Browse DevOps News (302)

Natalie Guevara explains how “agentic” workflows change day-to-day development: developers don’t just write code, they design the delivery system around it. The article outlines a practical GitHub-centered flow where Copilot-driven agent work is triggered by repo events and validated through CI, reviews, and branch protections.

Harshada Hole introduces first-class Git submodule support in Visual Studio 18.9, showing how submodules now appear in the Git UI and how you can add, update, and remove them without switching to a terminal.

Allison announces a GitHub notifications change: custom thread subscription settings are being removed, and existing custom subscriptions will be converted to “Subscribed,” which may increase notification volume for affected threads.

Allison announces a GitHub Enterprise update that lets enterprise owners install public third-party GitHub Apps directly on an enterprise account, enabling new enterprise management integrations while keeping access scoped away from orgs and repos unless explicitly granted.

Allison announces updates to GitHub Issues and Projects: a new “Relates to” issue relationship in public preview, plus generally available multi-select fields with improvements for grouping, editing from sidebars, copy/paste, and clearing values.

Allison announces updates to GitHub secret scanning, including a new partner (Lovable Labs), more secret types blocked by push protection by default, and richer alert context via extended metadata to help teams assess ownership and impact faster.

Allison explains a GitHub Code Quality change: enabling Code Quality no longer creates a ruleset that automatically requests GitHub Copilot code review on pull requests, and existing auto-created rulesets have had those settings turned off.

Allison announces a GitHub organization setting that lets maintainers centrally limit how many open pull requests a user without write access can have at once, helping enforce consistent contribution policies across all repositories.

Amaury Levé explains how Microsoft.Testing.Platform (MTP) reporting helps teams move from a failing CI build to actionable evidence, with inline annotations in GitHub Actions and Azure DevOps, Azure DevOps-only history-based flaky/regression triage, crash-resilient TRX output, and multiple report formats for both humans and automation.

Ankit Kumar Honey explains how GitHub expanded Dependabot malware advisories from npm to eight package ecosystems by ingesting OpenSSF’s malicious-packages data into the GitHub Advisory Database, including the validation, normalization, deduplication, and safety controls used to keep auto-published advisories resilient.

Mike Hulme explains why Microsoft was named a Leader in Gartner’s 2026 Magic Quadrant for AI-augmented code modernization tools, and outlines how GitHub Copilot modernization and Azure are positioned to assess, upgrade, and migrate legacy applications with agentic workflows while keeping developers in control.

Dan Hellem announces a small Azure Boards update that shows pull request annotations directly on work item cards, so teams can see code review activity and PR status without leaving the Kanban board or opening individual work items.

Eric van Wijk introduces the new Azure DevOps service connection, which lets pipelines authenticate to Azure DevOps using a Microsoft Entra workload identity (service principal or managed identity) instead of PATs or build session tokens, and shows where and how to use it across YAML, tasks, and scripts.

Dan Hellem announces the general availability of the Azure DevOps Remote MCP Server, explaining how AI assistants can securely connect to Azure DevOps via a hosted endpoint. The post covers the minimal mcp.json setup, Entra ID authentication requirements, current client support, and when to use the local MCP server instead.

The Visual Studio Code Team shares the 1.133 Insiders release notes, highlighting a change for extension authors: custom editor extensions can now set different default priorities for normal editing versus diff views, improving how custom editors behave when comparing files.

Microsoft Security Research, Ravikant Tiwari, Sagar Patil and Suriyaraj Natarajan break down ChainDrop, a large-scale npm supply chain compromise that used a Bun-based, self-propagating worm to steal credentials from developer machines and CI/CD runners, then republish infected packages. The post includes mitigation steps, IOCs, and Defender XDR hunting queries.

Allison announces a new way to customize GitHub code scanning default setup using a repository property, enabling teams to apply a shared CodeQL configuration across one repo or an entire organization without maintaining per-repo GitHub Actions workflows.

Ron Pessner announces updates to Microsoft’s Zero Trust for AI approach, including new AI-focused checks in the Zero Trust Assessment, a DevSecOps pillar in the Zero Trust Workshop, and a companion e-book with practical patterns for securing AI agents, AI memory, and the software supply chain.

Julia Muiruri explains how to turn a single, oversized AI-generated pull request into a clean stack of smaller PRs using GitHub stacked pull requests and the gh-stack CLI, with a practical example and reviewer-focused guidance for keeping CI and merge rules working across the whole stack.

Allison announces new Dependabot configuration options that let you control the branch names created for dependency update pull requests, including prefixes, maximum length, separators, letter casing, and custom templates—useful for CI/CD naming constraints and for keeping monorepo branches easier to identify.

Allison announces a public preview feature in GitHub Code Quality that can generate a code coverage workflow with AI from repository settings, opening a pull request for review before you merge.

Allison summarizes the CodeQL 2.26.2 release for GitHub code scanning, including new language support (Swift 6.3.3 and Kotlin 2.4.10), query behavior changes that may surface more findings, and a breaking change affecting how query authors embed links in alert messages.

Allison announces a GitHub Copilot Enterprise governance update that lets enterprise admins target managed settings to specific enterprise teams using itemized configuration files, so large orgs can scale guardrails while still letting teams tailor Copilot within defined boundaries.

.NET Team announces upcoming NuGet.org publishing security changes: new API keys will be capped at 30 days starting August 17, 2026, and older keys will expire on November 1, 2026. The post explains the supply-chain risk of long-lived secrets and recommends migrating to NuGet Trusted Publishing using OIDC.

Allison announces a GitHub update that lets users with the triage role create issues even when a repository restricts issue creation to collaborators only, making it easier for trusted contributors to help with intake and ongoing repository maintenance.

Allison announces general availability of GitLab-to-GitHub migrations using GitHub Enterprise Importer, including a self-serve GitHub CLI extension for single-repo and bulk migrations, plus options for staging migration archives in GitHub storage, AWS S3, or Azure Blob Storage.

Allison announces a security change for npm: granular access tokens configured to bypass 2FA can no longer perform sensitive account, org, and package-management actions without an interactive 2FA challenge, and automated publishing should move to trusted or staged publishing.

Alexander Neubeck explains how GitHub sped up Unicode case folding for code search by removing early-exit branches, enabling SIMD vectorization, and using byte-space arithmetic to avoid UTF-8 decode/encode work. The post also covers allocation-avoidance techniques and a compact lookup-table design for fast “does this fold?” checks.

Amaury Levé introduces an open-source polyglot unit-test generation agent that learns a repo’s conventions, writes tests, and validates they build and run in the project’s normal test workflow. The post explains the agent’s research/plan/execute/check loop, shows benchmark results versus stock Copilot, and includes setup commands for Copilot CLI and VS Code.

Kristen Womack’s July 2026 roundup for Azure Developer CLI (azd) summarizes releases 1.27.0 through 1.29.0, including new extension install options, a full tool uninstall workflow, Azure AI Foundry resource modeling in azure.yaml, container deployments to Azure App Service, and CI-friendly non-interactive behavior plus a breaking flag rename.

Allison announces a GitHub Actions update that lets workflows reference actions and reusable workflows in the same repository using a new $/ prefix, avoiding an explicit checkout and keeping internal references aligned with the exact commit being executed.

Cassidy Williams shows how she used the GitHub Copilot app to modernize an old React codebase by splitting work into stacked sessions and stacked pull requests, keeping changes reviewable while iterating on plans, branching strategy, and dependency upgrades.

Allison announces GitHub stacked pull requests in public preview, a workflow for breaking large changes into an ordered series of smaller PRs that can be reviewed independently and merged together, while still respecting existing checks, reviews, and branch protections.

Allison summarizes the July 2026 GitHub Copilot updates in Visual Studio Code (v1.127–v1.131), focusing on the Agents window workflow, multi-chat sessions, model and chat controls (including Copilot Vision and BYOK), plus editor, terminal, browser, and accessibility improvements.

Allison announces general availability for Copilot code review support for agent skills and MCP server connections, enabling teams to bring internal standards and external context into reviews. The update includes attribution on generated comments and outlines where to configure MCP servers and store tokens in repository settings.

murray-kp rounds up the July 2026 Microsoft Fabric updates across CI/CD and Git integration, OneLake governance, Spark runtime and diagnostics, lakehouse and warehouse features, and Real-Time Intelligence improvements including Eventstream security and new connectors.

Bruno Borges explains how to reduce Dependabot pull request noise without slowing down vulnerability fixes, using Microsoft’s GCToolkit repo as an example. The post shows how to group version updates, move to a monthly cadence, cover all ecosystems you use, and tune the new default “cooldown” window for safer upgrades.

The Visual Studio Code Team shares the evolving release notes for VS Code 1.132 (Insiders), with links to the commit log and closed issues so developers can track what’s landing as features are added throughout the iteration.

Allison summarizes what’s new in CodeQL 2.26.1 for GitHub code scanning, including expanded framework modeling across Go, Java/Kotlin, and JavaScript/TypeScript, plus query updates that reduce false positives and improve detection for issues like SSRF, path injection, and hard-coded cryptographic values.

Allison announces npm publish-time malware scanning and explains how it can delay package availability, when publishes may be held or blocked, and how maintainers can declare dual-use security functionality using new package metadata and a required DISCLOSURE file.