Hybrid environments demand secure devices. See how Dell’s Manageability Solutions update and protect every device in your company. Hybrid environments demand secure devices. See how Dell’s Manageability Solutions update and protect every device in your company. Technology Solutions Blog | Dell
With Dell AI PCs and CyberLink’ s AI-powered tools, creators can work faster, smarter, and more securely, freeing up time for what truly matters, which is your creative vision. With Dell AI PCs and CyberLink’ s AI-powered tools, creators can work faster, smarter, and more securely, freeing up time for what truly matters, which is your creative vision. AI Services Blog | Dell
Announcing the all-flash PowerProtect Data Domain appliance and portfolio software enhancements. Announcing the all-flash PowerProtect Data Domain appliance and portfolio software enhancements. Cyber Recovery Blog | Dell
Today, Microsoft and the US General Services Administration (GSA) announced a comprehensive agreement to bring a suite of productivity, cloud and AI services, including Microsoft 365 Copilot at no cost for up to 12 months for millions of existing Microsoft G5 users, to help agencies rapidly adopt secure and compliant advanced AI tools that will enhance operations, strengthen security and accelerate innovation for the American people. As an unparalleled milestone in advancing GSA’s OneGov strategy, Microsoft’s offerings will be available through a governmentwide unified pricing strategy that is expected to drive $3 billion in cost savings in the first year alone. Enabling AI innovation and acceleration for federal agencies This expansive offering will help agencies achieve key pillars of the America’s AI Action Plan by enabling federal agencies to serve at the forefront on driving AI innovation and adoption in service to the American people. Through this agreement federal agencies will access the latest AI capabilities at scale, now integrated in many of the products they already use, to achieve key administration priorities: Transforming productivity with AI: A unique Microsoft 365 and Copilot suite, offered exclusively to the federal government, enables agencies to automate workflows, analyze data and collaborate more efficiently, freeing public servants to focus on their core mission. Driving automation with AI agents: With AI agents, and no per-agent fees, agencies can build solutions for citizen inquiries, case management and contact centers, extending the reach and responsiveness of government services. Accelerating cloud modernization: With significant Azure discounts and the waiving of data egress fees, agencies can modernize infrastructure, reduce barriers to interagency collaboration and unlock the full power of advanced analytics and AI. Streamlining government operations: Dynamics 365 applications help agencies enhance citizen service, optimize supply chains and increase field responsiveness, directly impacting everyday public outcomes. Strengthening security across all levels: Integrated platforms such as Microsoft Entra ID and Sentinel provide advanced identity and threat protection, supporting the Zero Trust journey across federal environments. Federal agencies can opt-in to any or all of these offers through September 2026, with discounted pricing available for up to 36 months. Innovation meets security Agencies can quickly adopt these solutions knowing these services have already achieved key FedRAMP security and compliance authorizations, meeting more than 400 critical security controls established in NIST 800-53 standards. Microsoft 365, Azure and our key AI services are authorized at FedRAMP High. Microsoft 365 Copilot received provisional authorization from the US Department of Defense, with FedRAMP High expected soon. Investing for the future Our commitment goes beyond technology and savings. Microsoft is also committing $20 million in additional support services to help agencies implement the offers and maximize the value of these services, along with complimentary cost-optimization workshops that will enable agencies to identify opportunities to reduce software duplication, automate services and improve cross-team interoperability. These investments reflect our belief that technology’s greatest value lies in its ability to empower people. Taken together, we anticipate these services have the potential to deliver more than $6 billion in total estimated value over three years. For more than four decades, Microsoft has been privileged to support the US government’s most vital missions. Today, as we stand at the forefront of the AI era, we reaffirm our dedication to serving as a trusted partner — one that listens, innovates responsibly and shares in the mission to advance the nation’s public good. We look forward to the next chapter helping agencies harness secure AI and cloud solutions to build a stronger, more resilient and more innovative future for all. To learn how to take advantage of these offers, contact your Microsoft representative or authorized reseller*. For any additional questions, you can email our Microsoft OneGov team. *Microsoft OneGov offers are applicable to Microsoft federal customers with Enterprise Agreements and exclude AOS-G and CSP programs; Azure Consumption Discounts and waived egress fees applicable to select Governmentwide Acquisition Contracts. The post Accelerating AI adoption for the US government appeared first on The Official Microsoft Blog. Today, Microsoft and the US General Services Administration (GSA) announced a comprehensive agreement to bring a suite of productivity, cloud and AI services, including Microsoft 365 Copilot at no cost for up to 12 months for millions of existing Microsoft G5 users, to help agencies rapidly adopt secure and compliant advanced AI tools that will enhance… The post Accelerating AI adoption for the US government appeared first on The Official Microsoft Blog. Featured, The Official Microsoft Blog, Azure, Copilot, Dynamics 365, Entra ID, Microsoft 365, Microsoft 365 Copilot, Sentinel The Official Microsoft Blog
Since its initial launch in 2021, GitHub Copilot has evolved a lot — and so have the AI models that power it. When we first announced GitHub Copilot as a technical preview, OpenAI hadn’t yet launched ChatGPT. Today, AI dominates headlines and workflows alike. Amid this rapid change, our focus has remained the same: help developers stay in flow and get more done. Amidst all of that, we have been focused on continually improving GitHub Copilot with developers in mind. That’s meant re-evaluating what models power it, and building agentic workflows into its core experience, too. In this article, we’ll look at the models that drive different parts of GitHub Copilot and the powerful infrastructure that supports Copilot’s agentic capabilities. We’ll also discuss how model selection works across various features, like agent mode, code completions, and chat. Now, let’s take a look under the hood. ✨ Want to keep track of the latest models GitHub Copilot supports? We’re constantly bringing new AI models to GitHub Copilot, and if you’ve been paying attention you know things change fast. This blog offers a point-in-time snapshot of the AI models we offer now, but bookmark our documentation to stay one step ahead. Read the Docs > From Codex to multi-model: The evolution of GitHub Copilot When GitHub Copilot launched in 2021, it was powered by a single model: Codex, a descendant of GPT-3. At the time, Codex was a revelation. Capable of understanding and generating code in the IDE with surprising fluency, Codex helped prove that AI could be a valuable tool for developers and showed a future where AI could potentially become a true coding companion. Since then, Copilot has transitioned away from Codex and now defaults to the latest frontier models, while also giving developers access to their choice of advanced models. Where it once lived firmly in the IDE as an extension to help developers with autocomplete and code generation, Copilot has evolved to become part of the GitHub platform available across developer workflows. Copilot can answer questions, generate tests, debug code, get assigned an issue, generate a pull request, assist with code reviews, analyze codebases, and even fix security vulnerabilities, among other things. Throughout all of these changes, we have focused on helping developers accomplish more, do less boilerplate work, stay in the flow, focus on the big picture, and ship higher-quality code faster. Why offer multiple models? Moving Copilot to a multi-model architecture wasn’t just about keeping up with AI advancements. It was about allowing developers to choose their preferred LLM for the task at hand, giving them flexibility in a rapidly changing environment. Different models excel at different tasks, and by integrating a variety of them, GitHub Copilot can now deliver more tailored, powerful experiences through features like these: Baseline intelligence: GitHub Copilot now defaults to GPT-4.1 across chat, agent mode, and code completions. Optimized for speed, reasoning, and context handling, GPT-4.1 is tuned for developer workflows and supports more than 30 programming languages. Frontier model access: In Pro+, Business, and Enterprise tiers, developers can choose from a wide range of advanced models via the model picker, including: Anthropic: Claude Sonnet 3.5, Claude Sonnet 3.7, Claude Sonnet 3.7 Thinking, Claude Sonnet 4, Claude Opus 4 (preview), Claude Opus 4.1 (preview) OpenAI: GPT-4.1, GPT-5 (preview), GPT-5 mini (preview), o3 (preview), o3-mini, o4-mini (preview) Google: Gemini 2.0 Flash, Gemini 2.5 Pro Each option offers different trade-offs between speed, reasoning depth, and multimodal capabilities. Why developer choice matters in agentic workflows Because Copilot supports multiple models, developers have the autonomy to choose exactly how they build, whether they’re prioritizing speed, precision, or creativity. This flexibility lets developers tailor their experience based on their preferences — and these developer experience (DevEx) improvements translate into real productivity gains. Copilot’s agentic capabilities mean that: Developers no longer need to switch editors or even leave GitHub. Copilot is GitHub native, so it operates directly inside your IDE and in GitHub, which makes it easy to delegate tasks without breaking your flow. Developers can work exactly how they prefer, whether that means automating tasks with Copilot, accepting suggested fixes, or stepping back and letting coding agent take over. Copilot can operate with full context into your repositories, analyze and index your codebases, respect branch protections, and fit seamlessly into your existing review cycles. Copilot handles the busywork — from triaging comments to patching vulnerabilities or chasing down cross-repo blockers — so developers can stay focused on what matters most. Agentic workflows help reduce complexity and prioritize developer choice at every step, leading to higher-quality code and fewer to-dos. This empowers developers to work the way they want: faster, safer, and with more confidence. Delivering real-world impact through better DevEx GPT-4.1 was recently integrated into Copilot Chat and code completions, offering improved context windows and faster response times. These improvements translate directly into less waiting, more accurate assistance, and a smoother workflow. As AI continues to evolve, its role in shaping the developer experience will only grow. From reducing context switching to automating repetitive tasks, AI tools like Copilot are increasingly becoming a “second brain” for developers. Having a choice of models lets developers customize exactly how they work. This lets them build with confidence, drive even more impact, and find greater satisfaction in their work. How model selection works in Copilot GitHub Copilot is more than just one single AI model. It’s a dynamic platform that uses intelligence to match the right model with the right task. This flexibility is central to delivering a seamless DevEx, and it’s guided by a deep understanding of how developers work, what they need, and when they need it. Matching models to features Each Copilot feature is powered by a model specifically chosen to meet its unique demands: Code completions Copilot code completions now default to GPT-4.1, optimized for speed, accuracy, and relevance across more than 30 programming languages. Agent mode Designed for more complex, multi-step tasks, agent mode taps into models with advanced reasoning and planning capabilities.
Rain or red carpet—our Dell Pro Rugged tech thrives, proving durability is always in style. Rain or red carpet—our Dell Pro Rugged tech thrives, proving durability is always in style. Media & Entertainment Blog | Dell
The numbers don’t lie—enterprise customers are driving unprecedented demand for AI infrastructure, and Dell is making the most of this … The numbers don’t lie—enterprise customers are driving unprecedented demand for AI infrastructure, and Dell is making the most of this … Dell Blog | Dell
Port speeds and media types are evolving rapidly to address the recent need for speed because of GenAI. Configuring switch ports in Dell Enterprise SONiC is becoming an advanced undertaking. Port speeds and media types are evolving rapidly to address the recent need for speed because of GenAI. Configuring switch ports in Dell Enterprise SONiC is becoming an advanced undertaking. Data Center Blog | Dell
The open source Git project just released Git 2.51 with features and bug fixes from over 91 contributors, 21 of them new. We last caught up with you on the latest in Git back when 2.50 was released. To celebrate this most recent release, here is GitHub’s look at some of the most interesting features and changes introduced since last time. Cruft-free multi-pack indexes Returning readers will have likely seen our coverage of cruft packs, multi-pack indexes (MIDXs), and reachability bitmaps. In case you’re new around here or otherwise need a refresher, here’s a brief overview: Git stores repository contents as “objects” (blobs, trees, commits), either individually (“loose” objects, e.g. $GIT_DIR/objects/08/10d6a05…) or grouped into “packfiles” ($GIT_DIR/objects/pack). Each pack has an index (*.idx) that maps object hashes to offsets. With many packs, lookups slow down to O(M*log(N)), (where M is the number of packs in your repository, and N is the number of objects within a given pack). A MIDX works like a pack index but covers the objects across multiple individual packfiles, reducing the lookup cost to O(log(N)), where N is the total number of objects in your repository. We use MIDXs at GitHub to store the contents of your repository after splitting it into multiple packs. We also use MIDXs to store a collection of reachability bitmaps for some selection of commits to quickly determine which object(s) are reachable from a given commit1. However, we store unreachable objects separately in what is known as a “cruft pack”. Cruft packs were meant to exclude unreachable objects from the MIDX, but we realized pretty quickly that doing so was impossible. The exact reasons are spelled out in this commit, but the gist is as follows: if a once-unreachable object (stored in a cruft pack) later becomes reachable from some bitmapped commit, but the only copy of that object is stored in a cruft pack outside of the MIDX, then that object has no bit position, making it impossible to write a reachability bitmap. Git 2.51 introduces a change to how the non-cruft portion of your repository is packed. When generating a new pack, Git used to exclude any object which appeared in at least one pack that would not be deleted during a repack operation, including cruft packs. In 2.51, Git now will store additional copies of objects (and their ancestors) whose only other copy is within a cruft pack. Carrying this process out repeatedly guarantees that the set of non-cruft packs does not have any object which reaches some other object not stored within that set of packs. (In other words, the set of non-cruft packs is closed under reachability.) As a result, Git 2.51 has a new repack.MIDXMustContainCruft configuration which uses the new repacking behavior described above to store cruft packs outside of the MIDX. Using this at GitHub has allowed us to write significantly smaller MIDXs, in a fraction of the time, and resulting in faster repository read performance overall. (In our primary monorepo, MIDXs shrunk by about 38%, we wrote them 35% faster, and improved read performance by around 5%.) Give cruft-less MIDXs a try today using the new repack.MIDXMustContainCruft configuration option. [source] Smaller packs with path walk In Git 2.49, we talked about Git’s new “name-hash v2” feature, which changed the way that Git selects pairs of objects to delta-compress against one another. The full details are covered in that post, but here’s a quick gist. When preparing a packfile, Git computes a hash of all objects based on their filepath. Those hashes are then used to sort the list of objects to be packed, and Git uses a sliding window to search between pairs of objects to identify good delta/base candidates. Prior to 2.49, Git used a single hash function based on the object’s filepath, with a heavy bias towards the last 16 characters of the path. That hash function, dating back all the way to 2006, works well in many circumstances, but can fall short when, say, unrelated blobs appear in paths whose final 16 characters are similar. Git 2.49 introduced a new hash function which takes more of the directory structure into account2, resulting in significantly smaller packs in some circumstances. Git 2.51 takes the spirit of that change and goes a step further by introducing a new way to collect objects when repacking, called “path walk”. Instead of walking objects in revision order with Git emitting objects with their corresponding path names along the way, the path walk approach emits all objects from a given path at the same time. This approach avoids the name-hash heuristic altogether and can look for deltas within groups of objects that are known to be at the same path. As a result, Git can generate packs using the path walk approach that are often significantly smaller than even those generated with the new name hash function described above. Its timings are competitive even with generating packs using the existing revision order traversal. Try it out today by repacking with the new –path-walk command-line option. [source] Stash interchange format If you’ve ever needed to switch to another branch, but wanted to save any uncommitted changes, you have likely used git stash. The stash command stores the state of your working copy and index, and then restores your local copy to match whatever was in HEAD at the time you stashed. If you’ve ever wondered how Git actually stores a stash entry, then this section is for you. Whenever you push something onto your stash, Git creates three3 commits behind the scenes. There are two commits generated which capture the staged and unstaged changes. The staged changes represent whatever was in your index at the time of stashing, and the working directory changes represent everything you changed in your local copy but didn’t add to the index. Finally, Git creates a third commit listing the other two as its parents, capturing the entire snapshot. Those internally generated commits are stored in the special refs/stash ref, and multiple stash
If the past year has underscored anything, it’s that AI agents are becoming a bigger part of developers’ day-to-day workflows. We recently launched Copilot coding agent, an asynchronous, autonomous developer agent: it allows you to assign an issue to Copilot, and Copilot will work in the background and create a draft pull request for your review. Copilot coding agent works like a member of your team, and it’s received a great response from developers so far. But we know that not all of your work lives in GitHub Issues. Today, we’re launching a new agents experience on GitHub — the agents panel — allowing you to quickly delegate tasks to Copilot from any page on github.com with a simple prompt and track Copilot’s progress without breaking your flow. And of course, Copilot coding agent is also integrated into VS Code, GitHub Mobile, and the GitHub MCP Server, so you can collaborate with Copilot wherever you’re working. TL;DR: Collaborate with background agents on GitHub Available now for all paid Copilot plans (Pro, Pro+, Business, Enterprise). Ask your administrator to enable Copilot coding agent if you’re on Copilot Business or Copilot Enterprise. Hand off tasks from anywhere: GitHub.com, GitHub Mobile, Copilot Chat, VS Code, or MCP-enabled tools. Stay in control: Track and review tasks in GitHub or VS Code. Learn more > Delegate any coding task to Copilot coding agent, wherever you are, with the agents panel Need a quick refresher on GitHub Copilot coding agent? Skip ahead > The agents panel, available today on every page on github.com, is your mission control center for agentic workflows on GitHub. It’s a lightweight overlay that allows you to hand new tasks to Copilot and track existing tasks without navigating away from your current work. Just click the new Agents button in the navigation bar to get started. From the agents panel, you can: 🛠️ Assign background tasks without switching pages. 👀 Monitor running tasks with real-time status. 🔗 Jump into pull requests when you’re ready to review. Open the panel in a full-screen view by clicking View all tasks, or bookmark github.com/copilot/agents for direct access. Launch new tasks without breaking your flow You can start a new Copilot task from the new agents panel with a simple prompt. Just open the panel from any page on GitHub, describe your goal in natural language, and select the relevant repository. Copilot will then take it from there and start creating a plan, drafting changes, running tests, and then preparing a pull request. Not sure where to start? Try the following sample prompts: Describe a simple task: “Add integration tests for LoginController” “Refactor WidgetGenerator for better code reuse” “Add a dark mode/light mode switcher” Refer to a GitHub issue or pull request as context, optionally providing extra context: “Fix #877 using pull request #855 as an example” “Fix #1050, and make sure you update the screenshots in the README” Run multiple tasks in parallel: “Add unit test coverage for utils.go” + “Add unit test coverage for helpers.go” Copilot coding agent: a quick reintroduction Copilot coding agent lets you hand off coding tasks — via GitHub.com, GitHub Mobile, VS Code, or any MCP-enabled tool — and get back a draft pull request when it’s done. It runs in the cloud, can work in parallel on multiple tasks, and continues even if your computer is off. Its secure, GitHub Actions-powered environment can run builds, tests, and linters without asking for every step. You stay in control with detailed logs and pull request-based approvals, and can give feedback by mentioning @copilot in a review. Thanks to the Model Context Protocol (MCP), Copilot has read access to your repository data on GitHub (powered by the GitHub MCP Server). It can also view web pages for testing and validation (powered by the Playwright MCP Server), and connect to your own MCP servers, as well. You can learn more about how it works (or read our Docs), if you’re curious. More ways to hand off work to Copilot You can also start Copilot coding agent tasks from: GitHub Issues: Assign an issue to Copilot on github.com or GitHub Mobile. Visual Studio Code: Delegate tasks to Copilot and track running tasks with the GitHub Pull Requests extension. Other IDEs: Ask Copilot to open a pull request in Copilot Chat in JetBrains IDEs and Visual Studio. MCP‑enabled tools: Trigger tasks from compatible apps that integrate via the Model Context Protocol. Recent upgrades to Copilot coding agent We’ve made several improvements to Copilot coding agent since its initial launch: Broader availability: Copilot coding agent (public preview) is now open to all paid Copilot subscribers (Pro, Pro+, Business, Enterprise) 20x more usage: Each agent session now uses just one premium request Smarter agents: Built‑in browser for validating changes, plus new configurability via remote MCP servers, custom instructions, and firewall settings Cross‑surface support: Available across GitHub.com, VS Code, JetBrains IDEs, Visual Studio, and GitHub Mobile Try it now Copilot coding agent and the new agents panel on GitHub is available today in public preview for all paid Copilot subscribers. Your administrator may need to enable the Copilot coding agent policy. Learn more about GitHub Copilot > The post Agents panel: Launch Copilot coding agent tasks anywhere on GitHub appeared first on The GitHub Blog. News & insights, Product, agentic workflows, Agents panel, generative AI, GitHub Copilot The GitHub Blog
When I was a first-year student, I joined a campus club after seeing a flyer in the hallway. I didn’t know much about it — only that my mom had been part of the same group when she was in university, and it had shaped her life. At the first meeting, I found instant community. Some of those people became lifelong friends. But they were also mostly in their third or fourth year. The next year, most of them graduated and there was a huge leadership gap. I wasn’t ready, but I stepped up. That experience taught me something I’ll never forget: If you don’t bring in new people early, your community won’t last. Years later, I’m seeing the same pattern in open source. We talk a lot about burnout, bus factors, and maintainers leaving — but we don’t talk enough about how to bring in new contributors, or what it takes to help them grow into leaders. The graying of Open Source According to Tidelift’s 2024 maintainer survey, the percentage of maintainers aged 46–65 has doubled since 2021. Meanwhile, the share of contributors under 26 has dropped from 25% to just 10%. This “graying” isn’t inherently a problem. But the lack of succession is. If we don’t create pathways for younger contributors, we’re setting ourselves up for burnout, knowledge loss, and long-term fragility. Enter Sam: A Gen Z persona To explore what support might look like, I introduced a persona named “Sam” in a recent talk at Open Source Summit North America: Name: Sam (they/them) Age: 23 Location: Urban Canada, lives mostly online Sentiment: “I want to contribute to a climate tech project that actually matters — but I don’t know where to start. I taught myself to code on YouTube. I design and moderate online communities. But public repos feel intimidating. I want purpose, flexibility, and a place where people like me belong.” Sam is our Gen Z persona. They want to contribute to something that matters. They’re self-taught, community-oriented, and motivated by purpose. But they’re also navigating financial pressures, unclear pathways, and they aren’t sure how leadership in open source actually works. How do we help Sam thrive in open source? The mountain of engagement To support contributors like Sam, here’s a framework I’ve used for years in programs like Mozilla Open Leaders and GitHub’s Maintainer Programs: the Mountain of Engagement. This model outlines a contributor’s journey in six steps: Discovery: How they first hear about the project. First contact: How they first engage with the project or their initial interaction. Participation: How they first participate or contribute. Sustained participation: How their contribution or involvement can continue. Networked participation: How they may invite and onboard others or networking within the community. Leadership: How they may take on some additional responsibility on the project, or begin to lead. At each stage, you can compare traditional best practices with what Gen Z contributors like Sam might actually need. 1. Discovery How they first hear about the project. Traditional approach: Make your project discoverable. That means publishing to a public repository, applying an open source license, and doing basic marketing: a project website, documentation, and maybe a few social posts. What Sam needs: Sam isn’t browsing GitHub trending pages. They’re discovering projects through TikTok, Discord, and YouTube. They want to see purpose up front, not buried in a README. And their learning starts on mobile. 84% of Gen Z are on YouTube (Sprout Social Index, 2025) 86% say purpose is very or somewhat important for their job satisfaction. (Deloitte, 2025) To reach Sam, projects need to show up where they already are, with formats and values that resonate. 2. First contact How they first engage with the project, their initial interaction. Traditional approach: A good README, clear contributing docs, and a communication channel where newcomers can ask questions. What Sam needs: A mobile-friendly, visual-first landing experience. A project that leads with its mission. A casual, open chat like Discord where they can lurk before jumping in. 72.8% of Gen Z prefer visual learning. (TJHSS, 2025) Gen Z favors community-driven platforms like Discord over public forums. (Impero, 2022) 3. Participation How they first participate or contribute. Traditional approach: Personal invitations, fast responses to questions, “good first issues,” and clear contribution docs. These reduce friction and help people get started. What Sam needs: Real-time feedback. Sandboxed environments to try things out. Clear spaces where it’s okay to learn, not just perform. Generation Z students tend to be keen observers; they prefer to watch others complete tasks before attempting them themselves. (TJHSS, 2025) Projects like FreeCodeCamp and Kubernetes’ contributor playgrounds offer great models here. 4. Sustained participation How their contribution or involvement can continue. Traditional approach: Recognize contributors, match tasks to interests, and show how their work connects to the project’s mission. What Sam needs: Recognition they can share: badges, mentions, portfolios. They care about making a difference more than climbing a hierarchy. Show impact. 86% of Gen Z workers prioritize mentorship and skill development. (Deloitte, 2025) 5. Networked participation How they may invite and onboard others, networking within the community. Traditional approach: Mentorship, social events, and formal roles that build commitment and connection. What Sam needs: Named, shareable roles like Discord mod or community guide. Off-topic channels and casual connection. Peer-led leadership that spreads influence. 70% of Gen Z join communities for belonging and voice. (Impero, 2022) Rust’s consensus-driven governance is an example. 6. Leadership How they may take on some additional responsibility on the project, or begin to lead. Traditional approach: Invite someone to become a maintainer. Share governance. Provide documentation on roles and responsibilities. What Sam needs: Shared stewardship, not top-down control. Compensation or professional growth. A clear value exchange. 52% of Gen Z live paycheck to paycheck. (Deloitte, 2024) They’re more likely to contribute when there’s tangible support: mentorship, visibility, or paid time. TensorFlow’s contribution ladder and For Good First Issue’s mission-based focus both offer promising examples. What you can do Open source won’t thrive without the next
What does your ideal developer event look like? 👀 At GitHub Universe 2025, we’re building it. Returning to Fort Mason Center in San Francisco this October, Universe will be bigger, bolder, and more interactive than ever before. In addition to 100+ expert-led sessions (our full session catalogue drops in early September), you’ll find nine unique spaces designed to spark creativity, connection, and a lot of joy — whether you’re building LEGOs, networking with peers, or exploring new career resources. In this blog, we’re breaking down everything you can do on-site so you can start thinking about how you’ll spend your time. Let’s dive in. Early Bird pricing If you haven’t snagged an in-person pass yet, you’re in luck: You can still save $400 with our Early Bird discount until September 8. Better yet, buy 3 or more passes and get 25% off, or 8 or more passes and get 35% off. (You can even combine our $400 off Early Bird offer with either group discount for more savings!) Register now > Level up and build with the latest GitHub tools Go beyond the keynotes and sessions to explore GitHub’s latest tools with help from the people who know them best. If you’re curious about what’s new or want to go deep on the tools you already use, Universe is packed with opportunities to level up. Here’s where to start: 🧭 GitHub Central After the morning keynotes, head over to GitHub Central, where you’ll find live demos, customer stories, and product journeys aligned to our three content tracks — all designed to help you build more efficiently, securely, and creatively with GitHub. You’ll explore GitHub Copilot, GitHub Actions, GitHub Advanced Security, and more. With a mix of self-guided stations, live sessions with GitHub experts, and fun surprises, GitHub Central is your hub for discovery and inspiration. Whether you’re an enterprise architect or just getting started with automation, you’ll leave with practical ideas and trusted strategies to bring back to your team. 💡 GitHub Expert Center The GitHub Expert Center is your go-to for technical deep dives, quick advice, and 1:1 conversations. From specialists in AI and GitHub Actions, to security to scaled adoption, our GitHub experts are on-site and ready to answer all your GitHub product questions. Getting help is easy; you can book an appointment ahead of time or stop by in between your sessions. Fuel your growth (and your network!) The future of software is being shared, shaped, and supported by the people behind the code. If you’re interested in joining us at Universe to sharpen your skills, expand your network, or prep to find your next big opportunity, this is the place to start: 🌍 Open Source Zone In the Open Source Zone, you can connect with contributors, maintainers, and community leaders from around the globe. Discover rising stars from the GitHub Accelerator program, learn from Maintainer Community champions, and explore projects that are changing the way the world builds software. 🔎 Take a look at the 10 projects we featured in 2024. (And stay tuned for the projects we’ll be inviting this year!) 💼 Career Corner Looking to take the next step in your dev career? Book a 1:1 session with a career coach to get personalized advice on everything, including polishing your resume, optimizing your GitHub and LinkedIn profiles, and helping you prep for your next interview. The Career Corner is here to help you level up with confidence. 📚 GitHub Learn Learning isn’t one-size-fits-all. That’s why GitHub Learn brings together tutorials, certifications, and role-based learning paths to help you grow on your terms. Explore content from GitHub, Microsoft Learn, and more to help you build real, job-ready skills designed for developers at every level. 🎓 1:1 mentoring opportunity for students As part of GitHub’s Social Impact program, current students can apply for a 30-minute virtual micro-mentoring session with a GitHub employee ahead of Universe 2025. Sessions will be held from October 20–31, and you’ll get personalized resume feedback, career advice, or skill-building tips from an industry professional. Spots are limited — apply by September 19 for your chance to connect. Apply now > Make, tinker, and repeat At Universe, some of the most memorable moments happen when you’re solving puzzles, swapping stories with someone you just met, or building something weird and wonderful with AI. The spaces below are yours to unwind, experiment, and rediscover the joy of making. 🎯 Recess Take a quick break from sessions and connect over shared interests. Recess is your chance to meet fellow attendees or hang out with coworkers who share your non-dev passions, from Lego building to chatting with executives over gelato. 🔮 Makerspace Get your hands working in the most creative way possible! The Makerspace is where code meets art, music, robotics, and beyond. This is your space to play, explore, and reimagine what code can do. No formal training required — just bring your curiosity. 🛠️ Hack your badge Every in-person ticket includes a hackable badge — designed to be customized and coded. Follow tutorials, get inspired by other hackers, and create a unique piece of hardware art to commemorate your Universe experience. View this post on Instagram A post shared by GitHub (@github) 🛍️ The Shop Looking for GitHub Copilot gear? Want exclusive merch that speaks dev? The Shop is your destination for exclusive GitHub swag, fan-favorite collectibles, and a few surprises you’ll only find in person at our global developer event. Don’t miss your moment at GitHub Universe Regardless of what you want to accomplish during your time at Fort Mason, you can fully customize your event experience at GitHub Universe. Now’s the best time to grab your in-person pass and hang out with the people who love building and scaling as much as you do: Save $400 on your pass with our Early Bird discount, only until September 8. Get 25% off when you buy three or more passes. Or get 35% off when you buy eight or more passes. (And yes,
Have you ever worked with AI tools and wished they had access to some additional piece of context? Or wanted them to perform actions on your behalf? Think of those scenarios where you’re working with GitHub Copilot and you need it to check a GitHub Issue, run a Playwright test, or interact with an API. By default, these AI tools lack access to those external systems. But that’s where the Model Context Protocol (MCP) comes in. It’s a standardized way to extend AI tools with custom capabilities. I wanted to learn more about it by building something visual and interactive. So I created a turn-based game server that lets you play Tic-Tac-Toe and Rock Paper Scissors against Copilot using MCP. In my latest Rubber Duck Thursdays live stream, I walked through the project, which has a few components, all written in TypeScript: A Next.JS Web App and API, intended to run locally for demo/learning purposes An MCP Server that uses the MCP TypeScript SDK A shared library for common type definitions and components, which are reused across the web app, API, and MCP server You can take a look at the code over at github-samples/turn-based-game-mcp. Here’s what I learned. You can watch the full stream below 👇 Why MCP matters for developers Even with powerful AI agents, we continue to run into limitations: AI tools can’t natively access private data for retrieval augmented generation, like information from our GitHub repositories. They don’t have access to the latest documentation or real-time data. Agents can’t perform actions like creating pull requests, exploring the UI on your locally running application, or interact with your APIs. To access external context and take action, we need to extend the capabilities of these AI tools. But before MCP, there was no standard approach to integrating with third-party tools and services. You’d potentially need different plugins and different integration patterns for whatever AI tool you were using. MCP changes that by providing one standard way to plug tools and capabilities into any tool that supports the Model Context Protocol. MCP follows a client-server pattern that’s familiar to most developers: Host: The AI tool you’re using, like GitHub Copilot in VS Code (you’ll notice that Copilot in VS Code has good support in the MCP feature support matrix). The host initiates the connection to your MCP server via a client. Clients: Clients live inside the host application (for example, GitHub Copilot in VS Code), and have a 1:1 relationship with a server. When VS Code connects to a new MCP server (like GitHub, Playwright or the turn-based-game MCP server we’re talking about in this post), a new client is created to maintain the connection. Server: Your custom MCP server that provides tools, resources, and prompts. In our case, we’re making an MCP server that provides capabilities for playing turn-based games! Building the turn-based game MCP server For my learning project, I wanted something visual that would show the overall MCP interaction and could be reused when people are trying to explain it as part of a talk. So I built a web app with Tic-Tac-Toe and Rock Paper Scissors. But instead of the game having two people play locally (or online), or even a CPU in the backend, the opponent’s moves are orchestrated by an MCP server. The architecture includes: Next.js frontend: The game interface where I make moves API routes (part of the Next.js implementation): Backend logic for game state management, called by the frontend and the MCP server. MCP server: TypeScript server that handles AI game moves Shared libraries: Common game logic used across components Here’s how it works in practice: We register an MCP server in VS Code so that Copilot is aware of the new capabilities and tools. I interact with GitHub Copilot in VS Code. I can call tools explicitly, or Copilot can autodiscover them. Copilot calls the large language model. Based on the prompt context and the available tools, it may call the MCP server. The MCP server executes the requested tool (like making a move in the game) and returns results. Copilot uses those results to continue the conversation. The magic step is when you register the MCP server with an MCP application host (in our example, GitHub Copilot in Visual Studio Code). Suddenly, your AI agent gains access to the capabilities that have been built into those servers. Setting up the MCP server in VS Code You can configure your MCP servers by creating a .vscode/mcp.json file. You can find more details about that on the Visual Studio Code docs. { “servers”: { “playwright”: { “command”: “npx”, “args”: [ “@playwright/mcp@latest” ] }, “turn-based-games”: { “command”: “node”, “args”: [“dist/index.js”], “cwd”: “./mcp-server” } } } The above configuration tells GitHub Copilot in VS Code that there are two MCP servers that we’d like to use: A Playwright MCP server that is executed locally as an NPM package. A turn-based-games MCP server that runs a server locally based on the compiled TypeScript code from our working directory. For this implementation, I kept my turn-based-game MCP server architecture and logic relatively simple, with all components in a single repository. This monorepo approach bundles the web app, API, and MCP server together, making it straightforward to clone and run the entire system locally without complex dependency management or cross-repository setup. But for a more robust setup, you would likely distribute that MCP server either as a package (such as npm or a docker image), and have clear publishing and versioning processes around that. The three core building blocks of MCP Through building this project, I familiarized myself with three fundamental MCP server concepts: 1. Tools: Actions your AI can take Tools define what actions the MCP server can perform. In my game server, I specified tools like: Analyze_game: Get the current state of any game create_rock_paper_scissors_game: Start a new game of Rock Paper Scissors create_tic_tac_toe_game: Start a new Tic-Tac-Toe game play_rock_paper_scissors: Make an AI choice in Rock Paper Scissors play_tic_tac_toe: Make an AI move
The Copilot Chat extension for VS Code has been evolving rapidly over the past few months, adding a wide range of new features. Its new agent mode lets you use multiple large language models (LLMs), built-in tools, and MCP servers to write code, make commit requests, and integrate with external systems. It’s highly customizable, allowing users to choose which tools and MCP servers to use to speed up development. From a security standpoint, we have to consider scenarios where external data is brought into the chat session and included in the prompt. For example, a user might ask the model about a specific GitHub issue or public pull request that contains malicious instructions. In such cases, the model could be tricked into not only giving an incorrect answer but also secretly performing sensitive actions through tool calls. In this blog post, I’ll share several exploits I discovered during my security assessment of the Copilot Chat extension, specifically regarding agent mode, and that we’ve addressed together with the VS Code team. These vulnerabilities could have allowed attackers to leak local GitHub tokens, access sensitive files, or even execute arbitrary code without any user confirmation. I’ll also discuss some unique features in VS Code that help mitigate these risks and keep you safe. Finally, I’ll explore a few additional patterns you can use to further increase security around reading and editing code with VS Code. How agent mode works under the hood Let’s consider a scenario where a user opens Chat in VS Code with the GitHub MCP server and asks the following question in agent mode: What is on https://github.com/artsploit/test1/issues/19? VS Code doesn’t simply forward this request to the selected LLM. Instead, it collects relevant files from the open project and includes contextual information about the user and the files currently in use. It also appends the definitions of all available tools to the prompt. Finally, it sends this compiled data to the chosen model for inference to determine the next action. The model will likely respond with a get_issue tool call message, requesting VS Code to execute this method on the GitHub MCP server. Image from the Language Model Tool API published by Microsoft. When the tool is executed, the VS Code agent simply adds the tool’s output to the current conversation history and sends it back to the LLM, creating a feedback loop. This can trigger another tool call, or it may return a result message if the model determines the task is complete. The best way to see what’s included in the conversation context is to monitor the traffic between VS Code and the Copilot API. You can do this by setting up a local proxy server (such as a Burp Suite instance) in your VS Code settings: “http.proxy”: “http://127.0.0.1:7080″ Then, If you check the network traffic, this is what a request from VS Code to the Copilot servers looks like: POST /chat/completions HTTP/2 Host: api.enterprise.githubcopilot.com { messages: [ { role: ‘system’, content: ‘You are an expert AI ..’ }, { role: ‘user’, content: ‘What is on https://github.com/artsploit/test1/issues/19?’ }, { role: ‘assistant’, content: ”, tool_calls: [Array] }, { role: ‘tool’, content: ‘{…tool output in json…}’ } ], model: ‘gpt-4o’, temperature: 0, top_p: 1, max_tokens: 4096, tools: [..], } In our case, the tool’s output includes information about the GitHub Issue in question. As you can see, VS Code properly separates tool output, user prompts, and system messages in JSON. However, on the backend side, all these messages are blended into a single text prompt for inference. In this scenario, the user would expect the LLM agent to strictly follow the original question, as directed by the system message, and simply provide a summary of the issue. More generally, our prompts to the LLM suggest that the model should interpret the user’s request as “instructions” and the tool’s output as “data”. During my testing, I found that even state-of-the-art models like GPT-4.1, Gemini 2.5 Pro, and Claude Sonnet 4 can be misled by tool outputs into doing something entirely different from what the user originally requested. So, how can this be exploited? To understand it from the attacker’s perspective, we needed to examine all the tools available in VS Code and identify those that can perform sensitive actions, such as executing code or exposing confidential information. These sensitive tools are likely to be the main targets for exploitation. Agent tools provided by VS Code VS Code provides some powerful tools to the LLM that allow it to read files, generate edits, or even execute arbitrary shell commands. The full set of currently available tools can be seen by pressing the Configure tools button in the chat window: Each tool should implement the VS Code.LanguageModelTool interface and may include a prepareInvocation method to show a confirmation message to the user before the tool is run. The idea is that sensitive tools like installExtension always require user confirmation. This serves as the primary defense against LLM hallucinations or prompt injections, ensuring users are fully aware of what’s happening. However, prompting users to approve every tool invocation would be tedious, so some standard tools, such as read-files , are automatically executed. In addition to the default tools provided by VS Code, users can connect to different MCP servers. However, for tools from these servers, VS Code always asks for confirmation before running them. During my security assessment, I challenged myself to see if I could trick an LLM into performing a malicious action without any user confirmation. It turns out there are several ways to do this. Data leak due to the improper parsing of trusted URLs The first tool that caught my attention was the fetch_webpage tool. It lets you send an HTTP request to any website, but it requires user confirmation if the site isn’t on the list of trusted origins. By default, VS Code trusted localhost and the following domains: // By default, VS Code trusts “localhost” as well as the following domains: // – “https://*.visualstudio.com” // – “https://*.microsoft.com”
I’ve been there. Staring at my screen at 11 p.m., panicked, trying to learn the latest framework because I’m convinced it’ll make or break my career. Jason Lengstorf thinks we’ve got this all wrong. It feels like we’re scrambling to learn whatever thing we’re worried is gonna cost us our job if we don’t learn it really fast. A huge motivation for me is to try to remind everybody that this stuff can be fun. And having fun isn’t not working. Jason Lengstorf, creator of CodeTV We had the pleasure of hosting Jason Lengstorf, creator of “Learn with Jason” and the mastermind behind Code TV, where he makes what he calls “reality television for developers,” on a recent episode of The GitHub Podcast. With over 20 years in the industry, Jason’s perspective on learning, AI, and open source got me thinking about where we’ve been and where we’re headed. Listen to the full podcast episode👇 Jason’s take resonates with me because I see (and feel) this anxiety everywhere. Every Slack channel I’m in, every conference hallway conversation. Some of us are running a bit scared instead of running curious. But Jason’s perspective, combined with his predictions about AI integration and the critical role of open source maintainers, paints a picture of an industry on the cusp of significant change. Why I stopped panic-learning (and you should too) Here’s Jason’s thesis: “Having fun isn’t not working. Having fun actually makes you more likely to retain stuff and more likely to stick through a project and finish it.” When I first started building with AI tools, I treated every new model release like a pop quiz I hadn’t studied for. Sound familiar? But Jason’s approach with “Learn with Jason” flips this completely. Instead of cramming knowledge into developers’ heads, he creates space for exploration and discovery. The difference shows up everywhere. When developers approach learning with curiosity rather than desperation, they absorb concepts more thoroughly. They contribute more meaningfully to projects. They actually finish what they start. And they share their knowledge instead of hoarding it. Having fun actually makes you more likely to retain stuff and more likely to stick through a project and finish it and share it. I’m guilty of this too. How many times have you bookmarked a tutorial “for later” because you were too stressed about keeping up to actually enjoy learning it? When we give ourselves permission to enjoy the process, we model healthy behaviors for the next generation of developers. AI as a force multiplier (not a replacement) Jason nailed it with this analogy: “A can of caulk and a plunger can get you part of the way there, but at some point, you need to hire a plumber.” That’s AI and developers in a nutshell. All the YouTube videos in the world aren’t going to teach me how this stuff really works in 25 minutes. What we’re seeing in practice is that the tooling is acting similarly to the way that something like TypeScript suddenly enabled developers to intuit things about a code base. Here’s what happened when Jason and Jack Harrington built an MCP (Model Context Protocol) server live on stream. The AI churned out code automatically. Everything looked perfect until they hit a bug: One missing component name in a config file. Jack fixed it in seconds because he knew the system. Jason, despite 20 years of experience, would’ve needed to reverse-engineer the entire AI-generated codebase to debug it. If you’re a skilled developer, this is gonna make you unbelievably fast. If you are not a skilled developer, it’s gonna give you a lot of tools to learn very quickly. If you have no interest in learning, it is going to get you into a big bad mess really, really fast. That’s the difference AI makes: It amplifies what you already know, but can’t replace domain knowledge. For skilled developers, it creates incredible leverage. For those learning, it accelerates the process. But for those hoping to bypass learning entirely? Jason’s right — it creates bigger problems faster. The fact that MCP emerged as a shared standard gives me hope. Instead of every company launching their own incompatible AI integration system, we’re seeing convergence around shared protocols. This suggests the AI tooling ecosystem is maturing beyond the “new framework every week” phase. The developers keeping our world running (and why they need our help) Zod is the TypeScript schema validation library that’s become foundational to so much of our ecosystem. Yet, very few people know who builds Zod and how much of the AI stuff it’s powering, Jason says. This brings to mind the XKCD comic about critical infrastructure maintained by “some random person in Nebraska who’s thanklessly maintaining it.” The reality is even more stark than the comic suggests: SQLite, which runs most local databases globally, is maintained by four people The global timezone database is managed by two people Colin McDonald maintains Zod, which powers countless AI applications and framework integrations During Jason’s live coding challenges on CodeTV, participants consistently reach for the same open source tools: Tailwind, ShadCN/UI, Vue, Nuxt, React. We deploy to proprietary services and use proprietary AI models, but the building blocks, the things that actually create value, are largely gifts from individual maintainers and small teams. This creates both opportunity and responsibility. As Jason notes, Zod is one of the few projects he sponsors on GitHub because he considers it “load bearing” for his work. Check your package.json right now. I bet you’ll find at least three dependencies maintained by people you’ve never heard of. More of us need to identify our own load-bearing dependencies and if able to, support them financially through GitHub Sponsors or other means. Open source funding Open source maintainers are doing the work of many, for many — oftentimes without guaranteed funding. Check out the four trends shaping open source funding > The sustainability of open source isn’t just about individual kindness. It’s about the health of our entire industry.
You’ve been using GitHub Copilot in your IDE for autocomplete and code suggestions. But here’s what I discovered recently: there’s a whole other side of Copilot that lives on github.com, and it’s designed for different problems entirely. While your IDE handles the day-to-day coding, GitHub Copilot on github.com helps you tackle project management, team coordination, and rapid prototyping. I can file issues from screenshots, assign AI agents to fix bugs, and spin up working demos without opening VS Code. Check it out in the video below 👇 No extensions to install, no setup required. Just go to github.com/copilot and start working. This becomes your AI-powered command center, and here’s how you can use it strategically: File issues from screenshots Got a bug report with a screenshot? Don’t write it manually, let Copilot do it. Here’s how: Take a screenshot of the bug (e.g., a misaligned icon or layout problem) Drag it into the Copilot chat on github.com/copilot. Add a prompt like: Create a new issue using the ‘bug’ label. Use this screenshot and describe the overlapping arrow icon. Apply the UI issue template from this repo. Copilot reads the image, generates a clear title and description, applies the right labels, and uses your repository’s issue templates. It’s faster than manual transcription and often catches details I might miss. 📦 Quick actions at github.com/copilot Beyond screenshots, here’s what else you can do from your project hub: Chat with Copilot across your GitHub repositories Create and manage issues and pull requests Launch GitHub Spark to prototype code snippets or components Assign Copilot agents to work autonomously Switch between multiple AI models (even mid-conversation) 💡 Pro tip: Copilot can infer issue context from your screenshot and your prompt, no need to spell everything out. Let Agents handle routine work Once your issue is created, you can assign it to the Copilot coding agent to start working on a solution. To assign an agent: In the chat thread, tell Copilot: Assign yourself to this issue and draft a fix. The agent will analyze your codebase, identify the root cause, and submit a draft pull request with the fix. You can monitor progress in the task pane and review the pull request when ready. This works well for routine bugs, documentation updates, and dependency upgrades. For more complex features, I still prefer hands-on development in the IDE. 💡 Pro tip: Agents can work across issues, run workflows, and follow up, just like a teammate. Use Spark to prototype live When I need to test how a component behaves or validate a design idea, I use GitHub Spark to: Rapidly scaffold working code Preview and interact with the output Share the work via a link with collaborators Example prompt: Create a feature comparison table for an API pricing page. Show Free, Pro, and Enterprise tiers with checkmarks for features. Within minutes, I get working code with a live preview. I can edit directly in Spark, GitHub Codespaces, or VS Code, see changes immediately, and publish and share the prototype with teammates. 💡 Pro tip: Use Spark to quickly practice with unfamiliar syntax by running and editing snippets in real time. Choose the best model for the task You can get access to multiple AI models and switch between models on github.com. In my experience: Model Best for GPT-4.1 General coding and reasoning Claude Sonnet 4 Structured writing, refactors, context-heavy tasks Opus 4 Creativity, edge cases, alternative perspectives To switch models: In a thread, click the model name. Select a different model and reload the response. Compare answers and choose the best one for your use case. 💡 Pro tip: Use model comparison to reduce hallucinations and sharpen your output. In my experience, GPT-4.1 works well for general coding, Claude 4 for complex refactoring, and Opus 4 when I need creative approaches. But your mileage may vary; the real value is having options when one model’s response doesn’t quite fit. Navigate conversation branches GitHub Copilot groups multiple responses under each message you send, especially when you switch models. It’s not threading in the Slack sense, but it acts like it — each group works like a separate “branch” of your conversation, completely isolated from the others. Here are a few use practical use cases: Compare different refactoring approaches by switching models for the same question. Test multiple architectural patterns by reviewing several AI-generated answers. Explore alternative explanations side-by-side without mixing contexts. 💡 Pro tip: Think of each message as a base commit in Git. Model switching creates alternative responses grouped under that message, letting you review different approaches without starting over. Combine web and IDE strategically Copilot is most powerful when you use both github.com and your IDE together, leveraging each for what they do best. Task Use github.com when you need… Use IDE when you need… Project coordination Cross-repository visibility Single codebase focus Issue management Creating and assigning issues Implementing solution Agent work Async automation via coding agent Real-time collaboration via agent mode Prototyping Quick demos and sharing In-depth debugging Example workflow: I’ll start a project discussion on github.com, prototype the solution in Spark, create issues for the team, then switch to VS Code for implementation. Build your AI-native dev workflow Here’s what a full day might look like: Land at github.com/copilot. Check assigned pull requests and issues. Use chat to summarize project status and recent team activity. Assign an agent to a newly created issue. Prototype a new idea in Spark. Use thread conversations and switch models mid-thread. Push final changes via pull request. The key insight is that github.com Copilot handles the coordination and exploration work, while your IDE handles the detailed implementation. Used together, they can cover the full development workflow. Ready to try it? Copilot on github.com turns your browser into your personal development mission control. It’s time to stop thinking of Copilot as just autocomplete and start using it as your workflow orchestrator. Head to github.com/copilot and start building now > The post How to use GitHub Copilot on github.com:
Accidentally committing secrets to source code is a mistake every developer dreads — and one that’s surprisingly easy to make. GitHub Secret Protection was built for moments like these, helping teams catch exposed credentials before they cause harm. Secret Protection works by creating alerts for sensitive credentials found in code, and it offers several features to help mitigate leaks even further. Push protection helps stop leaks before they happen by blocking any commits that contain sensitive data and ensuring that credentials do not make it into a code base. Validity checks help users triage alerts by indicating which secrets are active and need immediate attention. The partner program allows for providers to be notified of leaks in public repositories for certain token types. When these types are detected, providers can take immediate action on the exposed secret (e.g. immediate revocation, application of a quarantine policy, notification). Copilot secret scanning allows for detecting generic secrets, things like passwords or connection strings that may not be associated with a specific provider. Custom patterns let you define expressions for detecting secrets that are specific to your project or organization. Aaron and I have worked extensively on validity checks during our time at GitHub. It’s become a core part of our product, and many users rely on it day-to-day as part of their triage and remediation workflows. Secret Protection calculates the validity of a leaked credential by testing it against an unobtrusive API endpoint associated with the token’s provider. We released this feature in 2023, and we started by adding validity checks support for the most common token types we saw leaked in code (e.g., AWS keys, GCP credentials, Slack tokens). Secret Protection got to a point where it was validating roughly 80% of newly created alerts. While the less common token types remained (and continue to remain) important, our team shifted focus to make sure we delivered the greatest value for our customers. Towards the end of 2024 and into 2025 we gradually saw the advent of agentic AI, and soon coding agents started to gain mainstream popularity. Our team got together earlier this year and had a thought: Could we successfully use coding agents to help cover this gap? Augmenting a repeatable workflow To identify opportunities for automation, we first took a close look at our existing process for adding validation support for new token types. This framework-driven workflow included the following steps for each token type: We researched the provider to determine a good endpoint for validating the token in question. We wrote code — a validator — to implement this change. We darkshipped the validator, thus allowing us to update our implementation with errors we saw. We fully shipped the validator by removing the darkship configuration. The coding and release parts (second and fourth steps) of this process were the obvious first choices for automation. The first step above involves finding a suitable endpoint to validate a new token type. We typically use /me (or equivalent) endpoints if they exist. Sometimes they do exist, but they’re buried in documentation and not easy to find. We experimented with handing off this research to Copilot, but it sometimes struggled. It could not reliably find the same least-intrusive endpoint an engineer would choose. We also discovered that creating and testing live tokens, and interpreting nuanced API changes, remained tasks best handled by experienced engineers. Copilot did an excellent job of making code changes. The output of the human-driven research task was fed into a manually dispatched GitHub workflow that created a detailed issue we could assign to the coding agent. The issue served as a comprehensive prompt that included background on the project, links to API documentation, and various examples to look at. We learned that the coding agent sometimes struggled with following links, so we added an extra field for any additional notes. After assigning an issue to Copilot, the coding agent automatically generated a pull request, instantly turning our research and planning into actionable, feedback-ready code. We treated code generated by the agent just like code written by our team: it went through automated testing, a human review process, and was eventually deployed by engineers. GitHub provided a streamlined process for requesting changes from the agent — just add comments to a pull request. The agent is not perfect, and it did make some mistakes. For example, we expected that Copilot would follow documentation links in a prompt and reference the information there as it implemented its change, but in practice we found that it sometimes missed details or didn’t follow documentation as intended. Our framework included the ability to darkship a validator. That is, we observed the results of our new code without writing validity inferences to the database. It wasn’t uncommon for our engineers to encounter some amount of drift in API documentation and actual behavior. This stage allowed us to safely fix any errors. When we were ready to fully release a change, we asked Copilot to make a small configuration change to take the new validator out of darkship mode. The result Prior to our AI experimentation, progress was steady but slow. We were validating 32 partner token types. It took us several months to get here as engineers balanced onboarding new checks with day-to-day feature development. With Copilot, we onboarded almost 90 new types in just a few weeks as our engineering interns, @inshalak and @matthew-tzong, directed Copilot through this process. Coding agents are a viable option for accelerating framework-driven repeatable workflows with automation. In our case, Copilot was literally a force multiplier. Being able to parallelize the output of N research tasks over N agents was huge. Copilot delivers speed and scale, but it’s no replacement for human engineering judgment. Always review, test, and verify the code it produces. We were successful by grafting Copilot into very specific parts of this framework. Takeaways and tips Our experiment using Copilot coding agent made a measurable impact: we dramatically accelerated our coverage of token types, parallelized
Open source runs on passion and persistence. Maintainers are the volunteers who show up to triage issues, review contributions, manage duplicates, and do the quiet work that keeps projects going. Most don’t plan on becoming community managers. But they built something useful, shared it, and stayed when people started depending on it. That’s how creators become stewards. But as your project grows, your time to build shrinks. Instead, you’re writing the same “this looks like a duplicate of #1234” comment, asking for missing reproduction steps, and manually labeling issues. It’s necessary work. But it’s not what sparked your love for the project or open source. That’s why we built GitHub Models: to help you automate the repetitive parts of project management using AI, right where your code lives and in your workflows, so you can focus on what brought you here in the first place. What maintainers told us We surveyed over 500 maintainers of leading open source projects about their AI needs. Here’s what they reported: 60% want help with issue triage — labeling, categorizing, and managing the flow 30% need duplicate detection — finding and linking similar issues automatically 10% want spam protection — filtering out low quality contributions 5% need slop detection — identifying low quality pull requests that add noise Folks surveyed indicated that they wanted AI to serve as a second pair of eyes and to not intervene unless asked. They also said triaging issues, finding similar issues, helping write minimal reproductions were top of mind. Clustering issues based on topic or feature was also possibly the most important concern to some. How GitHub Models + GitHub Actions = Continuous maintainer support We’re calling this pattern Continuous AI using automated AI workflows to enhance collaboration, just like CI/CD transformed testing and deployment. With GitHub Models and GitHub Actions, you can start applying it today. Here’s how Continuous AI can help maintainers (you!) manage their projects The following examples are designed for you to easily copy and paste into your project. Make sure GitHub Models is enabled for your repository or organization, and then just copy the YAML into your repo’s .github/workflows directory. Customize these code blocks as needed for your project. Add permissions: models: read to your workflow YAML, and your action will be able to call models using the built-in GITHUB_TOKEN. No special setup or external keys are required for most projects. Automatic issue deduplication Problem: You wake up to three new issues, two of them are describing the same bug. You copy and paste links, close duplicates, and move on… until it happens again tomorrow. Solution: Implement GitHub Models and a workflow to automatically check if a new issue is similar to existing ones and post a comment with links. name: Detect duplicate issues on: issues: types: [opened, reopened] permissions: models: read issues: write concurrency: group: ${{ github.workflow }}-${{ github.event.issue.number }} cancel-in-progress: true jobs: continuous-triage-dedup: if: ${{ github.event.issue.user.type != ‘Bot’ }} runs-on: ubuntu-latest steps: – uses: pelikhan/action-genai-issue-dedup@v0 with: github_token: ${{ secrets.GITHUB_TOKEN }} # Optional tuning: # labels: “auto” # compare within matching labels, or “bug,api” # count: “20” # how many recent issues to check # since: “90d” # look back window, supports d/w/m This keeps your issues organized, reduces triage work, and helps contributors find answers faster. You can adjust labels, count, and since to fine tune what it compares against. Issue completeness Problem: A bug report lands in your repo with no version number, no reproduction steps, and no expected versus actual behavior. You need that information before you can help. Solution: Automatically detect incomplete issues and ask for the missing details. name: Issue Completeness Check on: issues: types: [opened] permissions: issues: write models: read jobs: check-completeness: runs-on: ubuntu-latest steps: – name: Check issue completeness uses: actions/ai-inference@v1 id: ai with: prompt: | Analyze this GitHub issue for completeness. If missing reproduction steps, version info, or expected/actual behavior, respond with a friendly request for the missing info. If complete, say so. Title: ${{ github.event.issue.title }} Body: ${{ github.event.issue.body }} system-prompt: You are a helpful assistant that helps analyze GitHub issues for completeness. model: openai/gpt-4o-mini temperature: 0.2 – name: Comment on issue if: steps.ai.outputs.response != ” uses: actions/github-script@v7 with: script: | github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: ${{ github.event.issue.number }}, body: `${{ steps.ai.outputs.response }}` }) The bot could respond: “Hi! Thanks for reporting this. To help us investigate, could you please provide: 1) Your Node.js version, 2) Steps to reproduce the issue, 3) What you expected to happen versus what actually happened?”Or you can take it a step further and ensure the issue is following your contributing guidelines, like ben-balter/ai-community-moderator (MIT License). Spam and “slop” detection Problem: You check notifications and find multiple spam pull requests or low effort “fix typo” issues. Solution: Use AI to flag suspicious or low quality contributions as they come in. name: Contribution Quality Check on: pull_request: types: [opened] issues: types: [opened] permissions: pull-requests: write issues: write models: read jobs: quality-check: runs-on: ubuntu-latest steps: – name: Detect spam or low-quality content uses: actions/ai-inference@v1 id: ai with: prompt: | Is this GitHub ${{ github.event_name == ‘issues’ && ‘issue’ || ‘pull request’ }} spam, AI-generated slop, or low quality? Title: ${{ github.event.issue.title || github.event.pull_request.title }} Body: ${{ github.event.issue.body || github.event.pull_request.body }} Respond with one of: spam, ai-generated, needs-review, or ok system-prompt: You detect spam and low-quality contributions. Be conservative – only flag obvious spam or AI slop. model: openai/gpt-4o-mini temperature: 0.1 – name: Apply label if needed if: steps.ai.outputs.response != ‘ok’ uses: actions/github-script@v7 with: script: | const label = `${{ steps.ai.outputs.response }}`; const number = ${{ github.event.issue.number || github.event.pull_request.number }}; if (label && label !== ‘ok’) { await github.rest.issues.addLabels({ owner: context.repo.owner, repo: context.repo.repo, issue_number: number, labels: [label] }); } This workflow auto-screens new issues and new pull requests for spam/slop/low-quality, and auto labels them based on an LLM’s judgment. Tip: If the repo doesn’t already have spam or needs-review labels, addLabels will create them with default styling. If you want custom colors or descriptions, pre-create them. You can also
Norby’s AI companion helps people navigate the challenge of learning new languages, with support from Dell and NVIDIA. Norby’s AI companion helps people navigate the challenge of learning new languages, with support from Dell and NVIDIA. AI Solutions Blog | Dell
The reality is clear: AI is poised to be a pivotal force in accelerating the transformation journeys of CSPs. The reality is clear: AI is poised to be a pivotal force in accelerating the transformation journeys of CSPs. Telecommunications Blog | Dell
Opposite of GST Office, Chandar, Raiganj, Uttar Dinajpur, West Bengal - 733134
support@itmaity.com
infoitmaity@gmail.com
+91-9907-227112
+91-8759-027112
©2025. ITMAITY and Team. All Rights Reserved.
