Congratulations!

[Valid RSS] This is a valid RSS feed.

Recommendations

This feed is valid, but interoperability with the widest range of feed readers could be improved by implementing the following recommendations.

Source: https://github.blog/feed/

  1. <?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
  2. xmlns:content="http://purl.org/rss/1.0/modules/content/"
  3. xmlns:wfw="http://wellformedweb.org/CommentAPI/"
  4. xmlns:dc="http://purl.org/dc/elements/1.1/"
  5. xmlns:atom="http://www.w3.org/2005/Atom"
  6. xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
  7. xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
  8. >
  9.  
  10. <channel>
  11. <title>The GitHub Blog</title>
  12. <atom:link href="https://github.blog/feed/" rel="self" type="application/rss+xml" />
  13. <link>https://github.blog/</link>
  14. <description>Updates, ideas, and inspiration from GitHub to help developers build and design software.</description>
  15. <lastBuildDate>Wed, 16 Jul 2025 21:06:18 +0000</lastBuildDate>
  16. <language>en-US</language>
  17. <sy:updatePeriod>
  18. hourly </sy:updatePeriod>
  19. <sy:updateFrequency>
  20. 1 </sy:updateFrequency>
  21. <generator>https://wordpress.org/?v=6.8.2</generator>
  22.  
  23. <image>
  24. <url>https://github.blog/wp-content/uploads/2019/01/cropped-github-favicon-512.png?fit=32%2C32</url>
  25. <title>The GitHub Blog</title>
  26. <link>https://github.blog/</link>
  27. <width>32</width>
  28. <height>32</height>
  29. </image>
  30. <site xmlns="com-wordpress:feed-additions:1">153214340</site> <item>
  31. <title>GitHub Availability Report: June 2025</title>
  32. <link>https://github.blog/news-insights/company-news/github-availability-report-june-2025/</link>
  34. <dc:creator><![CDATA[Natalie Guevara]]></dc:creator>
  35. <pubDate>Wed, 16 Jul 2025 21:06:17 +0000</pubDate>
  36. <category><![CDATA[Company news]]></category>
  37. <category><![CDATA[News & insights]]></category>
  38. <category><![CDATA[GitHub Availability Report]]></category>
  39. <guid isPermaLink="false">https://github.blog/?p=89594</guid>
  40.  
  41. <description><![CDATA[<p>In June, we experienced three incidents that resulted in degraded performance across GitHub services.</p>
  42. <p>The post <a href="https://github.blog/news-insights/company-news/github-availability-report-june-2025/">GitHub Availability Report: June 2025</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  43. ]]></description>
  44. <content:encoded><![CDATA[
  45. <p>In June, we experienced three incidents that resulted in degraded performance across GitHub services.</p>
  46.  
  47.  
  48.  
  49. <p><strong>June 5 17:47 UTC (lasting 1 hour and 33 minutes)</strong></p>
  50.  
  51.  
  52.  
  53. <p>On June 5, 2025, between 17:47 UTC and 19:20 UTC, the Actions service was degraded, leading to run start delays and intermittent job failures. During this period, 47.2% of runs had delayed starts of 14 minutes on average, and 21.0% of runs failed. The impact extended beyond Actions itself; 60% of Copilot Coding Agent sessions were cancelled, and all Pages sites using branch-based builds failed to deploy (though Pages serving remained unaffected). The issue was caused by a spike in load between internal Actions services exposing a misconfiguration that caused throttling of requests in the critical path of run starts. We mitigated the incident by correcting the service configuration to prevent throttling and have updated our deployment process to ensure the correct configuration is preserved moving forward.</p>
  54.  
  55.  
  56.  
  57. <p><strong>June 12 17:55 UTC (lasting 3 hours and 12 minutes)</strong></p>
  58.  
  59.  
  60.  
  61. <p>On June 12, 2025, between 17:55 UTC and 21:07 UTC, the GitHub Copilot service was degraded and experienced unavailability for Gemini models and reduced availability for Claude models. Users experienced significantly elevated error rates for chat completions, slow response times, timeouts, and chat functionality interruptions across VS Code, JetBrains IDEs, and GitHub Copilot Chat. This was due to an outage affecting one of our model providers.</p>
  62.  
  63.  
  64.  
  65. <p>We mitigated the incident by temporarily disabling the affected provider endpoints to reduce user impact.</p>
  66.  
  67.  
  68.  
  69. <p>We are working to update our incident response playbooks for infrastructure provider outages and improve our monitoring and alerting systems to reduce our time to detection and mitigation of issues like this one in the future.</p>
  70.  
  71.  
  72.  
  73. <p><strong>June 17 19:32 UTC (lasting 31 minutes)</strong></p>
  74.  
  75.  
  76.  
  77. <p>On June 17, 2025, between 19:32 UTC and 20:03 UTC, an internal routing policy deployment to a subset of network devices caused reachability issues for certain network address blocks within our datacenters. Authenticated users of the github.com UI experienced 3-4% error rates for the duration of the incident. Authenticated callers of the API experienced 40% error rates. Unauthenticated requests to the UI and API experienced nearly 100% error rates. Actions experienced 2.5% of runs being delayed for an average of 8 minutes and 3% of runs failing. Large File Storage (LFS) requests experienced 1% errors. At 19:54 UTC, the deployment was rolled back, and network availability for the affected systems was restored. At 20:03 UTC, we fully restored normal operations. To prevent similar issues, we are expanding our validation process for routing policy changes.</p>
  78.  
  79.  
  80.  
  81. <hr class="wp-block-separator has-alpha-channel-opacity"/>
  82.  
  83.  
  84.  
  85. <p>Please follow our <a href="https://www.githubstatus.com/">status page</a> for real-time updates on status changes and post-incident recaps. To learn more about what we’re working on, check out the <a href="https://github.blog/category/engineering/">GitHub Engineering Blog</a>.</p>
  86. <p>The post <a href="https://github.blog/news-insights/company-news/github-availability-report-june-2025/">GitHub Availability Report: June 2025</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  87. ]]></content:encoded>
  91. <post-id xmlns="com-wordpress:feed-additions:1">89594</post-id> </item>
  92. <item>
  93. <title>How to catch GitHub Actions workflow injections before attackers do</title>
  94. <link>https://github.blog/security/vulnerability-research/how-to-catch-github-actions-workflow-injections-before-attackers-do/</link>
  96. <dc:creator><![CDATA[Dylan Birtolo]]></dc:creator>
  97. <pubDate>Wed, 16 Jul 2025 16:00:00 +0000</pubDate>
  98. <category><![CDATA[Security]]></category>
  99. <category><![CDATA[Vulnerability research]]></category>
  100. <category><![CDATA[code scanning]]></category>
  101. <category><![CDATA[CodeQL]]></category>
  102. <guid isPermaLink="false">https://github.blog/?p=89525</guid>
  103.  
  104. <description><![CDATA[<p>Strengthen your repositories against actions workflow injections — one of the most common vulnerabilities.</p>
  105. <p>The post <a href="https://github.blog/security/vulnerability-research/how-to-catch-github-actions-workflow-injections-before-attackers-do/">How to catch GitHub Actions workflow injections before attackers do</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  106. ]]></description>
  107. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  108. <html><body><p>You already know that security is important to keep in mind when creating code and maintaining projects. Odds are, you also know that it&rsquo;s much easier to think about security from the ground up rather than trying to squeeze it in at the end of a project.</p>
  109.  
  110.  
  111.  
  112. <p>But did you know that GitHub Actions injections are one of the most common vulnerabilities in projects stored in GitHub repositories? Thankfully, this is a relatively easy vulnerability to address, and GitHub has some tools to make it even easier.</p>
  113.  
  114.  
  115.  
  116. <figure class="wp-block-image size-full"><img data-recalc-dims="1" fetchpriority="high" decoding="async" width="768" height="768" src="https://github.blog/wp-content/uploads/2025/07/vulnerabilities.png?resize=768%2C768" alt="A bar chart detailing the most common vulnerabilities found by CodeQL in 2024. In order from most to least, they are: injection, broken access control, insecure design, cryptographic failures, identification and authentication failures, security misconfigurations, software and data integrity failures, security logging and monitoring failures, server side request forgery, and vulnerable and outdated components." class="wp-image-89527" srcset="https://github.blog/wp-content/uploads/2025/07/vulnerabilities.png?w=768 768w, https://github.blog/wp-content/uploads/2025/07/vulnerabilities.png?w=150 150w, https://github.blog/wp-content/uploads/2025/07/vulnerabilities.png?w=300 300w, https://github.blog/wp-content/uploads/2025/07/vulnerabilities.png?w=600 600w, https://github.blog/wp-content/uploads/2025/07/vulnerabilities.png?w=400 400w, https://github.blog/wp-content/uploads/2025/07/vulnerabilities.png?w=200 200w, https://github.blog/wp-content/uploads/2025/07/vulnerabilities.png?w=90 90w, https://github.blog/wp-content/uploads/2025/07/vulnerabilities.png?w=116 116w" sizes="(max-width: 768px) 100vw, 768px" /><figcaption class="wp-element-caption"><em>From the 2024 Octoverse report detailing the most common types of OWASP-classified vulnerabilities identified by CodeQL in 2024. Our latest data shows a similar trend, highlighting the continued risks of injection attacks despite continued warnings for several decades.</em></figcaption></figure>
  117.  
  118.  
  119.  
  120. <h2 class="wp-block-heading" id="h-embracing-a-security-mindset">Embracing a security mindset</h2>
  121.  
  122.  
  123.  
  124. <p>The truth is that security is not something that is ever &ldquo;done.&rdquo; It&rsquo;s a continuous process, one that you need to keep focusing on to help keep your code safe and secure. While automated tools are a huge help, they&rsquo;re not an all-in-one, fire-and-forget solution.</p>
  125.  
  126.  
  127.  
  128. <p>This is why it&rsquo;s important to understand the causes behind security vulnerabilities as well as how to address them. No tool will be 100% effective, but by increasing your understanding and deepening your knowledge, you will be better able to respond to threats.&nbsp;</p>
  129.  
  130.  
  131.  
  132. <p>With that in mind, let&rsquo;s talk about one of the most common vulnerabilities found in GitHub repositories.</p>
  133.  
  134.  
  135.  
  136. <h2 class="wp-block-heading" id="h-explaining-actions-workflow-injections">Explaining actions workflow injections</h2>
  137.  
  138.  
  139.  
  140. <p>So what exactly is a GitHub Actions workflow injection? This is when a malicious attacker is able to submit a command that is run by a <a href="https://docs.github.com/actions/writing-workflows/about-workflows">workflow</a> in your repository. This can happen when an attacker controls the data, such as when they create an issue title or a branch name, and you execute that untrusted input. For example, you might execute it in the run portion of your workflow.</p>
  141.  
  142.  
  143.  
  144. <p>One of the most common causes of this is with the <code>${{}}</code> syntax in your code. In the preprocessing step, this syntax will automatically expand. That expansion may alter your code by inserting new commands. Then, when the system executes the code, these malicious commands are executed too.</p>
  145.  
  146.  
  147.  
  148. <p>Consider the following workflow as an example:</p>
  149.  
  150.  
  151.  
  152. <pre class="wp-block-code language-plaintext"><code>- name: print title
  153.  run: echo "${{ github.event.issue.title }}"</code></pre>
  154.  
  155.  
  156.  
  157. <p>Let&rsquo;s assume that this workflow is triggered whenever a user creates an issue. Then an attacker can create an issue with malicious code in the title, and the code will be executed when this workflow runs. The attacker only needs to do a small amount of trickery such as adding backtick characters to the title: <code>touch pwned.txt</code>. Furthermore, this code will run using the permissions granted to the workflow, permissions the attacker is otherwise unlikely to have.</p>
  158.  
  159.  
  160.  
  161. <p>This is the root of the actions workflow injection. The biggest issues with actions workflow injections are awareness that this is a problem and finding all the instances that could lead to this vulnerability.</p>
  162.  
  163.  
  164.  
  165. <h2 class="wp-block-heading" id="how-to-proactively-protect-your-code">How to proactively protect your code</h2>
  166.  
  167.  
  168.  
  169. <p>As stated earlier, it&rsquo;s easier to prevent a vulnerability from appearing than it is to catch it after the fact. To that end, there are a few things that you should keep in mind while writing your code to help protect yourself from actions workflow injections.</p>
  170.  
  171.  
  172.  
  173. <p>While these are valuable tips, remember that even if you follow all of these guidelines, it doesn&rsquo;t guarantee that you&rsquo;re completely protected.</p>
  174.  
  175.  
  176.  
  177. <h3 class="wp-block-heading" id="use-environment-variables">Use environment variables</h3>
  178.  
  179.  
  180.  
  181. <p>Remember that the actions workflow injections happen as a result of expanding what should be treated as untrusted input. When it is inserted into your workflow, if it contains malicious code, it changes the intended behavior. Then when the workflow triggers and executes, the attacker&rsquo;s code runs.<br>One solution is to avoid using the <code>${{}}</code> syntax in workflow sections like <code>run</code>. Instead, expand the untrusted data into an environment variable and then use the environment variable when you are running the workflow. If you consider our example above, this would change to the following.</p>
  182.  
  183.  
  184.  
  185. <pre class="wp-block-code language-plaintext"><code>- name: print title
  186.  env:
  187.    TITLE: ${{ github.event.issue.title }}
  188.  run: echo "$TITLE"</code></pre>
  189.  
  190.  
  191.  
  192. <p>This won&rsquo;t make the input trusted, but it will help to protect you from some of the ways attackers could take advantage of this vulnerability. We encourage you to do this, but still remember that this data is untrusted and could be a potential risk.</p>
  193.  
  194.  
  195.  
  196. <h3 class="wp-block-heading" id="the-principle-of-least-privilege-is-your-best-friend">The principle of least privilege is your best friend</h3>
  197.  
  198.  
  199.  
  200. <p>When an actions workflow injection triggers, it runs with the permissions granted to the workflow. You can specify what permissions workflows have by <a href="https://docs.github.com/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token#defining-access-for-the-github_token-permissions">setting the permissions for the workflow&rsquo;s GITHUB_TOKEN</a>. For this reason, it&rsquo;s important to make sure that your workflows are only running with the lowest privilege levels they need in order to perform duties. Otherwise, you might be giving an attacker permissions you didn&rsquo;t intend if they manage to inject their code into your workflow.</p>
  201.  
  202.  
  203.  
  204. <h3 class="wp-block-heading" id="be-cautious-with-pull_request_target">Be cautious with <code>pull_request_target</code></h3>
  205.  
  206.  
  207.  
  208. <p>The impact is usually much more devastating when injection happens in a workflow that is triggered on <code>pull_request_target</code> than on <code>pull_request</code>. There is a significant difference between the <code>pull_request</code> and <code>pull_request_target</code> workflow triggers.</p>
  209.  
  210.  
  211.  
  212. <p>The <code>pull_request</code> workflow trigger prevents write permissions and secrets access on the target repository by default when it&rsquo;s triggered from a fork. Note that when the workflow is triggered from a branch in the same repository, it has access to secrets and potentially has write permissions. It does this in order to help prevent unauthorized access and protect your repository.</p>
  213.  
  214.  
  215.  
  216. <p>By contrast, the <code>pull_request_target</code> workflow trigger gives the workflow writer the ability to release some of the restrictions. While this is important for some scenarios, it does mean that by using <code>pull_request_target</code> instead of <code>pull_request</code>, you are potentially putting your repository at a greater risk.</p>
  217.  
  218.  
  219.  
  220. <p>This means you should be using the <code>pull_request</code> trigger unless you have a very specific need to use <code>pull_request_target</code>. And if you are using the latter, you want to take extra care with the workflow given the additional permissions.</p>
  221.  
  222.  
  223.  
  224. <h2 class="wp-block-heading" id="the-problems-not-just-on-main">The problem&rsquo;s not just on main</h2>
  225.  
  226.  
  227.  
  228. <p>It&rsquo;s not uncommon to create several branches while developing your code, often for various features or bug fixes. This is a normal part of the software development cycle. And sometimes we&rsquo;re not the best at remembering to close and delete those branches after merging or after we&rsquo;ve finished working with them. Unfortunately, these branches are still a potential vulnerability if you&rsquo;re using the <code>pull_request_target</code> trigger.</p>
  229.  
  230.  
  231.  
  232. <p>An attacker can target a workflow that runs on a pull request in a branch, and still take advantage of this exploit. This means that you can&rsquo;t just assume your repository is safe because the workflows against your <code>main</code> branch are secure. You need to review all of the branches that are publicly visible in your repository.</p>
  233.  
  234.  
  235.  
  236. <h2 class="wp-block-heading" id="what-codeql-brings-to-the-table">What CodeQL brings to the table</h2>
  237.  
  238.  
  239.  
  240. <p><a href="https://codeql.github.com/">CodeQL</a> is GitHub&rsquo;s code analysis tool that provides automated security checks against your code. The specific feature of CodeQL that is most relevant here is <a href="https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql">the code scanning feature</a>, which can provide feedback on your code and help identify potential security vulnerabilities. We recently <a href="https://github.blog/changelog/2025-04-22-github-actions-workflow-security-analysis-with-codeql-is-now-generally-available/">made the ability to scan GitHub Actions workflow files generally available</a>, and you can use this feature to look for several types of vulnerabilities, such as potential actions workflow injection risks.&nbsp;</p>
  241.  
  242.  
  243.  
  244. <p>One of the reasons CodeQL is so good at finding where untrusted data might be used is because of taint tracking. We <a href="https://github.blog/security/application-security/how-to-secure-your-github-actions-workflows-with-codeql/#taint-tracking-is-key">added taint tracking to CodeQL</a> for actions late last year. With taint tracking, CodeQL tracks where untrusted data flows through your code and identifies potential risks that might not be as obvious as the previous examples.</p>
  245.  
  246.  
  247.  
  248. <p>Enabling CodeQL to scan your actions workflows is as easy as <a href="https://docs.github.com/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning">enabling CodeQL code scanning with the default setup</a>, which automatically includes analyzing actions workflows and will run on any <a href="https://docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches">protected branch</a>. You can then check for the code scanning results to identify potential risks and start fixing them.&nbsp;</p>
  249.  
  250.  
  251.  
  252. <p>If you&rsquo;re already using <a href="https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning">the advanced setup for CodeQL</a>, you can add support for scanning your actions workflows by adding the <code>actions</code> language to the target languages. These scans will be performed going forward and help to identify these vulnerabilities.</p>
  253.  
  254.  
  255.  
  256. <p>While we won&rsquo;t get into it in this blog, it&rsquo;s important to know that CodeQL code scanning runs several queries&mdash;it&rsquo;s not just good at finding actions workflow injections. We encourage you to give it a try and see what it can find.&nbsp;</p>
  257.  
  258.  
  259.  
  260. <p>While CodeQL is a very effective tool&mdash;and it is really good at finding this specific vulnerability&mdash;it&rsquo;s still not going to be 100% effective. Remember that no tool is perfect, and you should focus on keeping a security mindset and taking a critical idea to your own code. By keeping this in the forefront of your thoughts, you will be able to develop more secure code and help prevent these vulnerabilities from ever appearing in the first place.&nbsp;</p>
  261.  
  262.  
  263.  
  264. <h2 class="wp-block-heading" id="future-steps">Future steps</h2>
  265.  
  266.  
  267.  
  268. <p>Actions workflow injections are known to be one of the most prevalent vulnerabilities in repositories available on GitHub. However, they are relatively easy to address. The biggest issues with eliminating this vulnerability are simply being aware that they&rsquo;re a problem and discovering the possible weak spots in your code.</p>
  269.  
  270.  
  271.  
  272. <p>Now that you&rsquo;re aware of the issue, and have CodeQL on your side as a useful tool, you should be able to start looking for and fixing these vulnerabilities in your own code. And if you keep the proactive measures in mind, you&rsquo;ll be in a better position to prevent them from occurring in future code you write.</p>
  273.  
  274.  
  275.  
  276. <p>If you&rsquo;d like to learn more about actions workflow injections, we previously published <a href="https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/">a four-part series about keeping your actions workflows secure</a>. The <a href="https://securitylab.github.com/resources/github-actions-untrusted-input/">second part</a> is specifically about actions workflow injections, but we encourage you to give the entire series a read.</p>
  277.  
  278.  
  279.  
  280. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  281. <p><strong>Need some help searching through your code to look for potential vulnerabilities?</strong> <a href="https://docs.github.com/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning">Set up code scanning</a> in your project today.</p>
  282. </div>
  283.  
  284.  
  285.  
  286. <p></p>
  287. </body></html>
  288. <p>The post <a href="https://github.blog/security/vulnerability-research/how-to-catch-github-actions-workflow-injections-before-attackers-do/">How to catch GitHub Actions workflow injections before attackers do</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  289. ]]></content:encoded>
  293. <post-id xmlns="com-wordpress:feed-additions:1">89525</post-id> </item>
  294. <item>
  295. <title>For the Love of Code: a summer hackathon for joyful, ridiculous, and wildly creative projects</title>
  296. <link>https://github.blog/open-source/for-the-love-of-code-2025/</link>
  298. <dc:creator><![CDATA[Lee Reilly]]></dc:creator>
  299. <pubDate>Wed, 16 Jul 2025 15:00:00 +0000</pubDate>
  300. <category><![CDATA[GitHub Copilot]]></category>
  301. <category><![CDATA[Open Source]]></category>
  302. <category><![CDATA[hackathon]]></category>
  303. <guid isPermaLink="false">https://github.blog/?p=87995</guid>
  304.  
  305. <description><![CDATA[<p>That idea you've been sitting on? The domain you bought at 2AM? A silly or serious side project? This summer, we invite you to build it — for the joy, for the vibes, For the Love of Code 🧡</p>
  306. <p>The post <a href="https://github.blog/open-source/for-the-love-of-code-2025/">For the Love of Code: a summer hackathon for joyful, ridiculous, and wildly creative projects</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  307. ]]></description>
  308. <content:encoded><![CDATA[
  309. <p>Code isn’t just for solving problems. It’s also for exploring ideas, expressing creativity, and building something just because it sparks joy.</p>
  310.  
  311.  
  312.  
  313. <p><strong>For the Love of Code</strong> is a global, summer-long hackathon for developers of all experience levels to build the project they’ve been thinking about but haven’t had a reason to start. Whether it’s a web app, CLI tool, game, AI exploration, or a creative experiment, this is your invitation to build for the fun of it — solo, with friends, or alongside GitHub Copilot.</p>
  314.  
  315.  
  316.  
  317. <h2 class="wp-block-heading" id="h-when">When</h2>
  318.  
  319.  
  320.  
  321. <p><strong>For the Love of Code will run from July 16 to September 22, 2025.</strong></p>
  322.  
  323.  
  324.  
  325. <p class="is-typography-preset-h2">What you could win</p>
  326.  
  327.  
  328.  
  329. <ul class="wp-block-list">
  330. <li>Internet immortality: Top entries will be featured on the GitHub blog</li>
  331.  
  332.  
  333.  
  334. <li>12 months of GitHub Copilot Pro+ for winners in each category</li>
  335.  
  336.  
  337.  
  338. <li>Glory, vibes, and an excellent excuse to finally build that thing</li>
  339. </ul>
  340.  
  341.  
  342.  
  343. <p>The real prize is working on something you love.</p>
  344.  
  345.  
  346.  
  347. <h2 class="wp-block-heading is-typography-preset-h2">What can you build?</h2>
  348.  
  349.  
  350.  
  351. <p>Anything you want! We’ll be picking winners in six highly scientific categories. Each one is outlined below with inspiration to spark ideas and <a href="https://xkcd.com/356/">nerd-snipe</a> you into action <img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f3af.png" alt="🎯" class="wp-smiley" style="height: 1em; max-height: 1em;" /></p>
  352.  
  353.  
  354.  
  355. <p class="is-typography-preset-h3">Category 1: Buttons, beeps, and blinkenlights</p>
  356.  
  357.  
  358.  
  359. <p><img decoding="async" style="width: 150px;float: right;margin-left: 10px" src="https://github.blog/wp-content/uploads/2025/07/1-beeps.png" alt="An illustration of a retro computer screen with Mona walking across">If it lights up, makes noise, or looks like it escaped from a 1998 RadioShack, it belongs here. Hardware hacks (real or simulated) that blink, beep, buzz, or surprise. Think interactive, physical, tactile, and just a little chaotic. Examples:</p>
  360.  
  361.  
  362.  
  363. <ul class="wp-block-list">
  364. <li>A traffic light that displays your build status</li>
  365.  
  366.  
  367.  
  368. <li>A soldered-together sidekick that yells “LGTM!” every time your tests pass</li>
  369.  
  370.  
  371.  
  372. <li><a href="https://github.com/HarryHighPants/esp32-git-contributions-epd"><strike>An e-ink screen displaying your contribution graph</strike></a> &#8211; oops, this has already shipped!</li>
  373.  
  374.  
  375.  
  376. <li><a href="https://github.com/hasibzunair/boss-detector"><strike>A hack to make your screen display actual work when the webcam detects your boss approaching</strike></a></li>
  377.  
  378.  
  379.  
  380. <li><a href="https://github.com/veggiedefender/open-and-shut"><strike>A laptop opening and closing-powered morse code generator</strike></a></li>
  381.  
  382.  
  383.  
  384. <li><a href="https://github.com/orhun/tuitar"><strike>A Rust project that visualizes guitar notes on an ESP32 T-Display ♩ ♪ ♫ ♬</strike></a></li>
  385. </ul>
  386.  
  387.  
  388.  
  389. <p class="is-typography-preset-h3">Category 2: Agents of change</p>
  390.  
  391.  
  392.  
  393. <p><img decoding="async" style="width: 150px;float: right;margin-left: 10px" src="https://github.blog/wp-content/uploads/2025/07/2-agents.png" alt="An illustration GitHub Copilot with one of their eyes replaced with a heart">AI-powered experiences, agents, or old-fashioned bots that help, hinder, or hilariously misunderstand you. Whether it&#8217;s helping automate workflows, critiquing your code like a judgmental coworker, or pretending to be your sentient toaster, this is your playground for all things assistant-y and absurd. Examples:</p>
  394.  
  395.  
  396.  
  397. <ul class="wp-block-list">
  398. <li>An LLM-powered changelog writer that wildly over-dramatizes every update. “Fixed minor bug” → “Vanquished a lurking menace that corrupted the sacred login flow.”</li>
  399.  
  400.  
  401.  
  402. <li>An agent that reviews PRs like a sarcastic senior dev, an overly nice intern, or a concerned parent: “Are you sure this function needs to be this recursive?”</li>
  403.  
  404.  
  405.  
  406. <li><a href="https://github.com/Nutlope/billsplit"><s>An AI-assisted app to help split your restaurant bills</s></a></li>
  407.  
  408.  
  409.  
  410. <li><a href="https://github.com/MetzinAround/shania"><s>A Shania Twain Slack or Discord bot to inspire</s></a><em>&nbsp;(Editor’s note: That don’t impress me much!)</em></li>
  411. </ul>
  412.  
  413.  
  414.  
  415. <p class="is-typography-preset-h3">Category 3: Terminal talent</p>
  416.  
  417.  
  418.  
  419. <p><img decoding="async" style="width: 150px;float: right;margin-left: 10px" src="https://github.blog/wp-content/uploads/2025/07/3-cli.png" alt="An illustration of a terminal with a familiar duck character">Command-line tools, extensions, and TUI projects that are clever, useful, or just plain fun. Serious utilities with personality, beautifully crafted interfaces, or quirky scripts that make your terminal feel more alive all belong here. If it runs in the shell and makes you smile, it belongs here. Examples:</p>
  420.  
  421.  
  422.  
  423. <ul class="wp-block-list">
  424. <li>A command-line karaoke machine.</li>
  425.  
  426.  
  427.  
  428. <li>A GitHub CLI extension that gives your daily horoscope and outlook based on issues and pull requests.</li>
  429.  
  430.  
  431.  
  432. <li>An interactive tool to automate that one thing that you’ve been meaning to automate for years.</li>
  433.  
  434.  
  435.  
  436. <li><a href="https://github.com/jmhobbs/terminal-parrot"><s>An animated party parrot for your terminal</s></a></li>
  437.  
  438.  
  439.  
  440. <li><a href="https://github.com/cjlangan/MechSim"><s>A mechanical keyboard sound simulator</s></a></li>
  441. </ul>
  442.  
  443.  
  444.  
  445. <p class="is-typography-preset-h3">Category 4: Game on</p>
  446.  
  447.  
  448.  
  449. <p><img decoding="async" style="width: 150px;float: right;margin-left: 10px" src="https://github.blog/wp-content/uploads/2025/07/4-game.png" alt="An illustration of a blocktacular arcade cabinet of some sort... that kinda resembles Hubot">Code is your controller. Build something playable, puzzling, or just plain fun. This category is for interactive experiences of all kinds, like prototyping a game idea, remixing mechanics, or mashing up genres. Think nostalgic, clever, or completely original. Fun first, functional close behind. Examples:</p>
  450.  
  451.  
  452.  
  453. <ul class="wp-block-list">
  454. <li>A retro-style arcade game inspired by the classics you grew up playing.</li>
  455.  
  456.  
  457.  
  458. <li>An adventure game with AI-generated plot twists, NPCs, and side quests.</li>
  459.  
  460.  
  461.  
  462. <li><a href="https://github.itch.io/dodled-jump"><s>A vibe-coded vertical jumper built with and featuring your favorite Copilot.</s></a></li>
  463.  
  464.  
  465.  
  466. <li><a href="https://github.itch.io/flappy-mona"><s>Yet another Flappy Bird clone, but with Octocats</s></a></li>
  467.  
  468.  
  469.  
  470. <li><a href="https://github.com/sergiubucur/falling-through-code"><s>A vertical scroller where you fall through real lines of GitHub code</s></a></li>
  471. </ul>
  472.  
  473.  
  474.  
  475. <p class="is-typography-preset-h3">Category 5: World wide wonders</p>
  476.  
  477.  
  478.  
  479. <p><img decoding="async" style="width: 150px;float: right;margin-left: 10px" src="https://github.blog/wp-content/uploads/2025/07/5.png" alt="An illustration of browser window with one of Mona's arms coming through">Any web project that makes people smile, think, learn, or click “view source” belongs here. Whether it&#8217;s your first HTML experiment, a polished tool you’ve been meaning to ship, or a playful side project that does something surprisingly useful, this is your space. Educational, delightful, impressive, or just plain fun, all kinds of web builds are welcome. Examples:</p>
  480.  
  481.  
  482.  
  483. <ul class="wp-block-list">
  484. <li>A web app that takes a GitHub username and roasts them based on their contributions, commit messages, and questionable emoji use <img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1fa84.png" alt="🪄" class="wp-smiley" style="height: 1em; max-height: 1em;" /> <img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f4df.png" alt="📟" class="wp-smiley" style="height: 1em; max-height: 1em;" /> <img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f9b4.png" alt="🦴" class="wp-smiley" style="height: 1em; max-height: 1em;" />&nbsp;<img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f4be.png" alt="💾" class="wp-smiley" style="height: 1em; max-height: 1em;" /> <img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1fae0.png" alt="🫠" class="wp-smiley" style="height: 1em; max-height: 1em;" />.</li>
  485.  
  486.  
  487.  
  488. <li>A nostalgic 90s-style site that loads like it’s on dial-up, complete with pixel art loading bars, pop-up ads, a guestbook, and that dancing baby GIF.</li>
  489.  
  490.  
  491.  
  492. <li><a href="https://github.com/rauchg/doom-captcha"><s>A CAPTCHA that requires you to kill baddies in Doom</s></a></li>
  493.  
  494.  
  495.  
  496. <li><a href="https://github.com/ChrisPirillo/alien-computer"><s>An an interactive, randomized retro sci-fi dashboard with an alien aesthetic</s></a><s> Qapla&#8217;</s></li>
  497. </ul>
  498.  
  499.  
  500.  
  501. <p class="is-typography-preset-h3">Category 6: Everything but the kitchen sink</p>
  502.  
  503.  
  504.  
  505. <p><img decoding="async" style="width: 150px;float: right;margin-left: 10px" src="https://github.blog/wp-content/uploads/2025/07/6-wildcard.png" alt="An illustration of a retro computer screen featuring a joker card">Too niche? Too specific? Hard to categorize? Perfect. This is your wild card category for all the creative projects that don’t fit neatly anywhere else. Think extensions, plugins, tools, GitHub Actions, or prototypes that turned into something unexpectedly useful. Practical, playful, or just uniquely yours, we want to see it all. Examples:</p>
  506.  
  507.  
  508.  
  509. <ul class="wp-block-list">
  510. <li>A Git hook that plays sitcom laugh tracks when you commit.&nbsp;</li>
  511.  
  512.  
  513.  
  514. <li>A VS Code extension that gives your functions Yelp-style reviews.</li>
  515.  
  516.  
  517.  
  518. <li>A GitHub Action that refuses to deploy if your team hasn’t merged a PR with a positive emoji in the title that week.</li>
  519.  
  520.  
  521.  
  522. <li>A rewrite of something in Rust for the sake of it.</li>
  523.  
  524.  
  525.  
  526. <li><strike><a href="https://github.com/tonybaloney/vscode-pets">A VS Code extension to bring pets into your editor</a></strike></li>
  527.  
  528.  
  529.  
  530. <li>YOUR AMAZING IDEA GOES HERE!</li>
  531. </ul>
  532.  
  533.  
  534.  
  535. <p>Make it wildly useful, or just plain weird. As long as it brings you joy.</p>
  536.  
  537.  
  538.  
  539. <aside data-color-mode="light" data-dark-theme="dark" data-light-theme="light_dimmed" class="wp-block-group post-aside--large p-4 p-md-6 is-style-light-dimmed has-global-padding is-layout-constrained wp-block-group-is-layout-constrained is-style-light-dimmed--1" style="border-top-width:4px">
  540. <h2 class="wp-block-heading h5-mktg gh-aside-title is-typography-preset-h5" id="h-not-sure-where-to-start-ask-github-copilot" style="margin-top:0">Not sure where to start? Ask GitHub Copilot!</h2>
  541.  
  542.  
  543.  
  544. <p>You don’t have to build alone.</p>
  545.  
  546.  
  547.  
  548. <p>GitHub Copilot isn’t just for autocomplete, it’s a creative partner that can riff with you, brainstorm ideas, explain what your code is actually doing, and more. Ask it things like:</p>
  549.  
  550.  
  551.  
  552. <p><em>“Give me five fun and creative coding projects I can complete in a weekend.”</em></p>
  553.  
  554.  
  555.  
  556. <p><em>“Help me create a Git hook that plays sitcom laugh tracks when you commit.”</em></p>
  557.  
  558.  
  559.  
  560. <p>And if you want to take it further…</p>
  561.  
  562.  
  563.  
  564. <p>We may feature standout projects that make especially creative use of Copilot, including Agent mode. It’s not required for participation, but we’ll definitely be keeping an eye out.</p>
  565.  
  566.  
  567.  
  568. <p>Copilot can’t wait to get started with you! &lt;3</p>
  569.  
  570.  
  571.  
  572. <figure class="wp-block-image size-full is-resized"><img data-recalc-dims="1" decoding="async" width="500" height="631" src="https://github.blog/wp-content/uploads/2025/05/leereilly-copilot.gif?resize=500%2C631" alt="An excited GitHub Copilot jumping." class="wp-image-89327" style="width:100px" /></figure>
  573.  
  574.  
  575.  
  576. <p class="is-typography-preset-subtitle"></p>
  577. </aside>
  578.  
  579.  
  580.  
  581. <p class="is-typography-preset-h2">Who can participate?</p>
  582.  
  583.  
  584.  
  585. <p>Students, maintainers, weekend tinkerers, creative coders, <s>salty</s> seasoned pros, and curious beginners. Solo or squad. First-timer or frequent flyer. If you write code…or want to… it’s for you.</p>
  586.  
  587.  
  588.  
  589. <p class="is-typography-preset-h2">How to join</p>
  590.  
  591.  
  592.  
  593. <ol class="wp-block-list">
  594. <li>Spend an afternoon or the whole summer. Build something joyful: solo, with friends, or with Copilot.</li>
  595.  
  596.  
  597.  
  598. <li>Push your code to a public GitHub repository by 11:59 p.m. Anywhere on Earth (AoE)* on September 22, 2025*.</li>
  599.  
  600.  
  601.  
  602. <li>Submit your entries via the <a href="https://gh.io/ftloc-submit">official submission form</a>.</li>
  603. </ol>
  604.  
  605.  
  606.  
  607. <p>* <em>Editor’s note: We suspect Lee picked this deadline to avoid doing time zone math, and so he’d never have to explain daylight saving time again. Respect.</em></p>
  608.  
  609.  
  610.  
  611. <p>Tag your progress with <code>#ForTheLoveOfCode</code> and we’ll feature our favorites on social and <a href="https://github.com/explore">GitHub Explore</a> page!</p>
  612.  
  613.  
  614.  
  615. <h2 class="wp-block-heading is-typography-preset-h2">Rules</h2>
  616.  
  617.  
  618.  
  619. <p>The short and sweet version:</p>
  620.  
  621.  
  622.  
  623. <ul class="wp-block-list">
  624. <li>The use of open source is encouraged!</li>
  625.  
  626.  
  627.  
  628. <li>The use of GitHub Copilot is encouraged, but optional.</li>
  629.  
  630.  
  631.  
  632. <li>Submit up to 42 projects. (Don’t ask why. You know why.)</li>
  633.  
  634.  
  635.  
  636. <li>Your project must be in a public GitHub repo with a clear README.</li>
  637. </ul>
  638.  
  639.  
  640.  
  641. <p>Please see complete <a href="https://github.blog/wp-content/uploads/2025/07/ftloc-final.pdf">terms and conditions</a>.</p>
  642.  
  643.  
  644.  
  645. <p>We know… “terms and conditions” sounds like the least fun part of a joyful code challenge. But if you’re submitting a project or hoping for a prize, take a second to read the <a href="https://github.blog/wp-content/uploads/2025/07/ftloc-terms.pdf">official rules</a>. Future-you will thank you.<br><br>We’re building a space that’s creative, collaborative, and welcoming to all. Please be excellent to each other. See our <a href="https://docs.github.com/en/site-policy/github-terms/github-community-code-of-conduct">Code of Conduct</a>.</p>
  646.  
  647.  
  648.  
  649. <p class="is-typography-preset-h2">Judging</p>
  650.  
  651.  
  652.  
  653. <p>A panel of <a href="https://stars.github.com/">GitHub Stars</a>, <a href="https://github.com/education/students">Campus Experts</a>, and staff will evaluate entries based on joyfulness, execution, technical difficulty, ingenuity, and relevance to the category. Bonus points (figuratively) for unexpected use of GitHub Copilot.</p>
  654.  
  655.  
  656.  
  657. <p>We’ll pick three winners from each category and announce the winners by October 22, 2025 on the GitHub blog. But honestly? If it makes you smile, you’ve already won.<br></p>
  658.  
  659.  
  660.  
  661. <aside data-color-mode="light" data-dark-theme="dark" data-light-theme="light_dimmed" class="wp-block-group post-aside--large p-4 p-md-6 is-style-light-dimmed has-global-padding is-layout-constrained wp-block-group-is-layout-constrained is-style-light-dimmed--2" style="border-top-width:4px">
  662. <h2 class="wp-block-heading">New to Git, GitHub, and/or GitHub Copilot?</h2>
  663.  
  664.  
  665.  
  666. <p>For the Love of Code is the perfect opportunity to check them out (version control pun intended)!</p>
  667.  
  668.  
  669.  
  670. <ul class="wp-block-list">
  671. <li><a href="https://git-scm.com/doc">Git Documentation</a>: Learn everything about version control and how to get started.</li>
  672.  
  673.  
  674.  
  675. <li><a href="https://docs.github.com/en">GitHub Docs</a>: Explore tutorials and FAQs about GitHub.</li>
  676.  
  677.  
  678.  
  679. <li><a href="https://github.com/features/copilot">GitHub Copilot</a>: Find out more about AI that builds with you and loves code as much as you.</li>
  680.  
  681.  
  682.  
  683. <li><a href="https://github.com/orgs/community/discussions/">GitHub Community Forum</a>: This is a great place to ask questions and share answers.</li>
  684. </ul>
  685. </aside>
  686.  
  687.  
  688.  
  689. <p class="is-typography-preset-h2">Frequently asked questions</p>
  690.  
  691.  
  692.  
  693. <details>
  694.  <summary><img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f4a1.png" alt="💡" class="wp-smiley" style="height: 1em; max-height: 1em;" /> General participation</summary>
  695.  <ul>
  696.    <li><strong>Can I work with a team?</strong><br>Yes! Solo or squad… your choice. GitHub Copilot makes a great pair (or peer) programmer. Limit your team to no more than 10 people.</li>
  697.    <li><strong>How many times can I enter?</strong><br>Up to 42 times. Don’t ask why. You know why.</li>
  698.    <li><strong>Who can participate?</strong><br>Anyone 13 years of age or older with a GitHub account except where prohibited by law. See official rules for regional restrictions.</li>
  699.    <li><strong>How much time should I spend?</strong><br>As much or as little as you like. Vibe code your project in an afternoon, build over a weekend, or stretch it out across the summer.</li>
  700.    <li><strong>I’m new to GitHub/Git/Copilot. Can I still join?</strong><br>Absolutely. This is a great excuse to dive in! We’ve linked beginner-friendly docs and tutorials to help you get started.</li>
  701.    <li><strong>Can I edit my project after the deadline?</strong><br>You can keep working on your repo forever — but for judging, we’ll look at the state of your project as of 11:59 p.m. AoE on September 22. If you want to keep improving it afterward, go for it! Just be sure the version you want judged is in place by the deadline.</li>
  702.    <li><strong>I submitted the form but made a typo. Can I fix it?</strong><br>Yes! You can submit the form again with corrected info. We’ll just review the latest one. No need to email us in a panic.</li>
  703.  </ul>
  704. </details>
  705.  
  706. <details>
  707.  <summary><img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f6e0.png" alt="🛠" class="wp-smiley" style="height: 1em; max-height: 1em;" /> Projects and tools</summary>
  708.  <ul>
  709.    <li><strong>Can I reuse an old idea or prototype?</strong><br>Yes, as long as your project is built (or rebuilt) during the hackathon window. Forking, remixing, and using boilerplate is encouraged.</li>
  710.    <li><strong>Can I use paid tools, licensed software, or APIs?</strong><br>Yes! Just note any dependencies or subscriptions in your README. Do not commit sensitive info like API keys.</li>
  711.    <li><strong>Can I use GitHub Copilot?</strong><br>Yes! Copilot is optional, but encouraged. It’s great for riffing, prototyping, debugging, or naming your weird project.</li>
  712.    <li><strong>Can I submit something that’s not a traditional software project?</strong><br>Sure! If it involves code — hardware hacks, interactive art, generative anything — it counts. Just host it (or as much as you can) in a public GitHub repo.</li>
  713.  </ul>
  714. </details>
  715.  
  716. <details>
  717.  <summary><img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f680.png" alt="🚀" class="wp-smiley" style="height: 1em; max-height: 1em;" /> Submission and deadlines</summary>
  718.  <ul>
  719.    <li><strong>Is there anything I shouldn’t build?</strong><br>Keep it respectful, safe, and fun. No NSFW content, hateful speech, or projects that violate GitHub’s Code of Conduct. Weird is good. Harmful isn’t.</li>
  720.    <li><strong>When is the deadline?</strong><br>All entries must be submitted by 11:59 p.m. (anywhere on Earth, or UTC−12) on September 22, 2025 (“Entry Period”). Submissions accepted until it’s no longer September 22 anywhere on the planet. Off-planet submissions discouraged.</li>
  721.    <li><strong>Do I need to share the source code?</strong><br>Yes. Submissions must be in a public GitHub repo. You can license your work however you like (see Choose a License).</li>
  722.    <li><strong>What should I include in my README?</strong><br>Mention any tools, dependencies, paid services, or setup instructions. The better your README, the better we can appreciate your work! Please consider applying the <a href="https://github.com/topics/fortheloveofcode">#ForTheLoveOfCode Topic</a> to your repo and adding screenshots, too.</li>
  723.  </ul>
  724. </details>
  725.  
  726. <details>
  727.  <summary><img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f3c6.png" alt="🏆" class="wp-smiley" style="height: 1em; max-height: 1em;" /> Judging and prizes</summary>
  728.  <ul>
  729.    <li><strong>Who’s judging this?</strong><br>A panel of GitHub Stars, Campus Experts, and staff.</li>
  730.    <li><strong>How are winners selected?</strong><br>We’re looking for joyful, clever, and creative projects. Bonus points (figuratively) for unexpected uses of GitHub Copilot.</li>
  731.    <li><strong>What if I win more than one category? Do I get multiple prizes?</strong><br>That’d be amazing! But to keep things fair, we’ll likely award each participant one prize max. You’ll still get shoutouts for your other awesome entries.</li>
  732.    <li><strong>I don’t want the prize. Can I still participate or be featured?</strong><br>Definitely. Just let us know if you’re opting out of the prize; we’ll still celebrate your project like the internet legend you are.</li>
  733.    <li><strong>Is there cash money involved?</strong><br>Nope. But there’s Copilot Pro+, blog fame, and eternal internet glory.</li>
  734.    <li><strong>How do you define “best use of Copilot” or “surprise awards”?</strong><br>We’re keeping it loose and fun. If you do something clever, hilarious, or surprisingly useful with Copilot, we’ll take note. Same goes for standout docs, vibes, or chaos energy. Surprise us!</li>
  735.  </ul>
  736. </details>
  737.  
  738. <details>
  739.  <summary><img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f5bc.png" alt="🖼" class="wp-smiley" style="height: 1em; max-height: 1em;" /> Media, demos, and showcasing</summary>
  740.  <ul>
  741.    <li><strong>Do I need a video or demo?</strong><br>Not required, but highly encouraged! GIFs, screenshots, or short videos help bring your project to life. They also increase your chances of getting noticed and being featured.</li>
  742.    <li><strong>Can I host my demo outside GitHub (e.g. itch.io, Vercel)?</strong><br>Yes! Just include the link in your README or submission form. We still need the project code in a public GitHub repo.</li>
  743.    <li><strong>Will projects be shown on livestreams, social, or at GitHub Universe?</strong><br>Maybe! Submitting gives us permission to showcase your project if it’s selected. We’ll always give credit.</li>
  744.  </ul>
  745. </details>
  746.  
  747.  
  748.  
  749. <p>Something not covered here? Please ask in the <a href="https://github.com/orgs/community/discussions/166366">community discussion</a>.</p>
  750.  
  751.  
  752.  
  753. <p></p>
  754. <p>The post <a href="https://github.blog/open-source/for-the-love-of-code-2025/">For the Love of Code: a summer hackathon for joyful, ridiculous, and wildly creative projects</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  755. ]]></content:encoded>
  759. <post-id xmlns="com-wordpress:feed-additions:1">87995</post-id> </item>
  760. <item>
  761. <title>From chaos to clarity: Using GitHub Copilot agents to improve developer workflows</title>
  762. <link>https://github.blog/ai-and-ml/github-copilot/from-chaos-to-clarity-using-github-copilot-agents-to-improve-developer-workflows/</link>
  764. <dc:creator><![CDATA[Chris Reddington]]></dc:creator>
  765. <pubDate>Tue, 15 Jul 2025 16:00:00 +0000</pubDate>
  766. <category><![CDATA[AI & ML]]></category>
  767. <category><![CDATA[GitHub Copilot]]></category>
  768. <category><![CDATA[coding agent]]></category>
  769. <category><![CDATA[Rubber Duck Thursdays]]></category>
  770. <guid isPermaLink="false">https://github.blog/?p=89531</guid>
  771.  
  772. <description><![CDATA[<p>Explore how you can set Copilot coding agent up for success with custom instruction and Copilot setup steps.</p>
  773. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/from-chaos-to-clarity-using-github-copilot-agents-to-improve-developer-workflows/">From chaos to clarity: Using GitHub Copilot agents to improve developer workflows</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  774. ]]></description>
  775. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  776. <html><body><p>Modern development often starts with good intentions: a quick script, a prototype, maybe an action to automate one small thing. But as projects evolve, those early efforts can become brittle. What if you could bring clarity and structure to those projects without slowing down your momentum?</p>
  777.  
  778.  
  779.  
  780. <p>This tutorial shows how we used <strong>GitHub Copilot coding agent</strong> to refactor and enhance a personal GitHub Actions project called <a href="https://github.com/chrisreddington/validate-file-exists"><code>validate-file-exists</code></a>. What started as a patchwork utility became well-structured, test-covered, documented, and set up for success with Copilot agent mode and coding agent.</p>
  781.  
  782.  
  783.  
  784. <p>We&rsquo;ll walk through my example of:</p>
  785.  
  786.  
  787.  
  788. <ul class="wp-block-list">
  789. <li>Updating <a href="https://docs.github.com/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot">Copilot custom instructions</a> for better task alignment.</li>
  790.  
  791.  
  792.  
  793. <li>Creating the <a href="https://docs.github.com/copilot/how-tos/agents/copilot-coding-agent/customizing-the-development-environment-for-copilot-coding-agent"><code>copilot-setup-steps.yaml</code></a> file to give the coding agent the needed tools in its environment.</li>
  794.  
  795.  
  796.  
  797. <li>Working with Copilot to identify technical debt.</li>
  798.  
  799.  
  800.  
  801. <li>Collaborating with Copilot in pull requests.</li>
  802.  
  803.  
  804.  
  805. <li>Partnering with Copilot to iteratively improve the UI on a separate project.</li>
  806. </ul>
  807.  
  808.  
  809.  
  810. <figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
  811. <iframe title="Rubber Duck Thursdays - Let's build with agents" width="500" height="281" src="https://www.youtube.com/embed/fWsj8caUPt0?list=PL0lo9MOBetEEkxEQuYjIvrCbJTrsvRj36" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
  812. </div></figure>
  813.  
  814.  
  815.  
  816. <h2 class="wp-block-heading" id="h-the-github-action-that-started-it-all">The GitHub Action that started it all</h2>
  817.  
  818.  
  819.  
  820. <p>Back in November 2024, I created a small GitHub Action called <a href="https://github.com/chrisreddington/validate-file-exists"><code>validate-file-exists</code></a>. I wanted to ensure certain files (like a <code>dependabot.yml</code> file, or <code>.github/<a href="http://copilot-instructions.md">copilot-instructions.md</a></code>) were present in a repository. If not, then the GitHub Actions workflow would fail. It supported comma-separated inputs and was meant to be part of a larger &ldquo;baseline&rdquo; of quality gates I use across projects.</p>
  821.  
  822.  
  823.  
  824. <p>It was functional, but I could have improved it further. It was missing docs, had inconsistent metadata, some gaps in input validation, and didn&rsquo;t have Copilot custom instructions or Copilot setup steps to help set Copilot up for success. Time to fix that&mdash;with help from Copilot agent mode in VS Code.</p>
  825.  
  826.  
  827.  
  828. <h2 class="wp-block-heading" id="h-step-one-improve-custom-instructions">Step one: Improve custom instructions</h2>
  829.  
  830.  
  831.  
  832. <p>Before bringing in the agent, I reviewed the existing <code>copilot-instructions.md</code>. It was sparse, without any description of the repository&rsquo;s purpose, usage, or structure, nor any clear guidance for Copilot.</p>
  833.  
  834.  
  835.  
  836. <h3 class="wp-block-heading" id="h-action">Action:</h3>
  837.  
  838.  
  839.  
  840. <p>I based the instructions on <a href="https://docs.github.com/copilot/how-tos/agents/copilot-coding-agent/best-practices-for-using-copilot-to-work-on-tasks#adding-custom-instructions-to-your-repository">best practices for using Copilot to work on tasks</a>, by providing the sample custom instructions file in my prompt, and asking Copilot to update based on the codebase. In other words, I wanted it to provide:&nbsp;</p>
  841.  
  842.  
  843.  
  844. <ul class="wp-block-list">
  845. <li>A clear summary of the repository/codebase and what the action does.</li>
  846.  
  847.  
  848.  
  849. <li>Contribution guidelines (how to build, format, lint, and test the codebase, including expectations before committing).</li>
  850.  
  851.  
  852.  
  853. <li>Project structure overview.</li>
  854.  
  855.  
  856.  
  857. <li>Key technical principles (strict TypeScript, incorporating TSDoc, and focused and manageable functions).</li>
  858. </ul>
  859.  
  860.  
  861.  
  862. <h3 class="wp-block-heading" id="h-result-nbsp">Result:&nbsp;</h3>
  863.  
  864.  
  865.  
  866. <p>Copilot had the right context on my expectations to guide it toward meaningful contributions. You can find the <a href="https://github.com/chrisreddington/validate-file-exists/blob/main/.github/copilot-instructions.md">latest version here</a>, but here&rsquo;s a snapshot below:</p>
  867.  
  868.  
  869.  
  870. <pre class="wp-block-code language-plaintext"><code># Validate File Exists Action
  871.  
  872. This is a TypeScript-based GitHub Action that validates whether specified files
  873. exist in a repository. It takes a comma-separated list of files and validates
  874. their existence, failing the workflow if any files are missing. Please follow
  875. these guidelines when contributing:
  876.  
  877. ## Code Standards
  878.  
  879. ### Required Before Each Commit
  880.  
  881. - Run `npm run format:write` to ensure consistent code formatting with Prettier
  882. - Run `npm run lint` to check for ESLint violations
  883. - Run `npm run test` to ensure all tests pass
  884. - Run `npm run local-action` to test the action locally with a `.env` file
  885.  
  886. ### Development Flow
  887.  
  888. - Build: `npm run package` (compiles TypeScript and bundles with ncc)
  889. - Test: `npm run test` or `npm run ci-test`
  890. - Coverage: `npm run coverage` (generates coverage badge)
  891. - Full check: `npm run all` (format, lint, test, coverage, package)
  892. - Local testing: `npm run local-action` (test action locally with .env file)
  893.  
  894. ## Repository Structure
  895.  
  896. - `src/`: Core TypeScript source code
  897.  - `main.ts`: Main entry point and action orchestration
  898.  - `fileValidator.ts`: Core file validation logic
  899.  - `index.ts`: Action entrypoint that calls run()
  900.  - `types.ts`: TypeScript type definitions
  901. - `__tests__/`: Jest unit tests for all source files
  902. - `dist/`: Compiled and bundled JavaScript output (generated)
  903. - `action.yml`: GitHub Action metadata and interface definition
  904. - `script/`: Release automation scripts
  905. - `badges/`: Generated coverage and status badges
  906.  
  907. ## Key Guidelines
  908.  
  909. 1. Follow TypeScript strict mode and best practices
  910. 1. Use clear, descriptive variable and function names
  911. 1. Add TSDoc comments for all public methods and classes
  912. 1. Write comprehensive unit tests using Jest for all new functionality
  913. 1. Keep functions focused and manageable (generally under 50 lines)
  914. 1. Use consistent error handling with @actions/core.setFailed()
  915. 1. Validate inputs and provide meaningful error messages
  916. 1. Use @actions/core for all GitHub Actions integrations (inputs, outputs,
  917.   logging)
  918. 1. Maintain backwards compatibility for action inputs/outputs</code></pre>
  919.  
  920.  
  921.  
  922. <h2 class="wp-block-heading" id="step-two-add-copilot-setup-steps-yaml">Step two: Add copilot-setup-steps.yaml</h2>
  923.  
  924.  
  925.  
  926. <p>Like any of us developers, Copilot coding agent needs a proper environment to work. That means setting up any required frameworks, installing dependencies, and making sure Copilot has access to the right tools to get the job done.</p>
  927.  
  928.  
  929.  
  930. <h3 class="wp-block-heading" id="action">Action:</h3>
  931.  
  932.  
  933.  
  934. <p>I created <code>.github/copilot-setup-steps.yaml</code> using the GitHub docs on <a href="https://docs.github.com/copilot/how-tos/agents/copilot-coding-agent/customizing-the-development-environment-for-copilot-coding-agent#preinstalling-tools-or-dependencies-in-copilots-environment">customizing the development environment for Copilot coding agent</a>. The example checks out the code, sets up Node.js, and installs the needed dependencies. Given this is a TypeScript action, that&rsquo;s pretty much all I needed!<br><br>I made one minor change to the workflow: changing the node-version to be sourced from the <code>.node-version</code> file, to be consistent <a href="https://github.com/chrisreddington/validate-file-exists/blob/main/.github/workflows/ci.yml">with my CI workflow</a>:&nbsp;</p>
  935.  
  936.  
  937.  
  938. <pre class="wp-block-code language-plaintext"><code>- name: Setup Node.js
  939. id: setup-node
  940. uses: actions/setup-node@v4
  941. with:
  942. node-version-file: .node-version
  943. cache: npm</code></pre>
  944.  
  945.  
  946.  
  947. <h3 class="wp-block-heading" id="result">Result:</h3>
  948.  
  949.  
  950.  
  951. <p>Copilot coding agent has the needed dependencies and tools to build, lint, and test the codebase. As it makes changes to the codebase, it will be able to check for quality (as requested in our custom instructions) using the tools that were installed in the <code>copilot-setup-steps.yml</code>.</p>
  952.  
  953.  
  954.  
  955. <h2 class="wp-block-heading" id="step-three-let-copilot-find-technical-debt">Step three: Let Copilot find technical debt</h2>
  956.  
  957.  
  958.  
  959. <p>With the setup steps and custom instructions in place, it was time to find a task. So of course, I turned to Copilot. Using Copilot Chat in VS Code, we asked Copilot:</p>
  960.  
  961.  
  962.  
  963. <p>&ldquo;What technical debt exists in this project? Please give me a prioritized list of areas we need to focus on. I would like to create a GitHub Issue with the top 2 or 3 items. Please include a brief problem statement, a set of acceptance criteria, and pointers on what files need to be added/updated.&rdquo;</p>
  964.  
  965.  
  966.  
  967. <p>Within minutes, it explored the codebase and came back with a list of suggestions:</p>
  968.  
  969.  
  970.  
  971. <ul class="wp-block-list">
  972. <li>Inconsistent package metadata.</li>
  973.  
  974.  
  975.  
  976. <li>README mismatches (wrong input names).</li>
  977.  
  978.  
  979.  
  980. <li>No validation for empty or malformed inputs.</li>
  981. </ul>
  982.  
  983.  
  984.  
  985. <p>Notice how we asked for a problem statement, acceptance criteria, and guidance on the files to add/update? These come from the <a href="https://docs.github.com/copilot/how-tos/agents/copilot-coding-agent/best-practices-for-using-copilot-to-work-on-tasks#making-sure-your-issues-are-well-scoped">best practices for using Copilot to work on tasks</a>. In other words, make sure your issues are well-scoped!</p>
  986.  
  987.  
  988.  
  989. <h3 class="wp-block-heading" id="action">Action:</h3>
  990.  
  991.  
  992.  
  993. <p>I asked Copilot to write an issue that addresses those three items. Once I created the issue, I assigned it to Copilot.</p>
  994.  
  995.  
  996.  
  997. <h2 class="wp-block-heading" id="h-step-four-copilot-coding-agent-in-action">Step four: Copilot coding agent in action</h2>
  998.  
  999.  
  1000.  
  1001. <p>Once assigned, the agent kicked off a new pull request. Here&rsquo;s what it did, asynchronously:</p>
  1002.  
  1003.  
  1004.  
  1005. <ul class="wp-block-list">
  1006. <li>Explored the contents of the repository to build up its understanding of the problem.</li>
  1007.  
  1008.  
  1009.  
  1010. <li>Created a plan based on its exploration.</li>
  1011.  
  1012.  
  1013.  
  1014. <li>Fixed the <code>package.json</code> name, description, URLs, and author field.</li>
  1015.  
  1016.  
  1017.  
  1018. <li>Updated the README usage examples to match the code.</li>
  1019.  
  1020.  
  1021.  
  1022. <li>Added input validation logic:
  1023. <ul class="wp-block-list">
  1024. <li>Reject empty or whitespace-only strings.</li>
  1025.  
  1026.  
  1027.  
  1028. <li>Reject inputs that are just commas.</li>
  1029. </ul>
  1030. </li>
  1031.  
  1032.  
  1033.  
  1034. <li>Wrote four new tests for these edge cases.</li>
  1035.  
  1036.  
  1037.  
  1038. <li>Confirmed linting, formatting, and coverage were intact.</li>
  1039.  
  1040.  
  1041.  
  1042. <li>Updated the pull request body with a checklist of work completed.</li>
  1043. </ul>
  1044.  
  1045.  
  1046.  
  1047. <p>As I delegated the task to Copilot, it freed me up to explain to the audience what it was doing, and how the Copilot setup steps and instructions work in the context of the agent&rsquo;s session.</p>
  1048.  
  1049.  
  1050.  
  1051. <h3 class="wp-block-heading" id="result">Result:</h3>
  1052.  
  1053.  
  1054.  
  1055. <p>Copilot completed all tasks in just over 11 minutes. After a review of the agent&rsquo;s approach, I approved the CI workflow so that it could run the standard quality checks on the codebase. The workflow failed, but through no fault of Copilot. I had some additional Markdown linting checks in the CI that weren&rsquo;t in the instructions.</p>
  1056.  
  1057.  
  1058.  
  1059. <h2 class="wp-block-heading" id="real-time-debugging-and-linting-fixes">Real-time debugging and linting fixes</h2>
  1060.  
  1061.  
  1062.  
  1063. <p>While I could have fixed it manually, it was a good opportunity to show how we can iterate on changes with Copilot. I added a new comment to the pull request, and asked Copilot:&nbsp;</p>
  1064.  
  1065.  
  1066.  
  1067. <p>&ldquo;Our GitHub Action had a linting error for the markdown, can you fix that please?&rdquo; (Also pasting the error from the GitHub Actions workflow.)</p>
  1068.  
  1069.  
  1070.  
  1071. <p>A few minutes later, it updated the code, pushed a new commit, and the pull request passed. And while Copilot was working on my task in the background, I was able to wrap up the stream.</p>
  1072.  
  1073.  
  1074.  
  1075. <h2 class="wp-block-heading" id="bonus-making-ui-changes-with-copilot-coding-agent-and-the-playwright-mcp-server">Bonus: Making UI changes with Copilot coding agent and the Playwright MCP server</h2>
  1076.  
  1077.  
  1078.  
  1079. <p>While Copilot worked on the initial code changes for the GitHub Action, I showed off a second project: a <a href="https://chrisreddington.com/trend-radar/"><strong>Trend Radar visualisation app</strong></a> (<a href="https://github.com/chrisreddington/trend-radar">here&rsquo;s the repository</a>) that I built using Next.js and Tailwind CSS.</p>
  1080.  
  1081.  
  1082.  
  1083. <h3 class="wp-block-heading" id="problem">Problem:</h3>
  1084.  
  1085.  
  1086.  
  1087. <p>Users had to manually input point data into forms. I wanted to:</p>
  1088.  
  1089.  
  1090.  
  1091. <ul class="wp-block-list">
  1092. <li>Let users click on the radar to place a point.</li>
  1093.  
  1094.  
  1095.  
  1096. <li>Enable drag-and-drop repositioning to change a point&rsquo;s category or likelihood.&nbsp;</li>
  1097. </ul>
  1098.  
  1099.  
  1100.  
  1101. <h3 class="wp-block-heading" id="solution">Solution:</h3>
  1102.  
  1103.  
  1104.  
  1105. <p>I filed a GitHub issue describing the UX, acceptance criteria, and references.</p>
  1106.  
  1107.  
  1108.  
  1109. <p>After a few iterations of comments by working through the pull request, Copilot coding agent:</p>
  1110.  
  1111.  
  1112.  
  1113. <ul class="wp-block-list">
  1114. <li>Implemented click-to-place logic.</li>
  1115.  
  1116.  
  1117.  
  1118. <li>Added drag-and-drop support.</li>
  1119.  
  1120.  
  1121.  
  1122. <li>Wrote unit tests.</li>
  1123.  
  1124.  
  1125.  
  1126. <li>Took screenshots and attached them to the pull request.</li>
  1127.  
  1128.  
  1129.  
  1130. <li>Updated the pull request (and responded with comments) with summaries of the work that had been completed</li>
  1131. </ul>
  1132.  
  1133.  
  1134.  
  1135. <p><a href="https://github.blog/changelog/2025-07-02-copilot-coding-agent-now-has-its-own-web-browser/">Playwright is now installed by default</a> with the Copilot coding agent, which lets Copilot validate visual behaviors too.</p>
  1136.  
  1137.  
  1138.  
  1139. <h2 class="wp-block-heading" id="final-thoughts">Final thoughts</h2>
  1140.  
  1141.  
  1142.  
  1143. <p>This wasn&rsquo;t just a cleanup session. It was a lesson in modern software collaboration. Copilot coding agent is our new teammate.</p>
  1144.  
  1145.  
  1146.  
  1147. <p>By structuring our repositories with context and intent, we invite Copilot to contribute meaningfully.</p>
  1148.  
  1149.  
  1150.  
  1151. <p>If you haven&rsquo;t tried Copilot coding agent yet, think through your existing projects:</p>
  1152.  
  1153.  
  1154.  
  1155. <ul class="wp-block-list">
  1156. <li>Clean up an old GitHub Action.</li>
  1157.  
  1158.  
  1159.  
  1160. <li>Refactor a neglected repository.</li>
  1161.  
  1162.  
  1163.  
  1164. <li>Add validations and tests.</li>
  1165. </ul>
  1166.  
  1167.  
  1168.  
  1169. <p>You might be surprised how much progress you can make in an afternoon.</p>
  1170.  
  1171.  
  1172.  
  1173. <ul class="wp-block-list">
  1174. <li><a href="https://docs.github.com/copilot/how-tos/agents/copilot-coding-agent/best-practices-for-using-copilot-to-work-on-tasks#adding-custom-instructions-to-your-repository">Write clear, concise <code>copilot-instructions.md</code></a> to steer the agent.</li>
  1175.  
  1176.  
  1177.  
  1178. <li><a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-coding-agent/customizing-the-development-environment-for-copilot-coding-agent#preinstalling-tools-or-dependencies-in-copilots-environment">Use <code>copilot-setup-steps.yaml</code></a> to give the agent the tools it needs.</li>
  1179.  
  1180.  
  1181.  
  1182. <li><a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-coding-agent/best-practices-for-using-copilot-to-work-on-tasks#making-sure-your-issues-are-well-scoped">Setting a clear and well-scoped piece of work</a> is important when working with Copilot.</li>
  1183.  
  1184.  
  1185.  
  1186. <li><a href="https://github.blog/changelog/2025-07-02-copilot-coding-agent-now-has-its-own-web-browser/">Copilot now has access to a browser</a>, thanks to the Playwright MCP server &ndash; enabling it to interact with web pages, and add screenshots to the pull request.</li>
  1187.  
  1188.  
  1189.  
  1190. <li>You don&rsquo;t have to work on new projects to try out Copilot and its agentic capabilities. Which existing project could you get started on?</li>
  1191. </ul>
  1192.  
  1193.  
  1194.  
  1195. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1196. <p><strong>Ready to explore more?</strong> See <a href="https://github.blog/ai-and-ml/github-copilot/how-the-github-billing-team-uses-the-coding-agent-in-github-copilot-to-continuously-burn-down-technical-debt/">how the GitHub billing team uses the coding agent to continuously burn down technical debt &gt;</a></p>
  1197. </div>
  1198. </body></html>
  1199. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/from-chaos-to-clarity-using-github-copilot-agents-to-improve-developer-workflows/">From chaos to clarity: Using GitHub Copilot agents to improve developer workflows</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1200. ]]></content:encoded>
  1204. <post-id xmlns="com-wordpress:feed-additions:1">89531</post-id> </item>
  1205. <item>
  1206. <title>Code review in the age of AI: Why developers will always own the merge button</title>
  1207. <link>https://github.blog/ai-and-ml/generative-ai/code-review-in-the-age-of-ai-why-developers-will-always-own-the-merge-button/</link>
  1209. <dc:creator><![CDATA[Elle Shwer]]></dc:creator>
  1210. <pubDate>Mon, 14 Jul 2025 16:38:03 +0000</pubDate>
  1211. <category><![CDATA[AI & ML]]></category>
  1212. <category><![CDATA[Generative AI]]></category>
  1213. <category><![CDATA[agentic workflows]]></category>
  1214. <category><![CDATA[AI agents]]></category>
  1215. <category><![CDATA[code review]]></category>
  1216. <category><![CDATA[GitHub Copilot]]></category>
  1217. <guid isPermaLink="false">https://github.blog/?p=89505</guid>
  1218.  
  1219. <description><![CDATA[<p>When it comes to merging code, developers will always make the final decision. But we’re rethinking how tools like GitHub Copilot can help. </p>
  1220. <p>The post <a href="https://github.blog/ai-and-ml/generative-ai/code-review-in-the-age-of-ai-why-developers-will-always-own-the-merge-button/">Code review in the age of AI: Why developers will always own the merge button</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1221. ]]></description>
  1222. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  1223. <html><body><p>When GitHub first shipped the pull request (PR) back in 2008, it wrapped a plain-text diff in a social workflow: comments, approvals, and a merge button that crucially refused to light up without at least one thumbs up from another developer. That design decision hard-wired accountability into modern software and let maintainers scale far beyond hallway conversations or e-mail patches.</p>
  1224.  
  1225.  
  1226.  
  1227. <p>Seventeen years later, just about every &ldquo;agentic&rdquo; coding tool, from research demos to enterprise platforms, still funnels its work through that same merge gate. The PR remains the audit log, the governance layer, and the social contract that says nothing ships until a person is willing to own it.</p>
  1228.  
  1229.  
  1230.  
  1231. <p>Now that large language models (LLM) can scaffold projects, file PRs, and even reply to review comments they wrote themselves, the obvious next question is, who is accountable for code that ships when part of it comes from a model?&nbsp;</p>
  1232.  
  1233.  
  1234.  
  1235. <p>At GitHub, we think the answer hasn&rsquo;t fundamentally changed: it&rsquo;s the developer who hits &ldquo;Merge.&rdquo; But what has changed is everything that happens before that click.&nbsp;</p>
  1236.  
  1237.  
  1238.  
  1239. <p>In this article, we&rsquo;ll explore how we&rsquo;re re-thinking code reviews for a world where developers increasingly work with AI (and how your team can, too).&nbsp;</p>
  1240.  
  1241.  
  1242.  
  1243. <aside data-color-mode="light" data-dark-theme="dark" data-light-theme="light_dimmed" class="wp-block-group post-aside--large p-4 p-md-6 is-style-light-dimmed has-global-padding is-layout-constrained wp-block-group-is-layout-constrained is-style-light-dimmed--3" style="border-top-width:4px">
  1244. <h3 class="wp-block-heading h5-mktg gh-aside-title is-typography-preset-h5" id="h-what-a-code-review-is-still-for" style="margin-top:0">What a code review is (still) for</h3>
  1245.  
  1246.  
  1247.  
  1248. <p>Before diving into AI-assisted reviews, it&rsquo;s worth revisiting what makes code reviews effective in the first place. A review is far more than a bug hunt. A good review:&nbsp;</p>
  1249.  
  1250.  
  1251.  
  1252. <ul class="wp-block-list">
  1253. <li>Catches defects and security issues&nbsp;</li>
  1254.  
  1255.  
  1256.  
  1257. <li>Ensures high code quality</li>
  1258.  
  1259.  
  1260.  
  1261. <li>Shares knowledge across the team and maintains consistency with your codebase&rsquo;s patterns and standards</li>
  1262.  
  1263.  
  1264.  
  1265. <li>Safeguards long-term maintainability&nbsp;</li>
  1266. </ul>
  1267.  
  1268.  
  1269.  
  1270. <p>AI changes none of that; it only moves the bottlenecks. A model can quickly spot an unused import, but it can&rsquo;t decide if a new endpoint undermines your privacy stance or if today is the right day to pay down that gnarly abstraction you&rsquo;ve been avoiding. The merge button still needs (and, in our view, <em>always</em> will need) a developer fingerprint.</p>
  1271.  
  1272.  
  1273.  
  1274. <p>For a deeper dive into effective code review practices, <a href="https://github.blog/developer-skills/github/how-to-review-code-effectively-a-github-staff-engineers-philosophy/">check out our guide on reviewing code effectively</a>.</p>
  1275. </aside>
  1276.  
  1277.  
  1278.  
  1279. <h2 class="wp-block-heading" id="what-we-learned-from-github-copilots-code-review-capabilities">What we learned from GitHub Copilot&rsquo;s code review capabilities</h2>
  1280.  
  1281.  
  1282.  
  1283. <p>Earlier this year, the GitHub Copilot code review team conducted in-depth interviews with developers about their code review process. They also walked us through their code review workflow. These interviews revealed three consistent patterns:</p>
  1284.  
  1285.  
  1286.  
  1287. <ol class="wp-block-list">
  1288. <li><strong>No special treatment for AI:</strong> Reviewers grilled model-generated diffs as hard as those from other developers.</li>
  1289.  
  1290.  
  1291.  
  1292. <li><strong>Self reviews raised the floor:</strong> Developers who <a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-code-review/using-copilot-code-review?tool=vscode#requesting-a-review-from-copilot">ran a Copilot review before opening a PR</a> often wiped out an entire class of trivial nit-picks (i.e., trimmed imports, missing tests), cutting out back-and-forth by roughly a third.</li>
  1293.  
  1294.  
  1295.  
  1296. <li><strong>AI was no replacement for human judgement: </strong>Programming often involves trade-offs. LLMs can inform you about those trade-offs, but someone has to make the call about what path to take based on your organization&rsquo;s goals and standards.&nbsp;&nbsp;</li>
  1297. </ol>
  1298.  
  1299.  
  1300.  
  1301. <p>An overarching principle quickly became clear: <strong>AI augments developer judgment; it can&rsquo;t replace it. </strong>And our findings, from confidence scores to red-flag explanations, are informing how we&rsquo;re building Copilot&rsquo;s code review features.</p>
  1302.  
  1303.  
  1304.  
  1305. <aside data-color-mode="light" data-dark-theme="dark" data-light-theme="light_dimmed" class="wp-block-group post-aside--large p-4 p-md-6 is-style-light-dimmed has-global-padding is-layout-constrained wp-block-group-is-layout-constrained is-style-light-dimmed--4" style="border-top-width:4px">
  1306. <h2 class="wp-block-heading h5-mktg gh-aside-title is-typography-preset-h5" id="h-github-copilot-code-review-is-generally-available" style="margin-top:0">GitHub Copilot code review is generally available</h2>
  1307.  
  1308.  
  1309.  
  1310. <p>Let an AI teammate handle the first pass. GitHub Copilot&rsquo;s code-review agent is generally available for every Copilot plan, and it&rsquo;s spotting bugs, performance issues, and even suggesting fixes before a human ever opens the diff. Enable automatic reviews in your repo rules or ask Copilot on-demand, right inside GitHub, GitHub Mobile, or VS Code.</p>
  1311.  
  1312.  
  1313.  
  1314. <p><a href="https://github.blog/changelog/2025-04-04-copilot-code-review-now-generally-available/">Learn more &gt;</a></p>
  1315. </aside>
  1316.  
  1317.  
  1318.  
  1319. <h3 class="wp-block-heading" id="what-ai-can-and-cant-handle-today">What AI can (and can&rsquo;t) handle today</h3>
  1320.  
  1321.  
  1322.  
  1323. <p>LLMs are already great at the &ldquo;grind&rdquo; layer of a review:</p>
  1324.  
  1325.  
  1326.  
  1327. <ul class="wp-block-list">
  1328. <li><strong>Mechanical scanning.</strong> &ldquo;Is there a typo?&rdquo; &ldquo;Are all arguments used?&rdquo;</li>
  1329.  
  1330.  
  1331.  
  1332. <li><strong>Pattern matching.</strong> &ldquo;This looks like SQL injection&rdquo; or &ldquo;You forgot to await that promise.&rdquo;</li>
  1333.  
  1334.  
  1335.  
  1336. <li><strong>Pedantic consistency.</strong> &ldquo;Variable names snake_case here, camelCase there.&rdquo;</li>
  1337. </ul>
  1338.  
  1339.  
  1340.  
  1341. <p>Soon they&rsquo;ll be able to do even more, such as understand product and domain context.&nbsp; But they still fall short on:</p>
  1342.  
  1343.  
  1344.  
  1345. <ul class="wp-block-list">
  1346. <li><strong>Architecture and trade-offs.</strong> Should we split this service? Cache locally?</li>
  1347.  
  1348.  
  1349.  
  1350. <li><strong>Mentorship.</strong> Explaining <em>why</em> a pattern matters and when to break it.</li>
  1351.  
  1352.  
  1353.  
  1354. <li><strong>Values.</strong> Should we build this feature at all?</li>
  1355. </ul>
  1356.  
  1357.  
  1358.  
  1359. <p>Those gaps keep developers in the loop and in the pilot&rsquo;s seat. That principle is foundational for us as we continue to develop GitHub Copilot.&nbsp;</p>
  1360.  
  1361.  
  1362.  
  1363. <h2 class="wp-block-heading" id="a-playbook-for-modern-code-reviews">A playbook for modern code reviews</h2>
  1364.  
  1365.  
  1366.  
  1367. <p>The most effective approach to AI-assisted code reviews starts before you even submit your pull request. Think of it as the golden rule of development: Treat code reviewers the way you&rsquo;d like them to treat you.</p>
  1368.  
  1369.  
  1370.  
  1371. <h3 class="wp-block-heading" id="use-ai-to-self-review-your-code-in-your-ide">Use AI to self review your code in your IDE</h3>
  1372.  
  1373.  
  1374.  
  1375. <p>Before pushing your code, <a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-code-review/using-copilot-code-review?tool=vscode#requesting-a-review-from-copilot">run GitHub Copilot code review in your IDE</a> to catch the obvious stuff so your teammates can focus on the nuanced issues that require developer insight. Copilot code review can comb your staged diff, suggest docstrings, and flag null dereferences. From there, you can fix everything it finds before you submit your PR so teammates never see the noise.</p>
  1376.  
  1377.  
  1378.  
  1379. <h3 class="wp-block-heading" id="take-ownership-of-your-code">Take ownership of your code</h3>
  1380.  
  1381.  
  1382.  
  1383. <p>Just because you used AI to generate code doesn&rsquo;t mean it&rsquo;s not your code. Once you commit code, you&rsquo;re responsible for it. That means understanding what it does, ensuring it follows your team&rsquo;s standards, and making sure it integrates well with the rest of your codebase.</p>
  1384.  
  1385.  
  1386.  
  1387. <blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
  1388. <p>If an AI agent writes code, it&rsquo;s on me to clean it up before my name shows up in git blame.</p>
  1389. <cite>Jon Wiggins, Machine Learning Engineer at Respondology</cite></blockquote>
  1390.  
  1391.  
  1392.  
  1393. <h3 class="wp-block-heading" id="run-your-code-through-automated-ci-gates">Run your code through automated CI gates</h3>
  1394.  
  1395.  
  1396.  
  1397. <p>Your pipeline should already be running unit tests, secret scanning, CodeQL, dependency checks, style linters. Keep doing that. Fail fast, fail loudly.</p>
  1398.  
  1399.  
  1400.  
  1401. <h3 class="wp-block-heading" id="practical-tips-for-personal-code-hygiene">Practical tips for personal code hygiene:</h3>
  1402.  
  1403.  
  1404.  
  1405. <ul class="wp-block-list">
  1406. <li>Review your own code in your IDE.</li>
  1407.  
  1408.  
  1409.  
  1410. <li>Ensure variable names, comments, and structure to match your team&rsquo;s conventions.</li>
  1411.  
  1412.  
  1413.  
  1414. <li>Test AI-generated code thoroughly before including it in pull requests.</li>
  1415. </ul>
  1416.  
  1417.  
  1418.  
  1419. <h2 class="wp-block-heading" id="use-ai-to-focus-on-the-areas-where-your-judgement-is-critical">Use AI to focus on the areas where your judgement is critical</h2>
  1420.  
  1421.  
  1422.  
  1423. <p>The real power of AI in code reviews isn&rsquo;t in replacing developers as the reviewers. It&rsquo;s in handling the routine work that can bog down the review process, freeing developers to focus where their judgment is most valuable.</p>
  1424.  
  1425.  
  1426.  
  1427. <h3 class="wp-block-heading" id="ai-doesnt-replace-your-existing-automated-checks">AI doesn&rsquo;t replace your existing automated checks.&nbsp;</h3>
  1428.  
  1429.  
  1430.  
  1431. <p>Make sure tests pass, coverage metrics are met, and static analysis tools have done their work before developer reviews begin. This creates a solid foundation for more meaningful discussion.&nbsp;</p>
  1432.  
  1433.  
  1434.  
  1435. <p>You can use an LLM to catch not just syntax issues, but also patterns, potential bugs, and style inconsistencies. Ironically, LLMs are particularly good at catching the sorts of mistakes that LLMs make, which is increasingly relevant as more AI-generated code enters our codebases.</p>
  1436.  
  1437.  
  1438.  
  1439. <h3 class="wp-block-heading" id="clearly-define-roles">Clearly define roles</h3>
  1440.  
  1441.  
  1442.  
  1443. <p>Set clear expectations about when AI feedback should be considered versus when human judgment takes precedence. For example, you should rely on other developers for code architecture and consistency with business goals and organizational values. It&rsquo;s especially useful to use AI to review long repetitive PRs where it can be easy to miss little things.</p>
  1444.  
  1445.  
  1446.  
  1447. <h2 class="wp-block-heading" id="implementation-tips-for-building-a-sustainable-ai-assisted-review-process">Implementation tips for building a sustainable AI-assisted review process</h2>
  1448.  
  1449.  
  1450.  
  1451. <ul class="wp-block-list">
  1452. <li><strong>Document clear guidelines</strong> that specify when to use AI in code reviews, what types of feedback to trust, and how to escalate when developers disagree with an AI code review. With GitHub Copilot, for instance, <a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-code-review/using-copilot-code-review?tool=webui#customizing-copilots-reviews-with-custom-instructions">you can use custom instructions to set clear rules for how Copilot engages with your code</a>.&nbsp;</li>
  1453.  
  1454.  
  1455.  
  1456. <li><strong>Update guidelines regularly</strong> based on team feedback and evolving AI capabilities. Remember that as your codebase and AI tools evolve, what works today might not work tomorrow.</li>
  1457.  
  1458.  
  1459.  
  1460. <li><strong>Encourage open team discussions</strong> about the strengths and limitations of AI-assisted reviews. Share both positive and negative experiences to help everyone learn and improve their approach.</li>
  1461.  
  1462.  
  1463.  
  1464. <li><strong>Refine automation continuously</strong> by using feedback from reviewers to improve your automated testing strategy. Identify patterns where solutions to recurring issues could be automated.</li>
  1465. </ul>
  1466.  
  1467.  
  1468.  
  1469. <h2 class="wp-block-heading" id="developer-judgement-remains-crucial">Developer judgement remains crucial</h2>
  1470.  
  1471.  
  1472.  
  1473. <p>While AI can handle much of the routine work in code reviews, developer judgment remains irreplaceable for architectural decisions, mentoring and knowledge transfer, and context-specific decisions that require understanding of your product and users.&nbsp;</p>
  1474.  
  1475.  
  1476.  
  1477. <p>And even as LLMs get smarter, three review tasks remain stubbornly human:</p>
  1478.  
  1479.  
  1480.  
  1481. <ol class="wp-block-list">
  1482. <li><strong>Architecture trade-offs</strong>: Should we split this service? Cache locally? Pay tech debt now or later?</li>
  1483.  
  1484.  
  1485.  
  1486. <li><strong>Mentorship and culture</strong>: PR threads are team classrooms. A bot can&rsquo;t tell a junior engineer the war story behind that odd regex.</li>
  1487.  
  1488.  
  1489.  
  1490. <li><strong>Ethics and product values</strong>: &ldquo;Should we even build this?&rdquo; is a question AI can&rsquo;t answer.</li>
  1491. </ol>
  1492.  
  1493.  
  1494.  
  1495. <p>The goal is to make developers more effective by letting them focus on what they do best.</p>
  1496.  
  1497.  
  1498.  
  1499. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1500. <p><strong>Learn more</strong> about <a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-code-review/using-copilot-code-review">code reviews with GitHub Copilot &gt;&nbsp;</a></p>
  1501. </div>
  1502. </body></html>
  1503. <p>The post <a href="https://github.blog/ai-and-ml/generative-ai/code-review-in-the-age-of-ai-why-developers-will-always-own-the-merge-button/">Code review in the age of AI: Why developers will always own the merge button</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1504. ]]></content:encoded>
  1508. <post-id xmlns="com-wordpress:feed-additions:1">89505</post-id> </item>
  1509. <item>
  1510. <title>Modeling CORS frameworks with CodeQL to find security vulnerabilities</title>
  1511. <link>https://github.blog/security/application-security/modeling-cors-frameworks-with-codeql-to-find-security-vulnerabilities/</link>
  1513. <dc:creator><![CDATA[Kevin Stubbings]]></dc:creator>
  1514. <pubDate>Thu, 10 Jul 2025 17:38:14 +0000</pubDate>
  1515. <category><![CDATA[Application security]]></category>
  1516. <category><![CDATA[Security]]></category>
  1517. <category><![CDATA[CodeQL]]></category>
  1518. <category><![CDATA[GitHub Security Lab]]></category>
  1519. <category><![CDATA[security research]]></category>
  1520. <guid isPermaLink="false">https://github.blog/?p=89417</guid>
  1521.  
  1522. <description><![CDATA[<p>Discover how to increase the coverage of your CodeQL CORS security by modeling developer headers and frameworks.</p>
  1523. <p>The post <a href="https://github.blog/security/application-security/modeling-cors-frameworks-with-codeql-to-find-security-vulnerabilities/">Modeling CORS frameworks with CodeQL to find security vulnerabilities</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1524. ]]></description>
  1525. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  1526. <html><body><p>There are many <a href="https://github.blog/security/application-security/localhost-dangers-cors-and-dns-rebinding/">different types of vulnerabilities</a> that can occur when setting up CORS for your web application, and insecure usage of CORS frameworks and logic errors in homemade CORS implementations can lead to serious security vulnerabilities that allow attackers to bypass authentication. What&rsquo;s more, attackers can utilize CORS misconfigurations to escalate the severity of other existing vulnerabilities in web applications to access services on the intranet.</p>
  1527.  
  1528.  
  1529.  
  1530. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="847" width="1024" src="https://github.blog/wp-content/uploads/2025/07/cors1.jpg?resize=1024%2C847" alt="A CORS diagram showing communication between two websites in the browser." class="wp-image-89421" srcset="https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=1600 1600w, https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=300 300w, https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=768 768w, https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=1024 1024w, https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=1536 1536w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  1531.  
  1532.  
  1533.  
  1534. <p>In this blog post, I&rsquo;ll show how developers and security researchers can use CodeQL to model their own libraries, using work that I&rsquo;ve done on CORS frameworks in Go as an example. Since the techniques that I used are useful for modeling other frameworks, this blog post can help you model and find vulnerabilities in your own projects. Because static analyzers like CodeQL have the ability to get the detailed information about structures, functions, and imported libraries, they&rsquo;re more versatile than simple tools like grep. Plus, since CORS frameworks often use set configurations via specific structures and functions, using CodeQL is the easiest way to find misconfigurations in your codebases.</p>
  1535.  
  1536.  
  1537.  
  1538. <h2 class="wp-block-heading" id="h-modeling-headers-in-codeql">Modeling headers in CodeQL</h2>
  1539.  
  1540.  
  1541.  
  1542. <p>When adding code to CodeQL, it&rsquo;s best practice to always check the related queries and frameworks that are already available so that we&rsquo;re not reinventing the wheel. For most languages, CodeQL already has a CORS query that covers many of the default cases. The easiest and simplest way of implementing CORS is by manually setting the&nbsp; <code>Access-Control-Allow-Origin</code> and <code>Access-Control-Allow-Credentials</code> <a href="https://developer.mozilla.org/en-US/docs/Glossary/Response_header">response headers</a>. By modeling the frameworks for a language (e.g., Django, FastAPI, and Flask), CodeQL can identify where in the code those headers are set. Building on those models by looking for specific header values, CodeQL can find simple examples of CORS and see if they match vulnerable values.</p>
  1543.  
  1544.  
  1545.  
  1546. <p>In the following Go example, unauthenticated resources on the servers could be accessed by arbitrary websites.</p>
  1547.  
  1548.  
  1549.  
  1550. <pre class="wp-block-code language-go"><code>func saveHandler(w http.ResponseWriter, r *http.Request) {
  1551.    w.Header().Set("Access-Control-Allow-Origin", "*")
  1552. }</code></pre>
  1553.  
  1554.  
  1555.  
  1556. <p>This may be troublesome for web applications that do not have authentication, such as tools intended to be hosted locally, because any dangerous endpoint could be accessed and exploited by an attacker.</p>
  1557.  
  1558.  
  1559.  
  1560. <p>This is a snippet of the Go http framework where CodeQL models the <code>Set</code> method to find security-related header writes for this framework. Header writes are modeled by the <code>HeaderWrite</code> class in <code>HTTP.qll</code>, which is extended by other modules and classes in order to find all header writes.</p>
  1561.  
  1562.  
  1563.  
  1564. <pre class="wp-block-code language-go"><code> /** Provides a class for modeling new HTTP header-write APIs. */
  1565.  module HeaderWrite {
  1566.    /**
  1567.     * A data-flow node that represents a write to an HTTP header.
  1568.     *
  1569.     * Extend this class to model new APIs. If you want to refine existing API models,
  1570.     * extend `HTTP::HeaderWrite` instead.
  1571.     */
  1572.    abstract class Range extends DataFlow::ExprNode {
  1573.      /** Gets the (lower-case) name of a header set by this definition. */
  1574.      string getHeaderName() { result = this.getName().getStringValue().toLowerCase() }</code></pre>
  1575.  
  1576.  
  1577.  
  1578. <p>Some useful methods such as <code>getHeaderName</code> and <code>getHeaderValue</code> can also&nbsp; help in developing security queries related to headers, like CORS misconfiguration. Unlike the previous code example, the below pattern is an example of a CORS misconfiguration whose effect is much more impactful.</p>
  1579.  
  1580.  
  1581.  
  1582. <pre class="wp-block-code language-go"><code>func saveHandler(w http.ResponseWriter, r *http.Request) {
  1583.    w.Header().Set("Access-Control-Allow-Origin",
  1584.    r.Header.Get("Origin"))
  1585.    w.Header().Set("Access-Control-Allow-Credentials",
  1586.    "true")
  1587. }</code></pre>
  1588.  
  1589.  
  1590.  
  1591. <p>Reflecting the request origin header and allowing credentials permits an attacking website to make requests as the current logged in user, which could compromise the entire web application.</p>
  1592.  
  1593.  
  1594.  
  1595. <p>Using CodeQL, we can model the headers, looking for specific headers and methods in order to help CodeQL identify the relevant security code structures to find CORS vulnerabilities.</p>
  1596.  
  1597.  
  1598.  
  1599. <pre class="wp-block-code language-plaintext"><code>/**
  1600. * An `Access-Control-Allow-Credentials` header write.
  1601. */
  1602. class AllowCredentialsHeaderWrite extends Http::HeaderWrite {
  1603.    AllowCredentialsHeaderWrite() {
  1604.        this.getHeaderName() = headerAllowCredentials()
  1605.    }
  1606. }
  1607.  
  1608. /**
  1609. * predicate for CORS query.
  1610. */
  1611. predicate allowCredentialsIsSetToTrue(DataFlow::ExprNode allowOriginHW) {
  1612.        exists(AllowCredentialsHeaderWrite allowCredentialsHW |
  1613.                allowCredentialsHW.getHeaderValue().toLowerCase() = "true"</code></pre>
  1614.  
  1615.  
  1616.  
  1617. <p>Here, the <code>HTTP::HeaderWrite</code> class, as previously discussed, is used as a superclass for <code>AllowCredentialsHeaderWrite</code>, which finds all header writes of the value <code>Access-Control-Allow-Credentials</code>. Then, when our CORS misconfiguration query checks whether credentials are enabled, we use AllowCredentialsHeaderWrite as one of the possible sources to check.</p>
  1618.  
  1619.  
  1620.  
  1621. <p>The simplest way for developers to set a CORS policy is by setting headers on HTTP responses in their server. By modeling all instances where a header is set, we can check for these CORS cases in our CORS query.&nbsp;</p>
  1622.  
  1623.  
  1624.  
  1625. <p>When modeling web frameworks using CodeQL, creating classes that extend more generic superclasses such as <code>HTTP::HeaderWrite</code> allows the impact of the model to be used in all CodeQL security queries that need them. Since headers in web applications can be so important, modeling all the ways they can be written to in a framework can be a great first step to adding that web framework to CodeQL.</p>
  1626.  
  1627.  
  1628.  
  1629. <h2 class="wp-block-heading" id="modeling-frameworks-in-codeql">Modeling frameworks in CodeQL</h2>
  1630.  
  1631.  
  1632.  
  1633. <figure class="wp-block-image size-full"><img data-recalc-dims="1" loading="lazy" decoding="async" width="961" height="877" src="https://github.blog/wp-content/uploads/2025/07/cors2.png?resize=961%2C877" alt="A computer with two windows open showing secure code." class="wp-image-89422" srcset="https://github.blog/wp-content/uploads/2025/07/cors2.png?w=961 961w, https://github.blog/wp-content/uploads/2025/07/cors2.png?w=300 300w, https://github.blog/wp-content/uploads/2025/07/cors2.png?w=768 768w" sizes="auto, (max-width: 961px) 100vw, 961px" /></figure>
  1634.  
  1635.  
  1636.  
  1637. <p>Rather than setting the CORS headers manually, many developers use a CORS framework instead.&nbsp; Generally, CORS frameworks use middleware in the router of a web framework in order to add headers for every response. Some web frameworks will have their own CORS middleware, or you may have to include a third-party package. When modeling a CORS framework in CodeQL, you&rsquo;re usually modeling the relevant structures and methods that signify a CORS policy. Once the modeled structure or methods have the correct values, the query should check that the structure is actually used in the codebase.</p>
  1638.  
  1639.  
  1640.  
  1641. <p>For frameworks, we&rsquo;ll look into Go as our language of choice since it has great support for CORS. Go provides a couple of CORS frameworks, but most follow the structure of Gin CORS, a CORS middleware framework for the Gin web framework. Here&rsquo;s an example of a Gin configuration for CORS:</p>
  1642.  
  1643.  
  1644.  
  1645. <pre class="wp-block-code language-go"><code>package main
  1646.  
  1647. import (
  1648.  "time"
  1649.  
  1650.  "github.com/gin-contrib/cors"
  1651.  "github.com/gin-gonic/gin"
  1652. )
  1653.  
  1654. func main() {
  1655.  router := gin.Default()
  1656.  router.Use(cors.New(cors.Config{
  1657.    AllowOrigins:     []string{"https://foo.com"},
  1658.    AllowMethods:     []string{"PUT", "PATCH"},
  1659.    AllowHeaders:     []string{"Origin"},
  1660.    ExposeHeaders:    []string{"Content-Length"},
  1661.    AllowCredentials: true,
  1662.    AllowOriginFunc: func(origin string) bool {
  1663.      return origin == "https://github.com"
  1664.    }
  1665.  }))
  1666.  router.Run()
  1667. }</code></pre>
  1668.  
  1669.  
  1670.  
  1671. <p>Now that we&rsquo;ve modeled the <code>router.Use</code> method and <code>cors.New</code> &mdash; ensuring that <code>cors.Config</code> structure is at some point put into a <code>router.Use</code> function for actual use &mdash; we should then check all <code>cors.Config</code> structures for appropriate headers.</p>
  1672.  
  1673.  
  1674.  
  1675. <p>Next, we find the appropriate headers fields we want to model. For a basic CORS misconfiguration query, we would model <code>AllowOrigins</code>, <code>AllowCredentials</code>, <code>AllowOriginFunc</code>. My pull requests for adding GinCors and RSCors to CodeQL can be used as references if you&rsquo;re interested in seeing everything that goes into adding a framework to CodeQL. Below I&rsquo;ll discuss some of the most important details.</p>
  1676.  
  1677.  
  1678.  
  1679. <pre class="wp-block-code language-plaintext"><code> /**
  1680.   * A variable of type Config that holds the headers to be set.
  1681.   */
  1682.  class GinConfig extends Variable {
  1683.    SsaWithFields v;
  1684.  
  1685.    GinConfig() {
  1686.      this = v.getBaseVariable().getSourceVariable() and
  1687.      v.getType().hasQualifiedName(packagePath(), "Config")
  1688.    }
  1689.  
  1690.    /**
  1691.     * Get variable declaration of GinConfig
  1692.     */
  1693.    SsaWithFields getV() { result = v }
  1694.  }</code></pre>
  1695.  
  1696.  
  1697.  
  1698. <p>I modeled the Config type by using SSAWithFields, which is a <a href="https://en.wikipedia.org/wiki/Static_single-assignment_form">single static assignment</a> with fields. By using <code>getSourceVariable()</code>, we can get the variable that the structure was assigned to, which can help us see where the config is used. This allows us to find track variables that contain the CORS config structure across the codebase, including ones that are often initialized like this:</p>
  1699.  
  1700.  
  1701.  
  1702. <pre class="wp-block-code language-go"><code>func main() {
  1703. ...
  1704. // We can now track the corsConfig variable for further updates,such as when one of the fields is updated.
  1705. corsConfig:= cors.New(cors.Config{
  1706. ...
  1707. })}</code></pre>
  1708.  
  1709.  
  1710.  
  1711. <p>Now that we have the variable containing the relevant structure, we want to find all the instances where the variable is written to. By doing this, we can get an understanding of the relevant property values that have been assigned to it, and thus decide whether the CORS config is misconfigured.</p>
  1712.  
  1713.  
  1714.  
  1715. <pre class="wp-block-code language-plaintext"><code> /**
  1716.   * A write to the value of Access-Control-Allow-Origins header
  1717.   */
  1718.  class AllowOriginsWrite extends UniversalOriginWrite {
  1719.    DataFlow::Node base;
  1721. // This models all writes to the AllowOrigins field of the Config type
  1722.    AllowOriginsWrite() {
  1723.  
  1724.      exists(Field f, Write w |
  1725.        f.hasQualifiedName(packagePath(), "Config", "AllowOrigins") and
  1726.        w.writesField(base, f, this) and
  1727.  
  1728. // To ensure we are finding the correct field, we look for a write of type string (SliceLit)
  1729.        this.asExpr() instanceof SliceLit
  1730.      )
  1731.  
  1732.    }
  1733.  
  1734.    /**
  1735.     * Get config variable holding header values
  1736.     */
  1737.    override GinConfig getConfig() {
  1738.      exists(GinConfig gc |
  1739.        (
  1740.          gc.getV().getBaseVariable().getDefinition().(SsaExplicitDefinition).getRhs() =
  1741.            base.asInstruction() or
  1742.          gc.getV().getAUse() = base
  1743.        ) and
  1744.        result = gc
  1745.      )
  1746.    }
  1747.  }</code></pre>
  1748.  
  1749.  
  1750.  
  1751. <p>By adding the <code>getConfig</code> function, we return the previously created <code>GinConfig</code>, which allows us to verify that any writes to relevant headers affect the same configuration structure. For example, a developer may create a config that has a vulnerable origin and another config that allows credentials. The config that allows credentials wouldn&rsquo;t be highlighted because only configs with vulnerable origins would create a security issue. By allowing CORS relevant header writes from different frameworks to all extend <code>UniversalOriginWrite</code> and <code>UniversalCredentialsWrite</code>, we can use those in our CORS misconfiguration query.&nbsp;</p>
  1752.  
  1753.  
  1754.  
  1755. <h2 class="wp-block-heading" id="writing-cors-misconfiguration-queries-in-codeql">Writing CORS misconfiguration queries in CodeQL</h2>
  1756.  
  1757.  
  1758.  
  1759. <p>CORS issues are separated into two types: those without credentials (where we&rsquo;re looking for * or null) and CORS with credentials (where we&rsquo;re looking for origin reflection or null). If you want to keep the CodeQL query simple, you can create one query for each type of CORS vulnerability and assign their severity accordingly. For the Go language, CodeQL only has a &ldquo;CORS with credentials&rdquo; type of query because it&rsquo;s applicable to all applications.&nbsp;</p>
  1760.  
  1761.  
  1762.  
  1763. <p>Let&rsquo;s tie in the models we just created above to see how they&rsquo;re used in the Go CORS misconfiguration query itself.&nbsp;</p>
  1764.  
  1765.  
  1766.  
  1767. <pre class="wp-block-code language-plaintext"><code>from DataFlow::ExprNode allowOriginHW, string message
  1768. where
  1769.  allowCredentialsIsSetToTrue(allowOriginHW) and
  1770.  (
  1771.    flowsFromUntrustedToAllowOrigin(allowOriginHW, message)
  1772.    or
  1773.    allowOriginIsNull(allowOriginHW, message)
  1774.  ) and
  1775.  not flowsToGuardedByCheckOnUntrusted(allowOriginHW)
  1776. ...
  1777. select allowOriginHW, message</code></pre>
  1778.  
  1779.  
  1780.  
  1781. <p>This query is only interested in critical vulnerabilities, so it checks whether credentials are allowed, and whether the allowed origins either come from a remote source or are hardcoded as null. In order to prevent false positives, it checks if there are certain guards &mdash; such as string comparisons &mdash;&nbsp; before the remote source gets to the origin. Let&rsquo;s take a closer look at the predicate <code>allowCredentialsIsSetToTrue</code>.</p>
  1782.  
  1783.  
  1784.  
  1785. <pre class="wp-block-code language-plaintext"><code>/**
  1786. * Holds if the provided `allowOriginHW` HeaderWrite's parent ResponseWriter
  1787. * also has another HeaderWrite that sets a `Access-Control-Allow-Credentials`
  1788. * header to `true`.
  1789. */
  1790. predicate allowCredentialsIsSetToTrue(DataFlow::ExprNode allowOriginHW) {
  1791.  exists(AllowCredentialsHeaderWrite allowCredentialsHW |
  1792.    allowCredentialsHW.getHeaderValue().toLowerCase() = "true"
  1793.  |
  1794.    allowOriginHW.(AllowOriginHeaderWrite).getResponseWriter() =
  1795.      allowCredentialsHW.getResponseWriter()
  1796.  )
  1797.  or
  1798. ...</code></pre>
  1799.  
  1800.  
  1801.  
  1802. <p>For the first part of the predicate, we&rsquo;ll use one of the headers we previously modeled, AllowCredentialsHeaderWrite, in order to compare headers. This will help us filter out all header writes that don&rsquo;t have credentials set.</p>
  1803.  
  1804.  
  1805.  
  1806. <pre class="wp-block-code language-plaintext"><code>  exists(UniversalAllowCredentialsWrite allowCredentialsGin |
  1807.    allowCredentialsGin.getExpr().getBoolValue() = true
  1808.  |
  1809.    allowCredentialsGin.getConfig() = allowOriginHW.(UniversalOriginWrite).getConfig() and
  1810.    not exists(UniversalAllowAllOriginsWrite allowAllOrigins |
  1811.      allowAllOrigins.getExpr().getBoolValue() = true and
  1812.      allowCredentialsGin.getConfig() = allowAllOrigins.getConfig()
  1813.    )
  1814.    or
  1815.    allowCredentialsGin.getBase() = allowOriginHW.(UniversalOriginWrite).getBase() and
  1816.    not exists(UniversalAllowAllOriginsWrite allowAllOrigins |
  1817.      allowAllOrigins.getExpr().getBoolValue() = true and
  1818.      allowCredentialsGin.getBase() = allowAllOrigins.getBase()
  1819.    )
  1820.  )
  1821. }</code></pre>
  1822.  
  1823.  
  1824.  
  1825. <p>If CORS is not set through a header, we check for CORS frameworks using <code>UniversalAllowCredentialsWrite</code>.To filter out all instances whose corresponding Origin value is set to &ldquo;*&rdquo;, we use the <code>not</code> CodeQL keyword on <code>UniversalAllowAllOriginsWrite</code>,&nbsp; since these are not applicable to this vulnerability. <code>flowsFromUntrustedToAllowOrigin</code> and <code>allowOriginIsNull</code> follow similar logic to ensure that the resulting header rights are vulnerable.</p>
  1826.  
  1827.  
  1828.  
  1829. <h2 class="wp-block-heading" id="extra-credit">Extra credit</h2>
  1830.  
  1831.  
  1832.  
  1833. <p>When you model CodeQL queries to detect vulnerabilities related to CORS, you can&rsquo;t use a one-size-fits-all approach. Instead, you have to tailor your queries to each web framework for two reasons:&nbsp;</p>
  1834.  
  1835.  
  1836.  
  1837. <ul class="wp-block-list">
  1838. <li>Each framework implements CORS policies in its own way</li>
  1839.  
  1840.  
  1841.  
  1842. <li>Vulnerability patterns depend on a framework&rsquo;s behavior</li>
  1843. </ul>
  1844.  
  1845.  
  1846.  
  1847. <p>For example, we saw before in Gin CORS that there is an <code>AllowOriginFunc</code>. After looking at the documentation or experimenting with the code, we can see that it may override <code>AllowOrigins</code>. To improve our query, we could write a CodeQL query that looks for <code>AllowOriginFunc</code>s that always return true, which will result in a high severity vulnerability if paired with credentials.</p>
  1848.  
  1849.  
  1850.  
  1851. <h2 class="wp-block-heading" id="take-this-with-you">Take this with you&nbsp;</h2>
  1852.  
  1853.  
  1854.  
  1855. <p>Once you understand the behavior of web frameworks and headers with CodeQL, it&rsquo;s simple to find security issues in your code and reduce the chance of vulnerabilities making their way into your work. The number of CodeQL languages that support CORS misconfiguration queries is still growing, and there is always room for improvement from the community .&nbsp;</p>
  1856.  
  1857.  
  1858.  
  1859. <p>If this blog has been helpful in helping you write CodeQL queries, please feel free to open anything you&rsquo;d like to share with the community in our <a href="https://github.com/GitHubSecurityLab/CodeQL-Community-Packs">CodeQL Community Packs</a>.</p>
  1860.  
  1861.  
  1862.  
  1863. <p>Finally, <a href="https://github.com/security/advanced-security/code-security">GitHub Code Security</a> can help you secure your project by detecting and suggesting a fix for bugs such as <a href="https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials/">CORS misconfiguration</a>!</p>
  1864.  
  1865.  
  1866.  
  1867. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1868. <p><strong>Explore more</strong> GitHub Security Lab <a href="https://github.blog/tag/github-security-lab/">blog posts &gt;</a></p>
  1869. </div>
  1870. </body></html>
  1871. <p>The post <a href="https://github.blog/security/application-security/modeling-cors-frameworks-with-codeql-to-find-security-vulnerabilities/">Modeling CORS frameworks with CodeQL to find security vulnerabilities</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1872. ]]></content:encoded>
  1876. <post-id xmlns="com-wordpress:feed-additions:1">89417</post-id> </item>
  1877. <item>
  1878. <title>Beyond prompt crafting: How to be a better partner for your AI pair programmer</title>
  1879. <link>https://github.blog/ai-and-ml/github-copilot/beyond-prompt-crafting-how-to-be-a-better-partner-for-your-ai-pair-programmer/</link>
  1881. <dc:creator><![CDATA[Christopher Harrison]]></dc:creator>
  1882. <pubDate>Wed, 09 Jul 2025 16:00:00 +0000</pubDate>
  1883. <category><![CDATA[AI & ML]]></category>
  1884. <category><![CDATA[GitHub Copilot]]></category>
  1885. <guid isPermaLink="false">https://github.blog/?p=89424</guid>
  1886.  
  1887. <description><![CDATA[<p>Ensuring quality code suggestions from Copilot goes beyond the perfect prompt. Context is key to success when working with your AI pair programmer.</p>
  1888. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/beyond-prompt-crafting-how-to-be-a-better-partner-for-your-ai-pair-programmer/">Beyond prompt crafting: How to be a better partner for your AI pair programmer</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1889. ]]></description>
  1890. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  1891. <html><body><p>When a developer first starts working with <a href="https://github.com/features/copilot">GitHub Copilot</a> there&rsquo;s (rightly) a focus on prompt crafting &mdash; or the art of providing good context and information to generate quality suggestions.&nbsp;</p>
  1892.  
  1893.  
  1894.  
  1895. <p>But context goes beyond typing out a couple of lines into Copilot Chat in VS Code. We want to ensure Copilot is considering the right files when performing operations, that these files are easy for Copilot to read, and that we provide Copilot any extra guidance it may need about the project or specific task.&nbsp;</p>
  1896.  
  1897.  
  1898.  
  1899. <p>So let&rsquo;s explore taking the next step beyond prompt crafting, and think about how we can be a better partner for our AI pair programmer.</p>
  1900.  
  1901.  
  1902.  
  1903. <h2 class="wp-block-heading" id="h-context-is-key">Context is key</h2>
  1904.  
  1905.  
  1906.  
  1907. <p>I always like to talk about context by starting with a story. The other day my partner and I woke up and she said, &ldquo;Let&rsquo;s go to brunch!&rdquo; Fantastic! Who doesn&rsquo;t love brunch?&nbsp;</p>
  1908.  
  1909.  
  1910.  
  1911. <p>I recommended a spot, one of our favorites, and she said, &ldquo;You know&hellip; we&rsquo;ve been there quite a bit lately. I&rsquo;d like to try something different.&rdquo; I recommended another spot to which she replied, &ldquo;Now that I&rsquo;m thinking about it, I really want waffles. Let&rsquo;s find somewhere that does good waffles.&rdquo;</p>
  1912.  
  1913.  
  1914.  
  1915. <p>This conversation is, of course, pretty normal. My partner asked a question, I responded, she provided more context, and back and forth we went. All of my suggestions were perfectly reasonable based on the information I had, and when she didn&rsquo;t hear what she was expecting she provided a bit more guidance. As we continued talking, she realized she had a craving for waffles, which she discovered as she considered my suggestions.</p>
  1916.  
  1917.  
  1918.  
  1919. <p>This is very much how we both talk with other people, but also how we approach working with generative AI tools, including Copilot. We ask questions, get answers, and work back and forth providing more context and making decisions based on what we see.&nbsp;</p>
  1920.  
  1921.  
  1922.  
  1923. <p>If we don&rsquo;t receive the suggestions we&rsquo;re expecting, or if something isn&rsquo;t built to the specs we had in mind, it&rsquo;s very likely Copilot didn&rsquo;t have the context it needed &mdash; just as I didn&rsquo;t have the context to suggest somewhere new when I started the conversation with my partner.</p>
  1924.  
  1925.  
  1926.  
  1927. <h2 class="wp-block-heading" id="h-how-github-copilot-works-with-code">How GitHub Copilot works with code</h2>
  1928.  
  1929.  
  1930.  
  1931. <p>To understand how Copilot in the IDE gets its context, it&rsquo;s important to understand how it works. Except for <a href="https://github.blog/news-insights/product-news/from-pair-to-peer-programmer-our-vision-for-agentic-workflows-in-github-copilot/">agent mode, which performs external tasks</a>, Copilot doesn&rsquo;t build or run the code as it generates code suggestions. In fact, it behaves very similarly to, well, a pair programmer. It reads the code (and comments) of the files we&rsquo;ve pointed it at just as another developer would.&nbsp;</p>
  1932.  
  1933.  
  1934.  
  1935. <p>But unlike a teammate, Copilot doesn&rsquo;t have &ldquo;institutional knowledge,&rdquo; or the background information that comes with experience (although <a href="https://docs.github.com/en/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot">you can add custom instructions</a>, but more on that later). This could be the history of why things were built a certain way (which isn&rsquo;t documented somewhere but everyone just &ldquo;knows&rdquo; &#128580;), that an internal library or framework that should always be used, or patterns that need to be followed.</p>
  1936.  
  1937.  
  1938.  
  1939. <p>Obviously, all of this background info is important to get the right code suggestions from Copilot. If we&rsquo;re using a data abstraction layer (DAL), for instance, but Copilot is generating raw SQL code, the suggestions aren&rsquo;t going to be that helpful.&nbsp;</p>
  1940.  
  1941.  
  1942.  
  1943. <p>The problem isn&rsquo;t that Copilot is generating invalid code. Instead, it&rsquo;s lacking the context to generate the code in the format and structure we need. Basically, we want waffles and it&rsquo;s giving us an omelette. Let&rsquo;s see what we can do to get waffles.</p>
  1944.  
  1945.  
  1946.  
  1947. <h2 class="wp-block-heading" id="h-using-code-comments-to-improve-copilot-s-suggestions-through-better-context">Using code comments to improve Copilot&rsquo;s suggestions through better context</h2>
  1948.  
  1949.  
  1950.  
  1951. <p>There&rsquo;s a common belief that quality code shouldn&rsquo;t need comments, and that adding comments is a &ldquo;code smell,&rdquo; or an indication that something could be improved. While it&rsquo;s noble to strive to write code that&rsquo;s as readable as possible, it&rsquo;s something we often fall short of in our day-to-day work.</p>
  1952.  
  1953.  
  1954.  
  1955. <p>Even when we do &ldquo;hit the mark&rdquo;, we need to remember that just because code might be readable to one developer, it doesn&rsquo;t mean it&rsquo;s readable to all developers. A couple of lines of comments can go a long way to ensuring readability.</p>
  1956.  
  1957.  
  1958.  
  1959. <p>The same holds true for Copilot! As we highlighted above, Copilot doesn&rsquo;t run or compile your code except in specific situations. Instead, it &ldquo;reads&rdquo; your code much like a developer would.&nbsp;</p>
  1960.  
  1961.  
  1962.  
  1963. <p>Following the guidelines for having <a href="https://peps.python.org/pep-0257/">docstrings</a> in functions/modules in Python, for example, can help ensure Copilot has a better understanding of what the code does and how it does it. This allows Copilot to generate higher-quality suggestions by using your existing code to ensure any new code follows the same patterns and practices already in place.</p>
  1964.  
  1965.  
  1966.  
  1967. <figure class="wp-block-table"><table class="has-fixed-layout"><tbody><tr><td>&#128161; <strong>Pro tip</strong>: <strong>When you open a file, it&rsquo;s always a good idea to leave it in a better state than when you found it</strong>. One of the little improvements you could make is to add a few comments to places to help describe the code. You could always ask Copilot to generate the first draft of the comments, and you can add any additional details Copilot missed!</td></tr></tbody></table></figure>
  1968.  
  1969.  
  1970.  
  1971. <h2 class="wp-block-heading" id="the-benefit-of-using-custom-instructions-with-github-copilot-on-your-projects">The benefit of using custom instructions with GitHub Copilot on your projects</h2>
  1972.  
  1973.  
  1974.  
  1975. <p>To generate quality suggestions, Copilot benefits from having context around what you&rsquo;re doing and how you&rsquo;re doing it. Knowing the technology and frameworks you&rsquo;re using, what coding standards to follow, and even some background on what you&rsquo;re building helps Copilot raise the quality bar on its suggestions. This is where <a href="https://docs.github.com/en/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot">custom instructions</a> come into play.</p>
  1976.  
  1977.  
  1978.  
  1979. <p>Custom instructions help you provide all of this background information and set ground rules (things like what APIs you want to call, naming patterns you want followed, or even stylistic preferences).&nbsp;</p>
  1980.  
  1981.  
  1982.  
  1983. <p>To get started, you place everything that&rsquo;s important into a file named <strong>copilot-instructions.md</strong> inside your <strong>.github</strong> folder. It&rsquo;s a markdown file, so you can create sections like <strong>Project structure</strong>, <strong>Technologies</strong>, <strong>Coding standards</strong>, and any other notes you want Copilot to consider on every single chat request. You can also add any guidance on tasks where you see Copilot not always choosing the right path, like maybe using class-based React components instead of function-based components (all the cool kids are using function based-components).</p>
  1984.  
  1985.  
  1986.  
  1987. <p>Keep in mind that custom instructions are sent to Copilot on <strong>every single</strong> chat request. You want to keep your instructions limited to information that&rsquo;s relevant to the entire project. Providing too many details can make it a bit harder for Copilot to determine what&rsquo;s important.</p>
  1988.  
  1989.  
  1990.  
  1991. <p>In simpler terms, you can basically think about the one friend you have who maybe shares too much detail when they&rsquo;re telling a story, and how it can make it tricky to focus on the main plot points. It&rsquo;s the same thing with Copilot. Provide some project-level guidance and overviews, so it best understands the environment in which it&rsquo;s working.</p>
  1992.  
  1993.  
  1994.  
  1995. <p>A good rule of thumb is to have sections that highlight the various aspects of your project. An outline for a monorepo with a client and server for a web app might look like this:</p>
  1996.  
  1997.  
  1998.  
  1999. <pre class="wp-block-code language-plaintext"><code># Tailspin Toys Crowd Funding
  2000.  
  2001. Website for crowd funding for games.
  2002.  
  2003. ## Backend
  2004.  
  2005. The backend is written using:
  2006.  
  2007. - Flask for the API
  2008. - SQLAlchemy for the ORM
  2009. - SQLite for the database
  2010.  
  2011. ## Frontend
  2012.  
  2013. The frontend is written using:
  2014.  
  2015. - Astro for routing
  2016. - Svelte for the components and interactivity
  2017. - Tailwind CSS for styling
  2018.  
  2019. ## Code standards
  2020.  
  2021. - Use good variable names, avoiding abbreviations and single letter variables
  2022. - Use the casing standard for the language in question (camelCasing for TypeScript, snake_casing for Python, etc.)
  2023. - Use type hints in all languages which support them
  2024.  
  2025. ## Project structure
  2026.  
  2027. - `client` contains the frontend code
  2028. - `docs` contains the documentation for the project
  2029. - `scripts` contains the scripts used to install services, start the app, and run tests
  2030. - `server` contains the backend code </code></pre>
  2031.  
  2032.  
  2033.  
  2034. <p>This is relatively abbreviated, but notice the structure. We&rsquo;re telling Copilot about the project we have, its structure, the techs in use, and some guidance about how we want our code to be created. We don&rsquo;t have anything specific to tasks, like maybe writing unit tests, because we have another way to tell Copilot that information!</p>
  2035.  
  2036.  
  2037.  
  2038. <h2 class="wp-block-heading" id="providing-specific-instructions-for-specific-tasks">Providing specific instructions for specific tasks</h2>
  2039.  
  2040.  
  2041.  
  2042. <p>Continuing our conversation about instruction files&hellip; (I&rsquo;m Gen-X, so <a href="https://www.reddit.com/r/GenX/comments/108t56v/so_umm_theres_that/">I&rsquo;m required to use the Gen-X ellipsis at least once</a>.)</p>
  2043.  
  2044.  
  2045.  
  2046. <p>VS Code and Codespaces also support <a href="https://code.visualstudio.com/docs/copilot/copilot-customization#_use-instructionsmd-files"><code>.instructions.md</code></a> files. These are just like the <code>copilot-instructions.md</code> file we spoke about previously, only they&rsquo;re designed to be used for specific types of tasks and placed in <code>.github/instructions</code>.</p>
  2047.  
  2048.  
  2049.  
  2050. <p>Consider a project where you&rsquo;re building out <a href="https://flask.palletsprojects.com/en/stable/blueprints/">Flask Blueprints</a> for the routes for an API. There might be requirements around how the file should be structured and how unit tests should be created. You can create a custom instructions file called <code>flask-endpoint.instructions.md</code>, place it in <code>.github/instructions</code>, then add it as context to the chat when you request Copilot to create a new endpoint. It might look something like:</p>
  2051.  
  2052.  
  2053.  
  2054. <pre class="wp-block-code language-plaintext"><code># Endpoint creation guidelines
  2055.  
  2056. ## Endpoint notes
  2057.  
  2058. - Endpoints are created in Flask using blueprints
  2059. - Create a centralized function for accessing data
  2060. - All endpoints require tests
  2061.    - Use the `unittest` module for testing
  2062.    - All tests must pass
  2063.    - A script is provided to run tests at `scripts/run-server-tests.sh`
  2064.  
  2065. ## Project notes
  2066.  
  2067. - The Python virtual environment is located in the root of the project in a **venv** folder
  2068. - Register all blueprints in `server/app.py`
  2069. - Use the [test instructions](./python-tests.instructions.md) when creating tests
  2070.  
  2071. ## Prototype files
  2072.  
  2073. - [Endpoint prototype](../../server/routes/games.py)
  2074. - [Tests prototype](../../server/tests/test_games.py)</code></pre>
  2075.  
  2076.  
  2077.  
  2078. <p>Notice how we&rsquo;re providing specific information about how we want our endpoints created. You&rsquo;ll also notice we&rsquo;re even linking out to other files <strong>in the project</strong> using hyperlinks &mdash; both existing files for Copilot to use as representative examples, and other instructions files for more information.</p>
  2079.  
  2080.  
  2081.  
  2082. <p>Additionally, you can also apply instructions to file types based on a pattern. Let&rsquo;s take the tests for example. If they were all located in <code>server/tests</code>, and started with <code>test_</code>, you could add metadata to the top to ensure Copilot always includes the instructions when working on a test file:</p>
  2083.  
  2084.  
  2085.  
  2086. <pre class="wp-block-code language-plaintext"><code>---
  2087. applyTo: server/tests/test_*.py
  2088. ---</code></pre>
  2089.  
  2090.  
  2091.  
  2092. <p>This gives you a lot of flexibility in ensuring Copilot is able to access the right information at the right time. This can be done explicitly by adding in the instructions file, or implicitly by providing a pattern for Copilot to use when building certain files.</p>
  2093.  
  2094.  
  2095.  
  2096. <p>Just as before, these are artifacts in your repository. It can take some time to build a collection of instruction files, but that investment will pay off in the form of higher-quality code and, in turn, improved productivity.</p>
  2097.  
  2098.  
  2099.  
  2100. <h2 class="wp-block-heading" id="fully-reusable-prompts">Fully reusable prompts</h2>
  2101.  
  2102.  
  2103.  
  2104. <p>The VS Code team recently published a new, experimental feature called prompt files. Because they&rsquo;re still in development I don&rsquo;t want to dig too deep into them, but you can read more about <a href="https://code.visualstudio.com/docs/copilot/copilot-customization#_prompt-files-experimental">prompt files in the docs</a> and see how to utilize them as they are currently implemented. In a nutshell, they allow you to effectively create scripted prompts for Copilot. You can choose the Copilot modes they&rsquo;re available in (ask, edit and agent), the tools to be called, and what questions to ask the developer. These can be created by the team for enhanced reuse and consistency.</p>
  2105.  
  2106.  
  2107.  
  2108. <h2 class="wp-block-heading" id="extending-github-copilots-capabilities-with-model-context-protocol-mcp">Extending GitHub Copilot&rsquo;s capabilities with Model Context Protocol (MCP)</h2>
  2109.  
  2110.  
  2111.  
  2112. <p>In an ever changing software development landscape, we need to ensure the information we&rsquo;re working with is accurate, relevant, and up to date. This is what MCP, or Model Context Protocol, is built for! Developed initially by Anthropic, MCP is an open source protocol that lets organizations expose their services or data to generative AI tools.&nbsp;</p>
  2113.  
  2114.  
  2115.  
  2116. <p>When you add an MCP server to your IDE, you allow Copilot to &ldquo;phone a friend&rdquo; to find information, or even perform tasks on your behalf. For example, the <a href="https://github.com/microsoft/playwright-mcp">Playwright MCP server</a> helps create <a href="https://playwright.dev/">Playwright</a> end-to-end tests, while the <a href="https://github.com/github/github-mcp-server">GitHub MCP server</a> provides access to GitHub services like repositories, issues, and pull requests.</p>
  2117.  
  2118.  
  2119.  
  2120. <p>Let&rsquo;s say, for instance, that you added the Playwright MCP server to your IDE. When you ask Copilot to create a new test to validate functionality on your website, Copilot can consult an authoritative source, allowing it to generate the best code it can.</p>
  2121.  
  2122.  
  2123.  
  2124. <p>You can even create your own MCP servers! One question I commonly hear is about how you can allow Copilot to look through an internal codebase or suite of libraries. With a custom MCP server, you could provide a facade for Copilot to perform these types of queries, then utilize the information discovered to suggest code based on your internal environment.</p>
  2125.  
  2126.  
  2127.  
  2128. <p>MCP is large enough to have its own blog post, which my colleague Cassidy wrote, sharing <a href="https://github.blog/ai-and-ml/llms/what-the-heck-is-mcp-and-why-is-everyone-talking-about-it/">tips, tricks, and insights about MCP</a>.</p>
  2129.  
  2130.  
  2131.  
  2132. <h2 class="wp-block-heading" id="thinking-beyond-prompts">Thinking beyond prompts</h2>
  2133.  
  2134.  
  2135.  
  2136. <p>Let me be clear: prompt crafting is important. It&rsquo;s one of the first skills any developer should learn when they begin using GitHub Copilot.&nbsp;</p>
  2137.  
  2138.  
  2139.  
  2140. <p>But writing a good prompt is only one piece Copilot considers when generating an answer. By using the best practices highlighted above &mdash; comments and good code, custom instructions, and MCP servers &mdash; you can help Copilot understand what you want it to do and how you want it to do it. To bring it back to my analogy, you can ensure Copilot knows when you want waffles instead of omelettes.</p>
  2141.  
  2142.  
  2143.  
  2144. <p>And on that note, I&rsquo;m off to brunch.</p>
  2145.  
  2146.  
  2147.  
  2148. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2149. <p><strong>Get started</strong> with <a href="https://github.com/features/copilot">GitHub Copilot &gt;</a></p>
  2150. </div>
  2151. </body></html>
  2152. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/beyond-prompt-crafting-how-to-be-a-better-partner-for-your-ai-pair-programmer/">Beyond prompt crafting: How to be a better partner for your AI pair programmer</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2153. ]]></content:encoded>
  2157. <post-id xmlns="com-wordpress:feed-additions:1">89424</post-id> </item>
  2158. <item>
  2159. <title>Git security vulnerabilities announced</title>
  2160. <link>https://github.blog/open-source/git/git-security-vulnerabilities-announced-6/</link>
  2162. <dc:creator><![CDATA[Taylor Blau]]></dc:creator>
  2163. <pubDate>Tue, 08 Jul 2025 17:02:11 +0000</pubDate>
  2164. <category><![CDATA[Git]]></category>
  2165. <category><![CDATA[Open Source]]></category>
  2166. <category><![CDATA[security alert]]></category>
  2167. <guid isPermaLink="false">https://github.blog/?p=89409</guid>
  2168.  
  2169. <description><![CDATA[<p>Today, the Git project released new versions to address seven security vulnerabilities that affect all prior versions of Git.</p>
  2170. <p>The post <a href="https://github.blog/open-source/git/git-security-vulnerabilities-announced-6/">Git security vulnerabilities announced</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2171. ]]></description>
  2172. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  2173. <html><body><p>Today, the Git project <a href="https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g/">released new versions</a> to address seven security vulnerabilities that affect all prior versions of Git.</p>
  2174.  
  2175.  
  2176.  
  2177. <h2 class="wp-block-heading" id="h-vulnerabilities-in-git">Vulnerabilities in Git</h2>
  2178.  
  2179.  
  2180.  
  2181. <h3 class="wp-block-heading" id="h-cve-2025-48384">CVE-2025-48384</h3>
  2182.  
  2183.  
  2184.  
  2185. <p>When reading a <a href="https://git-scm.com/book/en/v2/Customizing-Git-Git-Configuration">configuration</a> value, Git will strip any trailing carriage return (CR) and line feed (LF) characters. When writing a configuration value, however, Git does not quote trailing CR characters, causing them to be lost when they are read later on. When initializing a <a href="https://git-scm.com/docs/gitsubmodules">submodule</a> whose path contains a trailing CR character, the stripped path is used, causing the submodule to be checked out in the wrong place.</p>
  2186.  
  2187.  
  2188.  
  2189. <p>If a <a href="https://en.wikipedia.org/wiki/Symbolic_link">symlink</a> already exists between the stripped path and the submodule&rsquo;s <a href="https://git-scm.com/docs/githooks">hooks</a> directory, an attacker can execute arbitrary code through the submodule&rsquo;s <code>post-checkout</code> hook.</p>
  2190.  
  2191.  
  2192.  
  2193. <p>[<a href="https://github.com/git/git/compare/d2bc61fcabd6cfa582d286bed1ce20d5d7c58d52...05e9cd64ee23bbadcea6bcffd6660ed02b8eab89">source</a>]</p>
  2194.  
  2195.  
  2196.  
  2197. <h3 class="wp-block-heading" id="h-cve-2025-48385">CVE-2025-48385</h3>
  2198.  
  2199.  
  2200.  
  2201. <p>When cloning a repository, Git can optionally fetch a <a href="https://git-scm.com/docs/git-bundle">bundle</a>, allowing the server to offload a portion of the clone to a <a href="https://en.wikipedia.org/wiki/Content_delivery_network">CDN</a>. The Git client does not properly validate the advertised bundle(s), allowing the remote side to perform protocol injection. When a specially crafted bundle is advertised, the remote end can cause the client to write the bundle to an arbitrary location, which may lead to code execution similar to the previous CVE.</p>
  2202.  
  2203.  
  2204.  
  2205. <p>[<a href="https://github.com/git/git/compare/d61cfed2c23705fbeb9c0d08f59e75ee08738950...35cb1bb0b92c132249d932c05bbd860d410e12d4">source</a>]</p>
  2206.  
  2207.  
  2208.  
  2209. <h3 class="wp-block-heading" id="h-cve-2025-48386-windows-only">CVE-2025-48386 (Windows only)</h3>
  2210.  
  2211.  
  2212.  
  2213. <p>When cloning from an authenticated remote, Git uses a <a href="https://git-scm.com/docs/gitcredentials">credential helper</a> in order to authenticate the request. Git includes a handful of <a href="https://git-scm.com/doc/credential-helpers">credential helpers</a>, including <a href="https://github.com/git/git/tree/v2.43.7/contrib/credential/wincred">Wincred</a>, which uses the <a href="https://support.microsoft.com/en-us/windows/credential-manager-in-windows-1b5c916a-6a16-889f-8581-fc16e8165ac0">Windows Credential Manager</a> to store its credentials.</p>
  2214.  
  2215.  
  2216.  
  2217. <p>Wincred uses the contents of a static buffer as a unique key to store and retrieve credentials. However, it does not properly bounds check the remaining space in the buffer, leading to potential buffer overflows.</p>
  2218.  
  2219.  
  2220.  
  2221. <p>[<a href="https://github.com/git/git/compare/2d22f0cd07c308d7ff25bbf4ec8f1bb53b4bcda7...9de345cb273cc7faaeda279c7e07149d8a15a319">source</a>]</p>
  2222.  
  2223.  
  2224.  
  2225. <h1 class="wp-block-heading" id="h-vulnerabilities-in-git-gui-and-gitk">Vulnerabilities in Git GUI and Gitk</h1>
  2226.  
  2227.  
  2228.  
  2229. <p>This release resolves four new CVEs related to <a href="https://git-scm.com/docs/gitk">Gitk</a> and <a href="https://git-scm.com/docs/git-gui">Git GUI</a>. Both tools are <a href="https://en.wikipedia.org/wiki/Tcl">Tcl/Tk</a>-based graphical interfaces used to interact with Git repositories. Gitk is focused on showing a repository&rsquo;s history, whereas Git GUI focuses on making changes to existing repositories.</p>
  2230.  
  2231.  
  2232.  
  2233. <h3 class="wp-block-heading" id="h-cve-2025-27613-gitk">CVE-2025-27613 (Gitk)</h3>
  2234.  
  2235.  
  2236.  
  2237. <p>When running Gitk in a specially crafted repository without additional command-line arguments, Gitk can write and truncate arbitrary writable files. The &ldquo;Support per-file encoding&rdquo; option must be enabled; however, the operation of &ldquo;Show origin of this line&rdquo; is affected regardless.</p>
  2238.  
  2239.  
  2240.  
  2241. <p>[<a href="https://github.com/git/git/compare/4e7e3b792e6973e09de6ddc191b86bbc245c53dd...67a128b91e25978a15f9f7e194d81b441d603652">source</a>]</p>
  2242.  
  2243.  
  2244.  
  2245. <h3 class="wp-block-heading" id="h-cve-2025-27614-gitk">CVE-2025-27614 (Gitk)</h3>
  2246.  
  2247.  
  2248.  
  2249. <p>If a user is tricked into running <code>gitk filename</code> (where <code>filename</code> has a particular structure), they may run arbitrary scripts supplied by the attacker, leading to arbitrary code execution.</p>
  2250.  
  2251.  
  2252.  
  2253. <p>[<a href="https://github.com/git/git/compare/664d4fa692cb8637a7c9297c94abf0de8593e585...8e3070aa5e331be45d4d03e3be41f84494fce129">source</a>]</p>
  2254.  
  2255.  
  2256.  
  2257. <h3 class="wp-block-heading" id="h-cve-2025-46334-git-gui-windows-only">CVE-2025-46334 (Git GUI, Windows only)</h3>
  2258.  
  2259.  
  2260.  
  2261. <p>If a malicious repository includes an executable <code>sh.exe</code>, or common <a href="https://git-scm.com/docs/gitattributes#_performing_text_diffs_of_binary_files">textconv</a> programs (for e.g.,&nbsp; <code>astextplain</code>, <code>exif</code>, or <code>ps2ascii</code>), path lookup on Windows may locate these executables in the working tree. If a user running Git GUI in such a repository selects either the &ldquo;Git Bash&rdquo; or &ldquo;Browse Files&rdquo; from the menu, these programs may be invoked, leading to arbitrary code execution.</p>
  2262.  
  2263.  
  2264.  
  2265. <p>[<a href="https://github.com/git/git/compare/27fbab4898620183e608865beffd960139c04d58...a1ccd2512072cf52835050f4c97a4fba9f0ec8f9">source</a>]</p>
  2266.  
  2267.  
  2268.  
  2269. <h3 class="wp-block-heading" id="h-cve-2025-46335-git-gui">CVE-2025-46335 (Git GUI)</h3>
  2270.  
  2271.  
  2272.  
  2273. <p>When a user is tricked into editing a file in a specially named directory in an untrusted repository, Git GUI can create and overwrite arbitrary writable files, similar to CVE-2025-27613.</p>
  2274.  
  2275.  
  2276.  
  2277. <p>[<a href="https://github.com/git/git/compare/a7d1716fa648f6557ea9c91e0f04bae2e8738e6a...a437f5bc93330a70b42a230e52f3bd036ca1b1da">source</a>]</p>
  2278.  
  2279.  
  2280.  
  2281. <h2 class="wp-block-heading" id="h-upgrade-to-the-latest-git-version">Upgrade to the latest Git version</h2>
  2282.  
  2283.  
  2284.  
  2285. <p>The most effective way to protect against these vulnerabilities is to upgrade to Git 2.50.1, the newest release containing fixes for the aforementioned vulnerabilities. If you can&rsquo;t upgrade immediately, you can reduce your risk by doing the following:</p>
  2286.  
  2287.  
  2288.  
  2289. <ul class="wp-block-list">
  2290. <li>Avoid running <code>git clone</code> with <code>--recurse-submodules</code> against untrusted repositories.</li>
  2291.  
  2292.  
  2293.  
  2294. <li>Disable auto-fetching bundle URIs by setting the <code>transfer.bundleURI</code> configuration value to &ldquo;false.&rdquo;</li>
  2295.  
  2296.  
  2297.  
  2298. <li>Avoid using the <code>wincred</code> credential helper on Windows.</li>
  2299.  
  2300.  
  2301.  
  2302. <li>Avoid running Gitk and Git GUI in untrusted repositories.</li>
  2303. </ul>
  2304.  
  2305.  
  2306.  
  2307. <p>In order to protect users against attacks related to these vulnerabilities, GitHub has taken proactive steps. Specifically, we have scheduled releases of <a href="https://github.com/apps/desktop">GitHub Desktop</a>. <a href="https://github.com/features/codespaces">GitHub Codespaces</a> and <a href="https://github.com/features/actions">GitHub Actions</a> will update their versions of Git shortly. GitHub itself, including <a href="https://github.com/enterprise">Enterprise Server</a>, is unaffected by these vulnerabilities.</p>
  2308.  
  2309.  
  2310.  
  2311. <hr class="wp-block-separator has-alpha-channel-opacity">
  2312.  
  2313.  
  2314.  
  2315. <p>CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386 were discovered by <a href="https://github.com/dgl">David Leadbeater</a>. <a href="https://github.com/jltobler">Justin Tobler</a> and <a href="https://github.com/pks-t">Patrick Steinhardt</a> provided fixes for CVEs 2025-48384 and 2025-48385 respectively. The fix for CVE-2025-48386 is joint work between <a href="https://github.com/ttaylorr">Taylor Blau</a> and <a href="https://github.com/peff">Jeff King<br><br></a>CVE-2025-46835 was found and fixed by <a href="https://github.com/j6t">Johannes Sixt</a>. <a href="https://github.com/mark987">Mark Levedahl</a> discovered and fixed CVE-2025-46334. <a href="https://github.com/avih">Avi Halachmi</a> discovered both CVE-2025-27613 and CVE-2025-27614, and fixed the latter. CVE-2025-27613 was fixed by Johannes Sixt.</p>
  2316. </body></html>
  2317. <p>The post <a href="https://github.blog/open-source/git/git-security-vulnerabilities-announced-6/">Git security vulnerabilities announced</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2318. ]]></content:encoded>
  2322. <post-id xmlns="com-wordpress:feed-additions:1">89409</post-id> </item>
  2323. <item>
  2324. <title>CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre</title>
  2325. <link>https://github.blog/security/vulnerability-research/cve-2025-53367-an-exploitable-out-of-bounds-write-in-djvulibre/</link>
  2327. <dc:creator><![CDATA[Kevin Backhouse]]></dc:creator>
  2328. <pubDate>Thu, 03 Jul 2025 20:52:20 +0000</pubDate>
  2329. <category><![CDATA[Security]]></category>
  2330. <category><![CDATA[Vulnerability research]]></category>
  2331. <category><![CDATA[CVE]]></category>
  2332. <category><![CDATA[GitHub Security Lab]]></category>
  2333. <category><![CDATA[linux]]></category>
  2334. <category><![CDATA[open source]]></category>
  2335. <guid isPermaLink="false">https://github.blog/?p=89368</guid>
  2336.  
  2337. <description><![CDATA[<p>DjVuLibre has a vulnerability that could enable an attacker to gain code execution on a Linux Desktop system when the user tries to open a crafted document.</p>
  2338. <p>The post <a href="https://github.blog/security/vulnerability-research/cve-2025-53367-an-exploitable-out-of-bounds-write-in-djvulibre/">CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2339. ]]></description>
  2340. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  2341. <html><body><p><a href="https://sourceforge.net/projects/djvu/">DjVuLibre</a> version 3.5.29 was released today. It fixes CVE-2025-53367 (GHSL-2025-055), an out-of-bounds (OOB) write in the <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.cpp#l570"><code>MMRDecoder::scanruns</code></a> method. The vulnerability could be exploited to gain code execution on a Linux Desktop system when the user tries to open a crafted document.</p>
  2342.  
  2343.  
  2344.  
  2345. <p>DjVu is a document file format that can be used for similar purposes to PDF. It is supported by <a href="https://gitlab.gnome.org/GNOME/evince">Evince</a> and <a href="https://gitlab.gnome.org/GNOME/papers">Papers</a>, the default document viewers on many Linux distributions. In fact, even when a DjVu file is given a filename with a .pdf extension, Evince/Papers will automatically detect that it is a DjVu document and run DjVuLibre to decode it.</p>
  2346.  
  2347.  
  2348.  
  2349. <p>Antonio found this vulnerability while researching the Evince document reader. He found the bug with fuzzing.</p>
  2350.  
  2351.  
  2352.  
  2353. <p>Kev has developed a proof of concept exploit for the vulnerability, as demoed in this video.</p>
  2354.  
  2355.  
  2356.  
  2357. <figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
  2358. <iframe loading="lazy" title="CVE-2025-53367: Exploitable OOB write in DjVuLibre" width="500" height="281" src="https://www.youtube.com/embed/32kROHYhYVM?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
  2359. </div></figure>
  2360.  
  2361.  
  2362.  
  2363. <p>The POC works on a fully up-to-date Ubuntu 25.04 (x86_64) with all the standard security protections enabled. To explain what&rsquo;s happening in the video:</p>
  2364.  
  2365.  
  2366.  
  2367. <ol class="wp-block-list">
  2368. <li>Kev clicks on a malicious DjVu document in his <code>~/Downloads</code> directory.</li>
  2369.  
  2370.  
  2371.  
  2372. <li>The file is named <code>poc.pdf</code>, but it&rsquo;s actually in DjVu format.</li>
  2373.  
  2374.  
  2375.  
  2376. <li>The default document viewer (<code>/usr/bin/papers</code>) loads the document, detects that it&rsquo;s in DjVu format, and uses DjVuLibre to decode it.</li>
  2377.  
  2378.  
  2379.  
  2380. <li>The file exploits the OOB write vulnerability and triggers a call to <code>system("google-chrome https://www.youtube.com/&hellip;")</code>.</li>
  2381.  
  2382.  
  2383.  
  2384. <li>Rick Astley appears.</li>
  2385. </ol>
  2386.  
  2387.  
  2388.  
  2389. <p>Although the POC is able to bypass <a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization">ASLR</a>, it&rsquo;s somewhat unreliable: it&rsquo;ll work 10 times in a row and then suddenly stop working for several minutes. But this is only a first version, and we believe it&rsquo;s possible to create an exploit that&rsquo;s significantly more reliable.</p>
  2390.  
  2391.  
  2392.  
  2393. <p>You may be wondering: why Astley, and not a calculator? That&rsquo;s because <code>/usr/bin/papers</code> runs under an <a href="https://apparmor.net/">AppArmor</a> profile. The profile prohibits you from starting an arbitrary process but makes an exception for google-chrome. So it was easier to play a YouTube video than pop a calc. But the AppArmor profile is not particularly restrictive. For example, it lets you write arbitrary files to the user&rsquo;s home directory, except for the really obvious one like <code>~/.bashrc</code>. So it wouldn&rsquo;t prevent a determined attacker from gaining code execution.</p>
  2394.  
  2395.  
  2396.  
  2397. <h1 class="wp-block-heading" id="h-vulnerability-details">Vulnerability Details</h1>
  2398.  
  2399.  
  2400.  
  2401. <p>The <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.cpp#l570"><code>MMRDecoder::scanruns</code></a> method is affected by an OOB-write vulnerability, because it doesn&rsquo;t check that the <code>xr</code> pointer stays within the bounds of the allocated buffer.</p>
  2402.  
  2403.  
  2404.  
  2405. <p>During the decoding process, run-length encoded data is written into two buffers: <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.h#l207"><code>lineruns</code></a> and <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.h#l209"><code>prevruns</code></a>:</p>
  2406.  
  2407.  
  2408.  
  2409. <pre class="wp-block-code"><code>//libdjvu/MMRDecoder.h
  2410. class DJVUAPI MMRDecoder : public GPEnabled
  2411. {
  2412. ...
  2413. public:
  2414.  
  2415.  unsigned short *lineruns;
  2416. ...
  2417.  unsigned short *prevruns;
  2418. ...
  2419. }</code></pre>
  2420.  
  2421.  
  2422.  
  2423. <p>The variables named <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.cpp#l583"><code>pr</code></a> and <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.cpp#l584"><code>xr</code></a> point to the current locations in those buffers.&nbsp;</p>
  2424.  
  2425.  
  2426.  
  2427. <p><code>scanruns</code> does not check that those pointers remain within the bounds of the allocated buffers.</p>
  2428.  
  2429.  
  2430.  
  2431. <pre class="wp-block-code"><code>//libdjvu/MMRDecoder.cpp
  2432. const unsigned short *
  2433. MMRDecoder::scanruns(const unsigned short **endptr)
  2434. {
  2435. ...
  2436.  // Swap run buffers
  2437.  unsigned short *pr = lineruns;
  2438.  unsigned short *xr = prevruns;
  2439.  prevruns = pr;
  2440.  lineruns = xr;
  2441. ...
  2442.  for(a0=0,rle=0,b1=*pr++;a0 &lt; width;)
  2443.    {
  2444.     ...
  2445.            *xr = rle; xr++; rle = 0;
  2446.     ...
  2447.            *xr = rle; xr++; rle = 0;
  2448. ...
  2449.          *xr = inc+rle-a0;
  2450.          xr++;
  2451. }</code></pre>
  2452.  
  2453.  
  2454.  
  2455. <p>This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with <code>pr</code> is also possible for the same reason.</p>
  2456.  
  2457.  
  2458.  
  2459. <p>We will publish the source code of our proof of concept exploit in a couple of weeks&rsquo; time in the <a href="https://github.com/github/securitylab">GitHub Security Lab repository</a>.</p>
  2460.  
  2461.  
  2462.  
  2463. <h1 class="wp-block-heading" id="h-acknowledgements">Acknowledgements</h1>
  2464.  
  2465.  
  2466.  
  2467. <p>We would like to thank L&eacute;on Bottou and Bill Riemers for responding incredibly quickly and releasing a fix less than two days after we first contacted them!</p>
  2468.  
  2469.  
  2470.  
  2471. <h1 class="wp-block-heading" id="h-timeline">Timeline</h1>
  2472.  
  2473.  
  2474.  
  2475. <ul class="wp-block-list">
  2476. <li>2025-07-01: Reported via email to the authors: L&eacute;on Bottou, Bill Riemers, Yann LeCun.</li>
  2477.  
  2478.  
  2479.  
  2480. <li>2025-07-01: Responses received from Bill Riemers and L&eacute;on Bottou.</li>
  2481.  
  2482.  
  2483.  
  2484. <li>2025-07-02: Fix commit added by L&eacute;on Bottou: <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/33f645196593d70bd5e37f55b63886c31c82c3da/">https://sourceforge.net/p/djvu/djvulibre-git/ci/33f645196593d70bd5e37f55b63886c31c82c3da/</a></li>
  2485.  
  2486.  
  2487.  
  2488. <li>2025-07-03: DjVuLibre version 3.5.29 released: <a href="https://sourceforge.net/p/djvu/www-git/ci/9748b43794440aff40bae066132aa5c22e7fd6a3/">https://sourceforge.net/p/djvu/www-git/ci/9748b43794440aff40bae066132aa5c22e7fd6a3/</a>&nbsp;</li>
  2489. </ul>
  2490. </body></html>
  2491. <p>The post <a href="https://github.blog/security/vulnerability-research/cve-2025-53367-an-exploitable-out-of-bounds-write-in-djvulibre/">CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2492. ]]></content:encoded>
  2496. <post-id xmlns="com-wordpress:feed-additions:1">89368</post-id> </item>
  2497. <item>
  2498. <title>5 ways to transform your workflow using GitHub Copilot and MCP</title>
  2499. <link>https://github.blog/ai-and-ml/github-copilot/5-ways-to-transform-your-workflow-using-github-copilot-and-mcp/</link>
  2501. <dc:creator><![CDATA[Klint Finley]]></dc:creator>
  2502. <pubDate>Wed, 02 Jul 2025 17:44:02 +0000</pubDate>
  2503. <category><![CDATA[AI & ML]]></category>
  2504. <category><![CDATA[GitHub Copilot]]></category>
  2505. <category><![CDATA[agent mode]]></category>
  2506. <category><![CDATA[MCP]]></category>
  2507. <guid isPermaLink="false">https://github.blog/?p=89268</guid>
  2508.  
  2509. <description><![CDATA[<p>Learn how to streamline your development workflow with five different MCP use cases. </p>
  2510. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/5-ways-to-transform-your-workflow-using-github-copilot-and-mcp/">5 ways to transform your workflow using GitHub Copilot and MCP</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2511. ]]></description>
  2512. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  2513. <html><body><p>Traditional AI coding assistants typically operate in isolation, limited to the code in your current workspace. Now with the introduction of the Model Context Protocol (MCP), AI development workflows are further evolving to incorporate more tools and context.&nbsp;</p>
  2514.  
  2515.  
  2516.  
  2517. <p>MCP can enable AI assistants to interact with external systems like knowledge bases, data stores, and testing applications.</p>
  2518.  
  2519.  
  2520.  
  2521. <aside data-color-mode="light" data-dark-theme="dark" data-light-theme="light_dimmed" class="wp-block-group post-aside--large p-4 p-md-6 is-style-light-dimmed has-global-padding is-layout-constrained wp-block-group-is-layout-constrained is-style-light-dimmed--5" style="border-top-width:4px">
  2522. <h3 class="wp-block-heading h5-mktg gh-aside-title is-typography-preset-h5" id="h-what-is-mcp-anyway" style="margin-top:0">What is MCP, anyway?</h3>
  2523.  
  2524.  
  2525.  
  2526. <p>The Model Context Protocol (MCP) is an open standard developed by Anthropic that helps AI assistants like GitHub Copilot securely connect to external data sources and tools. MCP addresses a common challenge with Large Language Models (LLMs): providing the right context to generate accurate and useful responses. MCP standardizes how AI tools access external context&mdash;such as your codebase, documentation, or design specifications&mdash;and makes it easier to bring this context into your development workflow. For a deeper dive into MCP and why it&rsquo;s gaining popularity, check out <a href="https://github.blog/ai-and-ml/llms/what-the-heck-is-mcp-and-why-is-everyone-talking-about-it/">Cassidy Williams&rsquo;s article on the GitHub Blog</a>.</p>
  2527. </aside>
  2528.  
  2529.  
  2530.  
  2531. <p>The real value of MCP integration is that you can now perform tasks that previously required multiple tools, context switching, and manual effort&mdash;all directly in your IDE. That means you can save time, maintain focus, and ship code faster.</p>
  2532.  
  2533.  
  2534.  
  2535. <p>In this article, we&rsquo;ll explore five practical ways MCP integrations with GitHub Copilot can streamline your workflow. We&rsquo;ll follow a realistic scenario: implementing a secure JWT (JSON Web Token) authentication system for a web application, illustrating an end-to-end workflow with MCP.</p>
  2536.  
  2537.  
  2538.  
  2539. <p>Let&rsquo;s jump in.&nbsp;</p>
  2540.  
  2541.  
  2542.  
  2543. <h2 class="wp-block-heading" id="1-using-mcp-to-bridge-design-and-development-with-figma">1. Using MCP to bridge design and development with Figma&nbsp;</h2>
  2544.  
  2545.  
  2546.  
  2547. <p>The gap between design and development has long been a source of friction in product teams. MCP provides a standardized way for GitHub Copilot to securely access and interpret design specifications directly.&nbsp;</p>
  2548.  
  2549.  
  2550.  
  2551. <p>Instead of manually translating design details into code, MCP enables Copilot to automatically retrieve exact design parameters&mdash;such as colors, spacing, typography, and component states&mdash;and generate accurate, ready-to-use code. This integration reduces guesswork and streamlines the handoff between designers and developers.</p>
  2552.  
  2553.  
  2554.  
  2555. <aside data-color-mode="light" data-dark-theme="dark" data-light-theme="light_dimmed" class="wp-block-group post-aside--large p-4 p-md-6 is-style-light-dimmed has-global-padding is-layout-constrained wp-block-group-is-layout-constrained is-style-light-dimmed--6" style="border-top-width:4px">
  2556. <h3 class="wp-block-heading h5-mktg gh-aside-title is-typography-preset-h5" id="h-explore-github-copilot-s-agentic-capabilities" style="margin-top:0">Explore GitHub Copilot&rsquo;s agentic capabilities</h3>
  2557.  
  2558.  
  2559.  
  2560. <p>GitHub Copilot comes with two powerful agentic workflows that can be used with MCP:</p>
  2561.  
  2562.  
  2563.  
  2564. <ul class="wp-block-list">
  2565. <li><strong>Agent mode (in your IDE):</strong> Turn Copilot Chat into a real-time collaborator that works with you. Give it a goal (&ldquo;add OAuth &amp; tests&rdquo;), and it plans, edits files, runs the suite, reads failures, fixes them, and loops until everything is green&mdash;all right in front of you, with the option to pause or steer at any step.</li>
  2566.  
  2567.  
  2568.  
  2569. <li><strong>Coding agent (in your GitHub projects)</strong>: Hand an Issue to Copilot and walk away. It spins up a protected workspace with GitHub Actions, writes code, runs linters/tests, and opens a pull request for you to review. Perfect for well-scoped tickets you&rsquo;d give a junior dev (docs, tests, small refactors) while you stay focused elsewhere.<a href="https://github.blog/news-insights/product-news/github-copilot-meet-the-new-coding-agent/?utm_source=chatgpt.com">&nbsp;</a></li>
  2570. </ul>
  2571.  
  2572.  
  2573.  
  2574. <p><strong>TL;DR: </strong>Think of Agent mode as a co-driver at your keyboard; the Coding agent is the valet that brings the finished work to your repo.</p>
  2575.  
  2576.  
  2577.  
  2578. <p><a href="https://github.blog/news-insights/product-news/from-pair-to-peer-programmer-our-vision-for-agentic-workflows-in-github-copilot/">Learn more &gt;</a></p>
  2579. </aside>
  2580.  
  2581.  
  2582.  
  2583. <p>We&rsquo;ll start developing our new JWT authentication system by taking a look at the user-facing side. Let&rsquo;s say the design team updated the authentication UI components in Figma, including login forms, error states, loading spinners, and success messages. Now, you need to implement these changes to match the new design system.</p>
  2584.  
  2585.  
  2586.  
  2587. <p>Start by asking Copilot, &ldquo;What are the latest design updates for the login form and authentication components?&rdquo; It will then retrieve specs for the elements that need to change. Then you can prompt it to create React components for each element:</p>
  2588.  
  2589.  
  2590.  
  2591. <ul class="wp-block-list">
  2592. <li><code>LoginForm</code> with exact spacing, colors, typography</li>
  2593.  
  2594.  
  2595.  
  2596. <li><code>AuthErrorMessage</code> component with proper error styling</li>
  2597.  
  2598.  
  2599.  
  2600. <li><code>TokenRefreshNotification</code> component</li>
  2601. </ul>
  2602.  
  2603.  
  2604.  
  2605. <p>Copilot will then give you ready-to-use code that maintains consistency with the design specifications from Figma.</p>
  2606.  
  2607.  
  2608.  
  2609. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2610. <p><strong><strong>Learn more </strong></strong>about <a href="https://help.figma.com/hc/en-us/articles/32132100833559-Guide-to-the-Dev-Mode-MCP-Server">Figma&rsquo;s MCP server beta &gt;</a></p>
  2611. </div>
  2612.  
  2613.  
  2614.  
  2615. <h2 class="wp-block-heading" id="2-tap-into-your-obsidian-knowledge-base-with-mcp">2. Tap into your Obsidian knowledge base with MCP</h2>
  2616.  
  2617.  
  2618.  
  2619. <p>When implementing complex features like JWT authentication, you often need to reference past decisions, architectural notes, and research findings scattered across your knowledge base. The unofficial, community-maintained Obsidian MCP server bridges this gap by connecting GitHub Copilot directly to your Obsidian vault.</p>
  2620.  
  2621.  
  2622.  
  2623. <p>Let&rsquo;s say you&rsquo;re implementing JWT token validation and need to understand your team&rsquo;s previous security decisions. You tell Copilot: &ldquo;Search for all files where JWT or token validation is mentioned and explain the context.&rdquo;</p>
  2624.  
  2625.  
  2626.  
  2627. <p>With that, Copilot can:</p>
  2628.  
  2629.  
  2630.  
  2631. <ul class="wp-block-list">
  2632. <li>Search across all Markdown files in your vault for relevant security patterns</li>
  2633.  
  2634.  
  2635.  
  2636. <li>Retrieve contents from specific architecture decision records (ADR)</li>
  2637.  
  2638.  
  2639.  
  2640. <li>Access meeting notes from previous security reviews</li>
  2641.  
  2642.  
  2643.  
  2644. <li>Pull implementation guidelines from your team&rsquo;s coding standards</li>
  2645. </ul>
  2646.  
  2647.  
  2648.  
  2649. <p>You might follow up with the following prompt: &ldquo;Get the contents of the last architecture call note about authentication and summarize the key decisions.&rdquo; Copilot will locate the relevant file and extract the critical information you need to inform your implementation approach.</p>
  2650.  
  2651.  
  2652.  
  2653. <p>Once you&rsquo;ve gathered the necessary context, you can ask Copilot to synthesize this information: &ldquo;Create a new note called &lsquo;jwt-implementation-summary.md&rsquo; that combines our authentication standards with the new JWT approach.&rdquo; Copilot will create this documentation directly in your vault, helping maintain your team&rsquo;s knowledge base.</p>
  2654.  
  2655.  
  2656.  
  2657. <p><strong>Setup note</strong>: This integration requires the community &ldquo;Obsidian Local REST API&rdquo; plugin and an API key.</p>
  2658.  
  2659.  
  2660.  
  2661. <p>With your research complete and documented, you can proceed to test your application.</p>
  2662.  
  2663.  
  2664.  
  2665. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2666. <p><strong>Learn more</strong> about <a href="https://github.com/MarkusPfundstein/mcp-obsidian">accessing Obsidian through MCP &gt;</a></p>
  2667. </div>
  2668.  
  2669.  
  2670.  
  2671. <h2 class="wp-block-heading" id="3-test-your-code-with-playwright">3. Test your code with Playwright</h2>
  2672.  
  2673.  
  2674.  
  2675. <p>Integrating MCP with Playwright transforms test creation from a manual, error-prone process into a simple, guided experience.</p>
  2676.  
  2677.  
  2678.  
  2679. <p>Modern web applications often involve complex user journeys, asynchronous operations, and dynamic content. Authentication flows are particularly challenging to test comprehensively.</p>
  2680.  
  2681.  
  2682.  
  2683. <p>Continuing with our JWT authentication system, you need to test the complete authentication flow including login, token refresh, and secure route access. To do this, you&rsquo;ll start by giving Copilot a prompt like this: &ldquo;Test the JWT authentication flow including login, automatic token refresh, and access to protected routes.&rdquo;</p>
  2684.  
  2685.  
  2686.  
  2687. <p>From there, Copilot will analyze your authentication implementation and generate comprehensive test coverage. But it doesn&rsquo;t stop there. Copilot then runs the tests with Playwright and provides immediate feedback on failures, suggesting fixes for common issues, like timing problems or selector changes.</p>
  2688.  
  2689.  
  2690.  
  2691. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2692. <p><strong>Learn more </strong>about the <a href="https://github.com/microsoft/playwright-mcp">Playwright MCP server &gt;</a></p>
  2693. </div>
  2694.  
  2695.  
  2696.  
  2697. <h2 class="wp-block-heading" id="4-file-pull-requests-faster">4. File pull requests faster</h2>
  2698.  
  2699.  
  2700.  
  2701. <p>Pull requests are the cornerstone of collaborative development. GitHub&rsquo;s remote MCP server, <a href="https://github.blog/changelog/2025-06-12-remote-github-mcp-server-is-now-available-in-public-preview/">now in public beta for VS Code or Visual Studio</a>, helps transform the process into an intelligent, automated workflow.</p>
  2702.  
  2703.  
  2704.  
  2705. <p>Turning back to our JWT authentication example, you can prompt Copilot: &ldquo;Create a pull request for my authentication feature changes&rdquo;</p>
  2706.  
  2707.  
  2708.  
  2709. <p>Copilot will then analyze:</p>
  2710.  
  2711.  
  2712.  
  2713. <ul class="wp-block-list">
  2714. <li>Code changes across multiple files&nbsp;&nbsp;</li>
  2715.  
  2716.  
  2717.  
  2718. <li>Related issues and project context&nbsp;&nbsp;</li>
  2719.  
  2720.  
  2721.  
  2722. <li>Team review patterns and expertise areas&nbsp;&nbsp;</li>
  2723.  
  2724.  
  2725.  
  2726. <li>Previous similar implementations</li>
  2727. </ul>
  2728.  
  2729.  
  2730.  
  2731. <p>Copilot returns Markdown with an overview, changes made, a testing strategy, and even related issues.</p>
  2732.  
  2733.  
  2734.  
  2735. <p>It will then suggest appropriate reviewers for each aspect of the change based on code ownership, expertise mapping, and current workload.</p>
  2736.  
  2737.  
  2738.  
  2739. <p>Once your application is deployed, you can move on to monitoring it.</p>
  2740.  
  2741.  
  2742.  
  2743. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2744. <p><strong>Get started</strong> with <a href="https://docs.github.com/en/copilot/tutorials/enhancing-copilot-agent-mode-with-mcp">GitHub&rsquo;s MCP server &gt;</a></p>
  2745. </div>
  2746.  
  2747.  
  2748.  
  2749. <h2 class="wp-block-heading" id="5-monitor-application-performance">5. Monitor application performance</h2>
  2750.  
  2751.  
  2752.  
  2753. <p>With the core authentication logic handled, now it&rsquo;s time to ensure that our application performs well by monitoring how it behaves in production. Using MCP to connect to Grafana through the open-source Grafana MCP server makes this easier&mdash;though setup requires a few configuration steps.</p>
  2754.  
  2755.  
  2756.  
  2757. <p>Let&rsquo;s say you need to analyze the JWT authentication system&rsquo;s latency metrics and error rates. You tell Copilot: &ldquo;Show me auth latency and error-rate panels for the auth-service dashboard for the last 6 hours.&rdquo;</p>
  2758.  
  2759.  
  2760.  
  2761. <p>After configuring the Grafana MCP server with your API key and host URL, Copilot can then query your Grafana instance to:</p>
  2762.  
  2763.  
  2764.  
  2765. <ul class="wp-block-list">
  2766. <li>Examine authentication latency metrics and p95 response times</li>
  2767.  
  2768.  
  2769.  
  2770. <li>Analyze error rates for login endpoints over time</li>
  2771.  
  2772.  
  2773.  
  2774. <li>Review existing alert rules for authentication services</li>
  2775.  
  2776.  
  2777.  
  2778. <li>Identify patterns in failed authentication attempts</li>
  2779. </ul>
  2780.  
  2781.  
  2782.  
  2783. <p>Copilot returns panel data as base64-encoded images and can extract raw time-series data when needed. If you need a longer time range, you can specify: &ldquo;Show me the same metrics for the last 24 hours&rdquo; and Copilot will adjust the query parameters accordingly.</p>
  2784.  
  2785.  
  2786.  
  2787. <p>For more advanced monitoring workflows, you can enable write operations by launching the server with the <code>--enable-write</code> flag and an Editor-role API key. This allows Copilot to create new alert rules or modify dashboard configurations based on your authentication metrics analysis.</p>
  2788.  
  2789.  
  2790.  
  2791. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2792. <p><strong>Learn more </strong>about the <a href="https://github.com/grafana/mcp-grafana">Grafana MCP server &gt;</a></p>
  2793. </div>
  2794.  
  2795.  
  2796.  
  2797. <h2 class="wp-block-heading" id="whats-next">What&rsquo;s next?</h2>
  2798.  
  2799.  
  2800.  
  2801. <p>Before diving into these powerful integrations, you&rsquo;ll need to configure your development environment. Here&rsquo;s how:</p>
  2802.  
  2803.  
  2804.  
  2805. <ol class="wp-block-list">
  2806. <li><strong>Install MCP extensions</strong>: Enable MCP support in your IDE through official extensions</li>
  2807.  
  2808.  
  2809.  
  2810. <li><strong>Configure API access</strong>: Set up authentication for each service (GitHub, Obsidian, Figma, etc.)</li>
  2811.  
  2812.  
  2813.  
  2814. <li><strong>Define context boundaries</strong>: Establish what information should be accessible to AI</li>
  2815.  
  2816.  
  2817.  
  2818. <li><strong>Security considerations</strong>: Implement proper access controls and data privacy measures</li>
  2819. </ol>
  2820.  
  2821.  
  2822.  
  2823. <p>A few best practices:</p>
  2824.  
  2825.  
  2826.  
  2827. <ul class="wp-block-list">
  2828. <li><strong>Start small</strong>: Begin with one integration and gradually expand your usage</li>
  2829.  
  2830.  
  2831.  
  2832. <li><strong>Maintain documentation</strong>: Keep your knowledge bases and documentation current for optimal AI assistance</li>
  2833.  
  2834.  
  2835.  
  2836. <li><strong>Regularly review Copilot&rsquo;s outputs</strong>: Periodically audit AI-generated suggestions to ensure quality and security</li>
  2837.  
  2838.  
  2839.  
  2840. <li><strong>Build team alignment</strong>: Ensure your team understands and adopts consistent MCP usage patterns</li>
  2841. </ul>
  2842.  
  2843.  
  2844.  
  2845. <p>The five integration patterns we&rsquo;ve explored represent just the beginning of what&rsquo;s possible. As MCP&rsquo;s ecosystem grows, new tools and integrations will continue to expand what&rsquo;s possible.</p>
  2846.  
  2847.  
  2848.  
  2849. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2850. <p><strong>Get started</strong> with our <a href="https://docs.github.com/en/copilot/tutorials/enhancing-copilot-agent-mode-with-mcp">remote MCP server &gt;</a></p>
  2851. </div>
  2852. </body></html>
  2853. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/5-ways-to-transform-your-workflow-using-github-copilot-and-mcp/">5 ways to transform your workflow using GitHub Copilot and MCP</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2854. ]]></content:encoded>
  2858. <post-id xmlns="com-wordpress:feed-additions:1">89268</post-id> </item>
  2859. </channel>
  2860. </rss>
  2861.  

If you would like to create a banner that links to this page (i.e. this validation result), do the following:

  1. Download the "valid RSS" banner.

  2. Upload the image to your own server. (This step is important. Please do not link directly to the image on this server.)

  3. Add this HTML to your page (change the image src attribute if necessary):

If you would like to create a text link instead, here is the URL you can use:

http://www.feedvalidator.org/check.cgi?url=https%3A//github.blog/feed/

Home · About · News · Docs · Terms

 
Copyright © 2002-9 Sam Ruby, Mark Pilgrim, Joseph Walton, and Phil Ringnalda