Research GitHub Campus Program

[marisastrong]

https://docs.github.com/en/education/explore-the-benefits-of-teaching-and-learning-with-github-education/use-github-at-your-educational-institution/about-github-campus-program

https://docs.github.com/en/enterprise-cloud@latest/admin/managing-code-security/managing-github-advanced-security-for-your-enterprise

https://docs.github.com/en/enterprise-cloud@latest/admin

https://ucopedu.atlassian.net/wiki/spaces/CDLShare/pages/830832659/Github+Education+Account

[marisastrong]

Synthesize findings
benefits
risks
share with Tech Council
Advanced Security Topics

[terrywbrady]

• Assumptions
  • Managed Accounts is too restrictive (no public repos, no collaboration outside the enterprise)
    • We will enable the use of personal accounts
    • We may want to add optional SAML/SSO authentication for some organizations within our enterprise
    • This might mean that external collaborators cannot be team members, they may need to be added individually to specific repos
  • Code will reside in the USA (default)
  • Roles
    • Enterprise Managers: IAS?
    • Billing Managers: Marisa, Kurt?
    • Enterprise Members:
      • CDL Staff via personal GitHub accounts, personal accounts augmented with SSO address
      • Any external collaborator that is added to an org or repo.
        • It would be good to calculate the number we anticipate.
        • I see conflicting information about whether or not this type of user counts as an enterprise user.
      • Guest Collaborator: only applies to Managed Accounts
      • Organization Admin
        • Is this role still applicable once we move to enterprise?
      • Team/Repo Admin
        • Can control access and extend invitations to non org members
      • Team/Repo Maintainer
        • Can control access and extend invitations to org members only
• Questions
  • Are we happy with the existing organizations or will we want to restructure. Org Best Practices
  • Are there specific orgs that we might want to further restrict with SAML/SSO?
    • IAS repos
• Features we will not be adopting
  • Managed Accounts (see above)
  • Self-hosting of the enterprise software
• Benefits
  • Consistent management of all of our GitHub orgs/repos
    • We currently have too many owners/admins
    • Consistent visibility into access across all orgs in the enterprise
  • Consistent application of education benefits across all of the orgs/repos we own
    • We currently have a cluster of GitHub orgs/accounts that have been granted "education" benefits, each of which has its own expiration
  • Ability to require SSO for some orgs/repos
  • Ability to verify a domain for our enterprise
  • Enterprise audit logs
  • Additional compute hours
  • Additional storage for artifacts
• Challenges/Risks
  • May be more difficult/costly to unwind GitHub benefits for campuses change
    • Our usage pattern is clearly visible as a single account with revenue potential
  • Some users will be removed from org admin
  • Will need to re-work some user/team access
  • External collaborators in a CDL enterprise account will likely have reduces repo admin rights
• Unknowns
  • Access to Copilot / AI features
  • Creation / scoping of API tokens
  • Ease/challenges of integrating with AWS Code Build/Code Pipeline
  • Will this help us meet future security requirements from UCOP IT?

[terrywbrady]

My vision of the campus program

• remove admin rights from all personal github accounts
• admin rights granted to specific CDL staff via new github admin accounts
• admin accounts must have SSO
• permissions granted to CDL staff via teams
• permissions granted to externals on a repo basis
• daily work is done in a non admin account
• copilot features available to non admin accounts

[terrywbrady]

Techniques for admin account:

• user+githubadmin@ucop.edu
• email lists + shared 2FA strategy

[mstrong-admin]

My vision of the campus program

Administration
remove admin rights from all personal github accounts
admin rights granted to specific CDL staff via new github admin accounts
admin accounts must have SSO
permissions granted to CDL staff via teams
permissions granted to externals on a repo basis
daily work is done in a non admin account
copilot features available to non admin accounts

[mstrong-admin]

Do schools receive free access to Copilot and the Student Developer Pack?
While GitHub offers free access to Copilot for individuals and numerous partner tools for all students and educators, these are not accessed through our educational institutional benefits. Students and educators must apply directly to receive these benefits.

[marisastrong]

Using private repositories - use Github Actions more liberally to see what limitations we might run up against. PAD team is using them extensively. Can check back in a couple of weeks to see how that is going.

We'll put Github Campus on pause for now.

[marisastrong]

@terrywbrady and @marisastrong will try assigning the Owner for administrative purposes.

user+githubadmin@ucop.edu
email lists + shared 2FA strategy