Browse DevOps News (306)
Allison announces general availability of repository-level GitHub Copilot usage metrics via the Copilot usage metrics REST API, enabling daily per-repository reporting for Copilot coding agent and Copilot code review pull request activity across enterprises and organizations.
Allison announces new controls for GitHub Copilot code review, including reading custom instructions from the PR head branch, expanded instruction file support, repository-level setup steps via a workflow YAML, and a default-on firewall with separate configuration from Copilot cloud agent.
Allison announces a GitHub Mobile improvement that lets you start “Fix with Copilot” directly from Copilot code review pull request comments, making it quicker to address review feedback from a phone while keeping PRs moving.
Dalia Abuadas argues that in an AI-assisted workflow, writing the first patch is often no longer the expensive part—reviewing, validating, and owning the change is. She proposes using a constrained “price check” patch to replace long scope debates with evidence from a real diff and tests.
Elliot Volkman shares Microsoft Security’s Black Hat USA 2026 agenda, focused on how attackers abuse “trust paths” across software supply chains, identities, cloud services, and AI systems. The post highlights sessions on npm supply chain campaigns, Azure Automation research, GitHub-focused detection ideas, and hands-on skilling with Defender and Sentinel.
Waldek Mastykarz explains how to evaluate agent skills that call APIs without paying for test traffic or mutating production data. He outlines why direct evals against real endpoints create cost, state, and non-determinism problems, then shows a proxy-based approach using Dev Proxy to emulate APIs while keeping production URLs unchanged.
Allison announces that GitHub Projects views now support advanced search in the filter bar, enabling boolean AND/OR expressions to build more precise views. The update also adds a reviews: filter for PR items and introduces a 90-day retention policy for deployment statuses in the REST and GraphQL APIs.
Allison announces a GitHub update that lets repository admins archive pull requests so they’re removed from public view without being deleted. The post explains what happens when a PR is archived (closed and locked), how visibility changes for non-admins, and how to find archived PRs during triage.
Allison announces new GitHub Enterprise Cloud REST API endpoints that let enterprise admins manage Visual Studio Subscription (VSS) assignments in bulk, including listing assignments, mapping UPNs to GitHub handles, and removing incorrect matches—useful when SCIM identities don’t align with VSS UPN formats.
Allison announces a public preview GitHub Actions runner image for Xcode 27 on GitHub-hosted macOS runners, including the new Xcode-version-based support model, the workflow labels to target the image, and current limitations around arm64-only availability.
Ruben Rios announces a preview of Private Marketplace support in Visual Studio, aimed at organizations that need tighter control over how developers discover and install extensions for security, compliance, and governance reasons.
Microsoft Security Research, Ravikant Tiwari, Sagar Patil, Suriyaraj Natarajan and Arvind Gowda break down a coordinated compromise of the @asyncapi npm organization, where attackers abused a misconfigured GitHub Actions workflow and trusted publishing to ship import-time malware, and they provide concrete indicators, hunting queries, and remediation steps.
Allison summarizes new GitHub secret scanning and public monitoring improvements, including new partner detectors, expanded push protection defaults, a new webhook field to distinguish secret categories, and additional insight cards to help enterprises understand leak attribution and exposure scope.
The Visual Studio Code Team shares the evolving release notes for VS Code 1.130 (Insiders), with links to the commit log and closed issues so developers can track what’s landing in the build as features are added.
Polly Davidson lays out a beginner-friendly roadmap for learning GitHub, from core Git concepts and essential commands to day-to-day collaboration with pull requests, issues, and projects. It also introduces GitHub Actions for CI/CD, GitHub Pages for publishing, and practical security basics like 2FA, secret scanning, Dependabot, and CodeQL.
Allison summarizes the June 2026 GitHub Copilot update for Visual Studio 2026, focusing on new usage tracking and alerts, a trust validation layer for MCP servers, and Copilot features that tie into pull request workflows and C++ modernization.
Allison announces a public preview feature where GitHub code scanning surfaces AI-powered security detections directly on pull requests, helping teams catch issues in languages and frameworks that don’t have native CodeQL coverage. The update explains what’s included, how it runs, enablement requirements, and how billing works via AI credits.
Simona Liao, Wendy Breiding, and Yun Jung Choi introduce Visual Studio 18.8’s built-in Agent Skills, a set of reusable Copilot capabilities for common .NET and Azure tasks. The post explains where to find and enable skills, why they’re off by default, and highlights starter skills for API work, performance reviews, Azure deployments, and Kusto queries.
Allison announces a new default safety behavior in Dependabot: version update pull requests will wait three days after a release appears in its registry, reducing the risk of immediately adopting compromised or broken dependency releases while keeping security updates immediate.
Allison announces generally available GitHub REST API endpoints for creating, updating, listing, and deleting secret scanning custom patterns across repository, organization, and enterprise scopes, with dry runs and publishing still handled in the UI.
Allison announces a new billing estimate view for GitHub Code Quality in public preview, showing active committers and an estimated monthly license cost so enterprises can understand expected charges before general availability.
James Rempt explains how Azure Dev/Test pricing (included with eligible Visual Studio subscriptions) can reduce the cost of running non-production Azure environments, making it easier to provision production-like resources for testing, validation, and CI/CD workflows without letting cloud spend slow down iteration.
Allison announces a GitHub settings UI change that splits the previously combined “SSO & Organizations” page into two separate pages, making it easier to manage SSO configuration and organization membership independently.
Allison announces CodeQL 2.26.0 updates for GitHub code scanning, including Kotlin 2.4.0 support, improved C# Razor Pages dataflow for SQL injection detection, new JavaScript/TypeScript system prompt injection coverage, and multiple query accuracy improvements across Go, Python, Swift, and GitHub Actions.
Allison announces a terminology update in GitHub Secret Scanning that renames detector types to better reflect how secrets are found, while keeping detection behavior unchanged. The post clarifies the difference between provider vs generic secrets and pattern-based vs AI-based detection, and confirms no API or webhook changes.
Salim Chawro summarizes Microsoft’s July 2026 Secure Future Initiative (SFI) progress report, covering measurable improvements in identity and configuration hardening, AI-assisted proactive defense for vulnerability discovery and remediation, and preparations for post-quantum cryptography—plus concrete steps organizations can apply now.
Allison announces a public preview of agentic autofix for GitHub code scanning alerts, where Copilot explores the repo, proposes and validates a fix by rerunning CodeQL, then opens a draft pull request. The post also covers how to trigger it, required licenses, and how AI Credits and Actions minutes are consumed.
Allison announces a GitHub Enterprise Cloud REST API update that lets enterprise owners and billing managers retrieve per-user consumption for a multi-user budget from a single endpoint, making it easier to review spend and identify users nearing their limits at scale.
David Paquette explains how the Azure DevOps team reduced Azure Pipelines task extension size by bundling Node-based tasks with esbuild, cutting thousands of files down to a few per task and significantly improving agent download and extraction time in real production pipelines.
Allison announces the general availability of GitHub’s refreshed pull requests dashboard at github.com/pulls, highlighting the new Inbox experience, saved views, and improved filtering/search to help developers and teams track reviews, CI failures, and ready-to-merge work more efficiently.
Tina Schuchman announces general availability updates in Microsoft Foundry, including OpenAI’s GPT‑5.6 model family, a new Asia-Pacific Data Zone, and production-ready hosted agents in Foundry Agent Service. The post also highlights governance features like tracing/evaluation, cost controls, and options for publishing agents to Teams and Microsoft 365 Copilot.
Michael Recachinas explains how GitHub enforced validated repository ownership across a 14,000+ repo organization to unblock security workflows like secret scanning remediation, reduce risk, and make governance and compliance scoping reliable.
Allison announces a public preview update to GitHub Code Quality that lets organization owners enable or disable Code Quality for a targeted subset of repositories, with optional enforcement to prevent repo admins from changing the setting.
Allison announces general availability of GitHub Advanced Security innersource advisories, letting enterprises publish internal security advisories with visibility limited to enterprise-owned repositories. The update includes a new REST API for creating, updating, and withdrawing vulnerabilities, and uses Dependabot to notify affected repos and open upgrade pull requests.
David Pine explains how the .NET Aspire team uses GitHub Agentic Workflows to turn merged product pull requests into SME-reviewed documentation pull requests in a separate repo, while keeping security tight through a “safe-outputs” contract and narrowly scoped GitHub App permissions.
Allison announces enterprise-managed OpenTelemetry export controls for GitHub Copilot in VS Code and Copilot CLI, letting organizations centrally mandate OTLP endpoints, protocols, resource attributes, and capture settings without relying on per-developer OTEL_* environment variables.
Allison announces general availability of device-level deployment for managed GitHub Copilot settings in VS Code and GitHub Copilot CLI, enabling enterprise admins to enforce consistent Copilot governance via MDM, configuration files, or server-managed settings.
Jakub Oleksy’s June 2026 GitHub availability report summarizes six production incidents (including Copilot outages) and the reliability work behind GitHub’s ongoing Azure migration, with concrete mitigations like dependency pinning, stronger config validation, improved traffic blocking, and tighter production access controls.
Allison summarizes the June/early July 2026 Visual Studio Code releases (v1.123–v1.127) focused on GitHub Copilot: integrated browser upgrades for agent-driven web validation, better organization for parallel agent sessions, clearer cost and token visibility, easier model-provider discovery via Marketplace, and more hands-off Autopilot behavior.
Katie Savage announces a free, instructor-led virtual training session focused on the GitHub Copilot app, including setup, agent-driven workflows, and practical features like custom instructions, MCPs, and PR-focused automation.