Best practices for administering GitHub Copilot with Luis Pujols | Beyond the Commit

GitHub Copilot Governance: Scaling the Right Way

Key Concepts:

• GitHub Copilot license assignment methods (manual, organization-based, identity provider provisioning, API)
• Copilot metrics API (usage data)
• Copilot user management API (license allocation data)
• Feature enablement strategy (phased approach: autocomplete & chat first, then advanced features)
• Developer responsibility and control
• GitHub Trust Center (IP and privacy information)

1. Assigning GitHub Copilot Licenses

Luis outlines four methods for assigning GitHub Copilot licenses, emphasizing that the best approach depends on organizational priorities:

• Manual Assignment: Suitable for small proof-of-concept (POC) groups. Licenses are assigned individually through organization settings.
• Organization-Based Assignment: Licenses are assigned across the entire organization. Simple but potentially inefficient if not all users require Copilot.
• Identity Provider (IdP) Provisioning: Links a GitHub organization to an IdP group. Licenses are automatically assigned to members of the synchronized group. This enables scalable rollout and centralized management within the existing identity system.
• Copilot API: Provides the most flexibility. Allows for custom workflows using other platform components like GitHub Actions. Example: a user can request a license via a GitHub issue, triggering an automated workflow to grant access. Enables self-service options and customized assignment rules (e.g., manager approval).

2. Monitoring and Measuring Copilot Usage

Luis introduces two APIs for tracking Copilot usage:

• Copilot Metrics API: Provides usage data for the last 28 days, broken down by language, IDE, and enterprise/organization/team level. Helps identify teams needing more enablement or those unaware of their access.

• Copilot User Management API: Provides information about license allocation, last activity date, and last editor used. Enables identification of inactive licenses.

  • Defining "Unused": Luis emphasizes the importance of defining clear criteria for what constitutes an unused license. Consider factors like:
    • Attendance at internal enablement sessions
    • Extension installation
    • Email notifications about the tool
  • Actionable Insights: Before revoking licenses, investigate the reasons for inactivity. Offer additional training, address specific use cases, or connect users with internal champions.

3. Feature Enablement Strategy

Luis recommends a phased approach to feature enablement:

• Phase 1 (Out-of-the-Box): Start with autocomplete and GitHub Copilot Chat. Focus on familiarizing developers with the new AI-assisted workflow and the differences between using autocomplete in the editor versus the chat window.
• Phase 2 (Advanced): Introduce more advanced features like prompt crafting best practices, variable commands, and agents. This iterative approach prevents overwhelming developers and maximizes tool adoption.

Christopher uses the analogy of a video game, suggesting starting with the base game mechanics before adding downloadable content (DLCs).

4. Developer Responsibility and Control (Andrew Weiss's Perspective)

Andrew Weiss emphasizes that GitHub Copilot is an aid to software development workflows, accelerating modernization initiatives and streamlining development operations.

• Copilot's Role: Assists in writing, reviewing, maintaining, and modernizing code. Addresses knowledge gaps and improves code documentation.
• Developer's Responsibility: The developer retains ultimate control and responsibility for the code. They must review all code merged into the pipeline, ensure it meets security standards and governance frameworks, and oversee the entire software development lifecycle from ideation to production.

Quote: "Absolutely, the developer has still the end all be all say in all sorts of software development activity." - Andrew Weiss

5. Intellectual Property (IP) and Privacy

Luis directs viewers to the GitHub Trust Center for information on IP and privacy concerns related to GitHub Copilot. This resource provides answers to common questions about data usage and security.

6. Conclusion

The conversation highlights the importance of a strategic approach to GitHub Copilot governance, focusing on proper license assignment, usage monitoring, phased feature enablement, and maintaining developer control. The key takeaway is that Copilot is a tool to augment, not replace, developers, and its successful adoption requires ongoing support, training, and a clear understanding of its capabilities and limitations.