Browse DevOps News (288)

Sandeep Sen announces the stable Azure MCP Server 3.0 release and explains what’s new for bringing Azure operational tooling into MCP-compatible AI agent workflows, including Terraform and Advisor tooling, more predictable client integration, and security-focused defaults for resource creation.

Jakub Oleksy reports on GitHub’s September 2026 reliability work and incidents, including database pressure reductions, overload controls, added headroom for GitHub Actions, expanded failure containment for pull requests, and progress moving production workloads and traffic to Azure.

Taylor Cuilty explains how GitHub redesigned repository star history to return trends (daily counts) without exposing stargazer identities, while also cutting database load dramatically by filtering by time range before aggregating.

The Visual Studio Code Team shares early release notes for VS Code 1.143 Insiders, highlighting updates to MCP server configuration, Agent Host chat controls for background shells, and a new extension contribution point for Explorer title actions.

Allison announces a public preview for GitHub Actions workflow dependency lockfiles, aimed at making workflow runs reproducible and reducing supply-chain risk from moved tags/branches or compromised actions. The post explains how to generate and maintain `.github/workflows/actions.lock`, and how admins can enforce lockfile usage with a new policy.

Allison announces a set of GitHub Apps updates focused on least-privilege access and easier administration, including new fine-grained permissions for repository creation and installation management, improved controls for adding approved apps to repos, and changes to token and credential handling for GitHub Apps.

Gloridel Morales announces the October 2026 patch release for Azure DevOps Server, with links to Patch 9 downloads and the corresponding release notes, plus a quick command to verify whether the patch is installed on your server.

sbaynes explains what changed when an AI agent moved from summarizing production network incidents to proposing (and potentially executing) real fixes, and why “safe autonomy” needs multiple deterministic layers rather than a single guardrail.

Allison announces new GitHub audit log events that let organizations and enterprises track manual dismissals and reopenings of GitHub Code Quality findings, including who performed the action, when it happened, and which repository, rule, and findings were affected.

Batu Ozturkler explains how GitHub Secret Scanning reduced false positives and sped up scanning by replacing an LLM-based stage with a compact, fine-tuned ModernBERT classifier that uses surrounding code and text context to decide whether a candidate string is a real credential.

mk_sunitha introduces Fabric App functions (preview), a TypeScript-based serverless capability for Fabric Apps that lets builders run secure server-side logic, use application authentication to access downstream resources, and manage secrets safely. The post also shows how to scaffold, debug, and deploy functions, including using GitHub Copilot in VS Code.

Allison announces updates to GitHub secret scanning: new detectors for Salesforce, Anthropic, and Cloudsmith, plus expanded push protection defaults that block commits containing Anthropic API keys when secret scanning is enabled.

Allison announces updates that make it easier to detect when Dependabot alerts have been withdrawn, including a new webhook action and a clearer REST API response for removed alerts.

Allison announces an update to GitHub billing that makes the “Budgets and alerts” page easier to use by listing all budgets in one place with search and filtering, helping personal, organization, and enterprise admins find and manage budgets faster.

Allison announces new Security Overview metrics for GitHub code scanning AI Scan on pull requests, helping org and enterprise admins track findings generated and resolved, remediation rate, repo-level trends, and how often developers apply autofix suggestions.

Allison announces new GitHub Copilot enterprise managed telemetry controls that let admins attribute Copilot activity to a specific user while keeping prompts, responses, and tool content disabled by default, with fine-grained OpenTelemetry capture settings across Copilot CLI, the Copilot app, and VS Code Agent Host sessions.

Christopher Harrison explains how to make GitHub Copilot more effective on a real codebase by storing project context in the repo. He covers repository and path-specific instructions, reusable “agent skills” for repeatable procedures, custom agents for broader work, and MCP servers (including Playwright) to connect Copilot to external tools.

Allison announces a limited public preview feature that durably records the authenticated GitHub user who pushed each commit, and exposes that pusher identity in the UI and API. It also adds a ruleset condition to block pushes where committer metadata doesn’t match the pusher’s verified emails.

Allison announces a new Dependabot option that lets organizations configure private registries with Anonymous authentication, useful for internal mirrors that allow unauthenticated reads while still working within GitHub.com’s egress allowlist and registry access controls.

Allison announces CodeQL 2.27.2, detailing new and improved analysis across C/C++, Go, Rust, and JavaScript/TypeScript, plus notable query updates for C# and GitHub Actions. The post also calls out a macOS 27/Xcode 27 limitation for traced analysis and a breaking change in the Go control-flow graph library.

Tsuyoshi Ushio introduces Dynamic Workflows for Azure Functions Hosted Skills, a preview feature that lets an LLM generate a typed DAG plan once and then run it durably via Durable Functions. The post explains the runtime model, safety checks, and when this approach reduces token usage and latency for event-driven apps.

Allison announces a GitHub change that lets users with the triage role (and higher) archive and unarchive pull requests, reducing friction for maintainers who delegate routine moderation work.

Allison announces an accessibility improvement to GitHub timelines: screen readers can now navigate issue and pull request timelines as lists, with clearer announcements for structure, position, and newly loaded events across github.com and GitHub Enterprise Server.

Allison announces a GitHub change that lets maintainers include draft pull requests when enforcing pull request limits, closing a loophole where users could open unlimited drafts. The update helps reduce repository clutter, notifications, and unnecessary CI runs caused by low-quality or spammy contributions.

Dan Hellem announces a new Azure DevOps Wiki editing experience built on Monaco Editor (the editor behind VS Code), highlighting Markdown-focused improvements like syntax highlighting, find/replace, better undo/redo, and autocomplete for work items, pull requests, people mentions, and wiki links.

Erin Havens shares GitHub data showing secret leaks are scaling with the volume of code being pushed, then explains how GitHub Secret Protection is using a fast ModernBERT-based classifier to improve push protection for unstructured secrets and reduce the human cost of remediation.

Allison announces a new fine-tuned GitHub model for context-aware leaked secret detection across secret scanning alerts, push protection, and GitHub Copilot /security-review. The post explains what’s changing, where it’s available (including GHES 3.23), and how AI Credits and budgets apply to the new opt-in checks.

Apoorv Gupta explains how GitHub Spec Kit can be extended for enterprise use with presets, extensions, bundles, workflows, and governed catalogs, so teams can standardize spec-driven development without forking the core toolkit.

The Visual Studio Code Team shares the release notes landing page for VS Code 1.142 (Insiders), with links to the commit log and closed issues so developers can track what’s changing as features land in the Insiders build.

Brian Celenza explains how GitHub is redesigning its Git storage architecture to handle “agentic” development at extreme scale, where pushes, merges, and CI fan-out happen concurrently and continuously. The post outlines the bottlenecks in today’s replica-based design and the principles behind a new storage/compute split.

Allison announces general availability of GitHub stacked pull requests, a workflow for breaking large changes into smaller PRs that can be reviewed independently and merged together. The update includes improvements to rebasing, merge queue behavior, approvals preservation, commit signing, webhooks, and GitHub CLI support.

Drew Noakes explains how C# Dev Kit 11.0 (aligned with .NET 11) was rearchitected to dramatically reduce solution load times and memory usage in VS Code, while also speeding up incremental builds and improving MSBuild file editing with richer language features.

Allison announces an update to GitHub code scanning that adds visibility into AI Scan for pull requests enablement in the Security Overview coverage view, including enabled/not-enabled counts, per-repo effective status, filter queries, and a new CSV export column for tracking adoption across orgs and enterprises.

Waldek Mastykarz introduces Agent Experience (AX): how AI agents discover, choose, and correctly use your SDKs, APIs, and CLIs. He breaks AX down into propensity and efficacy, shows why you must measure both quality and task cost, and shares practical examples from GitHub Copilot Chat evaluations.

Allison announces new GitHub Secret Scanning detectors and a new partner integration, expanding the set of credentials GitHub can identify and help remediate when they’re committed to repositories.

Amaury Levé explains how to run reliable UI-thread tests for UWP and WinUI 3 apps using MSTest 4.5 and Microsoft.Testing.Platform, including how packaged/unpackaged and AppContainer hosts change the test launch path and what to validate on CI agents.

Michelle Zhou introduces ReviewBench, an open benchmark for evaluating AI code review agents using a representative set of GitHub pull requests, a multi-source ground truth process, and calibrated scoring. The post explains how to interpret grounded vs augmented metrics and how teams can submit their own agents to the public leaderboard.

Allison announces that GitHub App installation tokens are now issued in a new stateless format by default, and outlines what developers should verify in their integrations to avoid breakages when handling longer tokens and updated validation behavior.

Allison announces changes to npm trusted publishing that reduce supply-chain risk: unvalidated trusted publishing configurations now expire after 48 hours, and GitHub Actions tokens from certain events are rejected for publishing.

Allison announces that npm staged publishing can now create brand-new packages via `npm stage publish`, enabling automated workflows to publish an initial version into a staged queue that must be promoted by a maintainer before it becomes installable.