September 2019 Summaries

Researchers have introduced the CodeSearchNet Challenge to advance code search capabilities using machine learning, acknowledging the lack of standardized benchmarks for evaluating these models. In collaboration with Weights & Biases, they have released a large dataset, the CodeSearchNet Corpus, which includes millions of functions with associated documentation across multiple programming languages such as Go, Java, JavaScript, PHP, Python, and Ruby. This dataset is intended to support the development of machine learning models for code search by pairing code with natural language descriptions, leveraging modern Transformer architectures and self-attentional models. An evaluation environment and leaderboard have been established using an annotated dataset of code search queries, with relevance annotated by programmers, data scientists, and researchers. The project, supported by contributors from Microsoft Research, GitHub, and the broader community, aims to expand its evaluation dataset to include more languages and queries in future iterations, presenting code search as one application among many potential uses of learned representations of code and natural language.

GitHub has introduced updates to improve the user experience with GitHub Projects by addressing issues related to project automation and issue tracking. Previously, automation caused moved issues to appear at the top of lists, disrupting column prioritization; now, issues moved via automation or the inline sidebar are placed at the bottom of their destination column, while "Done" automation triggers continue to move issues to the top. Additionally, the issue sidebar has been updated to better display project information and closed projects are now collapsed by default to keep the focus on relevant details. Users can also change an issue's project column directly from the issue page without navigating away. These changes aim to create a smoother workflow and feedback is encouraged for further improvements.

GitHub has introduced a new feature called team synchronization, now available for all GitHub Enterprise Cloud customers, which enables the management of GitHub teams by synchronizing them with Azure Active Directory (Azure AD). This feature allows for streamlined administration by assigning access permissions to groups rather than individuals, reflecting the company's structure and enhancing security and audit compliance. Organization owners and team maintainers can manage access levels like admin, read, or write to repositories and facilitate communication and code ownership within teams. The synchronization of Azure AD with GitHub teams accelerates administrative processes, allowing for efficient management of developer resources. While currently supporting identity providers using the SAML 2.0 standard, GitHub is working on expanding support to additional identity providers, aiming to improve authentication experiences across platforms.

GitHub has expanded its dependency graph feature to include PHP repositories using Composer, enhancing security by providing alerts for vulnerabilities in dependencies listed in composer.json and composer.lock files. This feature, which was previously available for languages using package managers like Maven, NPM, Yarn, and Nuget, now allows users to receive notifications via email or web, depending on their preferences, for both public and private repositories. Users managing multiple private repositories can enable the dependency graph across them using a script, and organizations using GitHub Enterprise can leverage dependency insights for a comprehensive overview of PHP dependencies and their vulnerabilities. To manage old projects, users can archive them to stop receiving security alerts. Those participating in the automatic security fixes beta will receive pull requests for vulnerable dependencies when alerts are issued, helping maintain secure and up-to-date PHP projects.

Software is integral to nearly every aspect of modern life, with open source being a fundamental component, as 99% of all software projects utilize it. However, the rise in open source creation and consumption brings challenges, particularly in security, as identifying and fixing vulnerabilities is often a fragmented and inefficient process. GitHub aims to streamline this by enhancing security workflows and introducing tools like security advisories and Semmle's code analysis engine, QL, which helps researchers identify vulnerabilities more effectively. The company has also become a CVE Numbering Authority, allowing it to issue CVEs for security advisories, thereby promoting broader awareness. Developers play a crucial role in maintaining security by updating dependencies, a task GitHub facilitates with tools like Dependabot for automatic security fixes. GitHub's commitment to enhancing security extends to providing dependency insights for enterprises and token scanning for secret management. The overarching goal is to build a global platform for secure developer collaboration, addressing the need for comprehensive security solutions in the open source ecosystem.

GitHub has announced the integration of Semmle, a semantic code analysis engine, to enhance the security of the open source supply chain. Semmle enables developers to identify code patterns and search for vulnerabilities through simple declarative queries, which has already been trusted by organizations like Uber, NASA, Microsoft, and Google. Its community-driven approach allows security researchers to share their findings, thereby improving safety across various codebases. GitHub emphasizes that software security requires collective effort, as no single entity can secure the entire open source ecosystem. This partnership aims to provide developers with the necessary tools and infrastructure to create and consume open source software securely, with further insights available from GitHub's SVP of Product, Shanku Niyogi, and additional resources on Semmle's blog.

GitHub Education celebrates its seventh anniversary, reflecting on its growth from a single repository to a thriving community that supports educators and students by offering various resources and programs. These include the GitHub Education Community, the GitHub Student Developer Pack, GitHub Classroom, the Campus Expert Program, and the Campus Advisor Program, all designed to enhance learning and teaching experiences with Git and GitHub. As part of its ongoing commitment to education, GitHub Education is introducing new offerings such as learning modules for teachers, professional development support, free access to Stack Overflow for Teams, new partner offers for the Student Developer Pack, and improved GitHub Classroom features. To commemorate this milestone, GitHub Education invites verified students and faculty to share stories of their first repositories on Twitter for a chance to win a GitHub Education backpack, using the hashtag #MyFirstRepo by October 15.

GitHub has expanded its documentation offerings by providing a Spanish-language version of its help site, help.github.com, aimed at supporting developers from Latin America and Spain, as these regions represent growing markets. The initiative, led by Alexandra from GitHub's documentation team, seeks to make GitHub's resources more accessible to non-English speakers, acknowledging the challenges posed by language barriers. The localized site includes comprehensive documentation for GitHub.com, GitHub Enterprise, GitHub Desktop, and GitHub Pages, and utilizes a continuous integration system with Crowdin to ensure content is up-to-date. Although some content may temporarily appear in English while awaiting translation, users are encouraged to revisit the site for updates. The Spanish site also features a search engine that accommodates queries in Spanish, and GitHub plans to introduce additional languages and translated content in the future, further supporting a diverse global developer community.

GitHub has enhanced its Pages feature by integrating the Checks API to improve the process of identifying and resolving build errors. Previously, users faced challenges in understanding the specific errors when a build failed, often relying on email notifications for guidance. With the new integration, users can access detailed annotations and information about build errors directly from the commit’s status indicator, making it easier to identify issues such as misconfigurations or syntax errors. This enhancement aims to streamline the continuous integration experience by providing clear diagnostics, the ability to re-run checks, and confirmation of successful deployments, thereby reducing the time spent on troubleshooting and support. Users are encouraged to provide feedback on the new feature rollout via Twitter or product documentation.

GitHub addresses the complexities and challenges of complying with US sanctions laws while striving to minimize their impact on the global developer community. Sanctions, often imposed for national security or foreign policy reasons, restrict certain services to developers in sanctioned countries, which affects their access to GitHub's offerings, particularly private repositories. However, GitHub ensures that public repositories remain accessible to promote open-source collaboration. GitHub emphasizes that these restrictions are not based on nationality but are legal obligations for US-based companies. The platform allows users whose access has been restricted to appeal and aims to restore services as soon as legally possible. GitHub is committed to advocating for regulations that support the free flow of information and is actively engaging with regulators to clarify the impact of sanctions on its services. The company continues to emphasize the importance of narrowly tailored sanctions to avoid unintended consequences on software development and is dedicated to protecting the interests of developers globally.

Four GitHub Campus Experts—John, Marleni, Sourabh, and Yosuf—provide insights into securing and excelling in internships, emphasizing the importance of preparation, early application, and self-discovery. They suggest participating in hackathons to identify interests and develop skills, which can enhance interview performance by allowing candidates to discuss their abilities more confidently. Applying early and widely is recommended, using resources like university career portals and alumni networks to maximize opportunities. Despite the potential anxiety of technical interviews, the experts stress that interviewers often value behavioral insights over technical prowess, with practice and preparation being key to improving interview skills. They recommend resources like "Cracking the Coding Interview" and GitHub topics for interview preparation, underscoring the value of each interview experience in building confidence and competence for future opportunities.

GitHub has introduced several updates to its Package Registry service, focusing on enhancing user experience and flexibility based on community feedback. One significant update is the introduction of proxy support for the npm registry, allowing organizations to use GitHub Package Registry as a source for npm packages and as a proxy for packages from npmjs.com, simplifying package management by centralizing dependencies. Additionally, the automatic creation of releases upon package publication has been removed, addressing user concerns about conflicts with existing release management practices. GitHub also aims to integrate Package Registry more closely with GitHub Actions by enabling the use of GITHUB_TOKEN instead of personal access tokens for accessing npm and Maven packages, and has introduced support for NuGet packages. These changes are part of GitHub's efforts to make the Package Registry generally available, with user feedback encouraged through surveys to inform future improvements.

GitHub Sponsors, initially launched in beta, is designed to financially support developers who contribute to open-source projects, and it is now expanding its availability globally. Initially, the program involved a manual, labor-intensive process for onboarding and payment, which limited the number of participants. With the integration of Stripe Connect Express, GitHub is streamlining this process, reducing onboarding time from a week to under five minutes, and ensuring compliance with various international tax laws and regulations. This allows GitHub to more efficiently manage payments to developers and to accommodate the growing demand from developers worldwide. The program is now available in every country where GitHub operates, beyond the 30 countries initially supported by Stripe Connect, and aims to provide a seamless, secure experience for developers, many of whom may be financially rewarded for their open-source contributions for the first time.

On August 26, 2019, GitHub successfully deployed its application to production on the latest Rails version, 6.0, shortly after its release, marking a significant milestone given its previous reliance on a custom fork of Rails 3.2. This upgrade was facilitated by GitHub's active participation in the Rails 6.0 development, contributing over 100 pull requests to enhance documentation, fix bugs, and improve performance, which also benefited the broader developer community. The deployment was achieved without customer disruption, attributed to GitHub's proactive weekly upgrades and rigorous testing against the latest Rails changes, allowing quick identification and resolution of regressions. This approach not only ensured stability but also enabled GitHub to contribute to new Rails features like parallel testing and multiple databases, setting a standard in the open-source community. The continuous upgrade process has positively impacted GitHub's code base and engineering teams by keeping the application in sync with Rails developments, fostering long-term tool investment, and enhancing the developer experience, with further contributions planned for Rails 6.1 and beyond.

High school students can significantly enhance their coding skills and build impactful projects through Hack Club, an initiative supported by GitHub to foster hackathon communities among young learners. By partnering with Hack Club, GitHub offers resources such as the GitHub Student Developer Pack, grants, training materials, and marketing support to empower students to organize and participate in hackathons. This collaboration aims to democratize access to computer science education and create a welcoming environment for students to explore coding, regardless of their background or experience. Successful Hack Club members, like founder Zach Latta and others, highlight the program's role in transforming computer science into an accessible field filled with opportunities for innovation and personal growth. GitHub's involvement continues to reinforce better computer science learning through hackathons, encouraging students to start their own clubs and connect with peers nationwide.

In June, GitHub announced the "Pins to Win" competition for students with the GitHub Student Developer Pack, encouraging them to creatively showcase their code and achievements through pinned gists and repositories on their profiles. Five standout profiles were recognized for their ingenuity: Darshan Baid, Jack LaFond, Keziah Moselle, Michael Clemens, and Wenzel Lowe, who used GIFs and the Gists API to enhance the interactivity and liveliness of their profiles. Michael highlighted physical computing projects with GIFs, while Keziah and Jack used the Gists API to provide live updates and incorporate personal interests, such as music. Keziah developed "showcase-gists" to display tweets and GitHub activity, and Jack created "music-box" to share his music listening habits. Both students also contributed to the GitHub community by improving documentation and updating lists of pinned gists. The competition not only allowed students to customize their profiles but also encouraged them to engage with the open-source community. The event highlighted innovative ways to enhance GitHub profiles, offering inspiration for others to join the GitHub Student Developer Pack and explore the #PinstoWin entries on Twitter.