GitHub Universe goes fully virtual, with Actions in the spotlight

GitHub Universe moves to an all-online format this year, with three days and five hours of content per day, plus a rebroadcast for the Asia-Pacific region. Brian Douglas, who will host virtual sessions at the event, says the agenda follows up on features shipped earlier in 2019, including code scanning, GitHub Discussions, and GitHub Actions.

Actions, which arrived two Universes ago, has become a building block for other GitHub features ranging from security and authentication to webhook access. Douglas’s talk, “Getting traction with GitHub Actions,” is aimed at expanding what teams do with Actions beyond the usual CI/CD jobs.

Using Actions for performance and staging

One example Douglas highlights outside of CI/CD is the Lighthouse action, built on Google’s open source Lighthouse auditing tool. Normally Lighthouse runs in a browser to score performance and accessibility. Wrapped as a GitHub Action, it runs automatically when a pull request is opened.

Instead of discovering performance regressions after merge, teams get a Lighthouse score tied to the PR, and the action uploads a report into the action artifact for review. Douglas notes this is a significant shift for organizations that have historically deferred accessibility and performance fixes—issues that often require major remediation later.

Learning path before Universe

For developers new to Actions, Douglas recommends two steps before the event: work through the Actions course on GitHub Learning Lab, then open the Actions tab in a repository to try workflows hands-on against a real project.

Security takes a central role

Douglas expects security to be a main theme at Universe, framed through the lens of everyday developer friction—shipping a token or committing a secret. He points to GitHub’s automatic token identification and regeneration as an example of a small fix that removes a frantic cleanup process entirely.

Recommended security sessions for DevOps teams include:

  • Keeping secrets in your infrastructure pipeline, with HashiCorp
  • So you committed a secret…, with Sasha Rosenbaum
  • Catching vulnerabilities early with GitHub, with Maya Kaczorowski and William Bartholomew

To prepare ahead of Universe, teams can use the Security tab on their repositories. It links security research documents and reports to the actual libraries a project depends on. Douglas describes discovering a vulnerability in one of his own actions this way—a fix that benefited everyone using it, not just his own project.

His bottom-line advice is to know what GitHub security tooling exists and to start using it. CodeQL, for instance, is activated from the Security tab; enabling it is the first step to leveraging community security research on your codebase, regardless of the language you’re writing in.

Making room for downtime

For first-time attendees, Douglas notes the challenge of feeling obligated to watch every session. This year’s virtual play track is designed as a lighter complement to the technical program, with background performances and short tutorials on creative coding tools.

He also suggests using GitHub Discussions—the native feature shipped earlier this year—to create your own Universe threads, ask questions, and reach speakers directly. Douglas plans to participate under the handle @bdougie.