IT & Security · Module
DevHub
Repositories, PRs, pipelines and deployments linked to changes, incidents and metrics
DevHub connects GitHub and GitLab to One3 so production deployments create ITSM changes, incidents suggest their causal deployment, and delivery metrics come from real records. It stores metadata, not source code.
What it does
DevHub is planned for W4 to give engineering leaders and IT one view of how software changes. A GitHub App connection installs at organisation level with repository selection, least-privilege permissions listed in the admin console, signed webhooks and backfill with rate-limit handling. GitLab connects for SaaS and self-managed, with Bitbucket and Azure DevOps later where customers need them.
Repositories and services
The repository catalog records owning team, service mapping, language, default branch, branch protection status and criticality. Repositories map to business service and application CIs in the ITSM CMDB. Contributor identity mapping links Git identities to One3 people by verified email and flags bots.
PRs, pipelines and deployments
Pull request sync captures author, reviewers, checks, size and timestamps from opened to merged. AI PR summaries explain intent, risk areas and test changes. Pipeline sync records status, duration, trigger and failed jobs. Deployments and environments come from Git host APIs or a signed deployment-event endpoint for other CD tools.
Changes and incidents
Each production deployment creates or links an ITSM change with its PRs, pipeline run and risk inputs. A deployment approval gate can request approval in the Approvals Inbox and return it to the Git host where external protection rules are supported (verify). Freeze window enforcement blocks deployments during ITSM freeze windows unless an approved emergency change is linked. When an incident hits a service, deployment-to-incident linkage suggests candidate deployments with evidence; a human confirms, and the change failure rate updates.
Metrics and reports
DORA-style delivery metrics — deployment frequency, lead time for changes, change failure rate and failed deployment recovery time — are shown per service, team and period with definitions and configurable exclusions. A monthly engineering leadership report links every statement to its metric. Release notes are drafted from merged PRs, and publishing is a previewed R3 Action. Security findings from Dependabot, code scanning and secret scanning flow to Security Center. Developer self-service actions and TechDocs add a light developer portal.
Features
What DevHub includes
GitHub App connection
Org-level install, repository selection, least-privilege permissions, signed webhooks and rate-limited backfill.
GitLab connection
GitLab.com and self-managed via group token or application with webhooks and backfill.
Repository catalog and service linkage
Owning team, language, branch protection and criticality, mapped to business service CIs in ITSM.
Pull request sync
Author, reviewers, state, checks, size and timestamps from opened to merged, with linked issues.
AI PR summaries
Intent, risk areas and test changes shown in DevHub and on linked changes; posting as a comment optional.
Pipeline sync
Runs with status, duration, trigger, failed jobs and commit.
Deployments and environments
From Git host APIs or a signed deployment-event endpoint for other CD tools.
Change records from production deployments
Each production deployment creates or links an ITSM change with PRs and risk inputs.
Deployment-to-incident linkage
Candidate causal deployments suggested with evidence for a human to confirm.
DORA-style delivery metrics
Deployment frequency, lead time, change failure rate and recovery time per service, team and period.
Deployment approval gate and freeze enforcement
Approvals Inbox gate returned to the Git host where supported, blocked during freeze windows.
Release notes generation
Drafts from merged PRs and issues with internal and customer variants; publishing previewed.
Security findings sync
Dependabot, code scanning and secret scanning alerts sent to Security Center as vulnerabilities.
Engineering leadership report
Monthly narrative of delivery trends, change-caused incidents, risks and open findings, each linked to its source.
Developer self-service and TechDocs
Templates for repository, environment and access requests with approvals, and docs-as-code rendered next to services.
Workflow
Deployment to change to incident
- 1
PR merged and pipeline runs
- 2
Production deployments check freeze windows and approvals
- 3
Approver sees risk score and PR summary
- 4
Deployment recorded and change created
- 5
New incidents suggest the causal deployment
- 6
Human confirms and metrics update
Workflow
Delivery metrics computation
- 1
Deployments, PRs and incidents are collected per service
- 2
Exclusions such as bots are applied
- 3
Metrics are computed with displayed definitions
- 4
Leadership report links each statement to its metric
AI
AI skills and Digital Employees
PR summaries
Intent, risk areas and test change summaries.
Release notes drafts
Audience-specific notes from merged PRs and issues.
Causal deployment suggestion
Evidence-backed candidate deployments for a new incident.
Code review comments
Findings and security hints posted on PRs by the AI Code Reviewer.
Incident timeline
Timeline assembled from deployments, pipeline runs, alerts and commits.
Digital Employees that use this module
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
Does DevHub store our source code?
No. It stores metadata such as PRs, pipelines, deployments and repository settings.
Which Git hosts are supported?
GitHub and GitLab are planned first. Bitbucket and Azure DevOps are later, where customers need them.
Who decides whether a deployment caused an incident?
DevHub suggests candidates with evidence, and a person confirms or rejects. Only confirmed links affect the change failure rate.
Can an agent publish release notes?
Agents draft release notes. Publishing to Help Center, Status Page or email is an R3 Action with a preview.
See DevHub in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.