While I agree with the spirit of your statement "people are afraid to run their own software", I feel like this assumes that people are the ones choosing the software they run. I wish my teams could run more things ourselves, but are told no by our systems and infrastructure staff.
Any self hosted service in an enterprise means that you're dealing with all the headaches that come with that including: backups, user/role creation and mapping maintenance, infrastructure scaling needs, OTEL or other monitoring, etc.
It's an easier decision for VPs to pay GitHub anything less than the man hours required to execute the above tasks because it's a "not our problem" fee.
I'm late to the game on this thread, but I am a lead SWE at a medium size logistics company. Been in logistics SWE since 2015. I'd be interested to hear how your company fits into the industry, who your service provider is, which no code platform you're using, etc and at the very least give you a sounding board based on my experience. Shoot me a DM if you're interested!
I'm genuinely not sure how other companies do this.... But how is your team handling SOX controls WITHOUT at least one DevOps person?
I work at a medium size publicly traded company and our SOX compliance controls would take literal months to generate and/or prove to auditors without our CI/CD pipelines. It's just an extract from GH Actions with a report of who modified, who approved, and who actually pushed to main. All of these actions must be siloed (if you can commit to repo, you cannot push to main)
Potentially this is a consequence of micro service infra, my team alone manages nearly 25 separate git repositories.
Thanks for your reply. When I describe "the business" I am referring to Product teams that manage SOP, help prioritize new offerings, etc. Here's an example of a feature request from the business:
"I want to allow customers to run scheduled reports from our portal and receive them via email."
Development then designs and executes, delivering a scheduled reporting suite for testing. Business will come back with feedback such as:
"I don't like how I have to select the time for every report. Can't you just default it?" or "Only some users from the customer's account should be able to create/edit scheduled reports. Please add this by Tuesday so I can demo." or even "This is great, but my customer has special holidays that they don't want emails to be sent on. We should have a yearly calendar that prevents reports from getting sent."
There is a large gap between feature request "requirements" and the expectations of the business. Thus, we request specific feature request requirement documents to be turned in prior to development starting work.
Can someone, anyone, explain to me how this passes SOX scrutiny?
I have issues with business/product team even commenting on PRs because auditors have said that access to GitHub=Access to Codebase.
There are a select few people I would consider granting access to code within our product teams, but without "segregation of duties" clearly defined, I don't think it would fly.
Any self hosted service in an enterprise means that you're dealing with all the headaches that come with that including: backups, user/role creation and mapping maintenance, infrastructure scaling needs, OTEL or other monitoring, etc.
It's an easier decision for VPs to pay GitHub anything less than the man hours required to execute the above tasks because it's a "not our problem" fee.