daunting due to the abundance of advice and the fear of making wrong choices, but overcoming these challenges involves understanding programming fundamentals over specific languages and engaging with the open-source community to gain experience. Rizel Scarlett from the Developer Relations Team advises that while choosing a programming language isn't crucial, mastering basics like functions, variables, and data structures is essential, as these skills are transferable across languages. She suggests contributing to open-source projects to simulate team experiences, starting personal projects to enhance skills, and considering apprenticeships and internships to gain practical exposure. Building a simple portfolio showcasing coding skills and establishing a brand on social media by sharing learning experiences is recommended to stand out to potential employers. Networking through platforms like LinkedIn and Twitter can also facilitate job opportunities, and preparation for coding exams can be bolstered by using platforms like HackerRank and LeetCode. While the transition from beginner to mid-level varies by company, it generally involves increased independence in problem-solving, planning, and designing solutions. Aspiring developers are encouraged to utilize available resources and connections while understanding that consistent effort is key to career advancement.

GitHub Copilot, an AI-powered code suggestion tool, has expanded its technical preview to include integration with Visual Studio 2022, following user feedback. To access this feature, developers must join a waitlist and, upon receiving confirmation, install the Copilot extension through Visual Studio's extension manager. Once installed and authorized, GitHub Copilot provides real-time coding suggestions, which users can accept, ignore, or navigate through alternatives, enhancing productivity by generating code snippets that align with the developer's intent. Users can adjust settings to tailor Copilot's functionality to specific languages and coding environments. The expansion aims to gather more feedback, particularly in .NET languages, to refine and improve the service.

End-to-end supply chain security is increasingly critical as threats expand to user accounts, dependencies, and build systems. GitHub has introduced comprehensive guides to assist in mitigating these risks, covering account security, code security, and build system protection. These resources emphasize the strategic implementation of security measures such as two-factor authentication, SSH keys, centralized authentication, vulnerability management for dependencies, and securing communication tokens. The guides also highlight the importance of signing builds and enhancing security for GitHub Actions. Designed for users across different plans, these guides encourage gradual improvements to reduce the risk of attacks over time, offering pathways for both beginners and advanced users to enhance their security posture.

Break The Code 2, a developer community competition hosted by .Tech Domains and GitHub Education, is a nostalgic return to the 90s, set in a Windows 98 OS experience, offering participants a chance to engage in digital sleuthing through 11 missions across four chapters. Building on the success of its predecessor, Break The Code 1.0, which connected over 100,000 tech enthusiasts in 2020, this iteration promises new puzzles, enigmas, cheat codes, and easter eggs, with prizes exceeding $15,000. Participants can leverage GitHub repositories and commands to access bonus features like in-game wallpapers and leaderboard advantages, while a Community Cooperative Secret Solving Livestream on April 1 will aid those seeking assistance with ciphers. The competition runs until April 15, providing an opportunity for tech lovers worldwide to embrace their inner hacker and unlock GitHub secrets together.

GitHub has introduced an enhancement to the self-hosted runners experience in GitHub Actions, aimed at bolstering the security and consistency of CI/CD workflows for large organizations. This new feature allows administrators to designate specific workflows that can access particular runner groups, which contain sensitive secrets necessary for production deployments, thereby preventing unauthorized workflows from accessing these runners. This measure enhances security for organizations not yet using OpenID Connect and supports the enforcement of consistent workflow practices across enterprises by integrating with reusable workflows. Admins can standardize deployment workflows by creating reusable workflows that describe the necessary deployment steps, setting repository access to all repositories, and restricting workflow access to selected workflows. This ensures that only workflows following the specified reusable deployment workflow can access the production runner group, thereby increasing security and consistency in deployment practices.

GitHub has encountered multiple service disruptions recently due to resource contention in its mysql1 database cluster, affecting the performance and availability of various services such as git operations, webhooks, API requests, and GitHub Actions. The issues were primarily linked to peak load times and suboptimal query performance, leading to several outages that required failover to healthy replicas for recovery. Despite ongoing efforts to partition the main database and add clusters, the problem persisted, prompting GitHub to conduct audits of load patterns and implement performance fixes, including traffic redistribution and increased monitoring. Proactive measures such as throttling webhook traffic and further database optimizations are being pursued to prevent future incidents, while an upcoming Availability Report aims to provide more insights into these challenges and the steps being taken to address them.

GitHub Enterprise Server has introduced a repository cache feature in public beta to address the challenges faced by large organizations with CI runners and geo-distribution issues. This cache acts as an eventually-consistent replica of Git data, providing data locality without affecting developer push workflows, and offers selective replication to meet strict data residency requirements. The cache is read-only, intended for CI farms, and requires a backoff-and-retry strategy due to potential delays in data arrival. While it addresses some issues, it does not currently replicate LFS files, and its authorization model is limited, with improvements expected in future releases.

GitHub has introduced a new beta version of its home feed, designed to enhance community building, inspiration, and celebration of developers' work by making discovery easier across the platform. The updated feed, accessible via a new "For you" tab on the dashboard, offers personalized updates that allow users to find new projects, track quality releases, and follow organizational activities. The feed highlights activities from projects and developers that users engage with, while GitHub Lists helps organize favorite repositories. Users can also follow organizations to stay informed about new projects and announcements. The initiative aims to make the platform more interactive and user-centric, with ongoing updates planned to further improve discovery, and feedback from users is encouraged to shape future developments.

GitHub has introduced a feature that allows users to create a branch directly from an issue, streamlining the workflow by eliminating the need to use the CLI or IDE initially. This new functionality is accessible via a "Development" section in the sidebar of an issue, which replaces the previous "Linked pull requests" section and serves as a hub for linked branches, pull requests, and issues. The feature suggests a branch name based on the issue title, but users can modify it, and they have the flexibility to create the branch in a different repository or from any source branch other than the default. Once a branch is created, it appears in the "Development" section, indicating work in progress, and when a pull request is made, it automatically links to the issue, maintaining an organized overview of the project's status. This capability is currently in public beta on GitHub, inviting user feedback and promising further integration with other GitHub clients.

The post, part of GitHub Security Lab's series on the OWASP Top 10 Proactive Controls, focuses on the importance of input validation as a secondary defense mechanism for enhancing software security. Input validation ensures that only properly formatted data can enter a software system, helping to mitigate potential vulnerabilities such as injection attacks. The article emphasizes the concept of defense in depth, where multiple layers of security controls provide redundancy to protect against exploitation. It discusses various input validation techniques, including allow lists, deny lists, and the distinction between validation and sanitization, highlighting the strengths and weaknesses of each approach. The post also underscores the necessity of performing server-side validation to ensure security, as client-side validation can easily be bypassed. Additionally, the use of automated tools like static analysis and semantic CodeQL queries in CI/CD pipelines is recommended to enforce validation rules and detect anti-patterns. Overall, input validation is portrayed as a crucial aspect of reducing an application's attack surface, while not being the primary defense against attacks.

February's Release Radar highlights a range of open source projects that have shipped significant updates, showcasing innovations from humanitarian efforts to developer tools. Among these are initiatives supporting Ukraine, such as Volodymyr Shymansky's repository for developers to express solidarity. GitLens 12.0 enhances Git functionality within Visual Studio Code with new features like worktrees and visual file history, while ToolJet 1.0 offers a low-code platform for building applications. JSON Visio 1.0 allows users to view JSON data as interactive graphs, and Xata Screenshot 1.0 provides a browser-native screenshot tool. Mailwind 2.0 integrates Tailwind CSS for HTML email design, and GLPI 10.0 presents a revamped IT management solution. Buf 1.0 provides tools for working with protocol buffer APIs, and Python-TUF 1.0 enhances software update security. Lastly, Japa 5.0 introduces a rewritten Node.js testing framework, renamed @japa/runner, continuing its focus on backend testing.

GitHub has introduced new features to GitHub Actions that allow users to re-run only failed jobs or a single job within workflows, enhancing efficiency by saving time and potentially reducing costs. These improvements come in response to user feedback and are designed to streamline the process of handling complex workflows, which often involve multiple jobs and dependencies. This update also includes navigation enhancements that help users better analyze previous workflow runs by offering a comprehensive view of job logs and attempts. Users can access these features through a new drop-down menu for failed jobs and re-run options directly from the logs view, with partial re-runs available via the REST API and command-line tools. GitHub encourages user feedback on these updates to continue refining the service.

GitHub has introduced several new features to enhance the management of enterprise accounts, aiming to simplify user and organization oversight for enterprise owners. Key updates include the ability for enterprise owners to become organization owners, allowing them to audit, apply policies, and ensure no organization is unowned, as well as the capacity to remove members from all organizations within their enterprise directly from account settings, bypassing the need for an identity provider. Other improvements include an updated UI for the "Organizations" page, increased visibility of enterprise owners to organization members, and the ability to transfer organizations in and out of enterprise accounts, along with upgrading invoice-based organizations to enterprise accounts. Future enhancements will focus on refreshing the "People" pages to be more user-friendly and informative, including a feature to export an enterprise user report, all designed to streamline administrative experiences and support business scaling within GitHub Enterprise.

In February, GitHub experienced a significant incident affecting the availability of its services such as GitHub.com, issues, pull requests, GitHub Actions, and GitHub Codespaces, due to a failed routine deployment that did not generate complete integrity hashes for Subresource Integrity. This failure resulted in the site serving 500 error pages to web users, although API and Git access were unaffected. The issue was swiftly resolved by rolling back to a previous deployment, and additional measures have since been implemented to enhance the robustness of the build process and prevent similar incidents. GitHub continues to provide monthly updates on service availability and improvements to its engineering systems to maintain service reliability, with further details accessible through their status page and engineering blog.

GitHub has expressed solidarity with Ukraine amid the Russian military invasion, condemning the violence and emphasizing its commitment to maintaining an open platform for developers worldwide, including those in Russia. The company is ensuring the availability of free open-source services while complying with international regulations, such as export controls aimed at restricting Russia's military capabilities. GitHub's leadership highlights the importance of security measures like two-factor authentication to protect users and maintains transparency by publicly posting government takedown notices. Emphasizing community safety and well-being, GitHub supports employee donations to Ukrainian relief efforts, matching contributions up to $200,000, and encourages employees to volunteer. The message underlines the company's dedication to fostering open collaboration and information flow, hoping for a peaceful resolution to the conflict.