Deploying at GitHub

How often does code go through security audits? Is every feature audited prior to deploying to live? GitHub is making money by selling private repositories which will often contain very sensitive code, so ensuring nobody can gain unauthorised access to them is presumably one of the top concerns.<p>I'm interested in seeing how tight security requirements fit in with this almost continuous deployment strategy.

Interesting, I saw something like this by looking at the <a href="https://github.com/mozilla/pdf.js/" rel="nofollow">https://github.com/mozilla/pdf.js/</a> project. Take a look at the closed pull requests. They have some bots listening for commands in comments and do stuff like unit testing and previewing. The result gets posted as comment from the responsible bot. Another one is checking master branch for changes and automatically builds and pushes at gh-pages. Seems to work very well, but don't know how they build/did it.

If you're looking for a less complex model of this, you should try our Continuous Integration and deployment service: <a href="https://circleci.com" rel="nofollow">https://circleci.com</a>. Over time, we'll be providing the sort of complexity that GitHub provides here, now we do about 70% of it.

I might be wrong but for me this is almost a [Hack] -&#62; [Prod] methodology...<p>Roll back in 30 seconds, cool but how do you manage data / schema migrations ? You have a snapshot also to rollback any data corruption the last hacking session could have introduced ?

If GitHub uses GitHub to deploy GitHub, what happens when GitHub goes down?

Encouraging to know this model scales to 100 employees at least.<p>Purely out of intellectual interest, I wonder if a company the size of Google or Facebook could also ship in this way, or if the whole release manager/team is essential.

I know this is Github, but... Rather than use the Github API, wouldn't it be more efficient to interact with Git directly? Libgit2 maybe?

<i>WOW</i>. 175 deploys in one day?

How do you deal with the github enterprise version of your software? Does it have a separate QA cycle? How often do you ship new releases of that?<p>I am hoping that Github could shed more light on the how they ship an enterprise version along with the SAASy web version that we all know and love.

Interesting ... what's your QA process? Do you have a staging environment where you try stuff out (looking for bugs) before pushing to production?