383 lines
8.4 KiB
Markdown
383 lines
8.4 KiB
Markdown
---
|
|
name: github-ai-features-2025
|
|
description: GitHub AI-powered security and automation features for 2025
|
|
---
|
|
|
|
## 🚨 CRITICAL GUIDELINES
|
|
|
|
### Windows File Path Requirements
|
|
|
|
**MANDATORY: Always Use Backslashes on Windows for File Paths**
|
|
|
|
When using Edit or Write tools on Windows, you MUST use backslashes (`\`) in file paths, NOT forward slashes (`/`).
|
|
|
|
**Examples:**
|
|
- ❌ WRONG: `D:/repos/project/file.tsx`
|
|
- ✅ CORRECT: `D:\repos\project\file.tsx`
|
|
|
|
This applies to:
|
|
- Edit tool file_path parameter
|
|
- Write tool file_path parameter
|
|
- All file operations on Windows systems
|
|
|
|
|
|
### Documentation Guidelines
|
|
|
|
**NEVER create new documentation files unless explicitly requested by the user.**
|
|
|
|
- **Priority**: Update existing README.md files rather than creating new documentation
|
|
- **Repository cleanliness**: Keep repository root clean - only README.md unless user requests otherwise
|
|
- **Style**: Documentation should be concise, direct, and professional - avoid AI-generated tone
|
|
- **User preference**: Only create additional .md files when user specifically asks for documentation
|
|
|
|
|
|
---
|
|
|
|
# GitHub AI Features 2025
|
|
|
|
## Trunk-Based Development (TBD)
|
|
|
|
Modern workflow used by largest tech companies (Google: 35,000+ developers):
|
|
|
|
### Principles
|
|
|
|
1. **Short-lived branches:** Hours to 1 day maximum
|
|
2. **Small, frequent commits:** Reduce merge conflicts
|
|
3. **Continuous integration:** Always deployable main branch
|
|
4. **Feature flags:** Hide incomplete features
|
|
|
|
### Implementation
|
|
|
|
```bash
|
|
# Create task branch from main
|
|
git checkout main
|
|
git pull origin main
|
|
git checkout -b task/add-login-button
|
|
|
|
# Make small changes
|
|
git add src/components/LoginButton.tsx
|
|
git commit -m "feat: add login button component"
|
|
|
|
# Push and create PR (same day)
|
|
git push origin task/add-login-button
|
|
gh pr create --title "Add login button" --body "Implements login UI"
|
|
|
|
# Merge within hours, delete branch
|
|
gh pr merge --squash --delete-branch
|
|
```
|
|
|
|
### Benefits
|
|
|
|
- Reduced merge conflicts (75% decrease)
|
|
- Faster feedback cycles
|
|
- Easier code reviews (smaller changes)
|
|
- Always releasable main branch
|
|
- Simplified CI/CD pipelines
|
|
|
|
## GitHub Secret Protection (AI-Powered)
|
|
|
|
AI detects secrets before they reach repository:
|
|
|
|
### Push Protection
|
|
|
|
```bash
|
|
# Attempt to commit secret
|
|
git add config.py
|
|
git commit -m "Add config"
|
|
git push
|
|
|
|
# GitHub AI detects secret:
|
|
"""
|
|
⛔ Push blocked by secret scanning
|
|
|
|
Found: AWS Access Key
|
|
Pattern: AKIA[0-9A-Z]{16}
|
|
File: config.py:12
|
|
|
|
Options:
|
|
1. Remove secret and try again
|
|
2. Mark as false positive (requires justification)
|
|
3. Request review from admin
|
|
"""
|
|
|
|
# Fix: Use environment variables
|
|
# config.py
|
|
import os
|
|
aws_key = os.environ.get('AWS_ACCESS_KEY')
|
|
|
|
git add config.py
|
|
git commit -m "Use env vars for secrets"
|
|
git push # ✅ Success
|
|
```
|
|
|
|
### Supported Secret Types (AI-Enhanced)
|
|
|
|
- AWS credentials
|
|
- Azure service principals
|
|
- Google Cloud keys
|
|
- GitHub tokens
|
|
- Database connection strings
|
|
- API keys (OpenAI, Stripe, etc.)
|
|
- Private keys (SSH, TLS)
|
|
- OAuth tokens
|
|
- Custom patterns (regex-based)
|
|
|
|
## GitHub Code Security
|
|
|
|
### CodeQL Code Scanning
|
|
|
|
AI-powered static analysis:
|
|
|
|
```yaml
|
|
# .github/workflows/codeql.yml
|
|
name: "CodeQL"
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
|
|
jobs:
|
|
analyze:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v2
|
|
with:
|
|
languages: javascript, python, java
|
|
|
|
- name: Autobuild
|
|
uses: github/codeql-action/autobuild@v2
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@v2
|
|
```
|
|
|
|
**Detects:**
|
|
- SQL injection
|
|
- XSS vulnerabilities
|
|
- Path traversal
|
|
- Command injection
|
|
- Insecure deserialization
|
|
- Authentication bypass
|
|
- Logic errors
|
|
|
|
### Copilot Autofix
|
|
|
|
AI automatically fixes security vulnerabilities:
|
|
|
|
```python
|
|
# Vulnerable code detected by CodeQL
|
|
def get_user(user_id):
|
|
query = f"SELECT * FROM users WHERE id = {user_id}" # ❌ SQL injection
|
|
return db.execute(query)
|
|
|
|
# Copilot Autofix suggests:
|
|
def get_user(user_id):
|
|
query = "SELECT * FROM users WHERE id = ?"
|
|
return db.execute(query, (user_id,)) # ✅ Parameterized query
|
|
|
|
# One-click to apply fix
|
|
```
|
|
|
|
## GitHub Agents (Automated Workflows)
|
|
|
|
AI agents for automated bug fixes and PR generation:
|
|
|
|
### Bug Fix Agent
|
|
|
|
```yaml
|
|
# .github/workflows/ai-bugfix.yml
|
|
name: AI Bug Fixer
|
|
|
|
on:
|
|
issues:
|
|
types: [labeled]
|
|
|
|
jobs:
|
|
autofix:
|
|
if: contains(github.event.issue.labels.*.name, 'bug')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Analyze Bug
|
|
uses: github/ai-agent@v1
|
|
with:
|
|
task: 'analyze-bug'
|
|
issue-number: ${{ github.event.issue.number }}
|
|
|
|
- name: Generate Fix
|
|
uses: github/ai-agent@v1
|
|
with:
|
|
task: 'generate-fix'
|
|
create-pr: true
|
|
pr-title: "Fix: ${{ github.event.issue.title }}"
|
|
```
|
|
|
|
### Automated PR Generation
|
|
|
|
```bash
|
|
# GitHub Agent creates PR automatically
|
|
# When issue is labeled "enhancement":
|
|
# 1. Analyzes issue description
|
|
# 2. Generates implementation code
|
|
# 3. Creates tests
|
|
# 4. Opens PR with explanation
|
|
|
|
# Example: Issue #42 "Add dark mode toggle"
|
|
# Agent creates PR with:
|
|
# - DarkModeToggle.tsx component
|
|
# - ThemeContext.tsx provider
|
|
# - Tests for theme switching
|
|
# - Documentation update
|
|
```
|
|
|
|
## Dependency Review (AI-Enhanced)
|
|
|
|
AI analyzes dependency changes in PRs:
|
|
|
|
```yaml
|
|
# .github/workflows/dependency-review.yml
|
|
name: Dependency Review
|
|
|
|
on: [pull_request]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
dependency-review:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@v3
|
|
with:
|
|
fail-on-severity: high
|
|
fail-on-scopes: runtime
|
|
```
|
|
|
|
**AI Insights:**
|
|
- Known vulnerabilities in new dependencies
|
|
- License compliance issues
|
|
- Breaking changes in updates
|
|
- Alternative safer packages
|
|
- Dependency freshness score
|
|
|
|
## Trunk-Based Development Workflow
|
|
|
|
### Daily Workflow
|
|
|
|
```bash
|
|
# Morning: Sync with main
|
|
git checkout main
|
|
git pull origin main
|
|
|
|
# Create task branch
|
|
git checkout -b task/user-profile-api
|
|
|
|
# Work in small iterations (2-4 hours)
|
|
# First iteration: API endpoint
|
|
git add src/api/profile.ts
|
|
git commit -m "feat: add profile API endpoint"
|
|
git push origin task/user-profile-api
|
|
gh pr create --title "Add user profile API" --draft
|
|
|
|
# Continue work: Add tests
|
|
git add tests/profile.test.ts
|
|
git commit -m "test: add profile API tests"
|
|
git push
|
|
|
|
# Mark ready for review
|
|
gh pr ready
|
|
# Get review (should happen within hours)
|
|
|
|
# Merge same day
|
|
gh pr merge --squash --delete-branch
|
|
|
|
# Next task: Start fresh from main
|
|
git checkout main
|
|
git pull origin main
|
|
git checkout -b task/profile-ui
|
|
```
|
|
|
|
### Small, Frequent Commits Pattern
|
|
|
|
```bash
|
|
# ❌ Bad: Large infrequent commit
|
|
git add .
|
|
git commit -m "Add complete user profile feature with API, UI, tests, docs"
|
|
# 50 files changed, 2000 lines
|
|
|
|
# ✅ Good: Small frequent commits
|
|
git add src/api/profile.ts
|
|
git commit -m "feat: add profile API endpoint"
|
|
git push
|
|
|
|
git add src/components/ProfileCard.tsx
|
|
git commit -m "feat: add profile card component"
|
|
git push
|
|
|
|
git add tests/profile.test.ts
|
|
git commit -m "test: add profile tests"
|
|
git push
|
|
|
|
git add docs/profile.md
|
|
git commit -m "docs: document profile API"
|
|
git push
|
|
|
|
# Each commit: 1-3 files, 50-200 lines
|
|
# Easier reviews, faster merges, less conflicts
|
|
```
|
|
|
|
## Security Best Practices (2025)
|
|
|
|
1. **Enable Secret Scanning:**
|
|
```bash
|
|
# Repository Settings → Security → Secret scanning
|
|
# Enable: Push protection + AI detection
|
|
```
|
|
|
|
2. **Configure CodeQL:**
|
|
```bash
|
|
# Add .github/workflows/codeql.yml
|
|
# Enable for all languages in project
|
|
```
|
|
|
|
3. **Use Copilot Autofix:**
|
|
```bash
|
|
# Review security alerts weekly
|
|
# Apply Copilot-suggested fixes
|
|
# Test before merging
|
|
```
|
|
|
|
4. **Implement Trunk-Based Development:**
|
|
```bash
|
|
# Branch lifespan: <1 day
|
|
# Commit frequency: Every 2-4 hours
|
|
# Main branch: Always deployable
|
|
```
|
|
|
|
5. **Leverage GitHub Agents:**
|
|
```bash
|
|
# Automate: Bug triage, PR creation, dependency updates
|
|
# Review: All AI-generated code before merging
|
|
```
|
|
|
|
## Resources
|
|
|
|
- [Trunk-Based Development](https://trunkbaseddevelopment.com)
|
|
- [GitHub Secret Scanning](https://docs.github.com/en/code-security/secret-scanning)
|
|
- [GitHub Advanced Security](https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security)
|
|
- [GitHub Copilot for Security](https://github.com/features/security)
|