GitHub & Atlassian: Advanced Practitioner Reference (2026)¶
The Three Things You Must Plan Around Now¶
- GitHub billing changes (April–June 2026): GHAS split into two SKUs (April 1, 2025); Copilot moved to usage-based AI Credits billing (June 1, 2026)
- Bitbucket app-password hard deadline: brownouts start June 9, 2026; permanent removal July 28, 2026
- Atlassian Server is dead (Feb 2024); Data Center is on a countdown — no new DC sales after March 30, 2026; full EOL March 28, 2029
Part 1 — GitHub¶
1.1 Repositories and Governance¶
Rulesets have superseded branch protection as the model of choice: - Multiple rulesets aggregate (most restrictive applies) vs branch protection (one rule "wins" by priority) - Can be set at the organization level (GitHub Enterprise) - Target branch-name patterns and tags - Run in evaluate (dry-run) mode before enforcement - Enforce metadata rules (commit message, branch naming, author email) natively — eliminating pre-receive hooks - Branch protection still exists and layers with rulesets
Three repository visibilities: - Public, private, and internal (enterprise accounts only) — internal = visible to all enterprise members, ideal for InnerSource
CODEOWNERS: routes review by path (last matching pattern wins); can be required via rulesets.
GitHub merge queue (GA 2023):
- Builds speculative merge commits (base + PRs ahead + this PR) and merges FIFO once required checks pass
- Requires the merge_group workflow trigger — the single most common misconfiguration
- Does not support wildcard branch patterns
- Designed and tested at scale (GitHub.com: 30,000+ PRs, 4.5M CI runs before GA)
1.2 Issues and Projects¶
YAML issue forms have largely superseded markdown templates for serious intake — structured dropdowns/checkboxes/validations.
GitHub Issues vs Jira decision: - GitHub Issues + Projects: free, markdown-native, zero context-switch — sufficient for teams under ~20–30 developers - Jira wins on: workflow enforcement (conditions/validators/post-functions), velocity/burndown/CFD reporting, cross-project portfolio visibility, issue hierarchy (Initiative→Epic→Story→Sub-task), 5,000+ Marketplace
GitHub Projects (v2) honest gaps vs Jira: - No native velocity/cycle-time analytics - Flat hierarchy (no true epics/parent-child without task-list workarounds) - Limited fine-grained permissions ("QA can only move to Done" isn't expressible) - Managed via GraphQL API
1.3 GitHub Actions¶
Core building blocks: triggers, matrix builds, concurrency controls, reusable workflows (workflow_call) vs composite/JS/Docker actions.
Security and scale features:
- OIDC federation: bind to Environments (environment:<env> subject) with required reviewers, not just branches — the right way to gate production
- Environments + deployment protection rules: required reviewers, wait timers, branch restrictions
- Actions Runner Controller (ARC): Kubernetes-native autoscaling using ephemeral runner pods (fresh pod per job, destroyed after — prevents state leakage and ensures no job is assigned to a shutting-down runner)
- ARC 0.14.0 (March 2026): moved to actions/scaleset library client
- Earlier releases added: native sidecar DinD, automatic pod retries (up to 5), OpenShift support, Azure Key Vault secret retrieval (GA), dual-stack IPv4/IPv6
Security best practices:
- Pin third-party actions to commit SHAs (Dependabot updates them)
- Minimize GITHUB_TOKEN permissions; set explicit permissions blocks
- Marketplace actions introduce third-party supply-chain risk
Repository secrets/variables scope: org, repo, and environment levels.
1.4 GitHub Advanced Security (GHAS) — Repriced April 1, 2025¶
GHAS was unbundled into two metered, committer-priced SKUs available even on Team:
| SKU | Price | Includes |
|---|---|---|
| Secret Protection | $19/active committer/mo | Push protection, validity checks, AI-detected generic secrets, 200+ partner patterns |
| Code Security | $30/active committer/mo | CodeQL code scanning, Copilot Autofix, security campaigns, dependency review |
Active committer definition: unique active committers on a 90-day window over repos where the feature is enabled.
Cost control: scope to specific repos — org-wide enablement counts every contractor and bot that pushes.
Copilot Autofix: covers 90%+ of alert types in JS/TS/Java/Python; suggestions remediate 2/3+ of found vulnerabilities.
Other security features:
- Dependabot: alerts, security updates, version updates, grouped updates via dependabot.yml
- Secret scanning push protection: blocks at push; delegated bypass (approval workflow); validity checks against provider APIs
- Custom patterns (up to 500/org via Hyperscan regex)
- Artifact attestations (GA June 2024): actions/attest-build-provenance via Sigstore → SLSA Build Level 2 out of the box, Level 3 with reusable workflows; no key management; Kubernetes admission controller for enforcement
- Security campaigns (2025): org-level security debt remediation workflows
1.5 GitHub Copilot¶
The product is now a family of agents:
| Feature | Status | Notes |
|---|---|---|
| Code completions | GA | Unlimited and unbilled on paid plans |
| Copilot Chat (IDE + GitHub.com) | GA | PR summaries, repo Q&A, slash commands, @workspace |
| Copilot code review | GA (April 4, 2025) | Automatic (via rules) + on-demand; 1M+ devs in first month of preview |
| Copilot coding agent | GA (Sept 25, 2025) | Assign issue → opens draft PR via GitHub Actions |
| Copilot CLI | GA | — |
| Agent mode (VS Code, JetBrains) | GA by early 2026 | Multi-file/multi-step agentic sessions |
Billing changed June 1, 2026 to usage-based AI Credits (1 credit = $0.01, priced by token/model):
| Plan | Price | AI Credits included |
|---|---|---|
| Business | $19/user/mo | $19 credits |
| Enterprise | $39/user/mo | $39 credits (also requires GHEC ~$21/user → real cost ~$60/user) |
- Code completions remain unlimited and unbilled
- Copilot code review additionally consumes GitHub Actions minutes on private repos starting June 1, 2026 (public repos remain free)
- Agentic sessions can consume credits and Actions minutes quickly — set spend alerts
Honest assessment: measurably helps on boilerplate, tests, and low-to-medium-complexity well-tested codebases; underdelivers on novel architecture and large unfamiliar codebases.
1.6 Enterprise Identity (EMU)¶
True SCIM provisioning requires GitHub Enterprise Cloud with Enterprise Managed Users (EMU). - Standard GHEC: only SCIM-triggered invitations (not full provisioning) - EMU hard tradeoff: managed users cannot contribute to public repos or external OSS - Okta + Entra split-IdP combination is explicitly unsupported - Data residency (GHE.com) requires EMU
GitHub Enterprise options: - GHEC: cloud-hosted, EMU optional, GitHub Connect bridge - GHES: self-hosted HA (primary-replica, backup-utils), GitHub Connect bridge to GHEC; air-gapped option
1.7 Packages and Ecosystem¶
GHCR for GitHub-native flows; choose Azure Artifacts/Artifactory for polyglot enterprise artifact governance.
GitHub Apps vs OAuth Apps vs PATs vs Actions tokens:
- GitHub Apps (JWT→installation tokens): the right credential for automation
- PATs: simpler but coarser; fine-grained PATs now available
- Actions GITHUB_TOKEN: repo-scoped, short-lived — prefer over PATs in Actions workflows
Codespaces: devcontainers + prebuilds; billed per compute-hour.
Part 2 — Atlassian¶
2.1 Server EOL and Data Center Countdown¶
| Milestone | Date |
|---|---|
| Server end of support | February 15, 2024 — DONE |
| No new DC sales | March 30, 2026 |
| DC license/tier/app purchases stop | March 30, 2028 |
| DC full EOL (read-only) | March 28, 2029 |
Migration path: Cloud Migration Assistant; "Atlassian Ascend"/FastShift programs for 1,000+ user orgs. A Bitbucket Hybrid License (DC + Cloud) arrives mid-2026.
2.2 Jira Software¶
Two project types: - Team-managed (formerly next-gen): simple, autonomous - Company-managed (classic): deep scheme model (workflow, permission, notification, issue type, field, screen schemes + project roles) — required for workflow gates, cross-project portfolio
Hierarchy: Initiatives (in Plans) → Epics → Stories/Tasks → Sub-tasks
Workflows: statuses/transitions with conditions, validators, post-functions — the feature that makes Jira worth it over GitHub Issues.
JQL tips: write index-friendly queries; avoid full-text scans at scale; use functions (currentUser(), membersOf(), startOfWeek()).
Jira Automation: no-code triggers/conditions/actions/branches at project and org level.
Jira Plans (Advanced Roadmaps): cross-team/program planning and dependency tracking.
2.3 Jira Service Management (JSM) — Now "Service Collection"¶
JSM + Assets + Rovo + Customer Service Management are now sold as the Service Collection.
Premium tier (~$47–53/agent/mo) gates the features that matter: - CMDB/Assets - Change management with CI/CD deployment gating - Major incident management - Atlassian Intelligence - Virtual Service Agent
Billed per agent — requesters are free.
Opsgenie status: new sales ended June 4, 2025; full shutdown April 5, 2027; capabilities folded into JSM.
JSM vs ServiceNow vs Zendesk: - JSM wins: Atlassian-ecosystem integration, per-agent price - ServiceNow wins: heavyweight enterprise ITSM breadth - Zendesk wins: pure customer-facing support UX
2.4 Rovo — Atlassian's AI Layer¶
"Rovo for all" (from April 9, 2025): Rovo Search/Chat/Agents/Studio included in paid Jira/Confluence/JSM Cloud plans — no separate SKU for core features.
Credit allowances (pooled at org level, monthly, no rollover):
| Plan | Credits/user/mo |
|---|---|
| Standard | 25 |
| Premium | 70 |
| Enterprise | 150 |
- Jira, Confluence, and Service Collection/JSM
- A single Rovo Chat/Agent question = 10 credits; Deep Research = 100 credits
- Atlassian Intelligence (in-product drafting/summaries) is the foundation; Rovo is the cross-product layer
- Rovo Dev (for engineers — CLI, PR analysis) is a separate $20/dev/mo product with 2,000 credits
- Rovo is Cloud-only
- Rovo credit overages are not yet billed but Atlassian has signaled future consumption-based charging (≥90 days notice)
2.5 Bitbucket — URGENT Deprecation¶
App-password hard deadline: - No new creation: September 9, 2025 — PASSED - Controlled brownouts begin: June 9, 2026 - Permanent removal: July 28, 2026
Action required immediately: migrate all Bitbucket CI integrations to API tokens with scopes (or OIDC for cloud auth).
Bitbucket Pipelines OIDC: oidc: true flag; $BITBUCKET_STEP_OIDC_TOKEN for keyless cloud auth.
Code Insights/Annotations API: pushes CI quality/coverage/security results back onto PRs.
Bitbucket Pipelines vs GitHub Actions: - Actions wins on: ecosystem (20,000+ marketplace), reusable workflows, matrix builds, macOS/Windows runners, free minutes (2,000/mo vs Bitbucket's 50 free; Standard 2,500, Premium 3,500) - Pipelines wins on: simplicity and zero-config Jira deployment tracking
Main reason to keep Bitbucket: native Jira integration — same-vendor, deeper integration than GitHub's, strongest reason Atlassian-centric orgs stay
2.6 Confluence¶
Key capabilities: - Spaces with a permission model (space admin; page view/add/edit/delete/export) - Page hierarchy and restrictions - Fabric editor with macros (code, ToC, panels, status, live Jira issue lists, children display, excerpt/excerpt-include) - Whiteboards (GA February 29, 2024): Cloud-only - Databases (broad rollout July 10, 2024): structured data as fields + entries, sync from Jira/Confluence/CSV — Cloud-only - CQL search and Confluence Analytics (Cloud) - Page properties + reports for lightweight tracking
Confluence vs Notion vs SharePoint: - Confluence wins: Atlassian-integrated teams (live Jira embeds, JSM knowledge base, space permissions) - Notion wins: flexible databases/UX for smaller teams - SharePoint wins: Microsoft 365-centric document governance
2.7 Forge vs Connect¶
Forge has replaced Connect as the app platform.
| Connect | Forge | |
|---|---|---|
| Model | External iframe (third-party servers) | Serverless on Atlassian infrastructure |
| Storage | External DB | Key-value + Forge SQL |
| Compliance | Requires vendor trust | Preferred model (Atlassian-hosted) |
| Status | End of support Q4 2026 | Active, all new investment |
Connect deprecation timeline: - No new Connect listings: September 17, 2025 — PASSED - No Connect updates: March 31, 2026 - End of support: Q4 2026
Action required: audit Connect app dependencies; confirm vendors have Forge versions before Q4 2026.
2.8 Atlassian Guard (Security Layer)¶
- Guard Standard (SSO/SCIM/API-token control/audit log) — included free in Cloud Enterprise
- Guard Premium (data classification, content scanning/DLP, anomalous-activity threat detection, extended audit) — currently supports Jira and Confluence
Part 3 — GitHub ↔ Atlassian Integration¶
The Official "GitHub for Jira" App¶
- Atlassian-maintained; Jira Cloud only
- Links commits/branches/PRs/builds/deployments to issues by string-matching the Jira issue key
- Surfaces data in the Jira development panel, board card icons, Code/Releases/Deployments tabs, JQL
- Smart commits:
PROJ-123 #comment ... #time 2h #done - "Create branch" button in Jira; JQL queries over development data
Limitation: only as reliable as naming discipline — which is why mature teams enforce issue-keyed branch names via rulesets and drive status transitions via Actions.
GitHub Enterprise Server ↔ Jira DC: not supported by the native app — requires third-party (e.g., GitKraken's Git Integration for Jira).
Production Integration Pattern (50–500 Engineers)¶
- Enforce issue-keyed branch names via GitHub rulesets (regex rejecting non-conforming branches at push)
- Drive Jira status transitions from GitHub Actions on
pull_request/push/deployment events calling the Jira API oratlassian/gajira-*actions — more reliable than smart commits (which depend on developer discipline and email matching) - Track deployments via GitHub Environments → Jira deployment panel
- Pipe CodeQL/Dependabot findings into Jira as security issues via Actions for SLA-tracked remediation
- Keep Jira as system of record; use GitHub Projects only for engineering-local sprint views to avoid dual-maintenance
Part 4 — Cross-Cutting Concerns¶
Org Design¶
- Mono-repo vs poly-repo drives GitHub org/team structure and Jira project layout (one project per team is the common default)
- Standardize naming across both: branch names, PR titles, Jira summaries
- Standardize identity: one IdP (Entra ID/Okta) → GitHub teams via EMU SCIM → Jira groups/roles via Guard SCIM
End-to-End Agile Delivery Flow¶
Jira issue → issue-keyed branch → PR (linked) → CI (Actions/Pipelines) → human + Copilot code review → merge queue → Jira transition → release → deployment tracked in Jira
- Dual-track agile: Confluence (discovery) + Jira sprints (delivery)
- DoD enforcement: Jira automation + GitHub required checks
DORA Metrics Cross-Platform¶
- Deployment frequency: GitHub releases/deployments
- Lead time: Jira create → PR merge → deploy
- Change failure rate: bug/incident tickets
- MTTR: incident resolution
- Tooling: LinearB, Sleuth, Faros AI, Jellyfish, Haystack
Security and Compliance Integration¶
- GHAS findings → Jira security issues (via Actions)
- Both audit logs → SIEM
- JSM change requests linked to GitHub PRs/deployments
- Secret-scanning alerts → JSM incidents
- Both platforms carry SOC 2 / ISO 27001; Atlassian Cloud adds FedRAMP
Licensing and Cost Optimization¶
| Product | Standard | Premium |
|---|---|---|
| Jira | ~$7.91/user/mo | ~$14.54/user/mo |
| Confluence | ~$5.42/user/mo | ~$10.44/user/mo |
| JSM | ~$20/agent/mo | ~$47–53/agent/mo |
| GitHub Team | $4/user/mo | — |
| GitHub Enterprise | ~$21/user/mo | — |
| GHAS Secret Protection | $19/committer/mo | — |
| GHAS Code Security | $30/committer/mo | — |
| Copilot Business | $19/user/mo | — |
| Copilot Enterprise | $39/user/mo (+ GHEC) | — |
Optimization levers: - Prune inactive users (metered billing means unused seats still cost) - Scope GHAS to specific repos, not org-wide - Reconcile licenses against IdP group sync - Consolidate on Enterprise where volume discounts apply - Set Copilot spend alerts given usage-based billing
Staged Implementation Roadmap¶
Stage 1 — Stabilize Identity and Deprecation Exposure (Now)¶
- Migrate Bitbucket app passwords to API tokens/OIDC before June 9, 2026 brownouts — this is the most urgent hard deadline
- Audit Connect app dependencies; confirm vendors have Forge versions before Q4 2026
- Standardize SSO/SCIM on one IdP feeding both ecosystems
- Decide EMU vs standard GHEC using the OSS-contribution and data-residency tests
Stage 2 — Modernize Governance (Next Quarter)¶
- Migrate branch protection → organization rulesets in evaluate mode first, then enforce; add metadata rules for issue-keyed branch names
- Enable merge queue on busy default branches (remember the
merge_grouptrigger) - Scope GHAS Secret Protection + Code Security to active repos; turn on push protection org-wide with delegated bypass
Stage 3 — Integrate and Measure (6–12 Months)¶
- Deploy GitHub for Jira; replace smart-commit reliance with Actions-driven transitions
- Stand up DORA metrics via a cross-platform tool
- Pilot Copilot coding agent / code review and Rovo agents on contained workflows; set spend alerts
Thresholds That Change the Plan¶
- Cross ~30 engineers or need workflow gates/portfolio reporting → move planning to Jira (not GitHub Projects)
- Active-committer count balloons with bots/contractors → re-scope GHAS repos to control cost
- Copilot agentic usage drives credit overages → cap org spend and restrict premium models
- Air-gapped/sovereign requirements → GHES + Bitbucket DC (until 2029)
Plugin: devsecops-cicd · View SKILL.md on GitHub