Share this
by Stephanie Wallis on 23 February 2021
Steve Fargher is a Senior Consultant specialising in DevOps and Agile, based in our Wellington office.
Steve is Equinox IT's GitHub lead and here he talks about the updates to GitHub Enterprise Server 3.0 and the potential its changes bring to DevOps security. Equinox IT is a GitHub Verified Partner.
What's new in GitHub Enterprise Server 3.0?
GitHub Enterprise Server 3.0 is introducing a couple of major things that we haven't seen before and it's bringing to general availability a couple of bits and pieces as well. So, we've got GitHub Actions which is the YAML-driven pipelines in GitHub Enterprise Server and GitHub, and also Packages which is a way that we can store our code and our artefacts for consumption by other projects and pipelines. Bringing these two things together is an exciting new change to GitHub Enterprise Server and it allows us to create some end-to-end DevOps workflows. It also allows us to define security policies for access, it's introducing the ability to have self-hosted runners which is something quite new to GitHub, though it has been talked about for a while. There is the mobile app, which I've personally been using for quite a while, it has just become general availability (GA) – so you can use your mobile app to interact with GitHub and your teams can use it to make updates and see the status of things.
What are you excited about?
Two things that really interest me about GitHub Enterprise Server 3.0 are the code scanning and the secret scanning stuff as part of the GitHub Advanced Security. GitHub Advanced Security is something they talked a lot about in our Partner Bootcamps and one of the cool things that it brings is the code scanning. So, there has been an element of code scanning previously in GitHub but this brings it into GA. The code scanning is powered by CodeQL which is a very powerful scripting language. The secret scanning as part of that security offering is currently in beta but will be in GA soon and it gives the ability to detect credentials in code when pushed to Git. For me this is really cool because I am quite passionate about security in DevOps.
The secret scanning is something we have had to do for our customers in the past as a manual process and it has been quite painful and extremely time consuming. By GitHub bringing this into the Enterprise Server as a native function it brings a lot of security and assures the end users that they are storing code securely and without secrets and credentials in it, which is really important.
The mobile app, I think, is really cool as well. One thing that the competitors to GitHub don't have is that mobile app to give you access to your code and repositories and pipelines, and to keep things flowing while you are on the go.
What potential do you see in the update?
I think the biggest potential is in the Actions and the Packages now being in together, and the ability for us to build artefacts, store those packages - and we can use Nuget, NPM, Maven, Docker, and any other containerisation. It allows us to build and store standard packages that we can then consume in other pipelines using Actions, and Actions, itself, is an awesome product. The security and integration around Actions and having Packages with that, I think that has got huge potential for GitHub and GitHub Enterprise Server.
copyright: GitHub Packages