“The standard harness costs are included inside M365 Copilot licences. Github Copilot isnt. Also github is literally owned by microsoft and is the microsoft comfort zone”
“Since then Copilot subscriptions have got much more expensive, local models have got much more powerful and getting local Copilot up and running has got much easier. So I wrote an updated guide.”
“The GitHub Rubber Ducky review is very good, and I usually run multi-modal (i.e. both Opus and Astra) for larger changes - they tend to catch different things.”
“Develop a good prompt or set of prompts, ground it in things like open source books like code complete, available on GitHub, and owasp top 10 for security, and you will end up with a surprisingly good report. I suppose the llm also has an effect.”
“Gotcha most people miss: scoping the trust policy condition to repo:org/repo:* lets any branch or PR in that repo assume the role, not just main. Use StringLike on the token.actions.githubusercontent.com:sub claim with ref:refs/heads/main, or scope to a GitHub environment instead.”
“Here's another gotcha: you don't need thumbprints at all since 2023! IAM validates [token.actions.githubusercontent.com](http://token.actions.githubusercontent.com) against its own library of trusted root CAs.”
“Adds a good bit of details in the cloudtrail logging to enable you to tie the specific action's execution directly to the actions taken in logs at the time. Reduces a lot of well i know its from one repo etc to very specifically what job it was in the repo, and what run id it came from.”
“Instead of running GitHub Actions pipeline for every Renovate PR which consumes lot of GH Actions free minutes, I usually apply all PR changes manually at once, test”
“I watched a YouTube video that said if you want to get your first job as a machine learning engineer, you should do volunteer work, especially in GitHub repositories, but I'm not entirely sure this is true, and if it is, where can I find these repositories that require this kind of work?”
“Your fallback is to make sure you can build locally. That means moving more of your logic and build steps into scripts that are called by the GitHub YAML instead of baking it directly into the YAML.”
“NVIDIA just released a repo that scans AI agent skills for security risks BEFORE you run them, which matters more than people realize now that everyone's installing random tools, skills, and MCPs from GitHub.”
“Anyone here that can explain, why the github web searches and fetch request are so slow for me? It seems like they are being rate limited really hard.”
“if you are doing environment specific deployments though upon approved PR, then you should definitely move to the next level of isolation to declare your github environments to correspond, and use those for the federated identity”
“365 subs don't include GitHub Copilot benefits, and partner subscriptions treat it as a separate benefit and not included in many of the lower subscriptions.”
“My understanding was that it is supposed to have tight integration with GitHub so that I can work on my GitHub repos. I have connected it to both my enterprise and personal account, but I am not able to browse/view my repos using any of the accounts.”
“GitHub Copilot is still managed entirely through GitHub's platform, so you still need a dedicated GitHub Copilot subscription (Individual, Business, or Enterprise) to use it in your IDE. None of the M365 perks or tokens carry over.”
“Does that mean if you have a 365 Premium subscription you can somehow utilize that with GitHub Copilot since the GitHub Copilot extra license is gone as well.”
“On each GitHub Actions / GitLab CI run the platform provides the run with a short lived JWT that contains all the info about the run. You take that, throw it at Vault, Vault verifies it's really from GH/GL, and is on an approved project/branch/committer/whatever, and then allows you access or not.”