March 2023 Summaries

Static analysis is a technique used to examine an application's code for potential errors without executing it, offering checks and highlighting issues. GitHub employs static analysis in its code scanning through CodeQL, a semantic analysis engine. The blog series introduces static analysis concepts, CodeQL, its application in security research, and guides on writing custom CodeQL queries. Static analysis helps identify vulnerabilities like SQL injection by tracing data flow from sources (user inputs) to sinks (functions where vulnerabilities may occur). Early static analysis tools address this by using technologies like lexical analysis and abstract syntax trees (ASTs) to refine detection accuracy. Modern methods, incorporating taint tracking and data flow analysis, further enhance precision by automatically identifying unsafe data flows to dangerous functions. These advancements enable security researchers to efficiently uncover vulnerabilities in code, with CodeQL facilitating the customization of analyses to accommodate specific sanitization methods.

Recent changes to CodeQL's data flow and taint tracking libraries for C++ have been introduced to enhance precision in standard queries and improve the experience for custom query authors. These updates include a shift from a "def-use" pattern to a "use-use" pattern, simplifying query implementation by integrating conditional sanitizers directly into the dataflow graph. Additionally, the new system offers more precise tracking of pointers and indirections, allowing specific identification of tainted data levels, such as those in command-line arguments. Custom query authors can adopt these changes by opting into the new library and adjusting their queries to reflect the nuanced handling of pointers and indirections. The update aims to maintain a high standard of security analysis while ensuring a seamless developer experience.

GitHub has introduced a new Export SBOM function, enabling users with read access to cloud repositories to generate Software Bills of Materials (SBOMs) in compliance with the National Telecommunications and Information Administration (NTIA) with just one click. This feature produces a JSON file in the SPDX format, detailing project dependencies and metadata, which can be integrated into security and compliance workflows or converted for use in spreadsheet applications like Microsoft Excel. The tool is part of GitHub's supply chain security offerings and is free for all cloud repositories, allowing developers to make SBOM generation a standard part of their development process. Users can upload existing SBOMs to receive vulnerability alerts through GitHub's Dependabot, use the SBOM gh CLI extension for automated generation, or employ third-party GitHub Actions during build times. Additionally, a REST API for SBOM generation is in development, further enhancing GitHub's capabilities in managing supply chain security.

GitHub has announced the release of a public beta for its official GitHub Actions VS Code extension, which enhances the experience of authoring, editing, and managing workflows directly within the Visual Studio Code IDE. Initially a community project, the extension now uses the official GitHub Actions schema, providing features like linting, code completion, and syntax highlighting. Users can manage workflow runs, view logs, and handle secrets and variables at various levels without leaving their editor. The extension offers smart validation and code completion, understanding the specific context and event payloads of workflows, such as pull requests. It also supports integrated documentation for schema and expressions, aiming to reduce context switching for developers. Existing community extension users will be automatically upgraded to this official version.

GitHub is emphasizing the importance of empowering developers to enhance productivity and streamline workflows in the software development lifecycle. At GitHub Galaxy, alongside CEO Thomas Dohmke, the focus was on improving team efficiency, security, and productivity through tools like GitHub Copilot, which claims to accelerate code writing and increase developer satisfaction. GitHub Copilot for Business is enhancing productivity for thousands of organizations, while GitHub's integrated platform aims to reduce workflow friction by providing a centralized space for code collaboration. New features like GitHub Enterprise 3.8, GitHub Codespaces, and advanced security tools such as Dependabot and GitHub Advanced Security are designed to enhance developer flow, onboarding speed, and security management. GitHub Actions and project management tools help automate tasks and improve collaboration, while self-service SBOMs facilitate security compliance. The event encourages developers to explore these tools to build a robust and efficient development environment.

Joseph Katsioloudes discusses the importance of secure coding in software development, highlighting his personal journey from focusing solely on functional code to understanding the need for security measures like user input validation. Recognizing a gap in secure coding education, he developed the Secure Code Game, a hands-on training tool available on GitHub Skills, designed to help developers and students improve their secure coding abilities. The game, currently supporting Python and C, uses gamification to teach best practices by providing vulnerable code for users to fix, thereby fostering a mindset of security awareness. Katsioloudes emphasizes that writing secure code is a form of creative problem-solving essential for delivering high-quality software and encourages community contributions to evolve the game. He also notes the challenges developers face in prioritizing security due to educational gaps, organizational emphasis, and the rapidly evolving threat landscape, advocating for a perception shift to view secure coding as integral to quality code.

On March 24, GitHub replaced its RSA SSH host key for Git operations as a precautionary step after discovering that the private key was inadvertently exposed in a public GitHub repository, though there was no indication of misuse or compromise of customer data. This change affects only RSA SSH Git operations, leaving web traffic and HTTPS operations unaffected, and requires users experiencing host key verification issues to update their known_hosts file accordingly. GitHub emphasized that the exposure was not due to a security breach but rather an accidental publication, and users employing ECDSA or Ed25519 keys remain unaffected. GitHub Actions users might encounter workflow disruptions if using certain configurations, prompting updates to the actions/checkout action. The announcement was made by Mike Hanley, GitHub's Chief Security Officer, who has a background in leading security initiatives at Duo Security and Cisco.

GitHub has been at the forefront of integrating generative AI into software development, initially launching GitHub Copilot in collaboration with OpenAI, utilizing the Codex model derived from GPT-3. This tool, which acts as an AI pair programmer, significantly boosts developers' productivity by auto-completing code and comments, with 46% of code now being written by it. Building on this success, GitHub is introducing GitHub Copilot X, which leverages OpenAI's GPT-4 model to expand its capabilities beyond code auto-completion. The new enhancements include chat and voice interfaces, integration with pull requests, and a command line interface, all aimed at streamlining the entire development lifecycle. GitHub Copilot X aims to revolutionize developer productivity by reducing repetitive tasks and fostering creativity, with a particular focus on making complex tasks more manageable. Additionally, the new features enable developers to receive AI-generated insights on documentation and code, which supports a more efficient development process and aligns with GitHub's mission to innovate and support developers in building the future of software.

The European Union's proposed Cyber Resilience Act, introduced by the European Commission, aims to enhance cybersecurity by requiring companies to ship and maintain secure software products, with a particular focus on critical products like web browsers and VPNs. The Act proposes exemptions for non-commercial open source software, but defining the scope of these exemptions is complex due to the diverse contexts in which open source is developed and maintained. GitHub and the open source community suggest that the Act should focus on finished, paid products and provide clarity to ensure open source software that is not monetized remains exempt, thus supporting the collaborative development and distribution platforms crucial to digital infrastructure. European Commission research underscores the economic impact of open source, contributing significantly to the EU's GDP, and the German government's Sovereign Tech Fund exemplifies direct governmental support for open source projects. As the legislation evolves, GitHub is actively engaging with EU policymakers and the developer community to refine the Act and enhance cyber resilience, emphasizing the need for models that integrate government support with multi-stakeholder initiatives like OpenSSF for securing digital commons.

Godot 4.0, a cross-platform, free, and open-source game engine, has officially been released and is celebrated for its growth and popularity as one of the fastest-growing projects on GitHub. The release will be marked by a celebration event at GitHub HQ in San Francisco, coinciding with the Game Developers Conference (GDC), offering an opportunity for attendees to meet core contributors and fellow game developers. The event, hosted by GitHub's Senior Program Manager Lee Reilly, is set for March 22, 2023, from 6:30 pm to 9:30 pm, and invites global Godot users to join in the festivities.

Grafana Labs, a leading open-source platform for monitoring and observability, uses GitHub Projects to efficiently manage tasks and track progress across its teams, including backend, front-end, UX, and documentation. By employing task lists and a set of common labels, the Grafana Labs Alerting team can filter tasks, create multiple project views to meet diverse stakeholder needs, and utilize automation to maintain focus on coding. Custom fields in GitHub Projects allow for tailored views that distinguish between smaller tasks, quarterly goals, and escalations, enhancing both visibility and workflow management. The integration of GitHub Actions automates task labeling and notification processes, prioritizing escalations and reducing the average number of open issues. This streamlined approach has significantly improved productivity, allowing Grafana Labs to adapt GitHub Projects to suit the evolving needs of its growing teams, including the creation of a specialized project for the SLO team. The use of GitHub Projects has proven to be a flexible and effective planning and tracking solution, enabling engineers to concentrate on code while providing managers with the necessary oversight to plan team efforts efficiently.

The ReadME Project has launched a new video series titled "Coding Accessibility," which highlights the stories of developers with disabilities who demonstrate creativity, tenacity, and ingenuity in overcoming barriers. The series introduces individuals like Becky Tyler, who, despite having quadriplegic cerebral palsy, uses her eyes to interact with her computer and was inspired to become a developer through open source software. The featured article, "From gaming with your eyes to coding with AI: New frontiers for accessibility," delves into the possibilities that arise when people with disabilities utilize tools like GitHub and generative AI. It includes stories of developers such as Anna Kirkpatrick and Anton Mirgorodchenko, who have innovatively adapted technology to enhance accessibility in coding. Additionally, The ReadME Podcast features conversations with these developers and their mentors, highlighting how they contribute to a more accessible world. The project invites audiences to engage with and share these inspiring stories.

GitHub has launched an open-source repository named github-ospo to assist organizations in establishing their own Open Source Program Office (OSPO), a crucial element for managing open source strategies, policies, and processes within a company. This initiative underscores the increasing reliance on open source software, with 90% of businesses utilizing it, and highlights the importance of securing these tools as security vulnerabilities in open source software have risen by 4% in 2022. GitHub aims to foster a more accessible open-source environment by sharing tools, processes, and best practices from its OSPO, and encourages the community to contribute to this project to build a collaborative and sustainable open-source future.

GitHub's Social Impact and Tech for Social Good team has launched the Activating Developers initiative to empower 50,000 more users to contribute to social good projects. As part of this effort, they introduced the Open Source Community Manager Program aimed at supporting digital public goods (DPGs) aligned with Sustainable Development Goals. The program will help manage and grow online communities for projects like Uli, Open Terms Archive, Chayn, OpenFisca, Uwazi, if-me.org, and Social Income, which address issues ranging from gender-based violence to poverty alleviation. OS community managers will play a crucial role in reducing barriers for contributors, enhancing project management, and ensuring the sustainability of these initiatives. Applications for the program are open until April 10, 2023.

Git 2.40 has been released, featuring contributions from over 88 developers, including 30 newcomers, and introducing a range of enhancements and bug fixes. Notable updates include the extension of git jump support to Emacs, allowing users to populate lists of locations in Emacs much like its existing functionality with Vim. The git cat-file tool now accurately reports object sizes when using --use-mailmap, correcting previous discrepancies. Additionally, git check-attr has been improved to function without requiring an index, making it easier to determine gitattributes in bare repositories. The release also marks significant progress in re-implementing older Git components in C for better performance, with git bisect now fully in C and the legacy git add --interactive implementation retired. Git’s CI infrastructure has seen optimizations, such as disabling resource-intensive Windows-specific builds and introducing configurable CI job cancellation for concurrent branch pushes. These updates reflect ongoing efforts to enhance Git's efficiency and usability across different platforms.

GitHub Advanced Security (GHAS) is a developer-centric application security solution that includes a security overview dashboard for monitoring security coverage and identifying high-risk repositories. GHAS supports integration with vulnerability management platforms such as Brinqa, Kenna Security, Nucleus, and ThreadFix, enabling organizations to prioritize and mitigate vulnerabilities more effectively. Brinqa offers a platform for managing the cyber risk lifecycle, Kenna Security uses machine learning for risk-based vulnerability prioritization, Nucleus provides real-time threat intelligence, and ThreadFix streamlines vulnerability management with numerous integrations. These partnerships and integrations allow security professionals to consolidate vulnerabilities, automate risk mitigation, and enhance their organization’s security posture using GitHub’s tools, further supported by a detailed integration guide for tools not directly included.

Section 230 of the Communications Decency Act, often dubbed the "26 words that created the internet," provides crucial liability protections for platforms hosting third-party content, fostering innovation and supporting developers. As the U.S. Supreme Court reviews this provision in the Gonzalez v. Google case, concerns arise over the potential narrowing of these protections, which could introduce legal uncertainties for software developers and platforms like GitHub that rely on them to maintain a collaborative and innovative online environment. Developers play a pivotal role in maintaining the software infrastructure and contributing significantly to the U.S. economy. Narrowing Section 230 could stifle innovation, competition, and entry for emerging developers and services, as seen in contrasting legal environments in Europe and Asia. The case's outcome could affect not just social media giants but a broader community that benefits from algorithmic recommendations and open-source projects used for content moderation and improving software security. As policymakers consider changes to intermediary liability, it's essential to create a legal framework that supports developers and innovation while addressing concerns about harmful content.

GitHub has announced a mandatory implementation of two-factor authentication (2FA) for all developers contributing code on its platform by the end of 2023, as part of a broader effort to enhance software supply chain security. This initiative aims to protect developers' accounts, which are frequent targets for social engineering and account takeover (ATO) attacks, thus ensuring the security of the open source ecosystem. The rollout of 2FA will begin with smaller groups starting on March 13, gradually expanding throughout the year to allow for adjustments and successful onboarding. Developers will receive notifications via email and banners on GitHub.com about their enrollment requirements, with a 45-day period to configure 2FA. GitHub has enhanced the 2FA setup experience, offering multiple methods such as authenticator apps, SMS, and security keys, with recommendations to use more secure options like TOTP and WebAuthn-compliant methods. A 28-day post-setup validation ensures 2FA configurations are correct, and users can perform a reset if necessary. GitHub underscores the importance of community involvement in this security effort to safeguard open source software, urging developers to proactively enroll in 2FA and highlighting its role in protecting the software supply chain.

GitHub Docs recently transitioned from an in-memory site-search solution to Elasticsearch to address scalability issues as the platform expanded. The previous system struggled with loading all searchable text into memory, necessitating a shift to a more robust solution. Elasticsearch was chosen for its ability to run locally, which simplifies the debugging process for engineers. The new implementation involves a single query to Elasticsearch that ranks search results using boosts and matching techniques, tailored to whether queries are single or multi-term. The search strategy emphasizes relevance by using a matrix of fields and analyzers, incorporating both explicit and regular matches, and applying varying boost levels to prioritize results based on content, title, and heading matches. Popularity metrics from pageviews further refine the ranking, ensuring that frequently accessed content is prioritized, although there is an ongoing effort to balance this with algorithmic adjustments to prevent popular yet less relevant results from dominating. Future directions include exploring synonyms and contextual variables to enhance search precision and incorporating user feedback to continually refine the search experience.

GitHub has introduced multi-repository variant analysis (MRVA) to help developers and security researchers identify new types of security vulnerabilities across numerous codebases using CodeQL, its static analysis engine. MRVA enables users to scale variant analysis by running highly customized CodeQL queries across thousands of repositories, thus saving time and facilitating the rapid discovery of vulnerabilities. This approach has already been employed by GitHub's Security Lab to uncover vulnerabilities affecting millions of applications. MRVA is designed to work seamlessly with GitHub's existing infrastructure, utilizing CodeQL databases from public repositories with code scanning enabled, and allowing for the creation of custom lists for targeted analysis. The tool also supports private repositories, provided they have CodeQL code scanning activated, and offers features such as sorting results by repository popularity and generating Markdown reports for sharing findings. This initiative is part of GitHub's broader commitment to enhancing software security without detracting from the developer experience.

The pervasive nature of software and hardware in everyday devices, from smartphones to industrial systems like elevators and medical equipment, makes the integration of quality and security non-negotiable in their development. This complex landscape requires compliance with various safety and security standards, which can be streamlined through automation. GitHub plays a crucial role in enhancing the development lifecycle of embedded systems by offering tools like version control, code scanning, and dependency management to ensure security and compliance. GitHub's capabilities, such as CodeQL, Dependabot, and secret scanning, integrate security checks into the workflow, while GitHub Actions facilitates automation in building and deploying software. These features empower developers to maintain security, manage dependencies, and automate workflows, ultimately enhancing productivity and ensuring the secure delivery of software solutions.

GitHub Galaxy is a virtual global enterprise event taking place from March 28-31, designed to enhance developer productivity and transform businesses by showcasing innovative tools and developer-friendly features. Attendees, including business leaders and developers, will have the opportunity to learn from key sessions focused on flexibility, productivity, security, reliability, efficiency, and collaboration in software development. The event highlights how GitHub's platform and tools like GitHub Copilot can streamline workflows, enhance security practices, and foster efficient collaboration, as demonstrated by companies like Telus, EY, and BCP. Over three days, participants can engage with industry experts and GitHub leaders in various regions, gaining insights into building a secure and integrated developer experience that drives innovation and meets business goals.

GitHub Advanced Security (GHAS) integrates security testing into developer workflows to enhance software security without sacrificing productivity or collaboration. GHAS allows developers to automate security tests for vulnerabilities and secret leaks on every pull request, displaying results in a cohesive format alongside native GitHub solutions. It offers free security features for public repositories and as an add-on for private ones, enabling the use of tools like CodeQL for static analysis, Dependabot for supply chain security, and secret scanning for credential leaks. Developers can extend their security coverage with over 60 third-party application security tools, including SAST, DAST, API, and container scanning tools, all integrated seamlessly via GitHub Actions. The platform provides a centralized view of security risks across multiple repositories, allowing users to manage vulnerabilities effectively and maintain a consistent security posture.

Pull requests are a fundamental aspect of GitHub, fostering collaboration and community growth, and the GitHub Mobile team has been striving to enhance this experience by enabling users to manage their code on the go. Recent updates to the GitHub Mobile app now allow users to edit files, including README files, directly from their mobile devices, facilitating continuous contributions even when away from a computer. Users can easily make modifications, commit changes, and create new branches for more structured updates, as well as propose changes through pull requests. This flexibility extends to editing within open pull requests, allowing for quick fixes without needing a laptop. The team invites feedback to help improve the mobile app, which is available for both iOS and Android, and encourages users to engage with the public feedback community for ongoing enhancements.

GitHub Enterprise Server 3.8 introduces a variety of new features aimed at enhancing user experience and improving management capabilities for enterprise clients. The release includes the public beta of GitHub Projects, an adaptable tool for planning and tracking work, which integrates planning directly into development workflows. The update also enhances GitHub Actions with organization-wide required workflows, enabling standardized CI/CD practices across repositories without individual configuration. Security improvements include native CodeQL support for Kotlin and the ability to authenticate storage accounts via OIDC, reducing the need for sensitive cloud secrets. The Management Console now supports multiple user accounts, allowing for better access control and activity tracking. Additionally, the release features new policy controls, such as branch protection rules and repository forking policies, to help administrators maintain compliant workflows and encourage code reuse.

GitHub Codespaces, coupled with dev containers, offers a streamlined approach to setting up development environments, allowing developers to bypass the tedious setup processes traditionally associated with configuring local machines. By utilizing a devcontainer.json file, developers can automate the installation of dependencies, manage environment variables, and customize their development setups with ease. This cloud-based solution enables coding from any location, providing a consistent and reliable environment that can be accessed through any modern browser. With GitHub Codespaces, developers can start coding immediately by simply opening a codespace, as it automatically configures the necessary tools and settings, thereby enhancing productivity and flexibility for software development projects.

GitHub Octernships is an initiative designed to help students transition their passion for software development into a tech career by offering opportunities to work on real-world projects with companies globally, while still studying. Participants receive mentorship from industry experts, gain hands-on experience in various areas such as open-source projects, documentation, design, and testing, and connect with potential employers from a curated list of registered partners. The program initially targets students from ten countries, including India, Singapore, and Mexico, with plans to expand further. Organizations like Appwrite have praised the program for its focus on practical projects and the high quality of participants, often leading to job offers. To apply, students must be verified on Global Campus, actively contribute to GitHub, and monitor project postings throughout the year. The program also encourages companies to become partners, offering them access to a diverse pool of skilled students and the opportunity to shape future tech talent.

The February Release Radar showcases a selection of notable open-source projects that released major version updates, highlighting the vibrant activity within the community after a festive break. Key projects include Moby 23.0, which introduces BuildKit/Buildx as the default build experience and new features for SwarmKit; DalleCLI 1.0, enabling command-line interaction with the DALL-E 2 API for AI-generated images; and Infection Monkey 2.0, which focuses on adversary emulation for chaos engineering. Other highlighted projects are Pretty Maps 1.0 for creating customizable maps, Homebrew 4.0 with improved installation speed and analytics, Snippets for VSCode 3.0 now featuring drag-and-drop functionality, and Qdrant 1.0, a Rust-based vector search engine for AI applications. The roundup also mentions Rallly 2.0 for scheduling meetings, Brainchop 2.0 for MRI analysis using AI models, and GitMoji CLI 8.0, which allows the use of emojis in commit messages, requiring Node version 16 or higher. The Release Radar encourages ongoing submissions from the open-source community, celebrating all contributors regardless of the project's scale.

GitHub Security Lab conducted an audit of DataHub, an open-source metadata platform used for data discovery and governance, uncovering several critical vulnerabilities in its authentication and authorization modules. These vulnerabilities, which included Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), JSON Injection, and missing JWT signature checks, could have allowed attackers to bypass authentication, gain unauthorized access to sensitive data, and perform other malicious activities. The audit employed both manual inspections and automated CodeQL analysis to identify these issues. After discovering these vulnerabilities, GitHub Security Lab reported them to the DataHub development team and collaborated closely to patch them, resulting in security improvements in DataHub versions 0.8.45 and 0.9.5. This collaboration has not only enhanced the security of DataHub but also benefited the wider community of organizations utilizing the platform.

In GitHub Desktop 3.2, users can now preview pull requests locally, allowing them to review a diff of all changes from a feature branch before pushing to the repository's default branch, which helps prevent common mistakes like leaving debugger statements. This update builds upon version 3.1's multi-commit diffing and introduces several enhancements, including improved submodule support, fork notifications, and the ability to force push or fetch without switching branches. These features aim to boost confidence in both Git and GitHub workflows by providing more robust tools for managing changes. GitHub Desktop continues to benefit from its open-source community, with numerous enhancements and fixes contributed since version 3.1, highlighting the collaborative nature of the platform's development.

SCaLE (Southern California Linux Expo) is the largest community-run open-source and free software conference in North America, taking place in Pasadena from March 9-12, 2023. GitHub will have a presence at the event, featuring talks from speakers like @blackgirlbytes discussing GitHub Copilot and @margaret-tucker on developer involvement in public policy. The conference will cover a wide range of open-source topics, including sessions like an introduction to Vitess, a MySQL sharding framework, and a session on creating a serverless stack by accident. Attendees can also look forward to practical advice for cloud engineering from Camilla Berretta's session, "Cloudy with a Chance of Success," which offers tips for overcoming challenges in cloud development. The event promises a diverse lineup of speakers from around the world, with opportunities for attendees to engage with experts and learn about the latest developments in open-source technologies. Registration for the event is still open, inviting participants to explore the full schedule and connect with the vibrant open-source community.

Python, a high-level, interpreted programming language, remains a dominant force in software development due to its readability, simplicity, and versatility, making it popular among developers, data scientists, and researchers. Originating in the 1980s and officially released in 1991 by Guido Van Rossum, Python is celebrated for its easy-to-read syntax that uses English keywords, cross-platform portability, extensibility, and a broad standard library. Its applicability ranges from web and software development to machine learning, data science, financial analysis, and artificial intelligence. Python's widespread use is bolstered by its open-source nature and expansive community support, offering resources and frameworks like Django for web development and libraries such as NumPy and Pandas for data manipulation. Its utility in academia and corporate sectors further drives demand, exemplified by its role in powering technologies at organizations like NASA and OpenAI. For those seeking to learn Python, platforms like GitHub provide tools such as Codespaces and Copilot to facilitate coding and project development.

In February, GitHub experienced several incidents that affected service performance, including a significant datacenter outage impacting Codespaces in Southeast Asia and issues with MySQL database connectivity due to deployment errors. The company responded by redirecting resources, implementing architectural adjustments, and enhancing monitoring systems to mitigate future occurrences. Additionally, in January, errors in the Container registry due to authentication misconfigurations led to failures in GitHub Pages and Packages, while a change in compression settings inadvertently affected checksum reliability for source code downloads, prompting a reversion and the introduction of checksum validation procedures. February closed with a still-under-investigation issue affecting Codespaces performance, with further details promised in a subsequent report. Through these incidents, GitHub has committed to improving its infrastructure resilience and communication with affected communities.

GitHub has introduced a public beta for enhanced macOS runners in GitHub Actions, offering increased speed and flexibility for developers requiring faster processing of macOS jobs. These new runners utilize the latest x64 Apple hardware, significantly reducing job execution times and enabling developers to focus more on building and testing code efficiently. In addition to the existing 3-core runners, a new 12-core "XL" runner is available, allowing users to easily increase performance by modifying a single line in their workflow file. This on-demand service ensures users only pay for the additional performance when needed, without consuming GitHub Action minutes in both private and public repositories. PyTorch has already benefited from this upgrade, reducing its build times dramatically. Developers interested in testing the new runners can request beta access and utilize the updated macos-12-xl or macos-latest-xl runner images. GitHub is also preparing to introduce Apple silicon-based machines, with plans for a limited beta in 2023, subject to hardware availability.

GitHub has announced the general availability of GitHub Actions Importer, a tool designed to streamline and automate the migration process from various CI/CD platforms like Azure DevOps, CircleCI, GitLab, Jenkins, and Travis CI to GitHub Actions. This extension of the GitHub CLI, available for free to all GitHub users, addresses the often manual and time-consuming nature of migrations, especially for large-scale infrastructures, by providing a phased approach involving planning, testing, and migration. GitHub Actions Importer allows for dry-run migrations to ensure converted workflows function correctly, thereby reducing the potential for errors and enhancing the efficiency and confidence of software delivery. By integrating seamlessly with GitHub, GitHub Actions eliminates the need for third-party tools while offering access to thousands of pre-built actions, ultimately improving developer productivity and reducing time spent on managing code infrastructure. GitHub plans to further enhance this tool by adding support for more CI/CD platforms in the future.