good afternoon how is everyone did
everyone have a good
lunch good so I apologize I'm a little
croaky today so bear with me as I try to
find my voice so I know we're just
coming out of lunch we're going to try
and keep it a little bit interactive
today so welcome to my session GitHub
and Azure better together I am April
Edwards I'm a senior developer Advocate
at GitHub I've been at gith GitHub for a
whole seven months now prior to joining
GitHub I was at Microsoft for over five
years and in those 5 years I got to
write this content for Microsoft build
and deliver it globally so now I get to
deliver it for you all here uh how many
of you are using Azure
today how many of you using AWS or
gcp okay good i' like to see a good mix
we're not just all about Azure we're
goingon to talk about some of the other
clouds as well we like to be inclusive
of all the clouds so um yeah I've been
in tech for 24 years this is my second
time here in Portugal and I love coming
back um and when I started off my career
I start off in the operational space and
I started working in azure actually in
2013 and if anyone remembers Azure it
was called Windows Azure or Azure
depending on which uh intonation you
want and we rebranded it to Microsoft
Azure because it wasn't just about
Windows and over 60% of the VMS in uh in
the cloud in Azure are actually Linux
VMS so Windows Azure did not fit as a
title so um yeah and in my career I've
moved around I've done different things
and in the last few years I've been more
in development probably in the last 10
years I've gone into development um I
got tired of Designing data centers and
lifting and shifting I got more into
refactoring and doing a little bit more
with that so that was kind of where my
path went so we're going to talk about
GitHub and we're going to talk about
Azure and how they integrate and there's
always questions about the different
product Stacks um and we're going to
take a good look at it at it all so
before we get started I want to ask all
of you a little bit of interaction after
lunch how would you define
devops you can just shout it out we're
all
friends
the flow from development into all the
stages yes so the whole process of De of
development yes anyone
else someone come on I'd offer free swag
for an answer but I'm out of Swag um but
with all of us here we all have a very
different definition of devops we have
different backgrounds we have different
technical skill sets we come from
different places in our life so I want
to go ahead and level set and this is
from one of my great colleagues Donovan
Brown who's now retired from Microsoft
and racing cars must be nice um he
defined devops as the union of people
process and products or Technologies to
deliver continuous value to our end
users now I want to work focus on this
word value because all the things we're
going to talk about today is the
technology the process but what value
are you actually
delivering we think about the devops
process um we have all these tooling we
have all this products and everything
we're doing how do they interact but
it's the people change it's our
interaction the developer experience
it's the operation ational teams so when
I was in operations I was tasked with
keeping the Lights On 24x7 by 365 I had
to maintain a certain nine of uptime in
all my infrastructure and then when I
moved into development I was tasked with
pushing features and those things
Collide all the time so if our teams
aren't aligned to delivering the same
value and the same end goal we're not
going to be able to align our process
and our products to that as well and we
can invest all the money in the products
we've all done it right we've worked for
an organization and they're like here's
all this money buy this new tool it's
going to fix all the things and we're
going to do all the devops but that's
not actually how it works we got to
change the fundamental people side of
it so why devops right and we talk about
all the tooling and everything else the
world is a very very messy place out
there um I've worked for organizations
we've bought all the tools we've done
all the things it's going to make our
lives better but the reality is when we
plan we build and we go through that
process there are so many different
tools we're asked to use it's hard to
contact switch it's hard to know what
tool to use maybe we like one tool
better than the other and we have
various skill sets amongst our teams and
that's really hard to be a very agile
organization
so what we've done at GitHub and we've
done it at Microsoft as well is we've
built a platform that allows you to
build scale and deliver secure software
from beginning to end now who remembers
GitHub in the days of old in 2008
2007 few of you all right so in 2007 we
were a small startup at GitHub you know
we just had a little bit of a codebase
and a little bit of a platform using git
to push all of our changes now we've
grown into this end-to-end platform so
we're going to talk about that end
to-end product what all the products do
and how we can deliver that better as
organization
what we want to do is improve that
developer experience for you as the
developer now we use this word developer
a lot so I'm going to go ahead and throw
out a really controversial statement
everyone is a
developer if you tell a computer to do
something for you you're developer so
when I worked in operations one day and
I said I'm a developer I got things
thrown at me I've set it out on Twitter
to one of my operational friends and I
got like exploded on on Twitter but that
same person was using things like
Powershell and Bash to do things and to
automate stuff you're a developer you
might not be a programmer you might not
deliver websites and applications but
you're a developer so we are going to
use the word developer lot it is
inclusive of everyone sitting here in
this room and I have someone sitting
over there who does not work in Tech per
se but she's a developer as well she
just doesn't know it
yet so we want to be able to lower that
maintenance and that overhead that we
have with all that tooling now the
really cool thing is you can integrate
all these tools into GitHub and probably
a lot of you are doing that today
because we're a huge open source
platform there's some really good stats
out there on open Source contribution um
over 90% of organizations are using open
source today how many of you use an open
source product in your
day-to-day good portion of you um and
that's maintained on GitHub a lot of
that is maintained on GitHub and I'm
going to just you know kind of say it
Microsoft acquired GitHub to get closer
to the developer experience so that's
why we're at today that's why we have
the GitHub and Azure story and that's
actually why I moved from Microsoft to
GitHub was to bring that story together
and to deliver that from the GitHub side
because we're making such a huge
investment in that space so why do we
care about devops because your
competition's already doing it now the
really cool thing in devops is we talk
about theories we talk about all these
commonalities but we have actual hard
statistics to prove that devop devops
works we can measure things we can
measure time to deploy time to remediate
all these important things change when
we when we look at our organizations and
how we're delivering our software and
our applications and our infrastructure
to the cloud so we're going to have an
outage and I hope we don't have an
outage while I'm here on stage but it's
happened to me github's had an outage
how do we recover from that how are we
transparent to other organizations about
that in a high performing devops
organization we know that they can
recover from inces much much faster over
2,000 times faster we also know we have
faster time from commit to deploy and
that's why it's important to be a high
performing organization how many of you
have deployed still deploy software once
every six
months I see a few hands it's okay safe
space safe space um I was talking to
someone recently at a at a conference
and they're like our customers do not
like us deploying stuff regularly they
only like it every 6 months and I'm like
do they not like your feature update
Ates every 6 months or do they not like
how you break everything 6 months and
they're like yeah they don't like how we
break everything right so how do we
revert that how do we come from that how
do we have more frequent code
deployments High performing devops
organizations we use this term called
shifting left in devops we want to fail
fast and we want to pretty much do
things more often smaller chunks instead
of pushing Big monolithic applications
where we might update them a few times a
year we want to do things and push
things to production now if any of you
worked in an organization where you've
done these big monolithic pushes I used
to work in an org that was like this
many many years ago uh we take an entire
like bank holiday weekend and we' get
ready we'd have the whole team ready
we'd have our development team our
operational team our security team
everyone was on board was all hands on
deck we'd push our updates to our
infrastructure and our features in our
applications and everything would break
it was a non-repeatable thing it
happened all the time it cost us time
money and a lot of gray hair um so what
happened um we started changing how we
did that we started doing more more
frequent deployments I deploy into
production every single day how many of
you deploy into production every single
day a few of you good and it's a hard
thing to do but you know I work with a
lot of organizations that do deploy into
production every day several times a day
at Microsoft and GitHub we deploy into
production several hundred times a day
if I pull up the GitHub repository you
can see the actions running you can see
all the code getting deployed live as we
are kind of doing this so why is it
important to shift left because it cost
our organizations less and at the end of
the day they want to see this result
they want to see how we're outperforming
our competition
and we know that when we deploy these
things to Azure and we catch it in
production it costs us a lot more money
this is a problem I have done this
before I've taken out an entire
infrastructure um I'm I I'm still
employed after that but we've all been
there right we've taken out an entire
infrastructure um but then there's other
organizations that have been a little
bit more exposed I haven't just made an
oopsies but some organizations actually
put passwords in production how many of
you put a password in
production really no one's put a
password in production
okay I got two I've done it um not
recently but it probably like 10 years
ago so how do we do things early and
often so the things we're going to talk
about today are going to get closer to
the developer experience how do we help
ourselves as developers deploy more
frequently but also prevent
errors so what does a normal day look
like for you and I realistically I don't
write a lot of code I'm in meetings I'm
waiting on other people I'm waiting for
access to things I need to be able to
deploy code faster so that small Manu
amount of time I have every day needs to
be more effective and that's why we're
shifting left and doing things earlier
and
often the other good thing is if we fail
fast we know it doesn't work quickly
instead of it failing and it goes on for
months months months and months and
there's a big cost and expense to the
organization but in our day and life of
a developer we need to be more effective
in how we do
things so what does secure software
development look like now I am not a
security expert but every project I've
ever been on I've had that security
person say you can't deploy to the cloud
it's not secure enough when the cloud
came about and I was really started
getting really involved in deployments
in 2013 it was always the security
person in the room saying this isn't
secure enough we need to do it a
different way we need to look at how we
do it as a developer I don't care about
security I mean I don't want to do
stupid things I don't want to cause a
security breach but security isn't my
forte it's not my specialty so how do we
enable our developers to be more secure
and write secure code so this is where
GitHub and Azure and Microsoft are
paired together to embed this in our
developer workflow we want to be able to
stay in the flow we want to be more
secure and not push those things to the
cloud and more importantly we talk about
the people side how do we bridge the gap
between our development teams our
security teams and our operational
teams so they've put together a really
good graphic here of what this looks
like in the Microsoft GitHub ecosystem
so while everyone says we're the same
company we're absolutely not we're very
different entities but we do work
together and I think that's an important
part of the story so it starts with
where you clone your where you write
your code in how many of you use vs code
or Visual Studio every
day does anyone here use notepad++
all right we're gon to have a
chat so true story I was with a customer
and we're deploy we're working on the
project we're writing infrastructure
code which is one of my favorite things
to do don't judge me uh we're writing
infrastructures code and this this
really really awesome smart human who's
Wicked great at writing code had just
learned terraform is coding away and
goes April I need your help and I'm like
sure what's going on he goes I have an
issue in my code he took him four hours
and he couldn't figure it out and so I
took his took his Branch looked at his
pulled up in vs code he was using
notepad++ and I found it in about 30
seconds why because I've got the
extension of vs code to tell me where
the heck the code went wrong so we're
going to use vs code actually we're
going to use code spaces we're going to
cheat but it's going to be similar we're
going to use this development experience
to push some code up into the cloud and
see what that looks like as us the
developer now where do you keep your
code how many of you keep your code in a
local server in your
environment okay do you have your own
git
system a your devop server okay so
you're self-hosted but you're using a
third party product okay that that's
allowed so where you keeping your code
that's a that's a secure place sorry
that's a very secure place love it um
and I'm a big fan of azure devops I used
to work with a product group so I I love
the product through and through so
where's your code now we say GitHub repo
and again it could be in a self-hosted
server in an Azure devop server or a
GitHub Enterprise server hosted in your
data center because that's very common
not everyone can just poof mood to the
cloud right so then how are you
deploying those things with Azure devop
server using Azure pipelines yes they're
using Azure pipelines fantastic so we're
going to talk about GitHub actions today
so you can integrate Azure pipelines and
GitHub actions um they seamlessly go
across each other um I'm not going to
demo it today because I'm not going to
pull up AER devops but I can show you
how to do that and we can talk about
that next up is security so when we're
writing a code before we deploy it we
want to look at things like our Advanced
Security package like are we scanning
our code so Uber one of our favorite uh
one of my favorite examples for who
likes doing code breaches like all the
time they don't scan their code their
code is sitting in GitHub um I don't
know why why they're not using our
products not it's they're not really my
customer but we have codes scan enable
to find those passwords in our code and
why does Uber keep having a breach
because they're not scanning their codes
they're not being proactive they're not
bringing those tool tools to us um the
other thing we have in GitHub Advanced
security is dependency scanning again
open source consumers out there what
packages are you using how do you keep
track of all those packages I can't I
absolutely can't and again I'm not a
security specialist so we're going to
look at GitHub Advance Security and
actually how that interacts with our
code and helps us to solve those
problems a little bit better before we
deploy it again that develop experience
um and then how we push things to the
cloud so I've containerized all my
applications um I'm quite fortunate not
all of us can do that but we're going to
push that to Azure container registry
and scan our container in that action to
see how it goes and then deploy it into
Azure so our security teams and our seup
teams care about things like
authentication they want to look at
Azure monitor how do we hook those
things into the process and then how do
we do things like things as code so when
I start off in Tech everything was CLI
no goey no pointy clicky things click
Ops was not a thing as I progressed in
my career goys came about and I was like
oh this is cool I can see what I'm doing
there's pretty pictures love it we're
going back to everything as code we
deploy things through this has arm
templates I prefer bicep um or terraform
but then we can add in our policies into
our infrastructure as code when we can
deploy that put those policies into our
pipelines and then we have things like
securing our code whether we use Azure
key Vault or GitHub secrets we can use
any of those and again hooking in the
aure security experience to that
experience bring that security team in
and we can hook all these products into
what you're deploying GitHub with
GitHub so where does security fit in the
development lifestyle life cycle not
lifestyle sorry uh security starts when
your developers clone their code so we
have to think about how we secure our
machines so that the same person that I
was speaking about before that was using
notepad++ had an extremely extremely
locked down machine why they didn't
trust their developers we're always
given the crappiest laptops we're given
the basement offices we're given like
the cobwebs and all the junk we're
getting the throwaways but they want to
secure and lock us down and when we
secure and lock down our developers we
prevent them from being more creative
being Ena we disable them from being who
they are and to be able to write code
again think about that pie chart I
showed up where we're waiting for Access
how long does it take how many people
when you're getting started a project
takes a day to get access to everything
two days a week a month when I was in
engineering I had a lot of customers
took us two to four weeks to get access
we kick off a customer project we do
Whole architecture thing and to get
access two weeks Etc it was always that
spin up time that we were waiting on but
then we had to think about how we
secured our machines and that was a
whole other conversation on top of
getting access to the infrastructure and
everything else we needed to do things
so if we're thinking about where
security starts we want to think about
the pre-commit where do where are we
writing our code in the IDE we're going
to talk about that IDE experience
shortly but we need to use secure coding
standards how many of you use peer
review when you're pushing your poll
requests awesome quite a few of you um
anytime I push a poll request when I was
more on the engineering side we had one
person from the Microsoft engineering
team one person from the customer so
everyone had visibility and we could
cross reference what was going on peer
reviews and The Human Side is really
critical now there's a lot of talk
around Ai and automation we're we're
going to automate some things the people
side is absolutely critical we still
need peer reviews you need to understand
the code what's going on so we need
those standards in place so AI is not
going to replace all of it while there
are features coming out in GitHub uh
very shortly in a few weeks to help with
peer reviews and poll requests ites
doesn't replace the human element of
reviewing this so I just want you to
remember that it's a co-pilot because it
is our friend it codes with us doesn't
code for us
technically so then when we commit that
code what are we doing when we commit
that code are we doing unit testing how
many of you love writing unit tests how
many of you have 100% code coverage I
like asking this question oh we got one
I get like one person every talk now I
love that like you is like no hands I
love seeing someone getting 100% code
coverage I don't have it so I envy you
we can we can hang out later and talk
about how you do that um so how do we
commit their code right are we doing
dependency scanning are we doing tests
are we doing any tests are we doing
tests before we deploy to production are
we protecting our production environment
so we're going to look at how we do that
then we deploy our code are we using
things like infrastructure's code how
many of you deploy things by the portal
by
hand all right I see a couple of you
okay no judging friends here remember
safe space that's okay but when we look
at infrastructures code we can test it
when I worked in infrastructure we just
pushed the big red button and deployed
stuff and we were like what's going to
come out on the other side so when we
deploy those things can we test it can
we see it we can new security acceptance
tests before we deploy to production and
one of the biggest pieces of the puzzle
is operate and monitor I was working
with a customer in the UK um a couple
years ago and they're like we're doing
all the devops they were really excited
like we're super agile we're doing all
the things um but we're missing
something I'm like okay so talk me
through your process what are you doing
they weren't doing any monitoring
monitoring is key because when I showed
you guys those stats of how effective a
high performing agile organization is
that's coming from our monitoring how
fast are we covering how fast are we
deploying how can we do better you need
to measure everything in this cycle so
that when you go to your next Sprint
cycle you can do better and that's what
we're looking to do we need to measure
measure to improve not measure to hinder
our
developers so we have GitHub Enterprise
um for those of you that have used uh
Azure devops um similarish kind of
product but very very different all at
the same time so we have things like
collaboration inner sourcing you know we
we talk about open source right
consuming Open Source Products we're
taking those practices inh house and
using practices like that to develop
inner Source practices how do we plan
our projects okay planning is critical
because before we can execute we need to
plan and plan well we need to be able to
put things in uh secure our packages
contain those packages in container
registry how do we automate and develop
we're going to talk about GitHub actions
and code spaces and again everything is
code and then we need to have everything
secured by Design so every product we de
develop within Microsoft and GitHub is
secure from Day Zero now there might be
some features missing but the security
is there security comes first when we're
developing these products so we're going
to talk about GitHub codes spaces so I'm
not going to talk at you for the entire
hour because nobody needs to hear that
we're going to do some actual coding in
a minute GitHub code spaces I love um
I'm working on a PC right now I have a
Mac at home I've got another another
device in my office I can
interchangeably work between all three
devices in a secure environment it spins
up a containerized environment in Azure
and I can set the environment for every
person in my organization so instead of
waiting days weeks months to get access
to things we can spin up a code space
directly from our repository which we're
going to do shortly simplifies my
workflow I don't have to contact switch
I don't have to come out of it and we
can customize them so the same person
that had no pad Plus+ running couldn't
run a local test why could he not run a
local test because he had like four gigs
of RAM and his machine would just fall
over and half the time my machine Falls
over because it's a special feature that
it has I don't know why but so we can
scale those up we can get more compute
out of it and we can customize that and
then when we talk about security we have
a secure development environment for our
developers we don't have to worry about
what's on my machine I don't have to
worry about you know when my screen
timeout is or installing things I can
have that experience within the browser
and be able to be mobile and move around
the
world so dependabot we're going to talk
about some security features because we
need to be secured by Design when we go
to do some things in a minute we're
going to look at the dependencies that
are in our repository and what we can do
to remediate them so we want to
integrate this with our developer
workflow again not a security expert but
I need to know that when I have
dependencies in my code when they're out
of date and is that providing a
vulnerability or an open door for a
hacker or someone to come
in we're going to look at code scanning
and I using the password example because
we've all done it we've all put a
password where we shouldn't have because
when you put a password in GitHub it
lives for forever you can get it removed
um but you have to actually revert that
password and you have to get it scrubbed
and that's a bit of a pain so we're
going to look at code scanning we're
also going to look at a really cool
feature called push protection uh we're
going to prevent ourselves from pushing
that code
up and we're going to do some things
with actions how many of you automate
things in your
day-to-day quite a few of you awesome I
love I love automation I love automating
all the things now when you're using
things like Azure devops you have Azure
pipelines and that is purely cicd
continuous integration continuous
deployment actions you can literally
automate anything what's really cool
about actions is we do have them as a uh
hosted Runner so you can host them
within your data center for security but
they're also Cloud hosted and they run
on Windows Linux and Mac um
containerized environment so you can
literally test against any line of code
any bit of code if you're developing for
apple and iOS absolutely you can test
your apps on that what's really cool
about them is they are secure by Design
we have more features coming out but
they integrate into our workflows into
what we're doing in our day-to-day and
when I say we can automate anything I
can literally join a repository and then
have an action that runs that tells
people how to do things I have an
actions workflow that we're going to
look at in a minute that closes excuse
me that destroys my Azure environment
When I close a poll request so as a good
developer I open up my poll request I
make some changes to my code code and
when I do that when I close that poll
request it runs an action and takes out
my entire test environment so I'm not
running that extra cost in the cloud
which is really important
but we are also going to use it for some
cicd and deploy stuff so let's get into
it okay so we have a repository here in
GitHub this is public for everyone to
look at please don't break my demo while
I'm doing it live thank you so we have a
repository and we want to get started
coding um we have a big green code
button right so for those of us that use
vs code we normally click on the Big
Green code button and we'd replicate our
code to our laptop right
yeah but we also need to install
packages does anyone know what packages
we have to install how long that takes
what versions We
need right we don't know so so getting
started can be tough and whenever I
started a net new project I always use a
GitHub codes space because these whole
things take so much time out of our
day-to-day at Microsoft they have
something called the open hack program
it's a 3-day hackathon where you can
learn things like containerization
security um data center migration and
getting started is hard so when we were
doing these hackathons it would take
people half a day just to get started
right we need to install things all
these dependencies we have different
machines so instead of going through all
that stuff I'm going to click on the
code spaces button here and I'm just
going to click a space and create off my
main environment now we can fully
customize this environment to how we
want to do it I'm just using some
defaults with a few gigs of RAM now if I
start running local test or doing
anything it will ask me to um increase
the size of it so it is building our
container we're getting all of our code
and it's going to spin it up for us so
those of you that use vs code you're
going to find this looks identical to
VSS code because it is vs code in the
cloud and I have all my settings synced
across so while this is loading I want
to show you all something cool so we're
in our repository we're writing code and
again getting that code down and making
changes can take a while if I just hit
the period or full stop this pulls up
the
okay so this is our exact repository
that we just saw um it's opening up all
my code I can edit it within the
github.com file um something really easy
to do that I need to do on the
Fly uh the problem with it though is I
can get away with a lot of things a lot
of the GitHub Advanced security doesn't
apply to this this is just running
running in a web browser it's really
lightweight I cannot run and debug my
code from here um I can open I can
change branches and write some code and
push my code up and create a pull
request but there are no protective
barriers around this so this is like the
quick and dirty editor but it's not
secure so while it's a cool fun thing to
do on the Fly and show you all we're not
going to write code from
there so I'm in my code space here I'm
going go ahead and make it a little bit
bigger for
us can everyone see
that does anyone do you are you guys
okay with the dark mode in the back yes
is okay
cool so we have our code here um we can
make some changes we have everything we
need we have extensions that have lined
up um first thing we're going to do is
we're going to change some code let's
see what happens so I talked about
actions and in my code base I have a
GitHub file and in this do GitHub file I
have a deploy uh a deployment file that
deploys to
Azure this deployment file is written in
yaml and in yaml yet another markup
language I am telling it all the tasks I
wanted to do to deploy my code to Azure
now we haven't really gone through the
code base yet we haven't really looked
at it but we're going to walk through
what this does really quickly and then
see what the output looks like so first
thing I'm going to do with my code is
every time I make a poll request it's
going to trigger this it's going to
build my image I'm going to send it up
to Azure so you can see here at line 20
I log into
Azure let me make this a little bit
bigger for everyone in the
back so line 19 and 20 I log into Azure
and notice here I have secrets.
credentials I don't have passwords in my
code look at that I'm a good developer
today The Next Step Up Is We log into
Azure container registry now as we log
into container registry I've been a
really good developer and I've hidden my
password but we're going to put in a
fake password Here uh and just call this
is my password and everybody loves
dollar
signs so I've made some changes to my
code we can see that on the left hand
side here my source control recognizes
it and I'm going to go ahead and push my
code
up oh you know what I didn't do thank
you didn't stage my
changes
right stage my changes now I can go
ahead and run get
push okay so what was supposed to happen
is that when I push my password up get
help push protection would stop that now
what I found in the last couple days is
that uh it doesn't work right away so
there's definitely a bug in in GitHub
push protection nothing is perfect I'm
going to try and run a few more times
and see if it does it it
won't okay
so that demo kind of failed but in
theory it should have stopped us from
posting that password up so how do I
enable these things how do I stop these
things I'm going to go into our
repository again and look at the GitHub
security settings so if I go into my
security plane I have quite a few things
uh enabled so I can look at
vulnerability alerts let me pull up
another environment for us as as well
that has more security vulnerability
alerts so I'm just going to show this
other repository because it does have
more vulnerabilities for us than the
existing one so in theory what we should
have seen is that I pushed up a secret
and it should have stopped us um
unfortunately I couldn't break my own
demo today but it tells us it has a
secret scan alert we can click on it and
see what happens so I've enabled this
pretty easily in my repository it says
possibly active secret now the other
thing you can do it tells you how to
remediate it now in this case a Secret's
pretty easy to figure out sometimes we
use connection strings and how those go
through um I have the option here to
close it now the reason why this is here
is because often we put things in P in
tests that we don't want in production
so if we can qualify this as being used
as a in a test we can go ahead and put
that out now you can also take away this
feature from your developers so they
can't just push their password through
but if we were in that
we would absolutely not have this
feature here so yes so we can close the
alert we can keep it open and it points
us to where it is in the file so it's
found one secret we can go to the
password now we can see in this
repository it picked up pretty easily
it's all my credentials um and it gave
us that
alert so all these things are pretty
easily turned on if I go into my
settings and I get a
repository and I go into my code
security and
Analysis and all I have to do is click
the button so so how do we enable these
things we hit the button and says enable
so I've enabled my secret scanning on
this
repository and I was actually able to to
catch it um so it pulled up that secret
for
us it also has pull request check
failure so in the one I'm going to run
if I have a pull request I only want
High errors so I can set that level so
when I'm pishing my pull request when
I'm setting my pull request out I can
say maybe only critical bugs or maybe
only small errors or maybe warnings if
it's on a warning I fail everything
through so I can set the level of these
things the other thing I've set up on my
repository is cql analysis that's our
code scanning and we'll go through that
in a second so in the code I just pushed
we also have dependencies so what do our
dependencies actually look
like actually I messed up this is not my
broken repository let's go to a broken
Repository
I can't get to it that's
okay um I don't have any dependencies
broken here but the dependent B alert
will show pull that up and pull those
across um let me see if I can actually
find it so I can show it to you all um
would you guys like to see the depend
bot
alerts yeah
okay let me find out where I put that
Repository
here we
go so I've embedded a lot of security
alerts into this so I have 100 security
alerts this is a good one to use so
again picked up a couple Secrets this
one's picked up an Azure storage account
access key and this one's picked up an
Azure application secret so same thing I
can look at that so the code scanning is
going to run every time I push my code
up this one is found sensitive
information so when I look at the clear
text logging and I go ahead and open
this up it goes right we found clear
text logging it tells tells me where it
is what branch it is tells me what
security weaknesses it pulls up and it's
given it a tag of high severity so as a
developer I know that if I see any of
these it's going to open up a pull
request in my repository and I can
address that pull request right then and
there so it sees a high
severity and we can go ahead and address
it now again I can dismiss this alert
but I don't want to this could be a
false positive could be used in test but
in this case it's not when it opens up
this alert for me we can see it's given
me an issue so I'm going to go straight
to that issue cuz when we talk about Dev
practices the other thing we need is
full traceability end to end because if
we're planning things doing things um we
need to be able to track and how to
revert it so we can see that we have an
issue that's already opened github's
done this for me through that it's
already labeled as a bug it won't fix
it's assigned me to it because I've set
it as a default to assign myself so I
get a notification I get it in my
inbox and from here I can fix it I can
create a specific Branch for it fix that
issue I can assign it to a project or a
milestone in my project so I have ways
to trace this full to
end and then I also know in my code base
I have 97
vulnerabilities in here so I also know
that there's some critical
vulnerabilities there's some less
critical vul
vulnerabilities so the same thing's open
this is open this up automatically it's
given a severity
score it's going ahead and telling me
how to update it so as a developer as
I'm trying to fix my code I can stupidly
put passwords on things I can
accidentally put connection strings on
things but things like consuming open
source hard for me to identify and
really how to remediate takes time away
from what I'm doing so by being able to
create the security update it tells me
how to fix it what version I need and I
can do it from there now I can address
my more severe issues if I want to um
and if something's less severe I don't
have to address it right away it tells
me what the impact is tells me the
workarounds the plugins and all the
things that I need so this was open two
days ago critical severity so if I go
ahead and create the dependabot security
update let's see what it
does
I need like really good elevator hold
music for this to see what
it anyone know a good
joke why do developers write code in the
dark because the light attracts
bugs
we'll come back and check on this
because I'm completely dependent on the
Wi-Fi here so these are all things I've
pushed just up from my codebase it will
stop me from pulling my code out so when
I went to deploy that uh change in my
yaml
file did to pull up
r okay good we have an error that's what
we
want so when I push that change up we're
going to go back and check on the uh the
little dependabot issue so when I push
that code up what happens now I went
back into my GitHub um into my other
GitHub repo to show you all the
dependency stuff but what if I can see
this all from the single paint of glass
for those of you all using notepad++ you
have to contact switch to the next place
so we had to leave that go to our
browser window look at all our
dependencies and fix stuff but I want to
be able to do it from the exact same
place so I don't have to contact switch
so I'm going to go back into our code
spaces here and in one of my extensions
I have the GitHub actions
extension so if I were to open up vs
code right now I would have this exact
configuration as we see it today um the
only difference is it's running locally
on my machine now the other cool thing
is I can run this code space on my
machine so where I normally have to
clone my code pull my code down I can
use the code space but actually it's not
running any code on my machine it's just
another secure development environment
the other thing I can do is I can pair
program I can ask one of you all to open
up your laptop I can create a live share
session and we can we can rubber product
together and solve this you can be on
your VSS code you can be on your Visual
Studio or you can be in another GitHub
code space and have that same experience
across the the board so we did make some
changes to our
code um and actually I probably should
initiate a poll request for what we
did it already did that's fine
um you know what I didn't do is I didn't
create a new Branch come on guys you're
supposed to tell me these things I
forgot to create a new branch and I
think actually that's why I broke my
demo so let's try it on a different
branch and see what
happens
so I don't have Branch protection on my
repository um I know I know I uh I I I I
need the feedback I need to fix that I
need to to do
better everybody needs to do better
right so I'm going to go and create that
Branch
across um
okay let me make let me make a file
change
still didn't break it Dar it
but we've created a pull request right
from the browser so if I go back to
Let's going back here little buddy sorry
zooming in makes it harder for me to see
everything but I know it's great for you
all right so I've changed this file uh I
can assign it to myself I can assign to
someone else I can see that Pro request
for within that codes space experience
um I'm going to go ahead and assign
myself to it now when I assign it to
myself I don't have teams open but I get
a notification in my teams and because I
also work in slack because I work in
both teams and slack for my day job I
get a notification in slack and I get an
email notification it's like Inception
hell of notifications but then I'm
communicating to myself and to my team
when this Project's been updated so a
really good feature of being able to
hook this in all these changes in your
repository into your communication tools
whether that's slack or teams is that
you can notify your people when things
are happening so when you do have an
outage or you are pushing a feature they
can see it they can see the poll
requests and have full visibility as
well so I can see the changes I made
here uh says I have no conflicts with
the Bas Branch but we can see that there
are three pending checks now this is the
exact view I would get is if I were in
my um browser window but then I also
have the GitHub extension for um
actions
we should see a little guy running over
here right now it's just not green
okay
let's all right it's not running that's
okay so what I'm going to do is I'm
going to pull up a different
um visual for you all because I like
breaking everything on the day so we can
see all these uh pushes that we make on
our actions from our from our side here
so even though I can't see the one we
just pushed I can push push up a
different one I can see all the actions
and all the tasks that are here I have
the full visibility here I can see which
working Branch I'm on what actions is
affecting and I can see the environments
I'm working in and the secrets and the
variables but I'm going to go into the
GitHub browser so we can have a better
visibility of that cuz actually it's not
the best visibility unless you know what
you're looking at so this is the GitHub
actions flow so we've pushed our code we
found some vulnerabilities um I'm not
actually going to push this to a live
website right now but this is a previous
run just because um I always joke that
like you've never had a bad day till
you've had a storage bad day and you've
lost all your data Another Bad Day is
when your ad authentication breaks and
you're giving a demo in front of
everyone um so my ad off broke this
morning which is really cool um so I
need to resolve that and unfortunately
I'm not the person that can fix that so
I got to wait for that so we're going to
use a previously ran build so in this
build I've pushed my code up I ran my
check so remember I told you I was
building and pushing a Docker image now
in this example I didn't put a password
of my code because I was a good
developer and when I click on this I can
see all the things that ran through in
this I can see that I set up my job I
logged into Azure we can see I logged
into Azure container container registry
I build and pushed it but see I have a
scan for image in my task the reason why
I scann for my images because if my
image is in Secure I don't want to
actually deploy that to Azure so I can
get my full um reporting here in the
tool I can set up other automation from
this I can say right my scan failed or
it passed Notify myself or others in my
team so I've built and pushed my Docker
image Let's Just Pretend We're actually
pushing to our website even though we're
not once it's been through all those
things everything has to be green now as
someone that was an engineer at
Microsoft we could not proceed if we had
even one failed unit tests on the devops
product group we run over 50,000 unit
tests every poll request at GitHub we
run over 13,000 uh unit tests per pull
request into our Live code base so when
we're doing that we have to have all
green if there is any failure we have to
fix it and then we have to proceed so
same thing here I've set mine up so that
anything is anything's any GRE has to be
all green I can have any warnings in my
container image because I don't want to
deploy any kind of security
vulnerability to my live production site
so once it pass passes all those things
we can see the next job it deploys to
our test
environment so in our summary page here
we can see that because everyone loves a
pretty little
picture we build and push a Docker image
we can see the job on the left and then
we deploy it to a test environment so
every time I push my code up it passes
all the tests it does all the uh code
scanning it then goes to that test
environment I spin up that test
environment and then it deploys my
website out now on a normal day I'd show
you our website and we'd do some live
changes to it not going to happen to
today so we've deployed it to test again
I need all the Green in test now the
other cool thing about what I'm
deploying to test is that every
environment is the same so I'm going to
show you a test environment I'm going to
show you a staging and I'm going to show
you production in Azure they're all the
exact same environment in our days of
working on Prem we'd often just like
deploy to the box in the corner now
we're going to deploy to like for like
Azure container apps in Azure so we have
everything identical so that test is
identical to production CU we've often
done it right we've done something to
either staging or uat and it doesn't
work in production because they're
different environments so all my entire
all my environments are the same and
each every single environment I'm
deploying to here uses the exact same
tasks so nothing is
different the other thing I've done is
I've put in a manual workflow into all
of this so you can see when it gets to
my staging environment I have to review
test we talked about doing like peer
reviews in our code and that manual
capacity we still need that manual
capacity when we're deploying to our
test environments so I have to manually
review this I'm might need myself my
management team or a designated team of
people to do this I can then pass that
through and then this will deploy to
production and we can see here we have
our little production environment down
here
below and we can add in all these
deployment protection rules so while I
may not have Branch policies configured
on this repository like I should the
good news is is I'm not going to deploy
to production without the proper checks
in my workflows so I have to have all
these reviews in place in order to go
through
that so we've been able to take take our
code from that developer experience push
it up make some changes uh prevent
ourselves from putting a I say prevent
ourselves try to prevent ourselves from
putting a password up but we did get it
in the secret scanning the other thing
that happens every single time I push my
code up I run something called code ql
cql is another security tool if I go to
the workflow file um to go through one
of the runs we've had previously pending
the internet come on internet you want
to
work
this is going to run on every single po
request so every time I push code up so
while it didn't catch it in push
protection this will run it will pull
the password that's how I found the
passwords previously by using this code
ql the code ql analysis takes your D
takes your code treats it as data
analyzes it um and it sees that I've
JavaScript in my file it's going to
analyze it perform the analysis and
again that has to be all green so I
cannot have any issues in my codee
before I push that up into the cloud and
I promis you all that I have a cool
little uh little action here that closes
my poll request this is one of my
favorite actions if I go to the
environment yaml file in here anytime I
do a poll request type closed it deletes
my test environment deletes the Azure
Resource
Group deletes the environment logs into
Azure and cleans up everything why do I
run this because anytime we're running
in the cloud we tend to leave things
running and we have cost issues we've
all done it over a weekend we rent that
$10,000 bill but we can prevent that by
doing Simple tasks like that in the
cloud so don't deploy some stuff end to
end um you're going to see AI coming out
I'm not going to talk about it today um
as much it's going to go through that
entire developer experience why we want
to enable you to have a better developer
experience to be be happier and to
prevent those things from going to your
production environments in the cloud so
I have a bunch of resources for you all
today uh we have the GitHub blog so any
product announcements will be on our
roadmap publicly on the blog we also
then put a Blog out about what's
happening now everything I did today is
in the GitHub and Azure learning site
the biggest thing you know when I was
starting off on Tech we didn't have free
resources we had books we had paid
courses the GitHub and Azure learning
goes to the Microsoft learn site and it
teaches you all about the GitHub and
Azure integration um we also have
courses on um Azure devops and GitHub
and Azure devops and Azure and how you
can integrate the two so there's some
really good learnings there there's
really good use cases so thank you all
for joining today I'm going to go ahead
and open up for some
questions where's the
wine you promised wine you promised Port
where's the
port
yes
so the question was about um how we at
GitHub and Microsoft deploy to
production every day and thoughts on
rolling back and rolling forward yes
traceability absolutely so everything we
do from end to end so all the changes
I've pushed today um I attach the Sha
code in GitHub to my pull request and
then I can track that to my Azure
container registry Etc so then if I am
using my good developer practices Branch
protection all that good stuff peer
reviews I can revert my commits as well
and and roll back those changes pretty
quickly so that's one way we do it the
other way we do it is we use feature
Flags in our code so when we're
deploying something we're using IF
statements effectively but using the
cicd tooling to say right we've made a
mistake we can pull that change back and
revert that change and restore State
much faster than restoring from a backup
or uh Etc so this changes the backup
story right um I've worked with
customers that are still deploying stuff
from the portal and when something
breaks they're going into the portal to
redeploy it and have to recover stuff
pull their backup tapes um pull it from
their off-site storage um now we're able
to use infrastructure code and redeploy
it and then pull the data from another
source what changes that by using the
cicd
protocols all right um I'll be around
for the rest of the day please feel to
reach out to me over LinkedIn or Twitter
um and enjoy the port in Porto and thank
you all for
[Applause]
joining