Author name: ITMAITY

Let’s be honest: that flood of security alerts in your inbox can feel completely overwhelming. We’ve been there too. As a developer advocate and a product manager focused on security at GitHub, we’ve seen firsthand how overwhelming it can be to triage vulnerability alerts. Dependabot is fantastic at spotting vulnerabilities, but without a smart way to prioritize them, you might be burning time on minor issues or (worse) missing the critical ones buried in the pile. So, we’ve combined our perspectives—one from the security trenches and one from the developer workflow side—to share how we use Exploit Prediction Scoring System (EPSS) scores and repository properties to transform the chaos into clarity and make informed prioritization decisions. Understanding software supply chain security If you’re building software today, you’re not just writing code—you’re assembling it from countless open source packages. In fact, 96% of modern applications are powered by open source software. With such widespread adoption, open source software has become a prime target for malicious actors looking to exploit vulnerabilities at scale. Attackers continuously probe these projects for weaknesses, contributing to the thousands of Common Vulnerabilities and Exposures (CVEs) reported each year. But not all vulnerabilities carry the same level of risk. The key question becomes not just how to address vulnerabilities, but how to intelligently prioritize them based on your specific application architecture, deployment context, and business needs. Understanding EPSS: probability of exploitation with severity if it happens When it comes to prioritization, many teams still rely solely on severity scores like the Common Vulnerability Scoring System (CVSS). But not all “critical” vulnerabilities are equally likely to be exploited. That’s where EPSS comes in—it tells you the probability that a vulnerability will actually be exploited in the wild within the next 30 days. Think of it this way: CVSS tells you how bad the damage could be if someone broke into your house, while EPSS tells you how likely it is that someone is actually going to try. Both pieces of information are crucial! This approach allows you to focus resources effectively. As security pro Daniel Miessler points out in Efficient Security Principle, “The security baseline of an offering or system faces continuous downward pressure from customer excitement about, or reliance on, the offering in question.” Translation? We’re always balancing security with usability, and we need to be smart about where we focus our limited time and energy. EPSS helps us spot the vulnerabilities with a higher likelihood of exploitation, allowing us to fix the most pressing risks first. Smart prioritization steps 1. Combine EPSS with CVSS One approach is to look at both likelihood (EPSS) and potential impact (CVSS) together. It’s like comparing weather forecasts—you care about both the chance of rain and how severe the storm might be. For example, when prioritizing what to fix first, a vulnerability with: EPSS: 85% (highly likelihood of exploitation) CVSS: 9.8 (critical severity) …should almost always take priority over one with: EPSS: 0.5% (much less likely to be exploited) CVSS: 9.0 (critical severity) Despite both having red-alert CVSS ratings, the first vulnerability is the one keeping us up at night. 2. Leverage repository properties for context-aware prioritization Not all code is created equal when it comes to security risk. Ask yourself: Is this repo public or private? (Public repositories expose vulnerabilities to potential attackers) Does it handle sensitive data like customer info or payments? How often do you deploy? (Frequent deployments face tighter remediation times) One way to provide context-aware prioritization systematically is with custom repository properties, which allow you to add contextual information about your repositories with information such as compliance frameworks, data sensitivity, or project details. By applying these custom properties to your repositories, you create a structured classification system that helps you identify the “repos that matter,” so you can prioritize Dependabot alerts for your production code rather than getting distracted by your totally-not-a-priority test-vulnerabilities-local repo. 3. Establish clear response Service Level Agreements (SLAs) based on risk levels Once you’ve done your homework on both the vulnerability characteristics and your repository context in your organization, you can establish clear timelines for responses that make sense for your organization resources and risk tolerance. Let’s see how this works in real life: Here’s an example risk matrix that combines both EPSS (likelihood of exploitation) and CVSS (severity of impact). EPSS ↓ / CVSS → Low Medium High Low ✅ When convenient ⏳ Next sprint ⚠️ Fix Soon Medium ⏳ Next sprint ⚠️ Fix soon 🔥 Fix soon High ⚠️ Fix Soon 🔥 Fix soon 🚨 Fix first Say you get an alert about a vulnerability in your payment processing library that has both a high EPSS score and high CVSS rating. Red alert! Looking at our matrix, that’s a “Fix first” situation. You’ll probably drop what you’re doing, and put in some quick mitigations while the team works on a proper fix. But what about that low-risk vulnerability in some testing utility that nobody even uses in production? Low EPSS, low CVSS… that can probably wait until “when convenient” within the next few weeks. No need to sound the alarm or pull developers off important feature work. This kind of prioritization just makes sense. Applying the same urgency to every single vulnerability just leads to alert fatigue and wasted resources, and having clear guidelines helps your team know where to focus first. Integration with enterprise governance For enterprise organizations, GitHub’s auto-triage rules help provide consistent management of security alerts at scale across multiple teams and repositories. Auto-triage rules allow you to create custom criteria for automatically handling alerts based on factors like severity, EPSS, scope, package name, CVE, ecosystem, and manifest location. You can create your own custom rules to control how Dependabot auto-dismisses and reopens alerts, so you can focus on the alerts that matter. These rules are particularly powerful because they: Apply to both existing and future alerts. Allow for proactive filtering of false positives. Enable “snooze until patch” functionality for vulnerabilities without a fix available. Provide visibility

The role of agentic AI has grown rapidly over the past several months as organizational leaders seek ways to accelerate AI Transformation. We firmly believe that Agents + Copilot + Human Ambition can deliver real AI differentiation for our customers. By putting the autonomous capabilities of an agent to work for their businesses, our customers are unlocking AI opportunity to realize greater value. The recent introduction of Microsoft 365 Copilot Chat is delivering on our promise of “Copilot for all” by providing frontline workers with a free, secure and enterprise-ready AI chat interface. Our customers are building their own custom agents with the no-code, low-code features of Microsoft Copilot Studio, allowing citizen and professional developers to extend the capabilities of Copilot and deliver on the unique needs of their industry. We also offer the best prebuilt agent framework right out-of-the-box, such as Sales Agent that works autonomously to help sellers build pipeline and close more deals with greater speed. Similarly, we recently announced general purpose reasoning agents — such as Researcher and Analyst — and invite all of our Microsoft 365 Copilot users to try these in their environments. It is exciting to see how agents are driving pragmatic AI innovation for our customers by increasing productivity, creating capacity across every role and function and improving business processes. Below are a few highlights from the past quarter that underscore the impact of an agentic AI approach — from improving employee experiences to streamlined workflows and significant cost savings. Agentic service management software provider Atomicwork leveraged Azure AI Foundry to create Atom — an AI agent that transforms the digital workplace experience for employees and automates service delivery. Adopters of this agentic management platform recognize significant benefits, such as reduced operational costs and increased employee satisfaction, with one customer achieving a 65% deflection rate within six months of implementation and projections of 80% by the end of the year. Integration within Microsoft Teams and other enterprise tools have further streamlined service delivery, allowing employees easier access to information and support. The company’s AI-driven approach has resulted in a 20% increase in accuracy and 75% reduction in response latency when compared to competing solutions. To support employees as they manage the high demand of internal requests and to create a more satisfying work environment, BDO Colombia used Copilot Studio and Power Platform to develop BeTic 2.0 — an agent that centralizes and automates key payroll and finance processes. The agent reduced operational workload by 50%, optimized 78% of internal processes and showed 99.9% accuracy in managed requests. It also helped reduce duplicative work, optimized workflows, improved the employee-client experience and continues to serve as a competitive differentiator for the company in the market. Dow is using agents to automate the shipping invoice analysis process and streamline its global supply chain to unlock new efficiencies and value. Receiving more than 100,000 shipping invoices via PDF each year, Dow built an autonomous agent in Copilot Studio to scan for billing inaccuracies and surface them in a dashboard for employee review. Using Freight Agent — a second agent built in Copilot Studio — employees can investigate further by “dialoguing with the data” in natural language. The agents are helping employees solve the challenge of hidden losses autonomously within minutes rather than weeks or months. Dow expects to save millions of dollars on shipping costs through increased accuracy in logistic rates and billing within the first year. As a leading provider of sustainable energy in Belgium, Eneco serves over 1.5 million customers. Facing performance issues with their existing chatbot, Eneco developed a new AI-driven agent using the no-code, graphical interface in Copilot Studio. This multilingual agent was deployed on the company website in just three months, integrating seamlessly with its live chat platform. The new agent manages 24,000 chats per month — an increase of 140% over the previous solution — and resolves 70% more customer conversations without a handoff to a live representative. For requests that do require escalation, the agent provides an AI-generated summary of the conversation for a more optimized call center experience. To reimagine trend forecasting and consumer marketing, The Estée Lauder Companies Inc. leveraged Copilot Studio to develop ConsumerIQ — an agent that centralizes and streamlines consumer data to enable instant access to actionable insights. Using natural language prompts, the agent reduced the time required for marketers to gather data from hours to seconds, while accelerating decision-making and helping prevent duplicated research. Together with Azure OpenAI Service and Azure AI Search, teams can gather data, identify trends, build marketing assets, inform research and move products to market faster. To create proposals and streamline knowledge retrieval and organization, Fujitsu leveraged Azure AI Agent Service within Azure AI Foundry to develop an intelligent, scalable AI agent for sales automation. The agent boosted productivity of sales teams by 67% while addressing knowledge gaps and allowing them to build stronger customer relationships. This transformation allowed teams to shift from time-intensive tasks to strategic planning and customer relationship building, while also supporting new hires with product information and strategic guidance. To reduce manual tasks and help employees deliver exceptional experiences, global baker Grupo Bimbo established its first ever technology Center of Excellence. Using Power Platform solutions and Copilot Studio, teams created 7,000 power apps, 18,000 processes and 650 agents to reduce busy work and enhance consumer service. By automating low-value tasks, the company saved tens of millions of dollars annually in development efforts and operational efficiencies. Grupo Bimbo also migrated to Azure for its AI capabilities, scalability, security and rapid time to market for apps. KPMG developed Comply AI — an agent that helps identify environment, social and governance compliance. Using Microsoft AI technologies, the agent helps identify relevant obligations, generate statements in natural language, assess control effectiveness and redraft control descriptions. This has already helped one of its customers achieve 70% improvement in Controls and Risks descriptions, an 18-month reduction in compliance program timelines and a 50% cut in ongoing compliance efforts. KPMG is also using

To ensure that you have access to the best technology available, we’re continuously adding support for new models to GitHub Copilot. That being said, we know it can be hard to keep up with so many new models being released all the time. All of this raises an obvious question: Which model should you use? You can read our recent blog post for an overview of the models currently available in Copilot and their strengths, or check out our documentation for a deep dive comparing different models and tasks. But the AI landscape moves quickly. In this article we’ll explore a framework—including a few strategies—for evaluating whether any given AI model is a good fit for your use, even as new models continue to appear at a rapid pace. It’s hard to go wrong with our base model, which has been fine-tuned specifically for programming-related tasks. But depending on what you’re working on, you likely have varying needs and preferences. There’s no single “best” model. Some may favor a more verbose model for chat, while others prefer a terse one, for example. We spoke with several developers about their model selection process. Keep reading to discover how to apply their strategies to your own needs. 💡 Watch the video below for tips on prompt engineering to get the best results. Why use multiple models? There’s no reason you have to pick one model and stick with it. Since you can easily switch between models for both chat and code completion with GitHub Copilot, you can use different models for different use cases. It’s kind of like dogfooding your own stack: You won’t know if it really fits your workflow until you’ve shipped some real code with it. – Anand Chowdhary, FirstQuadrant CTO and co-founder Chat vs. code completion Using one model for chat and another for autocomplete is one of the most common patterns we see among developers. Generally, developers prefer autocompletion models because they’re fast and responsive, which they need if they’re looking for suggestions as they think and type. Developers are more tolerant of latency in chat, when they’re in more of an exploratory state of mind (like considering a complex refactoring job, for instance). Reasoning models for certain programming tasks Reasoning models like OpenAI o1 often respond slower than traditional LLMs such as GPT-4o or Claude Sonnet 3.5. That’s in large part because these models break a prompt down into parts and consider multiple approaches to a problem. That introduces latency in their response times, but makes them more effective at completing complex tasks. Many developers prefer these more deliberative models for particular tasks. For instance, Fatih Kadir Akın, a developer relations manager, uses o1 when starting new projects from scratch. “Reasoning models better ‘understand’ my vision and create more structured projects than non-reasoning models,” he explains. FirstQuadrant CTO and co-founder Anand Chowdhary favors reasoning models for large-scale code refactoring jobs. “A model that rewrites complex backend code without careful reasoning is rarely accurate the first time,” he says. “Seeing the thought process also helps me understand the changes.” When creating technical interview questions for her newsletter, GitHub Senior Director of Developer Advocacy, Cassidy Williams mixes models for certain tasks. When she writes a question, she uses GPT-4o to refine the prose, and then Claude 3.7 Sonnet Thinking to verify code accuracy. “Reasoning models help ensure technical correctness because of their multi-step process,” she says. “If they initially get something wrong, they often correct themselves in later steps so the final answer is more accurate.” There’s some subjectivity, but I compare model output based on the code structure, patterns, comments, and adherence to best practices. – Portilla Edo, cloud infrastructure engineering lead What to look for in a new AI model Let’s say a new model just dropped and you’re ready to try it out. Here are a few things to consider before making it your new go-to. Recentness Different models use different training data. That means one model might have more recent data than another, and therefore might be trained on new versions of the programming languages, frameworks, and libraries you use. “When I’m trying out a new model, one of the first things I do is check how up to date it is,” says Xavier Portilla Edo, a cloud infrastructure engineering lead. He typically does this by creating a project manifest file for the project to see what version numbers Copilot autocomplete suggests. “If the versions are quite old, I’ll move on,” he says. Speed and responsiveness As mentioned, developers tend to tolerate more latency in a chat than in autocomplete. But responsiveness is still important in chat. “I enjoy bouncing ideas off a model and getting feedback,” says Rishab Kumar, a staff developer evangelist at Twilio. “For that type of interaction, I need fast responses so I can stay in the flow.” Accuracy Naturally, you need to evaluate which models produce the best code. “There’s some subjectivity, but I compare model output based on the code structure, patterns, comments, and adherence to best practices,” Portilla Edo says. “I also look at how readable and maintainable the code is—does it follow naming conventions? Is it modular? Are the comments helpful or just restating what the code does? These are all signals of quality that go beyond whether the code simply runs.” How to test an AI model in your workflow OK, so now you know what to look for in a model. But how do you actually evaluate it for responsiveness and correctness? You use it, of course. Start with a simple app Akın will generally start with a simple todo app written in vanilla JavaScript. “I just check the code, and how well it’s structured,” he says. Similarly, Kumar will start with a websocket server in Python. The idea is to start with something that you understand well enough to evaluate, and then layer on more complexity. “Eventually I’ll see if it can build something in 3D using 3js,” Akın says. Portilla Edo

We are entering a new reality — one in which AI can reason and solve problems in remarkable ways. This intelligence on tap will rewrite the rules of business and transform knowledge work as we know it. Like the Industrial Revolution and the internet era, this transformation will take decades to show its full promise — and will bring broad technological, societal and economic change. The 2025 Work Trend Index Annual Report is designed to prepare leaders and employees for this shift. As in previous years, it draws on a large global survey, Microsoft 365 telemetry and LinkedIn hiring and labor trends. New this year are insights from AI-native startups, economists, scientists and academics — all pointing to a seismic shift already underway. In fact, 82% of leaders say this is a pivotal year to rethink core aspects of strategy and operations. The data reveals the emergence of a new kind of organization: the Frontier Firm — built around intelligence on tap, human-agent teams and a new role for everyone: agent boss. While the shift ahead is profound, human ambition, creativity and ingenuity will continue to create new economic value and opportunity. In fact, 71% of workers at these firms say their company is thriving, compared to just 37% globally. You can buy intelligence on tap Imagine if you knew, before the internet took off, just how much it would reshape business. That’s where we are with AI. Intelligence is no longer bound by headcount or expertise. It’s an essential durable good: abundant, affordable and scalable on-demand. As economic and shareholder pressures grow, this on-demand intelligence offers a new lever for growth — one that can close the growing gap between business demands and human capacity. While 53% of leaders say productivity must increase, 80% of the global workforce reports lacking the time or energy to do their job. And on average, employees are interrupted by a meeting, email or ping every 2 minutes. To bridge this Capacity Gap, 82% of leaders expect to use digital labor to expand their workforce in the next 12 to 18 months. Digital labor will spur the reinvention of even the most established firms — and the birth of new companies we haven’t even thought of yet. On LinkedIn, top AI startups are hiring at 2X the rate of Big Tech. Much of that talent is flowing out of Big Tech and staying in the startup world, pointing to a deeper shift where innovation — and opportunity — are rising. As incumbents adapt and challengers scale, like we saw in the .com boom, the rules of talent and competition are being rewritten in real time. Human-agent teams will upend the org chart As AI continues to democratize expertise, we’re seeing a move from rigid org charts to more fluid, outcome-driven Work Charts. These structures flex with the needs of the business, drawing on the right mix of humans and agents to get the job done. While every function will evolve at a different pace and scale, 46% of leaders say their organization is using agents to fully automate workstreams or business processes — with customer service, marketing and product development as the top AI investment priorities. To maximize the impact of these human-agent teams, organizations need a new metric: the human-agent ratio. Leaders must ask two critical questions: How many agents are needed for which roles and tasks? And how many humans are needed to guide them? Getting that ratio right will be critical — and task-specific. Organizations will need to consider if there are times when human and digital labor outperform AI alone, when customers prefer a human touch or when society expects people to be responsible for the consequences — like a high-stakes product or finance decision. Whether it’s a customer conversation, a strategic decision or a product launch, knowing how to staff the right mix of humans and agents will define how work gets done — and how success is measured. Every employee becomes an agent boss As agents increasingly join the workforce, we’ll see the rise of the agent boss: someone who builds, delegates to and manages agents to amplify their impact and take control of their career in the age of AI. From the boardroom to the frontline, every worker will need to think like the CEO of an agent-powered startup. In fact, leaders expect their teams will be training (41%) and managing (36%) agents within five years. For those ready to lean in, AI will be a career accelerator — but leaders are ahead. We measured the agent boss mindset across seven indicators — from regular use and trust to career impact. Leaders outpace employees on every measure: 67% are familiar with agents (vs. 40% of employees) and 79% believe AI will accelerate their careers (vs. 67%). But this shift won’t stop at the top. As agents become embedded into daily work, roles across every level and function will evolve — along with the broader workforce. While 33% of leaders are considering headcount reductions, 78% are considering hiring for new AI roles. And 83% say AI will enable employees to take on more complex and strategic work earlier in their careers. This shift is multifaceted — every industry and role will evolve differently as the technology diffuses across business and society. Just as the internet era created billions of new knowledge jobs — from social media managers to UX designers — the AI era is already giving rise to new roles, with many more to come. Preparing for what’s next is no longer optional. Employees must build AI skills and companies must support them with the right tools and training. This moment calls for honest conversations, intentional communication and real investment in reskilling. The companies that invest now won’t just keep up — they’ll shape what comes next. Copilot is the new UI for AI Today we’re announcing the Microsoft 365 Copilot Wave 2 Spring release — designed to power the next era of human–agent collaboration. The Microsoft 365 Copilot app is now your window into the world of agents, with new capabilities for this next phase — driven by more advanced models, adaptive memory and reasoning agents that work alongside you. Updates include: Researcher and Analyst agents powered by OpenAI’s deep reasoning models rolling

Climate change is one of the most pressing issues of this century. We are working with developers to leverage technology to create a greener world. So, this Earth Day, we’re excited to launch the Climate Action Plan for Developers. We’ve curated tools and projects to help you kick-start your climate action journey and contribute to achieving net zero carbon emissions. Explore over 60,000 green software and climate-focused repositories on GitHub. Not sure where to start? Take a look below at a few highlights that can help you start to green your code today. 🚀 Speed & Scale Speed & Scale is a global initiative to move leaders to act on the climate crisis. Their team has developed a net zero action plan, with 10 objectives and 49 key results that track yearly progress. Learn about their action plan ⚡️ Electricity Maps Electricity Maps is the leading electricity grid API, offering a single source for accessing carbon intensity and energy mix globally. As a developer you can go beyond just viewing the maps to pull data from their API, download data files, and even contribute to their open source project. Access the Electricity Maps API 🖥️ CodeCarbon CodeCarbon is a lightweight software package that allows for integration into any Python project to track and reduce CO2 emissions from your computing. Get started with using the software package and check out the opportunities to help support this open source project. Get started with the software package 🌳 ClimateTriage, by OpenSustain.Tech ClimateTriage helps developers discover a meaningful way to contribute to open source projects focused on climate technology and sustainability. Harness the power of open source collaboration to tackle environmental challenges such as climate change, clean energy, biodiversity, and natural resource conservation. Whether you’re an experienced developer, a scientist, or a newcomer looking to contribute, connect you with opportunities to use your skills to create a sustainable future. Get started with a Good First Issue 💪 Use GitHub Copilot and CodeCarbon for greener code Computational tasks, especially in AI, have a growing carbon footprint. Learn how CodeCarbon, an open-source Python library, helps measure CO2 emissions from your code. Together with GitHub Copilot, integrate CodeCarbon into your projects, allowing you to track energy use and optimize for sustainability. Get started with GitHub Copilot for free today Learn more about how you can take climate action today. The post How to take climate action with your code appeared first on The GitHub Blog. ​ Open Source, Social impact, social impact The GitHub Blog

You might have heard of the GitHub CLI and all of the awesome things you can do with it. However, one of its hidden superpowers is the ability to execute complex queries and mutations through GitHub’s GraphQL API. This post will walk you through what GitHub’s GraphQL API endpoint is and how to query it with the GitHub CLI. What is GraphQL? Let’s start with the basics: GraphQL is a query language for APIs and a runtime for executing those queries against your data. Unlike traditional REST APIs that provide fixed data structures from predefined endpoints, GraphQL allows clients to request exactly the data they need in a single request. This single-request approach reduces network overhead, speeds up application performance, and simplifies client-side logic by eliminating the need to reconcile multiple API responses—a capability that has been openly available since the specification was open sourced in 2015. GraphQL operations come in two primary types: queries and mutations. Queries are read-only operations that retrieve data without making any changes—similar to GET requests in REST. Mutations, on the other hand, are used to modify server-side data (create, update, or delete)—comparable to POST, PATCH, PUT, and DELETE in REST APIs. This clear separation between reading and writing operations makes GraphQL interactions predictable while maintaining the flexibility to precisely specify what data should be returned after a change is made. How is GraphQL used at GitHub? GitHub implemented GraphQL in 2016 to address limitations of RESTful APIs. This adoption has significantly enhanced the developer experience when working with GitHub data. With the GraphQL endpoint, you can retrieve a repository’s issues, its labels, assignees, and comments with a single GraphQL query. Using our REST APIs, this would have otherwise taken several sets of nested calls. Some GitHub data and operations are only accessible through the GraphQL API (such as discussions, projects, and some enterprise settings), others exclusively through REST APIs (such as querying actions workflows, runners, or logs), and some using either endpoint (such as repositories, issues, pull requests, and user information). GitHub’s GraphQL endpoint is accessible at api.github.com/graphql and you can explore the full schema in our GraphQL documentation or through the interactive GraphQL Explorer. A key consideration when choosing between the REST API and the GraphQL API is how the rate limits are calculated. As a quick summary for how this is implemented: REST API: Limited by number of requests (typically 5,000 requests per hour for authenticated users and up to 15,000 for GitHub Apps installed in an Enterprise) GraphQL API: Limited by “points” (typically 5,000 points per hour for authenticated users but can go up to 10,000-12,500 points per hour for GitHub Apps) Each GraphQL query costs at least one point, but the cost increases based on the complexity of your query (number of nodes requested, connections traversed, etc.). The GraphQL API provides a rateLimit field you can include in your queries to check your current limit status. For scenarios where you need to fetch related data that would otherwise require multiple REST calls, GraphQL is often more rate limit friendly because: One complex GraphQL query might cost 5-10 points but replace 5-10 separate REST API calls. You avoid “over-fetching” data you don’t need, which indirectly helps with rate limits. The GraphQL API allows for more granular field selection, potentially reducing the complexity and point cost. However, poorly optimized GraphQL queries that request large amounts of nested data could potentially use up your rate limit faster than equivalent REST requests—and quickly run into secondary rate limit issues. A quick rule of thumb on deciding between which to use: For querying relational objects, such as GitHub Projects and their issues, GraphQL is often more effective, especially if it’s a discrete number of items. For bulk data of one type or single data points, such as pulling in a list of repository names in an organization, the REST API is often preferred. Sometimes there isn’t a right or wrong answer; so as long as the object exists, try one out! Why use GitHub CLI for GraphQL? While many developers start with GitHub’s GraphQL Explorer on the web, curl, or other API querying tools, there’s a more streamlined approach: using built-in GraphQL support in the GitHub CLI. Before diving into the how-to, let’s understand why GitHub CLI is often my go-to tool for GraphQL queries and mutations: Authentication is handled automatically: No need to manage personal access tokens manually. Streamlined syntax: Simpler than crafting curl commands. Local development friendly: Run queries and mutations right from your terminal. JSON processing: Built-in options for filtering and formatting results. Pagination support: Ability to work with cursor-based pagination in GraphQL responses. Consistent experience: Same tool you’re likely using for other GitHub tasks. How to get started with gh api graphql First, ensure you have GitHub CLI installed and authenticated with gh auth login. The basic syntax for making a GraphQL query with gh api graphql is: gh api graphql -H X-Github-Next-Global-ID:1 -f query=’ query { viewer { login name bio } } ‘ This simple query returns your GitHub username, the name you have defined in your profile, and your bio. The -f flag defines form variables, with query= being the GraphQL query itself. Here’s our example output: { “data”: { “viewer”: { “login”: “joshjohanning”, “name”: “Josh Johanning”, “bio”: “DevOps Architect | GitHub” } } } Running queries and mutations Basic query example Let’s try something more practical—fetching information about a repository. To get started, we’ll use the following query: gh api graphql -H X-Github-Next-Global-ID:1 -f query=’ query($owner:String!, $repo:String!) { repository(owner:$owner, name:$repo) { name description id stargazerCount forkCount issues(states:OPEN) { totalCount } } } ‘ -F owner=octocat -F repo=Hello-World The -F flag sets variable values that are referenced in the query with $variable. Here’s our example output: { “data”: { “repository”: { “name”: “Hello-World”, “description”: “My first repository on GitHub!”, “id”: “R_kgDOABPHjQ”, “stargazerCount”: 2894, “forkCount”: 2843, “issues”: { “totalCount”: 1055 } } } } 💡 Tip: The -H X-Github-Next-Global-ID:1 parameter sets an HTTP header that instructs GitHub’s GraphQL

Updated February 5, 2025: The post contains 50 new customer stories, which appear at the beginning of each section of customer lists. The post will be updated regularly with new stories. One of the highlights of my career has always been connecting with customers and partners across industries to learn how they are using technology to drive their businesses forward. In the past 30 years, we’ve seen four major platform shifts, from client server to internet and the web to mobile and cloud to now — the next major platform shift to AI.   As today’s platform shift to AI continues to gain momentum, Microsoft is working to understand just how organizations can drive lasting business value. We recently commissioned a study with IDC, The Business Opportunity of AI, to uncover new insights around business value and help guide organizations on their journey of AI transformation. The study found that for every $1 organizations invest in generative AI, they’re realizing an average of $3.70 in return — and uncovered insights about the future potential of AI to reshape business processes and drive change across industries. Check out the top 5 AI trends to watch from IDC and Microsoft Today, more than 85% of the Fortune 500 are using Microsoft AI solutions to shape their future. In working with organizations large and small, across every industry and geography, we’ve seen that most transformation initiatives are designed to achieve one of four business outcomes:   Enriching employee experiences: Using AI to streamline or automate repetitive, mundane tasks can allow your employees to dive into more complex, creative and ultimately more valuable work. Reinventing customer engagement: AI can create more personalized, tailored customer experiences, delighting your target audiences while lightening the load for employees. Reshaping business processes: Virtually any business process can be reimagined with AI, from marketing to supply chain operations to finance, and AI is even allowing organizations to go beyond process optimization and discover exciting new growth opportunities. Bending the curve on innovation: AI is revolutionizing innovation by speeding up creative processes and product development, reducing the time to market and allowing companies to differentiate in an often crowded field. In this blog, we’ve collected more than 300 of our favorite real-life examples of how organizations are embracing Microsoft’s proven AI capabilities to drive impact and shape today’s platform shift to AI. Today, we’ve added new stories of customers using our AI capabilities at the beginning of each section. We’ll regularly update this story with more. We hope you find an example or two that can inspire your own transformation journey. Enriching employee experiences Generative AI is truly transforming employee productivity and wellbeing. Our customers tell us that by automating repetitive, mundane tasks, employees are freed up to dive into more complex and creative work. This shift not only makes the work environment more stimulating but also boosts job satisfaction. It sparks innovation, provides actionable insights for better decision-making and supports personalized training and development opportunities, all contributing to a better work-life balance. Customers around the world have reported significant improvements in employee productivity with these AI solutions: New Stories: Acentra Health created MedScribe using Azure OpenAI Service. The solution has saved 11,000 nursing hours and nearly $800,000. It also helped each nurse process 20 to 30 letters daily, while achieving a 99% approval rate for MedScribe-generated letters. Brisbane Catholic Education provides Microsoft 365 Copilot to 12,500 educators, and uses Microsoft Copilot Studio to create a generative AI tool to help educators integrate Catholic traditions and values into the classroom. Crediclub saves 96% per month in auditing expenses and analyzes 150 meetings per hour with Azure AI, freeing up time for 800 sales advisors and 150 branch managers to interact directly with customers. eClinicalWorks developed a tool using Azure AI services and Azure AI Document Intelligence to help healthcare workers scan, sort and match thousands of faxes each year to match the faxed data with current patient files. Education Authority of Northern Ireland (EANI) introduced Microsoft 365 Copilot to reduce admin work, allowing teachers to focus on students. The Microsoft partnership ensures secure and ethical AI use, while teacher training focuses on prompt writing and effective tool adoption. Ma’aden uses Microsoft 365 Copilot to enhance productivity, saving up to 2,200 hours monthly. Tasks like drafting emails, creating documents and data analysis have become more efficient, helping Ma’aden achieve its growth goals. Marketing org mci group uses Microsoft 365 Copilot to enhance the use of AI and other technological advances to boost employee efficiency. Michelin deployed Microsoft 365 Copilot and a generative AI in-house chatbot based on Azure OpenAI Service called “Aurora” designed to help employees optimize work and team performance, boosting productivity tenfold. Raiffeisen Bank International built its own ChatGPT using Azure OpenAI Service to automate repetitive tasks like documenting intelligence and more rapidly summarize legal, regulation and banking documents. Sanabil Investments deployed Microsoft 365 Copilot to help employees reduce the time spent on manual everyday tasks that diverted focus from more strategic and valuable work. Within two months, approximately 70% of employees regularly used Copilot. Sensei rolled out Microsoft 365 to reduce the number of internal apps and better connect systems for easier collaboration, and is using Microsoft 365 Copilot to increase efficiency. Sikshana Foundation is working with Microsoft Research India to introduce an AI copilot for teachers that shortens preparation time for lessons from an hour or more to just minutes. The University of Hong Kong adopted Microsoft 365 Copilot to enhance productivity by automating administrative tasks and providing intelligent assistance, allowing faculty to focus more on teaching. Accenture and Avanade launched a Copilot business transformation practice, supported by Microsoft, and co-invested in new capabilities, solutions and training to help organizations securely and responsibly reinvent their business functions with generative and agentic AI and Copilot technologies. Access Holdings Plc adopted Microsoft 365 Copilot, integrating generative AI into daily tools and, as a result, writing code now takes two hours instead of eight, chatbots launch in 10 days instead

This was originally published on our developer newsletter, GitHub Insider, which offers tips and tricks for devs at every level. If you’re not subscribed, go do that now—you won’t regret it (we promise). If you’ve ever wondered which AI model is the best fit for your GitHub Copilot project, you’re not alone. Since each model has its own strengths, picking the right one can feel somewhat mysterious. Big disclaimer! AI moves fast, so these recommendations are subject to change. It’s mid-April 2025 right now, though things will probably be different within a week of posting. Zoom zoom zoom. With models that prioritize speed, depth, or a balance of both, it helps to know what each one brings to the table. Let’s break it down together. 👇 The TL;DR 💳 Balance between cost and performance: Go with GPT-4.1, GPT-4o, or Claude 3.5 Sonnet. 🪙 Fast, lightweight tasks: o4-mini or Claude 3.5 Sonnet are your buddies. 💎 Deep reasoning or complex debugging: Think Claude 3.7 Sonnet, o3, or GPT 4.5. 🖼️ Multimodal inputs (like images): Check out Gemini 2.0 Flash or GPT-4o. Your mileage may vary and it’s always good to try things yourself before taking someone else’s word for it, but this is how these models were designed to be used. All that being said… Let’s talk models. 🏎️ Putting coding speed first o4-mini and o3-mini: The speed demons 😈 Fast, efficient, and cost-effective, o4-mini and o3-mini are ideal for simple coding questions and quick iterations. If you’re looking for a no-frills model, use these. ✅ Use them for: Quick prototyping. Explaining code snippets. Learning new programming concepts. Generating boilerplate code. 👀 You may prefer another model: If your task spans multiple files or calls for deep reasoning, a higher‑capacity model such as GPT‑4.5 or o3 can keep more context in mind. Looking for extra expressive flair? Try GPT‑4o. ⚖️ AI models designed for balance Claude 3.5 Sonnet: The budget-friendly helper 😊 Need solid performance but watching your costs? Claude 3.5 Sonnet is like a dependable sidekick. It’s great for everyday coding tasks without burning through your monthly usage. ✅ Use it for: Writing documentation. Answering language-specific questions. Generating code snippets. 👀 You may prefer another model: For elaborate multi‑step reasoning or big‑picture planning, consider stepping up to Claude 3.7 Sonnet or GPT‑4.5. GPT-4o and GPT-4.1: The all-rounders 🌎 These are your go-to models for general tasks. Need fast responses? Check. Want to work with text *and* images? Double check. GPT-4o and GPT-4.1 are like the Swiss Army knives of AI models: flexible, dependable, and cost-efficient. ✅ Use them for: Explaining code blocks. Writing comments or docs. Generating small, reusable snippets. Multilingual prompts. 👀 You may prefer another model: Complex architectural reasoning or multi‑step debugging may land more naturally with GPT‑4.5 or Claude 3.7 Sonnet. 🧠 Models for deep thinking and big projects Claude 3.7 Sonnet: The architect 🏠 This one’s the power tool for large, complex projects. From multi-file refactoring to feature development across front end and back end, Claude 3.7 Sonnet shines when context and depth matter most. ✅ Use it for: Refactoring large codebases. Planning complex architectures. Designing algorithms. Combining high-level summaries with deep analysis. 👀 You may prefer another model: For quick iterations or straightforward tasks, Claude 3.5 Sonnet or GPT‑4o may deliver results with less overhead. Gemini 2.5 Pro: The researcher 🔎 Gemini 2.5 Pro is the powerhouse for advanced reasoning and coding. It’s built for complex tasks (think: deep debugging, algorithm design, and even scientific research). With its long-context capabilities, it can handle extensive datasets or documents with ease. ✅ Use it for: Writing full functions, classes, or multi-file logic. Debugging complex systems. Analyzing scientific data and generating insights. Processing long documents, datasets, or codebases. 👀 You may prefer another model: For cost-sensitive tasks, o4-mini or Gemini 2.0 Flash are more budget-friendly options. GPT-4.5: The thinker 💭 Got a tricky problem? Whether you’re debugging multi-step issues or crafting full-on systems architectures, GPT-4.5 thrives on nuance and complexity. ✅ Use it for: Writing detailed README files. Generating full functions or multi-file solutions. Debugging complex errors. Making architectural decisions. 👀 You may prefer another model: When you just need a quick iteration on something small—or you’re watching tokens—GPT‑4o can finish faster and cheaper. o3 and o1: The deep diver 🥽 These models are perfect for tasks that need precision and logic. Whether you’re optimizing performance-critical code or refactoring a messy codebase, o3 and o1 excel in breaking down problems step by step. ✅ Use them for: Code optimization. Debugging complex systems. Writing structured, reusable code. Summarizing logs or benchmarks. 👀 You may prefer another model: During early prototyping or lightweight tasks, a nimble model such as o4‑mini or GPT‑4o may feel snappier. 🖼️ Multimodal, or designed to handle it all Gemini 2.0 Flash: The visual thinker 🤔 Got visual inputs like UI mockups or diagrams? Gemini 2.0 Flash lets you bring images into the mix, making it a great choice for front-end prototyping or layout debugging. ✅ Use it for: Analyzing diagrams or screenshots. Debugging UI layouts. Generating code snippets. Getting design feedback. 👀 You may prefer another model: If the job demands step‑by‑step algorithmic reasoning, GPT‑4.5 or Claude 3.7 Sonnet will keep more moving parts in scope. So… which model do I choose? Here’s the rule of thumb: Match the model to the task. Practice really does make perfect, and as you work with different models, it’ll become clearer which ones work best for different tasks. The more I’ve personally used certain models, the more I’ve learned, “oh, I should switch for this particular task,” and “this one will get me there.” And because I enjoy staying employed, I would love to cheekily mention that you can (and should!) use these models with… GitHub Copilot in your favorite IDE GitHub Copilot on GitHub.com With agent mode or Copilot Edits With agent mode in Codespaces With agent mode in VS Code Good luck, go forth, and happy coding! Learn more about AI models. The post Which