July 2019 Summaries

GitHub Sponsors enables open source developers and maintainers to receive financial support from the community, providing them with the freedom to focus on their passions and strengthen the open source ecosystem. Chrissy LeMaire, a self-taught developer and Automation Engineer, shares her journey and projects, highlighting her work on dbatools and dbachecks, which automate Microsoft SQL Server tasks and streamline database management. She discusses the challenges open source faces, such as reputation issues and corporate hesitance, while emphasizing the inclusivity and supportiveness of the communities she's involved with. Her involvement in open source has led to personal and professional growth, public speaking opportunities, and recognition as a dual Microsoft MVP. Chrissy notes the vital need for financial contributions to sustain initiatives like Appveyor subscriptions and infrastructure improvements, which are crucial for maintaining project quality and supporting diverse SQL Server environments. She encourages potential sponsors to consider supporting her work if they've benefited from the efficiencies dbatools offers.

The GitHub Student Developer Pack provides free access to industry-standard developer tools for students aged 13 and older in degree-granting programs. To apply, students typically use a school-issued email for verification, but alternative documentation such as a student ID or a letter on school letterhead can also be submitted if a school email is unavailable. The application process is designed to be straightforward while protecting against misuse, with a review period that generally takes up to two weeks. If an application is rejected, GitHub encourages resubmission with clearer or additional documentation. The Pack seeks to support students globally, and GitHub continues to work on improving accessibility and usability of the Pack for all eligible students.

The GitHub and Slack integration has been enhanced with new features aimed at improving project management efficiency by allowing users to manage deployments, checks, and draft pull requests directly from Slack. Users can now list and create deployments using the Deployments API without leaving their Slack channel, and they can view the status of checks and receive notifications about new draft pull requests, all within Slack. To use these new functionalities, GitHub organization owners or repository admins must accept updated permissions. The integration is open source, inviting contributions and feedback from the community to further develop its capabilities, and is built using the same public APIs as other GitHub and Slack applications.

Dependabot, initially released as a GitHub app, has reached a significant milestone by merging its one millionth pull request, highlighting its role in automating dependency updates for developers. By automatically updating dependencies through pull requests, Dependabot helps developers focus on more critical aspects of their projects, such as building new features and fixing bugs, thereby saving countless developer hours that would have otherwise been spent on routine maintenance. Its functionality includes checking for outdated dependencies, updating them, and submitting pull requests, which can be done in mere minutes. Moreover, Dependabot is integral to GitHub's automated security fix pull requests, actively monitoring dependencies for security vulnerabilities and opening pull requests for necessary updates. This tool is available for free on the GitHub Marketplace, allowing users to easily install and configure it to enhance their workflow and keep their projects secure and up-to-date.

Snyk has developed a successful GitHub Marketplace app that enhances vulnerability testing for open source dependencies and published the 2019 Open Source Security Report, highlighting the growing importance of integrating security into the development process. The report emphasizes that developers are increasingly taking ownership of their application stack, including security, with 81% of survey respondents believing developers should be responsible for their applications' security. Despite this, many developers are not consistently practicing security testing, with only 37% implementing automated security tests in their CI pipelines and 14% testing Docker images for vulnerabilities. The text advocates for integrating security early in the software development life cycle to foster a security-aware mindset, reduce the cost of late-discovered security bugs, and align security practices with modern software development's fast pace. Snyk's app provides an additional layer of security by offering actionable advice, remediation, and integration into existing developer workflows, enabling developers to address vulnerabilities efficiently and maintain secure development practices.

On Monday at 3:46 pm UTC, GitHub.com experienced a 41-minute service disruption due to a logic error introduced in the deployment pipeline, which subsequently affected a later deployment and destabilized several internal systems, complicating recovery efforts. Although the incident temporarily degraded some services, all GitHub services have since returned to normal with no data loss. GitHub is conducting a thorough investigation to understand the contributing factors and intends to share the findings with the community in an effort to maintain trust and improve reliability, acknowledging the significant impact of availability issues on its global user base.

Hackathons serve as an effective tool for teaching computer science students how to become self-learners, allowing them to apply classroom concepts to real-world problems, explore new technologies, and improve their technical skills. These events, which typically occur over a weekend, provide a collaborative environment where students work in teams to create and present projects, thus enhancing their problem-solving abilities and decision-making skills. Hackathons foster peer-to-peer learning by bringing together individuals from diverse backgrounds, enabling participants to exchange knowledge, share tools, and articulate technical challenges. According to surveys by Major League Hacking (MLH), hackathon participation significantly boosts classroom performance and encourages continuous learning. Students can find local hackathons through MLH or host their own with support from organizations like GitHub, which provides funding and resources to facilitate these events.

GitHub Sponsors offers a platform for open-source maintainers like Fatih Arslan to receive financial support from the community, enabling them to focus on their projects sustainably. Arslan, a Senior Software Engineer at DigitalOcean, has contributed significantly to the open-source community with projects like vim-go, a popular development plugin for the Go programming language in vim, and the HashiCorp Configuration Language (HCL) parser. These projects have had a substantial impact, with vim-go garnering over 10,000 stars on GitHub. Arslan highlights the challenges of balancing open-source work with personal and professional life, noting that successful projects can easily become a second full-time job. He believes that GitHub Sponsors can help address this issue by providing the necessary resources to maintain and enhance open-source projects. Through his work, Arslan has grown as a developer and collaborator, connecting with a global community and emphasizing the importance of open-source contributions to personal and professional development.

GitHub hosts a vast array of over 300 programming languages, necessitating robust language recognition for purposes such as search, security alerts, and syntax highlighting. Traditional methods like using file extensions can be unreliable due to ambiguities and inconsistencies. To address this, GitHub initially used Linguist, a Ruby-based tool that employs naming conventions and heuristics, achieving 84% accuracy but struggling with non-standard naming conventions and missing extensions. To enhance language detection, GitHub developed OctoLingua, a machine learning classifier based on an Artificial Neural Network (ANN) architecture that outperforms Linguist by focusing on code vocabulary over file extensions. OctoLingua uses data from Rosetta Code and quality repositories, employing features such as special characters and tokens to train its model. It has proven to be more robust in classifying programming languages across various scenarios, including when file extensions are scrambled or missing. The development of OctoLingua aims to provide a reliable service for source code language detection at multiple granularity levels, with future plans to expand language support and potentially open-source the model to engage with the wider community.

GitHub has expanded its security alerts to include Yarn-based projects, ensuring that developers using Yarn for dependency management receive notifications about vulnerabilities in their yarn.lock manifests. This addition builds on the existing system, which already supports JavaScript developers using NPM-based projects. Public repositories will automatically receive these alerts, while private repository owners or those who previously opted out can enable the dependency graph to access this feature. This initiative, managed by Justin Hutchings, Director of Product Management for supply chain security, aims to enhance the security of software dependencies through tools like Dependabot and the Advisory Database.

Managing large pull requests can often be a time-consuming and challenging task, but a new feature that allows users to mark files as viewed aims to streamline the process. This feature helps reviewers easily track their progress by displaying the number of files viewed and remaining at the top of the pull request, allowing them to collapse files once reviewed. If any changes occur after a file has been marked, a "Changed since last view" badge ensures that reviewers are aware of updates. The development of this feature, credited to Product Designer @califa and Product Engineer @nplasterer, is intended to simplify the code review process, particularly for extensive pull requests.