devopsy.kinsta.cloud

Tag: GitHub Universe

  • GitHub Previews Free CI/CD Migration Tool Due in 2023

    GitHub Previews Free CI/CD Migration Tool Due in 2023

    At its GitHub Universe event, GitHub today unveiled a bevy of updates to its cloud service, including a forthcoming set of migration tools. The tools will automate migrations from legacy continuous integration/continuous delivery (CI/CD) platform to GitHub Actions.

    GitHub Actions Importer is already being used by a small group of enterprise IT organizations to migrate workflows and template the GitHub CI/CD platform.

    Damian Brady, senior manager for developer advocacy at GitHub, told conference attendees that these free tools will become more broadly available in 2023. GitHub Actions Importer will be distributed as a Docker container that manifests itself as an extension of the GitHub command line interface (CLI).

    One of the biggest challenges the company has faced in driving adoption of its platforms is that many DevOps teams don’t want to rebuild the templates and workflows they are already using on their existing CI/CD platform, he noted.

    Other GitHub Actions extensions include native integration with software development tools for building internet-of-things (IoT) applications and support for personal access tokens (PATs) that enable more granular control over permissions and repository access.

    Other security capabilities include expanded access to audit log events in the enterprise edition of GitHub, an ability for maintainers of open source repositories to privately share vulnerability reports and support for Ruby as one of the programming languages now supported by a CodeQL tool for discovering vulnerabilities.

    Additional extensions to existing services for developers also were previewed, including an ability to interact with the GitHub Copilot tool for automating code writing using voice commands. Dubbed “Hey, GitHub!” the tool is available as an experiment being advanced by the GitHub Next research team.

    Finally, the company previewed enhancements to code search-and-view capabilities in the Codespaces tool that will now be made available for free for up to 60 hours per month to developers.

    GitHub claims its CI/CD platform is now being used to process 10 million builds a day, most of which are employing code accessed via its repository. It’s not clear how that compares to other CI/CD platforms, but it’s apparent the GitHub Actions CI/CD platform has gained a significant amount of traction as GitHub continues to make a case for creating tighter integrations between its repository and CI/CD platform. GitHub is also clearly signaling it will spend a lot more time wooing organizations that already have a legacy CI/CD platform installed.

    In the meantime, the next era of DevOps has arrived as workloads become both more complex to build and deploy across highly distributed computing environments. Many of the CI/CD platforms that organizations deployed are now straining under the weight of multiple customizations and extensions that have been made over the years. Each DevOps teams will need to decide whether maintaining those platforms makes the most technical and economic sense or if they should migrate to a more modern platform.

    Regardless of what they decide, one thing that is certain is that DevOps teams won’t be getting larger, so the need to invest in higher levels of automation has become pressing.

  • Sonatype Delivers Premium Open Source Controls to GitHub Users

    New Integrations Deliver Enterprise-Grade Open Source Governance and Dependency Management to Millions of GitHub Developers

    SAN FRANCISCO – GitHub Universe, Nov. 12, 2019 (GLOBE NEWSWIRE) — Sonatype, the company that scales DevOps through open source governance and software supply chain automation, today announced new integrations that strengthen GitHub with premium open source governance and dependency management controls.

    Sonatype has long been the world’s premier provider of open source health and hygiene data and beginning today the company is announcing six new Nexus integrations with GitHub:

    Automatically fix open source issues with trustworthy pull requests from Nexus Lifecycle

    As the use of open source continues to skyrocket, the importance of understanding dependency trees becomes even more crucial to software security and innovation. According to Sonatype’s 2019 State of the Software Supply Chain report, teams that regularly update OSS dependencies deliver higher quality software with 65% fewer vulnerabilities.

    This realization is motivating more and more software engineering teams to seek solutions that can automatically open GitHub pull requests to help developers continuously update dependencies.  The challenge, however, is that automated pull requests are not created equal. Different from the competition, only Sonatype generates automatic pull requests that developers can truly trust.

    “The easy part of dependency management is creating a service that can automatically open a GitHub pull request whenever new versions of dependencies are published,” said Brian Fox, CTO of Sonatype. “The hard part, however, is creating a service that is smart enough to understand in real-time the integrity of new versions before automatically opening a pull request.”

    Sonatype generated pull requests are more intelligent because they’re based on Nexus Intelligence, giving developers confidence that they’re being recommended the best version available and removing friction in their GitHub pipeline.  Nexus Intelligence, which powers Nexus Lifecycle, has analyzed more than 65 million open source components and cataloged over 10 million open source vulnerabilities, creating incredibly accurate OSS data that decreases noise to give developers greater peace of mind when automatically upgrading dependencies.

    Innovate faster with less friction thanks to unrivaled, precise policy enforcement with Nexus for GitHub Actions 

    High velocity DevOps and Continuous Integration practices depend on automation to remain afloat. It’s vital that security is built directly into these pipelines to keep workflows moving and innovation rolling. This velocity makes precision and the highest quality data necessary to identify the best open source to use in software builds. Sonatype’s suite of new integrations with GitHub Actions brings the unique intelligence and power of the Nexus Platform directly to your CI/CD pipeline – making it even easier to develop secure software.

    • Nexus Lifecycle customers can now automatically enforce their policies and view expert remediation guidance directly in GitHub Actions. Sonatypes unparalleled open source data enables developers to know with extreme confidence, if a component is vulnerable without leaving their environment. Nexus now supports 42 programming languages and package formats.
    • Nexus Vulnerability Scanner (NVS) is a free tool that allows you to see what the Sonatype data difference is all about. Add NVS to your GitHub Actions pipeline to find out what’s really in your software and how we use Advanced Binary Fingerprinting to precisely identify components and eliminate false positives/negatives.
    • Nexus Repository (Pro and OSS) now integrates directly into GitHub Actions making your workflow even easier, by bringing your single source of truth for components, binaries, and build artifacts directly into your CI/CD pipeline.
    • Sonatype Nancy – is a free tool that checks for vulnerabilities in your Go (Golang) dependencies, by employing the power of OSS Index. Nancy works for projects that use dep or go modules for dependencies, and now integrates with GitHub Actions.

    Additional Resources:

    About Sonatype

    Sonatype is the leader in software supply chain automation technology with more than 300 employees, over 1,000 enterprise customers, and is trusted by more than 10 million software developers.  Sonatype’s Nexus platform enables DevOps teams and developers to automatically integrate security at every stage of the modern development pipeline by combining in-depth component intelligence with real-time remediation guidance. For more information, please visit Sonatype.com, or connect with us on Facebook, Twitter, or LinkedIn.

  • GitHub Applies Data Science to Managing Code

    GitHub Applies Data Science to Managing Code

    Over the last several years GitHub has emerged as one of the primary repositories around which application development now revolves. At its recent GitHub Universe 2017 conference, the company revealed how it is extending that central role to provide DevOps teams with the addition of a dependency graph that can be employed to alert DevOps teams when a module of code has been updated and a security alert service that will notify them anytime a patch has been made available for a specific module.

    Miju Han, engineering manager for data science for GitHub, says both new capabilities are examples of how the company is applying advanced algorithms and data science techniques to make it easier to manage DevOps processes that revolve around GitHub.

    In addition, Han says GitHub is making available a news feed through which DevOps teams can track updates to groups of modules stored in the repository, as well as a tool through which they can explore a curated set of modules.

    Han says his company intends to combine a variety of emerging data science tools to simplify the daily workflow that revolves around GitHub. As the repository has become more widely used, the sheer volume of code and related updates a DevOps team is supposed to track has become, in many cases, overwhelming. That’s why the company is now pouring resources in several data science research projects with an eye toward making it simpler to navigate the repository.

    The latest annual edition of an Octoverse report published by GitHub finds that there are now more than 24 million developers in 1.5 million organizations around the world accessing 67 million GitHub repositories. A total of 25 million of those repositories are public. The most popular programming languages in use across GitHub are JavaScript (2.3 million projects); Python (1 million projects); Java (986,000 projects) and Ruby (870,000 projects). In terms of pull requests, GitHub notes that Python surpassed Java in popularity in the last year. The company also notes that half of the largest companies in the U.S. based on revenue are employing GitHub repositories.

    There is no shortage of repositories being employed inside and out of enterprise IT organizations, including an enterprise edition of GitHub that the company claims has been implemented by 45 percent of the Fortune 100 list of the world’s largest companies.

    Arguably, the biggest challenging many organizations now face is trying to reconcile the various code repositories in use. Just about every provider of an application development platform provides access to a code repository. In addition, providers of everything from container frameworks to application lifecycle management (ALM) often provide similar capabilities. Keeping track of what version of any given piece of code resides where at any given time has become a significant challenge.

    The good news is that providers of repositories are starting to address that issue on their own platforms, which means it stands to reason that one day soon tools for managing code across heterogeneous repositories may not be all the far off. In the meantime, DevOps teams can take some comfort in the fact that the management tools they rely to manage all the code are about to become a whole lot smarter.

    — Mike Vizard