Browse All DevOps Content (767)

Visual Studio Code introduces the VS Code Learn extension, aimed at making it easier to get started with agentic development workflows inside VS Code.

Allison announces general availability of GitHub Code Quality for GitHub Enterprise Cloud and GitHub Team, combining deterministic CodeQL analysis with AI-assisted detection and Copilot Autofix to flag maintainability and reliability issues in pull requests, plus new org-level dashboards, coverage reporting, ruleset-based quality gates, and APIs.

John Edward outlines practical Azure architecture best practices for enterprise applications, covering the Azure Well-Architected Framework, scalability and high availability patterns, security with Zero Trust, observability, infrastructure as code, CI/CD, cost controls, networking, disaster recovery, and governance.

This week's DevOps roundup centers on tightening the software supply chain and pulling security and AI tooling into the same governed, review-first workflows teams already use. We cover the AsyncAPI npm compromise and the concrete CI/CD misconfiguration pattern behind it, plus new GitHub guardrails in Dependabot and secret scanning that help reduce exposure. On the platform side, Azure content focused on repeatable operating models for Kubernetes and AI, with practical updates in edge programmability and storage metrics. We also look at how enterprises can measure, control, and test AI agents like production software, from PR-visible detections and agentic autofix to load testing, deterministic evaluation, and AI gateway enforcement.

Allison announces general availability of repository-level GitHub Copilot usage metrics via the Copilot usage metrics REST API, enabling daily per-repository reporting for Copilot coding agent and Copilot code review pull request activity across enterprises and organizations.

Allison announces new controls for GitHub Copilot code review, including reading custom instructions from the PR head branch, expanded instruction file support, repository-level setup steps via a workflow YAML, and a default-on firewall with separate configuration from Copilot cloud agent.

Allison announces a GitHub Mobile improvement that lets you start “Fix with Copilot” directly from Copilot code review pull request comments, making it quicker to address review feedback from a phone while keeping PRs moving.

GitHub demonstrates how to onboard the GitHub Copilot for Jira integration, including installing the app from the Atlassian Marketplace, authorizing access, handling SSO, and enabling organizations so Copilot can turn a Jira work item into a draft pull request.

Dalia Abuadas argues that in an AI-assisted workflow, writing the first patch is often no longer the expensive part—reviewing, validating, and owning the change is. She proposes using a constrained “price check” patch to replace long scope debates with evidence from a real diff and tests.

Elliot Volkman shares Microsoft Security’s Black Hat USA 2026 agenda, focused on how attackers abuse “trust paths” across software supply chains, identities, cloud services, and AI systems. The post highlights sessions on npm supply chain campaigns, Azure Automation research, GitHub-focused detection ideas, and hands-on skilling with Defender and Sentinel.

VimalVerma outlines Hypervelocity Engineering (HVE) as an operating model for building and continuously evolving Azure AI Landing Zones, with a focus on platform engineering, Infrastructure as Code, Policy as Code, and security-by-design so enterprise AI platforms can scale without losing governance.

Visual Studio Code shows how to give GitHub Copilot more context by sharing your running website through VS Code’s Integrated Browser, so Copilot can reference what you’re seeing while you work.

Francesco Bonacci joins GitHub’s Open Source Friday to talk about Cua and the project’s open-source work in the GitHub ecosystem.

Waldek Mastykarz explains how to evaluate agent skills that call APIs without paying for test traffic or mutating production data. He outlines why direct evals against real endpoints create cost, state, and non-determinism problems, then shows a proxy-based approach using Dev Proxy to emulate APIs while keeping production URLs unchanged.

Hidde de Smet audits a local SKILL.md “skills” library spread across Claude Code, a shared .agents catalog, and GitHub Copilot’s VS Code setup, showing how silent failures (missing files, duplicates, stale references) accumulate over time and how to stocktake them with a checklist and a couple of shell one-liners.

Allison announces that GitHub Projects views now support advanced search in the filter bar, enabling boolean AND/OR expressions to build more precise views. The update also adds a reviews: filter for PR items and introduces a 90-day retention policy for deployment statuses in the REST and GraphQL APIs.

Allison announces a GitHub update that lets repository admins archive pull requests so they’re removed from public view without being deleted. The post explains what happens when a PR is archived (closed and locked), how visibility changes for non-admins, and how to find archived PRs during triage.

Allison announces new GitHub Enterprise Cloud REST API endpoints that let enterprise admins manage Visual Studio Subscription (VSS) assignments in bulk, including listing assignments, mapping UPNs to GitHub handles, and removing incorrect matches—useful when SCIM identities don’t align with VSS UPN formats.

Allison announces a public preview GitHub Actions runner image for Xcode 27 on GitHub-hosted macOS runners, including the new Xcode-version-based support model, the workflow labels to target the image, and current limitations around arm64-only availability.

Ruben Rios announces a preview of Private Marketplace support in Visual Studio, aimed at organizations that need tighter control over how developers discover and install extensions for security, compliance, and governance reasons.

Visual Studio Code runs through the five most popular VS Code extensions in 2026 so far, highlighting what developers are installing to improve their day-to-day workflow inside the editor.

Suma SaganeGowda explains how Microsoft 365 built COSMIC, an internal platform layer on Azure Kubernetes Service (AKS), to standardize provisioning, deployments, security/compliance guardrails, and observability across globally distributed services so product teams can ship faster without taking on Kubernetes operational overhead.

Microsoft Security Research, Ravikant Tiwari, Sagar Patil, Suriyaraj Natarajan and Arvind Gowda break down a coordinated compromise of the @asyncapi npm organization, where attackers abused a misconfigured GitHub Actions workflow and trusted publishing to ship import-time malware, and they provide concrete indicators, hunting queries, and remediation steps.

Allison summarizes new GitHub secret scanning and public monitoring improvements, including new partner detectors, expanded push protection defaults, a new webhook field to distinguish secret categories, and additional insight cards to help enterprises understand leak attribution and exposure scope.

The Visual Studio Code Team shares the evolving release notes for VS Code 1.130 (Insiders), with links to the commit log and closed issues so developers can track what’s landing in the build as features are added.

Polly Davidson lays out a beginner-friendly roadmap for learning GitHub, from core Git concepts and essential commands to day-to-day collaboration with pull requests, issues, and projects. It also introduces GitHub Actions for CI/CD, GitHub Pages for publishing, and practical security basics like 2FA, secret scanning, Dependabot, and CodeQL.

Visual Studio Code shares quick tips for using the integrated terminal inside VS Code to speed up common command-line tasks without leaving the editor.

GitHub compiles its GitHub for Beginners Season 3 into a single crash course covering core GitHub workflows: planning work with Issues and Projects, automating CI/CD with GitHub Actions, using built-in security features, publishing with GitHub Pages, writing Markdown, and making first open source contributions.

alyssaschimm announces a public preview in Azure Monitor that adds advanced platform metrics for Azure Storage, giving container-level visibility into blob capacity and blob count so teams can investigate growth drivers, set better alerts, and improve cost and capacity planning without building custom reporting pipelines.

Krishna Roy shows how to load test Copilot Studio agents by simulating real multi-turn conversations over Direct Line (HTTP + WebSockets) with Locust, then running the same workload in Azure Load Testing. The post covers measuring TTFB vs full turn completion, handling turn.complete, file uploads, and secret handling with Key Vault.

Thomas Maurer explains what AKS on bare metal is and where it fits for on-premises, edge, and sovereign deployments, focusing on how it keeps the AKS experience while running directly on physical hardware. He also outlines a deployment path using Azure Local SFF with Arc-based management.

Allison summarizes the June 2026 GitHub Copilot update for Visual Studio 2026, focusing on new usage tracking and alerts, a trust validation layer for MCP servers, and Copilot features that tie into pull request workflows and C++ modernization.

hetvip explains how to use Apache Airflow as an orchestrator for Azure Container Apps (ACA) Jobs, enabling dependency ordering, parallel fan-out, and per-task retries. The post introduces two open-source templates and a shared Airflow operator that triggers ACA Job executions via the ACA Jobs API.

Allison announces a public preview feature where GitHub code scanning surfaces AI-powered security detections directly on pull requests, helping teams catch issues in languages and frameworks that don’t have native CodeQL coverage. The update explains what’s included, how it runs, enablement requirements, and how billing works via AI credits.

akhilkarmalkar announces Azure Front Door edge actions (public preview), a way to run lightweight JavaScript during request processing at Microsoft’s global edge. The post explains where edge actions run in the Front Door pipeline, what scenarios they enable (routing, headers, auth checks), and how Hyperlight micro-VM isolation is used to keep execution secure.

Simona Liao, Wendy Breiding, and Yun Jung Choi introduce Visual Studio 18.8’s built-in Agent Skills, a set of reusable Copilot capabilities for common .NET and Azure tasks. The post explains where to find and enable skills, why they’re off by default, and highlights starter skills for API work, performance reviews, Azure deployments, and Kusto queries.

Allison announces a new default safety behavior in Dependabot: version update pull requests will wait three days after a release appears in its registry, reducing the risk of immediately adopting compromised or broken dependency releases while keeping security updates immediate.

Erik Ejlskov Jensen presents SQL Database Project Power Tools, focusing on improving the day-to-day workflow for SQL Database Projects by extending the tooling developers use in Visual Studio and SQL Server Management Studio (SSMS).

Visual Studio Code shows how to run language models locally in VS Code using the Ollama extension, including configuring custom models, bring-your-own-key providers, and utility model settings, with an emphasis on keeping processing private on your machine.

Lee Stott tours Microsoft’s open-source course on taking AI agents from prototype to production using Microsoft Agent Framework and Microsoft Foundry, covering agent design, multi-agent orchestration, evaluation, deployment, data sovereignty, and tool governance with concrete commands and code patterns.