DevSecOps with GitHub Advanced Security (GHAS)
summary
Demo-heavy session shows GHAS as three concrete features: secret scanning, CodeQL code scanning and Dependabot autofix, each enabled in repo settings and wired into GitHub Actions. Transcript records ~26 live demos (speaker reports 65 items prepped) including audit‑logs, branch rule sets, GPG‑verified commits, infra‑as‑code checks via Microsoft Security DevOps action, SARIF outputs, push protection that blocks leaks, and OIDC federation replacing stored credentials — demos mostly work though a few UI hiccups appear. GH500 certification and public demo repos are provided for follow‑up.
AI-written summary · about
chapters (22)
- 0:00DevSecOps with GHAS
- 4:50What is GitHub Advanced Security
- 8:56DevOps mindset for security
- 11:42Alerts and audit logs
- 16:16Branch protection rules
- 24:51Code scanning with CodeQL
- 33:06Configuring code scanning
- 42:02Planning security scans
- 44:10Local code scanning
- 53:00Dependabot and vulnerabilities
- 59:44Environment protection
- 1:01:49GPG signing and verified commits
- 1:06:30Hardening GitHub runners
- 1:10:22Infrastructure as code scanning
- 1:17:27OIDC for cloud auth
- 1:23:50Licensing compliance
- 1:25:15Secret scanning
- 1:28:04Software bill of materials and SBOM
- 1:29:10Threat modeling
- 1:32:17Secure workflows
- 1:35:51Zero trust principles
- 1:39:00Summary
related talks
01h 02mDeveloping secure software with GitHub
01h 00mLearn Live: GitHub administration for GitHub Advanced Security
11mGitHub Advanced Security and GitHub Copilot: Working together to make security
46mShip-It safely with GitHub Advanced Security
41mBake Security into your workflow with GitHub Advanced Security and AI
20mDeliver Secure Software with Azure Devops & Github
48mAdvanced Security with GitHub without GitHub Advanced Security
55mGitHub + Azure: Better Together!