Please enable JavaScript.

Coggle requires JavaScript to display documents.

Github Foundations - Coggle Diagram

- - - - Hay un desconocimiento general del problema
      - Codigo debe sercreado de forma correcta y segura
      - Aplicaciónes deben cumplir con reglas y regulaciones
- - - - SAML SSO
        
        Proceso usado para verificar la identidad del usuario y sus credenciales mediante un Proveedor de identidad conocido
        
        Proceso general
        
        El admin conecta la Org Github al IdP soportado
        
        Cuando alguien accede a los recursos que usa SAML SSO, Github lo redirecciona al IdP para autenticarlo
        
        Si se autentica de forma correcta, el IdP lo devuelve a github donde puede acceder a los recursos de la organización
        
        Los usuarios continuarán iniciando sesión en sus cuentas de github
      - Multifactor autenticación (2FA O MFA)
        
        Activando la opción en la organización, esto puede solicitarse para
        Miembros
        Colaoradores externos
        gestores de facturación
        
        Opciones (3)
        
        Security Keys usa un dispositivo físico
        
        TOTP, se recomienda un Cloud-based TOTP app (app de autenticación)
        Time-based One-time Password
        
        SMS
        
        Auditoria a los usuarios que tengan activado el 2FA
  - - - Active Directory Federation Services (ADFS)
      - Microsoft Entra ID
      - Okta
      - OneLogin
      - PingOne
      - Shibboleth
  - - - Token de acceso personal
      - SSH key
      - OAuth App
  - - - Integrar nuevos miembros
      - Otorgar nuevos permisos para movimientos en la org
      - Remover acceso de miembros de la organización
      - Sincronizar usuarios, con grupos de active directory
      - Sincronizar un nuevo team
      - Personalizar mapas de equipo/grupo
      - Configuracion dinámica
    - - El número maximo de miembros en un GitHub Team es 5000
      - El maximo en organización es 10,000
      - El máximo de equipos en una organización son 1500
- - - - Creation by
        
        Github.com
        
        Visual Studio Code
        
        Github CLI
      - Ways (4)
        
        From a Github or any template repository, to start a new project
        
        From a branch in your repository
        
        From an open pull request, to explore work-in-progress
        
        From a commit to investigate a bug at a specific point in time
      - Process at create codespace
        
        A virtual machine and storage are assigned to your codespace
        
        A container is created
        
        A connection to the codespace is made
        
        A post-creation setup is made
    - - You can rebuild your Codespace to implement changes to your dev container configuration
      - Los cambios hechos fuera de la carpeta /workspaces son borrados, los realizados adentro se mantienen sobre el rebuild
- - - - Plan and track work in a table or board view
      - Rank, sort, and group within a table by any custom field
      - Create draft issues with detailed descriptions and metadata
      - Materialize any perspective with tokenized filtering and saved views
      - Customize cards and group-by in Project boards
      - Real-time Project updates and user presence indicators
    - - Define custom fields of type: text, number, date, iteration, and single select
      - Configure iterations with flexible date ranges and breaks to represent your sprints, cycles, or quarterly roadmap
      - View linked pull requests and reviewers in both table and board views
    - - Create and configure custom bar, column, line, and stacked area charts
      - Use aggregation functions like sum, count, average, min, and max to get the proper insight
      - Persist charts and share them with a URL to keep everyone in the know
    - - GraphQL ProjectsV2 API
      - GitHub app Project scopes
      - Webhooks events for Project item metadata updates
      - GitHub Action to automate adding issues to Projects
  - - - Current charts (gráficos actualidad)
      - Historical charts (gráficos históricos)
        Only in teams and enterprise cloud for organitations
    - - Ways for automating
        
        Built-in automated workflows
        
        GraphQL API
        
        https://docs.github.com/issues/planning-and-tracking-with-projects/automating-your-project/using-the-api-to-manage-projects
        
        Github Actions with workflows
        
        https://docs.github.com/issues/planning-and-tracking-with-projects/automating-your-project/automating-projects-using-actions
- - - - Niveles de visibilidad
        
        Publico
        
        Internos, visible solo para miembros de la organización
        
        Privado, solo para propietario y equipos o individuos que agreguen
      - Niveles de permisos
        
        Read, solo visualizan o discuten sobre el proyecto
        
        Triage leve, para administrar issues y pr
        
        Write level, para quienes contribuyen en el proyecto
        
        Maintain Level, para gestores de proyecto que gestionan el repositorio sin acceso a accinoes sensibles o destructivas
        
        Admin level, full acceso,incluyendo gestión de seguridad o eliminar el repo
        
        mas info
    - - Usar nombre descriptivo
      - Incluir una descripción concisa, como ususarios potenciales
      - Lecenciad del repo para saber como usar, cambiar o distribuir el software
      - Incluir un leeme.md,como pagina de aterrizaje
    - - Articulate the purpose and vision of the project so potential consumers understand whether it fits their needs.
      - Offer visual aids, such as screenshots or code samples, to illustrate the project in action.
      - Include links to a production or demo version of the app for review.
      - Set expectations for prerequisites and deployment procedures.
      - Include references to the projects on which you depend. These references are a good way to promote the work of others.
      - Use Markdown to guide readers through properly formatted content.
      - ejemplos readme
    - - ejemplos
      - Codeowners
    - - .github/ISSUE_TEMPLATE.md,
      - .github/PULL_REQUEST_TEMPLATE.md
      - ejemplos
    - - The workflow should include details about where and how branches should be used for bugs and features, how pull requests should be opened, and any other details people outside the repository team should know before they push code
    - - Measure process, not output
        
        Code review turnaround time
        
        Pull request size
        
        Work in progress
        
        Time to open
      - Measure against targets and not absolutes
      - Measure teams and not individuals
        
        Number of unique contributors to a project
        
        Number of projects reusing code
        
        Number of cross-team mentions
      - casos de éxito
- - - - Breve repaso de Github Enterprise Platform
      - Cómo crrear un repositorio
      - Agregar archivos a un repositorio
      - Como buscar repositorios
      - Introducción a gists and wikis
    - - AI: AI generativa mejora la colaboración potenciando pull request and issues, la productividad mediante Copilot y seguridad mediante chequeos de seguridad mas rápidos
      - Colaboration: Mediante una suite de herramientas sin fisuras que permita la colaboración sin esfuerzo
      - Productivity: Acelerada con automatización que provee la plataforma. Con herramientas CICD integradas al igual que la configuración de tareas, para las tareas rutinarias, permitiendo el foco en la creación de soluciones innovadoras
      - Security: Integra caracteristicas de primera fuente para minimizar los riesgos con una solución integrada de seguridad
      - Scale
    - - Es lo que contiene todos los archivos de tu proyecto, y cada historia de revisión de los mismos.
        Se utilizan para gestionar tu trabajo, seguir cambios, almacenar historial de revisiones y trabajar con otros
      - Cómo crear un repositorio
      - Cómo agregar archivos a tu repositorio
      - gists: Repos for snippets. Gist are a simplified way to share code snippets with others
      - Wikis, sección de documentacion hospedada en github
  - - - Branches
      - Commits
      - Pull Requests
      - The github flow
    - - Steps Github Flow cycle
        
        Create a branch
        
        Make your changes
        
        Create a pull request
        
        Reviewing and implementing your feeback from your collaborators
        
        Get our pull request approved and merge it into the main branch
        
        Delete your branch
  - - - Creation ways
        
        A repository
        
        An item in a task list
        
        A note in a project
        
        A comment in an issue or pull request
        
        A specific line of code
        
        A url query
    - - Enabling a discussion in your repository
      - Create a new discussion
- - - - GitHub Support via email
      - 3,000 GitHub Actions minutes per month
      - 2 GB GitHub Packages storage
      - 180 GitHub Codespaces core hours per month
      - 20 GB GitHub Codespaces storage per month
      - Advanced tools and insights in private repositories:
      - Required pull request reviewers
      - Multiple pull request reviewers
      - Protected branches
      - Code owners
      - Autolinked references
      - GitHub Pages
      - Wikis
      - Repository insight graphs for pulse, contributors, traffic, commits, code frequency, network, and forks
    - - GitHub Support via email
      - 3,000 GitHub Actions minutes per month
      - 2 GB GitHub Packages storage
      - Advanced tools and insights in private repositories:
      - Required pull request reviewers
      - Multiple pull request reviewers
      - Draft pull requests
      - Team pull request reviewers
      - Protected branches
      - Code owners
      - Scheduled reminders
      - GitHub Pages
      - Wikis
      - Repository insight graphs for pulse, contributors, traffic, commits, code frequency, network, and forks
      - The option to enable or disable GitHub Codespaces
    - - GitHub Enterprise Support
      - More security, compliance, and deployment controls
      - Authentication with SAML single sign-on
      - Access provisioning with SAML or SCIM
      - Deployment protection rules with GitHub Actions for private or internal repositories GitHub Connect
      - The option to purchase GitHub Advanced Security
      - Opciones Enterpise
        
        GitHub Enterprise Server (GHES) (autohospedada)
        
        GitHub Enterprise Cloud
        
        Features
        
        50,000 GitHub Actions minutes per month
        
        50 GB GitHub Packages storage
        
        A service level agreement for 99.9% monthly uptime
        
        Option to centrally manage policy and billing for multiple GitHub.com organizations with an enterprise account
        
        Option to provision and manage the user accounts for your developers, by using Enterprise Managed Users
  - - - Administrar, clasificar (triage), y limpiar las notificaciones de github.com
      - Leer, revisar y colaborar sobre issues y pull request
      - Editar archivos en pull request
      - Buscar, interactuar con usuarios, repositorios y organizaciones
      - Recibir una notificación push cuando alguien menciona tu username
      - Programar notificaciones push para horas personalizadas específicas
      - Securitizar tu cuenta github.com con doble factor de autenticación
      - Verificar tus intentos de ingreso en dispositivos no reconocidos
    - - Agregar y clonar repositorios
      - Agregar cambios a tu commit de forma interactiva
      - Rápidamente agregar coautores a tu commit
      - Validar ramas con pull request y ver estatus de CI
      - Comparar cambios de imágenes
- - - - git config --global user.name "nombre"
      - git config --global user.mail "mail"
      - validación
        git config --list
  - - - Cambios del proyecto, quien los hizo, y cuando se realizaron
      - Incluir un mensaje aclaratorio en cada cambio
      - Recuperar versiones anteriores del proyecto o de archivos
      - Crear ramas, donde los cambios pueden realizarse de forma experimental. Permitiendo trabajar al mismo tiempo, por distintas personas sin afectar la rama principal. Despues se pueden mezclar esos cambios
      - Agregar una etiqueta a una versión por ejemplo para un nuevo release
    - - Working tree
      - Repository (repo)
      - Hash
      - Object
        
        Blob Object
        
        tree object
        
        Commit Object
        
        tag Object
      - Commit
      - Branch
      - Remote
      - Commands, subcommands, and options
      - push
      - pull
    - - Características clave
        
        Issues
        
        Discussions
        
        Pull Request
        
        Notifications
        
        Labels
        
        Actions
        
        Forks
        
        Projects
        
        Branches
- - - - italic with *
      - italic with _
      - Bold with **
      - Bold with _ x2
    - - H1 with #
      - H2 with ##
      - example h2
    - - ! + [ text alt] (url_image)
      - Link sites
        [texto] + (url_site)
      - Link
    - - Ordered lists, start with numbers
      - Unordered list, start with * or _
    - - quoted text
    - - /code
      - /details
      - /saved-replies (%cursor%)
      - /table
      - /tasklist
      - /template
- - - - If applied, this commit will <descripción de contribución>
      - Descripción breve en tiempo presente imperativo ejem Add, no added, ni adds
      - Asunto max 50 caracteres
      - Iniciar con mayúscula, y no terminar con punto
      - Explicar el qué y porqué frente al como
    - - Uso de etiquetas para ordenamiento visual
        
        Bug (rojo), algo no funciona
        
        Documentation (azul), mejoras o anadiduras en la documentación
        
        Duplicate (gris), este issue o PR ya existe
        
        Enhancement (teal) Nueva característica o solicitud
      - Notificaciones del PR
        
        Not subscribed: solo recibe notificaciones cuando tu participas o fuieste mencionado
        
        Subscribed: Recibe todas las notificaciones
        
        Custom: Solo serás notificado para los eventos que selecciones
    - - Publicar una stand-alone library (dependency)
      - Copiar proyecto añadiendo tu funcionalidad
      - Crear un github actions para que otros lo incorporen en su workflow
- - - - Describe code scanning.
      - List the steps for enabling code scanning in a repository.
      - List the steps for enabling code scanning with third-party analysis.
      - Contrast how to implement CodeQL analysis in a GitHub Actions workflow versus a third-party continuous integration (CI) tool.
      - Explain how to configure code scanning on a repository using triggering events.
      - Contrast the frequency of code scanning workflows (scheduled vs triggered by events).
  - - - CodeQL is the code analysis engine GitHub developed to automate security checks
      - You can analyze your code using CodeQL and display the results as code scanning alerts
      - Ways to set up CodeQL analysis for code scanning
        
        Use default setup to quickly configure CodeQL analysis for code scanning on your repository. The default setup handles choosing the languages to analyze, query suite to run, and events that trigger scans with the option to manually configure the languages and query suites. This setup option runs code scanning as a GitHub Action.
        
        Use advanced setup to add the CodeQL workflow directly to your repository. Adding the CodeQL workflow directly into your repository generates a customizable workflow file, which uses the github/codeql-action to run the CodeQL CLI as a GitHub Action.
        
        Run the CodeQL CLI directly in an external CI system and upload the results to GitHub.
      - CodeQL treats code like data, allowing you to find potential vulnerabilities in your code with greater confidence than traditional static analyzers
        You generate a CodeQL database to represent your codebase, then run CodeQL queries on that database to identify problems in the codebase
      - Languages supported
        
        C or C++
        
        C#
        
        Go
        
        Java/Kotlin
        
        JavaScript/TypeScript
        
        Python
        
        Ruby
        
        Swift
      - Default Setup
        
        Needs write permissions
        
        1 Go to repository's main page
        
        2 Select Security
        
        3 Select Set Up code scanning
        
        4 Select Default in Set Up dropdown
        
        5 Review the default options
        If needed, select the Edit button in the bottom left corner of the new window to customize how CodeQL runs.
        The on:pull_request and on:push triggers are the default for code scanning are each useful for different purposes. You'll learn more about these triggers in the Configure Code Scanning unit.
        
        6 Select Enable CodeQL once you're ready to turn on code scanning
        In the default CodeQL analysis workflow, code scanning is configured to analyze your code each time you either push a change to any protected branches or raise a pull request against the default branch. Once the push is made, code scanning runs automatically.
    - - You can perform analysis elsewhere and then upload the results
      - Alerts for code scanning that you run externally are displayed in the same way as those you run within GitHub
      - You can upload Static Analysis Results Interchange Format (SARIF) files generated outside GitHub or with GitHub Actions to see code scanning alerts from third-party tools in your repository
      - GitHub creates code-scanning alerts in a repository using information from SARIF files
      - You can generate SARIF files using many static analysis-security testing tools, including CodeQL. The results must use SARIF version 2.1.0.
      - You can upload the results using the code-scanning API, the CodeQL CLI, or GitHub Actions. The best method will depend on how you generated the SARIF file
      - Code-scanning API
        
        The code-scanning API lets you retrieve information on code scanning alerts, analyses, databases, and default setup configuration from a repository
        
        You can use the endpoints to create automated reports for the code-scanning alerts in an organization or upload analysis results generated using offline code-scanning tools.
        
        You can access the GitHub API over HTTPS from https://api.github.com. All data is sent and received as JSON.
        
        The API uses custom media types to let consumers choose the format of the data they wish to receive, application/sarif+json
        
        Media types are specific to resources, allowing them to change independently and support formats that other resources don't.
        
        You can use this media type with GET requests sent to the /analyses/{analysis_id} endpoint
        
        Example curl
        
        curl -L \
        
        -H "Accept: application/vnd.github+json" \
        
        -H "Authorization: Bearer <YOUR-TOKEN>" \
        
        -H "X-GitHub-Api-Version: 2022-11-28" \
        
        https://api.github.com/orgs/ORG/code-scanning/alerts
      - CodeQL CLI
        
        The CodeQL CLI is a standalone product that you can use to analyze code. Its main purpose is to generate a database representation of a codebase, a CodeQL database
        
        Once the database is ready, you can query it interactively, or run a suite of queries to generate a set of results in SARIF format and upload the results to GitHub.com
        
        The CodeQL CLI is free to use on public repositories that are maintained on GitHub.com, and available to use on private repositories that are owned by customers with an Advanced Security license.
        
        The bundle (https://github.com/github/codeql-action/releases), contains: CodeQL CLI product, a compatible version of the queries and libraries from codeql and a precompiled versions of all the queries included in the bundle
      - Code-scanning analysis with GitHub Actions
        
        To use GitHub Actions to upload a third-party SARIF file to a repository, you'll need a GitHub Actions workflow
        
        A GitHub Actions workflow is an automated process, made up of one or more jobs, configured as a .yml file. Workflows are stored in the .github/workflows directory for your repository
        
        Your workflow uses the upload-sarif action, which is part of the github/codeql-action repository. This workflow includes input parameters that you can use to configure the upload and can to be triggered when the push and scheduled event occurs
        
        The main input parameter is sarif-file, which configures the file or directory of SARIF files to be uploaded. The directory or file path is relative to the root of the repository.
      - Upload SARIF files generated outside your repository
      - Upload SARIF files generated as part of a CI workflow
    - - You can configure how GitHub scans the code in your project for vulnerabilities and errors
      - With your own configuration, you save time and decide the best frequency of code scanning for your project. This can to be setted with Advanced setup option that generates a customizable workflow file that you can then commit
      - CodeQL analysis is just one type of code scanning you can perform in GitHub. The GitHub Marketplace contains several other code scanning workflows
      - Steps
        
        Switching from Default to Advanced Code Scanning Setup
        
        Edit Code-scanning workflow
        in .github/workflows directory the codeql-analysis.yml file
      - Configurations
        
        Configure frequency
        
        Scan on: push (default configuration)
        Trigger a code scan on every push to the default branch of the repository and any protected branches.
        For trigger on specified branch, the workflow must exist in that branch
        The results of scan appear in the security tab for your repository
        
        Scan on PR
        Trigger a code scan on pull requests targeted against the default branch
        If a pull request is from a private fork, the pull_request event is only triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings
        If you scan pull requests, the results appear as alerts in a pull-request check
        
        Define the severities causing PR check failure
        
        By default alerts with the severiy level of error, or security severity level critical or high cause a pull-request check failure. Blocking when trying to merge code
        
        The levels of alerte can changed in Setting -> Code security and analysis-> Protection rules of your repository, using the drop-down menu to select the severity level you would like to trigger a pull request check failure
      - Avoid unnecessary scans of PR
        
        You can configure this setting by specifying on:pull_request:paths-ignore or on:pull_request:paths in the code-scanning workflow
      - Adjust scanning schedule
        
        By default the scans are once a week, in addition to the scans triggered by events. To adjust edit the cron value in the workflow
    - - This exercise checks your knowledge on configuring code scanning for your repository.This GitHub exercise is graded automatically once you have attempted a solution to the challenge.
      - https://github.com/keyoj/skills-introduction-to-codeql
      - What is GitHub code scanning: Code scanning is a capability that allows development teams to integrate security testing tools into the software development process. This is done using GitHub Actions. With code scanning, you can integrate many different types of tools including SAST, container, and infrastructure as code security tools.
      - What is CodeQL: CodeQL is a static analysis testing tool that helps you identify security weaknesses such as SQL injection, cross-site scripting, and code injection issues.
      - Step 4 Prevent vulnerabilities in the pull request
        
        edit the routes.py file.
        
        change the SQL statement to make it insecure.
        
        commit those changes and merge the insecure code into the main branch.
        
        experience the alert inside the pull request.
      - What is pull request: Pull requests are proposed changes to a repository submitted by a user and accepted or rejected by a repository's collaborators.
      - What is branch: A branch is a parallel version of your repository. By default, your repository has one branch named main and it is considered to be the definitive branch. Creating additional branches allows you to copy the main branch of your repository and safely make any changes without disrupting the main project
      - Recap
        
        Enabled CodeQL on your repository.
        
        CodeQL scanned the code in your repository and notified us of two SQL injection vulnerabilities.
        
        Reviewed the findings, marked the findings as closed, and explored the audit trail.
        
        Fixed your code in the main branch and saw that the findings automatically closed out.
        
        Introduced a new vulnerability in a new branch.
        
        Created a pull request, and were notified of the vulnerability.