January 2021 Summaries

In the third part of a series on building GitHub's new homepage, the focus is on optimizing performance through high-performance animations and effective image handling. By replacing traditional scroll event listeners with IntersectionObservers, animations are triggered more efficiently, reducing CPU usage and improving Cumulative Layout Shift scores. The team also refined animations by explicitly defining only opacity and transform as animatable properties to prevent unnecessary style recalculations. To optimize video performance, IntersectionObservers are used to play videos only when visible, complemented by setting preload to none to save bandwidth. Additionally, the use of WebP images offers a balance of compression and transparency, though older browsers require a fallback using SVGs with embedded base64-encoded JPGs. This approach enhances page load efficiency, demonstrating GitHub's commitment to creating a faster, more reliable web experience.

Open source ecosystems are expanding in complexity and significance as they intersect with the social sector, where GitHub's Tech for Social Good program has identified unique challenges and opportunities. While most open source software (OSS) from corporate tech companies focuses on infrastructure like servers and APIs, the social sector emphasizes applications with graphic user interfaces, addressing needs often overlooked by private tech firms. For instance, Dimagi, a social sector organization, leverages its CommCare app for global health solutions, including COVID-19 contact tracing. As these organizations mature, they're contributing back to the broader OSS community, with Dimagi's team actively involved in projects like Ansible and CitusDB, driven by unique industry challenges and regulatory requirements. This dynamic highlights a growing trend of social sector solutions potentially influencing mainstream technology, spurred by the prioritization of social good over business opportunities.

Over the past year, GitHub has faced challenges in adapting its deployment processes to accommodate a doubling of developers contributing to its core application, leading to issues with its existing chatops-based deployment tooling. The previous system, which relied on a single Slack channel to manage and track deployments, became overwhelmed and confusing due to the high volume of messages, thereby increasing the risk and reducing efficiency. To address these issues, GitHub revamped its deployment system by introducing two canary stages, with the first at 2% and a second at 20% deployment traffic, to better identify potential issues before full production rollout. Additionally, the entire deployment process was automated to allow for a single command to handle multiple deployment stages, streamlining the process with automated progression and time-gated checks. This new system is backed by a state-machine model and features a UI component for better tracking and monitoring, significantly improving developer experience and system reliability. The improvements have been well received internally and have influenced GitHub's broader offerings, including the GitHub Actions CD, demonstrating the success of the deployment team's collaborative efforts.

TwilioQuest, a game developed by Twilio, is designed to teach students coding skills while building their confidence to contribute to open source projects in a fun and engaging way. The game follows a storyline where players, called "Operators," complete missions that correspond to different programming skills or languages, with a specific mission named "Flame of Open Source" to aid in contributing to open source projects. During the GitHub Univers(ity) event, a competition called Operation Univers(ity) encouraged students to play TwilioQuest, resulting in 220 unique participants completing an average of 24 code challenges each, with 160 finishing the "Flame of Open Source" mission. This interactive approach demonstrates that playing games like TwilioQuest can enhance coding skills and confidence, as emphasized by its creator, Kevin Whinnery, and further detailed in his presentation.

In 2020, GitHub introduced numerous updates and features aimed at enhancing user experience and workflow efficiency across various platforms, including the GitHub CLI for command line enthusiasts and GitHub for Mobile, providing on-the-go access with push notification support. The GitHub Enterprise Server saw significant upgrades with version 3.0, integrating GitHub Actions, Packages, and advanced security features, while GitHub Actions expanded its automation capabilities with workflow visualization, environment protection rules, and manual approval processes. Additionally, GitHub focused on improving community interaction through features like GitHub Discussions for open-ended conversations and GitHub Sponsors for supporting open-source projects, alongside enhancements in code collaboration and inclusivity with branch renaming options. The platform also introduced a refreshed design and a highly requested dark mode to improve the user interface. These updates reflect GitHub's commitment to advancing tools for developers and fostering a collaborative coding environment.

GitHub recently faced internal controversy after the dismissal of an employee on January 8th, which prompted concerns from staff about the circumstances surrounding the decision. An independent investigation was initiated on January 11th, revealing significant procedural errors, leading to the resignation of the head of HR and the reversal of the employee's dismissal. GitHub publicly apologized to the affected employee and reiterated its condemnation of the January 6th attack on the US Capitol by extremists, including Nazis and white supremacists. The company emphasized its commitment to a discrimination-free workplace, encouraging employees to express concerns about any form of discrimination while maintaining professionalism and adherence to company policies. GitHub remains dedicated to fostering a safe and inclusive environment for its community and employees.

GitHub has released a candidate version of GitHub Enterprise Server 3.0, marking a significant update that introduces several new features and enhancements aimed at improving automation, security, and flexibility for developers and administrators. This version includes GitHub Actions, a leading CI solution for automating software development workflows, and GitHub Packages, facilitating end-to-end DevOps workflows. It also brings advanced security features like code scanning, powered by CodeQL, and secret scanning to detect vulnerabilities and credentials before they reach production. The platform is now fully containerized, offering a modernized architecture for more scalable and flexible management. Additionally, GitHub for Mobile now supports Enterprise Server, allowing users to manage projects on the go. This release encourages feedback from users testing it in non-production environments and aims to provide a seamless and secure development experience.

In 2020, GitHub made significant advancements in its security products, including the introduction of CodeQL for code scanning, which provides security reviews with every Git push by identifying vulnerabilities like SQL injection and cross-site scripting. GitHub integrated over a dozen partner tools and improved the CodeQL engine for faster and more efficient analysis, with features like an AST viewer in the VS Code extension. Secret scanning was expanded to include private repositories and new token formats, with notifications for secret leaks and an API for easier resolution. Dependabot was enhanced to automate dependency updates and alert users about vulnerabilities, while dependency review helps prevent the introduction of vulnerable dependencies. The GitHub Advisory Database now includes npm advisories, providing a comprehensive source of security information. GitHub simplified the enablement of these features at both the repository and organization levels, offering many tools for free to enhance security across environments, with more updates and features detailed in the GitHub Changelog and public roadmap.

GitHub's evolution in its on-call strategy, driven by its growing product complexity and size, highlights a shift from a monolithic on-call system to a more decentralized model where each engineering team is responsible for the code they maintain. This change aimed to address the inefficiencies and challenges of the previous system, such as engineers' unfamiliarity with the vast monolithic codebase and imbalance in on-call responsibilities. The transition faced logistical hurdles like file ownership and monitoring, as well as cultural challenges, including adjusting to remote work during the pandemic, training engineers new to on-call duties, and fostering a supportive, blameless culture. GitHub implemented a new service ownership model, tailored monitoring, and a focus on work-life balance, while promoting long-term improvements in operational practices. The initiative led to improved incident resolution times, but GitHub continues to seek feedback and refine its processes to ensure sustained operational excellence and support for its engineering teams.

In December, GitHub experienced no incidents that resulted in service downtime, marking a stable month in terms of availability. However, a follow-up investigation into an incident from November 27 revealed an edge case involving a large number of GitHub App token requests, which caused abnormal replication lag in a MySQL cluster affecting the GitHub Actions service. This led to some token requests failing due to outdated information in the database replicas. To prevent similar issues in the future, GitHub is updating its queries to manage the volume of token requests more effectively. The company continues to focus on enhancing its engineering systems and reliability, with more details available on their engineering blog.

GitHub has announced a significant development in providing unrestricted access to its platform for developers in Iran, following the acquisition of a license from the US government. This change reverses the restrictions imposed in 2019 due to US sanctions, which had previously limited GitHub's ability to offer services to developers in certain countries. GitHub has worked diligently with the Office of Foreign Assets Control (OFAC) over two years to advocate for wider access, emphasizing the platform's role in fostering global progress, communication, and the US policy of free speech and information flow. The lifting of restrictions allows full access to all GitHub services for individuals and organizations in Iran, including both free and paid options. GitHub is continuing efforts to secure similar permissions for developers in other sanctioned regions, such as Crimea and Syria, aiming for comprehensive collaboration opportunities for all developers worldwide.