“> A human, you can hold accountable, and you can keep them at a good security posture with short-lived session tokens.You can do this too (and better) with a repo: OIDC/Workload identity trust relationship between github and aws for short lived tokens + a github environment setup that requires manual approval.”
“So often recent breaches involve Github in one way or another. How is it still considered a sane choice to host anything proprietary there? If your business is built around open source, ok, put a mirror on Github.”
“Just signed up for strix, is it common for these type of products to want access to my Github repo's? Shouldn't the attack surface be outside them?”
“That is a classic PAT with no expiry, which GitHub still lets you create and which is still the easiest thing to reach for when you are wiring up a bot account.Secret scanning would not have caught it either.”
“I noticed significant and often discrepancy between what my local copilot reports/finds when doing code- and security- review and what I get from GiHub. This especially shows when some multi-threading C++ is involved?”
“Compared to that, my initial impression is that Copilot feels a bit lacking or less intuitive—though I realize I’m still fairly new to using AI assistants embedded in the IDE, so it’s likely a matter of setup and learning how to prompt it correctly.”
“My view is a lot of this documentation should either be generated on demand or kept fresh using scheduled GitHub actions workflows. Whenever I look at a new repo I use a skill called acquire code base knowledge.”
“And you could setup an GitHub Action (in the docs repo) that would clone all repositories you want, then make copilot update the documentation and create a PR into the documentation respotory - everything could be done as automated CI job. The action could run once a month for example.”
“I’ve been using GitHub Copilot for quite a while, and honestly, the results are usually good. I definitely couldn’t type the code that quickly myself.”
“I asked GitHub Copilot to "draw something simple but impressive" in paint over RDP using ironrdp-agent, and here's what it did. I'm not sure where this came from, but it certainly is impressive!”
“Models want to run linters, tests, etc. And that is all covered in GitHub actions. So I have been instructing agents to push a draft PR, then I validate the static checks pass and tell the agent if there are issues.Agents and AI are getting expensive, it seems silly to waste tokens on static checks.”
“yeah github scheduled workflows are notoriously flaky. had the same thing happen — switched to latchkey and at least when something breaks the ai catches it mid-run instead of me digging through logs at midnight”
“Your GitHub Actions history already knows. I wrote a prompt that reads it, names the confirmed flakes, and puts an annual dollar figure on the re-runs. Plus the usual Elixir causes to look for.”
“It seems that the code quality has become much worse in the last 5-7 days compared to before. Is this a general observation or just my own experience? It doesn’t seem to matter which model I choose - even Claude Opus 5 produces much worse code and has much bigger problems understanding our codebase compared to just a week ago.”
“You don’t understand Github Actions yet you are simultaneously somehow so comfortable with Github Actions that you are able to make a full GUI app for it?”
“The built-in label is expected on current VS Code. Copilot Chat now ships with VS Code, so you update it by updating VS Code itself rather than uninstalling that extension.”
“I went to download github copilot chat but it says that it is already installed and its a built in extension so i'm not allowed to update it, remove it or change it in anyway which means it just doesn't work at all. Anyone know how to fix this?”
“you could actually say it is an issue with github. I've had to deal with this issue myself. I went through your repo and saw that you've made commits to the repo recently and you have just one branch which is also the default branch.”
“The “Save” action—a separate button (the “Publish” button also triggers the “Save” action first)—however, GHC allows you to create and, more importantly, test an agent (even testing consumes Copilot credits) even before saving the agent.”
“I desperately need a way to just outright block Github Copilot Harness. The amount of people that message me each week after they have started to build an agent to then be hit with the no credit capacity block.”