If you want everything integrated together this is probably fine, but GitHub Enterprise + Jira Premium is $35 per user per month (and every other project management tool is cheaper and better than Jira, just about). I don't know what the value add is here, other than self-hosting. (Or at least, the $65 value add).
If you are building a docker image for example, you likely are doing a pull from docker hub, the security scanning software can help you catch security issues there.
It can also help with things like dependencies in your node projects, python projects and more (at least, that is what the security scanning software we use at $work does, I assume gitlab is similar).
It's not about employees pushing malicious code, it's about catching issues with dependencies further up the stack, to make sure that the end result you are pushing to your servers/users is not vulnerable.
Preferably with an emphasis on speed?
We're building Linear, focusing on speed and providing sane defaults that sense for software companies. The app offline first so all interactions are <100ms. Sprints, projects, roadmaps, multiple teams, GitHub/Gitlab/Sentry supported etc supported. Lot of YC startups and growth companies (100-300 engineers) use us.
Today, we’re making GitHub Enterprise Server 3.0 available as a release candidate. Announced in the GitHub Universe Keynote, it’s the biggest ever change to Enterprise Server, bringing customers:
* Actions – developer-first workflow automation and CI/CD * Packages – publish and consume packages together with code * Mobile Apps (beta)- iOS and Android apps for collaborating from any device
For companies interested in automating code security with GitHub Advanced Security, we’re also bringing:
* Code scanning – scan every pull request for known vulnerabilities with CodeQL * Secret scanning (beta) – detect credentials in code before they hit production