May 2022 Summaries

Andrzej Mazur, a web game developer and founder of Enclave Games, discusses the Gamedev.js Jam 2022, which encouraged developers to create web games and share their source code on GitHub. This event, an extension of the long-running js13kGames competition, saw 95 games submitted, with 27 developers opting to share their code, reflecting a theme of openness and community engagement. Highlighting 13 standout entries, Mazur provides insights into their creativity, gameplay mechanics, and innovation, with games like "Aaron’s Quest IV" and "Sushi Mania" receiving high praise for gameplay, innovation, and thematic alignment. The event underscores a growing trend towards transparency and collaboration in game development, urging participants to engage with the community via platforms like itch.io and follow ongoing developments through social media and Discord. The post concludes with a call for increased participation and open source contributions for the upcoming Gamedev.js Jam 2023.

GitHub Enterprise Server 3.5 introduces over 60 new features with a strong focus on enhanced security and improved developer experience, including the integration of GitHub Advanced Security capabilities. Key updates include the GitHub Container Registry, now in public beta, which allows fine-grained permission controls and anonymous access to public containers. Dependabot is now generally available for all customers, offering alerts and updates for dependency vulnerabilities. GitHub Actions gains reusable workflows and caching support, while administrators can restrict runner groups to specific workflows and manage updates on self-hosted runners. Additionally, new maintenance settings and an expanded security audit log provide better oversight and compliance capabilities. GitHub Advanced Security enhancements include secret scanning push protection, a security overview for risk assessment, and improvements to CodeQL for detecting security issues across more programming languages.

In June 2022, GitHub disclosed the completion of notifications to users affected by a security breach involving the npm organization on GitHub, caused by stolen OAuth tokens from third-party integrators Heroku and Travis CI. The attack allowed access to npm infrastructure, resulting in the exfiltration of sensitive data, including a database backup containing npm user information from 2015 with usernames, password hashes, and email addresses for approximately 100,000 users, as well as private package manifests and metadata. Although GitHub found no evidence of modified or new versions of npm packages published by the attacker, they took measures to reset passwords for affected users and began notifying them directly. An unrelated internal discovery revealed that plaintext credentials were stored in GitHub’s internal logs, which was mitigated, and those logs were purged. GitHub assured users that necessary actions were taken to address both incidents and encouraged users to rotate their npm tokens and reset passwords for enhanced security.

GitHub's internal rollout of Dependabot, a tool for maintaining up-to-date dependencies, serves as a case study in integrating security features within an organization's development workflow. Managed by the Product Security Engineering Team, the rollout was executed in three stages: measuring the current state of dependency alerts, incrementally enabling Dependabot across repositories, and focusing on remediating identified vulnerabilities. The process emphasized minimizing disruption to engineering teams while maximizing security benefits, using a staged approach and clear communication strategies. By incorporating Dependabot into the Engineering Fundamentals program, GitHub increased the number of services with zero alerts from 68% to 81% in three months, demonstrating the effectiveness of prioritizing and managing dependency upgrades. This initiative not only enhanced GitHub's security posture but also informed the design of features like the Security Overview for GitHub Enterprise users, reflecting the company's commitment to leveraging internal experiences to improve its offerings.

GitHub has announced significant enhancements to its REST API documentation by transitioning to an OpenAPI schema, which enables automatic generation of accurate and detailed documentation. The update includes a new three-column layout for improved readability, with example requests and responses easily accessible and adjustable by language preference. The documentation now features improved examples and parameter table information, driven by the OpenAPI schema, and includes response schemas directly, ensuring a comprehensive view of possible response values. Status codes are now presented in easily scannable tables, and the information architecture has been revamped to categorize and subcategorize API operations for better navigation. The sidebar now serves as the primary navigation tool, highlighting active operations as users scroll. Feedback is encouraged to further refine the documentation, with acknowledgments given to key contributors from the GitHub Docs team.

GitHub's Security Bug Bounty Program experienced a record-breaking year in 2021, surpassing $2 million in total payments to researchers, with over $800,000 awarded in just the past year. This success is attributed to a dedicated internal team focused on community engagement, and the program received 1,363 submissions, awarding its highest single bounty of $50,000. Notable achievements include resolving a path traversal vulnerability in GitHub Enterprise Server, which led to further security enhancements. The program also saw a 21% increase in contributors and an 18% rise in first-time reports. GitHub plans to expand its scope, adding npm and focusing on both monetary and non-monetary rewards to foster relationships with researchers. Upcoming initiatives include a live hacking event with HackerOne in June 2022, aimed at strengthening community interaction and rewarding innovative findings. As the program enters its ninth year, GitHub aims to improve response times and continue offering competitive rewards, encouraging all levels of researchers to participate in enhancing the security of its products and user community.

GitHub has expanded its Sponsors program to all developers in India, removing the waitlist and allowing those with a bank account in the country to sign up immediately. This move aims to financially support the robust Indian open source community, which includes over eight million developers who have contributed more than 200 million times to open source projects in the last year. By creating GitHub Sponsors profiles, Indian developers can now receive financial backing for their projects, gain recognition from influential figures in the open source community, and find improved opportunities for internships and full-time positions. The initiative not only facilitates global support for Indian developers but also offers tools to help users discover and support open source projects and maintainers in India. GitHub plans to continue expanding the program to more regions, further enabling developers to pursue careers in open source development.

GitHub has updated the format of its authentication tokens, affecting several types, including personal access tokens and OAuth access tokens. As a result, GitHub Connect will no longer support GitHub Enterprise Server (GHES) versions 3.1 or older after June 3, 2022, necessitating an upgrade to GHES 3.2 or newer to maintain access. GitHub Connect is essential for using the latest features such as Dependabot updates, license synchronization, and GitHub.com Actions synchronization. Customers needing to upgrade their GHES can refer to the provided instructions for upgrading.

April's Release Radar highlights several noteworthy open-source projects that have introduced major updates, showcasing a diverse array of innovations. Flyte 1.0, developed through a collaboration involving Lyft and Spotify, focuses on machine learning workflows built on Kubernetes, while Remotion 3.0 enhances video creation in React with AWS Lambda integration for improved speed and scalability. Sentry CLI 2.0, after five years of development, brings improvements for application monitoring, and SpiderFoot 4.0 expands its OSINT capabilities with new tools and features. JReleaser 1.0 simplifies the software release process, Ktor 2.0, written in Kotlin, enhances asynchronous client-server application development, and USWDS 3.0 modernizes the design system for U.S. government websites. Additionally, Gitmoji CLI 5.0 updates its emoji library for GitHub use, requiring Node.js 14 or higher, and Claustrowordia, the winner of the Ludum Dare game jam, offers an engaging blend of Wordle, Scrabble, and crossword puzzles. The article encourages developers to engage with open-source projects and to consider submitting their releases for future features.

GitHub has introduced native support for rendering mathematical expressions in Markdown, a feature that had been highly requested for over eight years. This new capability allows users to incorporate math expressions using TeX and LaTeX style syntax with the $ and $$ delimiters, which are then rendered through the MathJax library. The update aims to enhance communication among engineers, scientists, data scientists, and mathematicians by facilitating the inclusion of complex mathematical formulas directly in GitHub documentation. The implementation was announced by Martin Woodward and Tali Herzka, with an invitation for the GitHub community to explore and utilize this feature.

GitHub is committed to enhancing accessibility across its platform to support developers of all abilities, recognizing this as a crucial aspect of fostering an inclusive environment for open-source contributions and personal projects. The company has established a central accessibility team that collaborates with external consultants with disabilities to create training, tools, and documentation for internal teams, ensuring accessibility is integrated into product updates. Recent initiatives include introducing themes for colorblind users, enabling keyboard-only navigation, and allowing users to disable animated images. Looking ahead, GitHub aims to extend its influence by promoting digital accessibility within the open-source community and aligning with evolving standards from organizations like the W3C. The platform encourages community involvement through feedback and contributions to accessibility-focused open-source projects.

Innersource, a practice where organizations apply open-source methodologies internally, enhances both user experiences and developer productivity by fostering high-quality, secure, and reusable code. By adopting innersource techniques such as creating software templates and facilitating cross-team collaboration, companies can achieve a consistent user experience and boost developer efficiency by up to 87%. A government agency, with the assistance of GitHub Professional Services, developed a portal to help developers discover and utilize reusable software, which significantly improved the quality and security of their code base. This approach, complemented by metrics for monitoring security and the use of GitHub Advanced Security features, led to a 50% reduction in vulnerabilities across their innersource repositories, thereby securing the products and services dependent on them. Organizations can accelerate development by identifying reusable software, making it discoverable, tracking relevant metrics, and taking action based on these insights.

GitHub has achieved ISO/IEC 27001:2013 certification for its Information Security Management System (ISMS), marking a significant step in its commitment to security and compliance. This certification, completed ahead of schedule, encompasses GitHub.com, GitHub Enterprise Cloud, GitHub Advanced Security, and GitHub Actions, and includes features such as Pull Requests, Issues, Wikis, Pages, and Packages. The achievement illustrates GitHub's ongoing dedication to enhancing security processes, risk management, and operational maturity. It adds to GitHub's existing compliance credentials, including SOC, ISAE reports, FedRAMP, and Cloud Security Alliance CAIQ. GitHub plans to continue pursuing further certifications and audits to ensure a safer environment for developers.

GitHub utilizes its own platform to enhance product development, including moving its Engineering team to Codespaces and using GitHub Actions for coordination. The company leverages GitHub Issues for project planning, enabling team members at all levels to pitch ideas, which are then organized into six-week cycles. This approach encourages collaboration and rapid iteration, with feedback from developers and customers playing a crucial role in refining products. The flexibility of GitHub's project management tools allows various stakeholders, from engineers to VPs, to customize their workflows and easily track progress. The organization emphasizes a dynamic, inclusive environment, inviting others to explore career opportunities with them.

Innersource, which applies open-source techniques within an enterprise, is a strategic approach for increasing collaboration and breaking down silos in large organizations. Measuring innersource contributions can help assess progress, with metrics such as the innersource contribution percentage indicating the rate of contributions from individuals outside the original development team. Various contribution levels, from 0% to 50%, reflect different degrees of collaboration and project ownership, with higher percentages indicating more substantial cross-team cooperation and feature development. The concept encourages shared ownership and efficiency by allowing teams to improve and utilize each other's software packages, thus streamlining processes and reducing reliance on hierarchical decision-making. Enterprises can explore resources like innersourcecommons.org and opensource.guide, along with tools available on GitHub, to support their innersource initiatives and enhance organizational collaboration.

This year marks a significant milestone as thousands of students globally are celebrated for their achievements in redefining learning and innovation through the GitHub Graduation event for the Class of 2022. Scheduled for June 11, the event honors students' perseverance and passion, showcasing their projects and skills. Participants are invited to join the celebration by submitting a pull request by May 27, with the first 7,500 submissions receiving a custom holographic card featuring their GitHub stats. The event also includes a virtual yearbook, and students are encouraged to share their stories and achievements on GitHub by May 30. Additionally, for the first time since the pandemic, GitHub Graduation will be celebrated in person in various cities worldwide, with updates available on the GitHub Education Twitter page.

Open Source Monthly is a series aimed at promoting open source projects by helping first-time contributors find suitable projects, encouraging corporations and individuals to sponsor projects, and assisting maintainers in gaining consistent contributors and sponsors. This edition highlights Sharing Excess, a Philadelphia-based nonprofit addressing food insecurity by redistributing surplus food through partnerships with local businesses and using a Progressive Web App developed by Drexel University students. The app, maintained by Ryan McHenry, facilitates food deliveries to nonprofits and food banks. The project encourages collaborative efforts with similar organizations to amplify impact and offers various opportunities for code and non-code contributions. Additionally, the series spotlights "Mulheres no mundo da tecnologia," a non-code project celebrating women in technology, emphasizing the value of diverse contributions to open source. The initiative underscores the importance of introducing open source at the collegiate level to enhance diversity, equity, and inclusion in the tech community.

In response to a rise in account takeovers due to compromised developer accounts lacking two-factor authentication (2FA), a series of enhancements have been implemented to facilitate easier 2FA adoption on the npm registry. A public beta has been launched, offering an improved 2FA experience with features such as support for multiple security factors, a new configuration menu, and complete CLI support for login and publishing using physical security keys and biometric devices. Mandatory 2FA enrollment began with maintainers of the top-100 npm packages and will expand to include maintainers of the top-500 packages and high-impact maintainers with significant weekly downloads or dependents. Future plans include refining the WebAuthn login and publishing process and enhancing the account recovery process with secure identity verification methods.

GitHub is enhancing computer science education by inviting teachers to join its Global Campus, providing access to essential tools and resources for teaching and learning. This platform, supporting nearly two million global users, allows educators to upgrade to GitHub Team, connect with peers, manage classrooms, and access a range of educational resources and events. A key feature is free access to GitHub's browser-based IDE, Codespaces, which simplifies development environments and reduces technical barriers in computer science classrooms. Teachers can utilize a unified dashboard to manage assignments, engage in community discussions, and connect students with curated events. Codespaces offers a consistent, scalable development environment accessible from any device with a browser, ensuring all students have a uniform setup. Global Campus aims to continue expanding its offerings, encouraging teachers to prepare students for careers in technology.

GitHub has introduced Job Summaries for GitHub Actions, allowing users to incorporate custom Markdown content into the run summary generated by each job. This new feature, which uses the $GITHUB_STEP_SUMMARY environment variable, enables the display of aggregated test results, reports, and other outputs directly on the Actions run summary page. To facilitate the creation of Job Summaries, GitHub has added a helper utility to the @actions/core npm package, making it easy to add headings, code blocks, tables, and links. This addresses a long-standing user request for richer content capabilities beyond logs and annotations, which were previously limited and led to decreased productivity. By supporting GitHub Flavored Markdown, Job Summaries open up numerous possibilities for enhancing CI workflows with interactive and visually rich outputs, and GitHub encourages users to provide feedback through the GitHub Actions Community Forum.

A recent Secure Code Warrior survey reveals that 86% of developers do not prioritize application security, and 67% admit to knowingly shipping vulnerabilities in their code, often due to tight deadlines or a lack of understanding of what makes code vulnerable. The GitHub Security Lab aims to address this issue by finding vulnerabilities, amplifying research, and educating developers to secure open-source software. Common vulnerabilities include SQL injection, command injection, cross-site scripting (XSS), and cross-site request forgery (CSRF), each with specific risks and implications. GitHub offers security tools like CodeQL for code scanning and Dependabot for dependency management, both available for free to open-source projects, to help developers proactively detect and fix vulnerabilities. These tools also provide educational resources to improve developers' understanding of security threats and how to address them effectively.

Teaching offers significant reciprocal advantages, enhancing both the instructor's understanding and the learner's knowledge, with various methods available from formal workshops to informal platforms like social media and open-source projects. A panel of experts, including Jerome Hardaway from Vets Who Code, Cassidy Williams from Remote, and Anthony Sottile from Sentry, share insights on effective teaching practices, emphasizing the importance of real-world experience, note-taking, and adaptability to different learning styles. They highlight the necessity of overcoming imposter syndrome by starting small, preparing for potential mistakes, and using errors as learning opportunities to build trust and improve teaching methods. The discussion underscores the value of templates for content delivery and encourages new educators to start creating learning content, as perfection is not required for progress. This conversation is part of The ReadME Project by GitHub, which focuses on open-source software community stories and insights.

Ludum Dare, a long-standing and popular game jam, recently celebrated its 20th anniversary with its 50th competition, attracting 8,490 participants globally who submitted 2,894 games. The event's theme, "delay the inevitable," inspired a wide array of creative and unconventional games. Highlights from the competition include "Claustrowordia," a crossword puzzle game that won overall, "Flameline," a metroidvania-style game, and "Different Strokes," an exploration of an online art gallery. Many of these games, such as "Nighty Night, Nosferatu" and "Claim your FREE BitBuddy™ TODAY!," offer unique gameplay experiences and are available with source code for further exploration. The event showcases the diverse talents of game developers and provides an opportunity for creative expression and community engagement.

GitHub is enhancing its security measures by requiring all users who contribute code on GitHub.com to enable two-factor authentication (2FA) by the end of 2023, as part of a broader initiative to secure the software supply chain against frequent threats like social engineering and account takeovers. Recognizing that most security breaches stem from low-cost attacks rather than sophisticated exploits, GitHub aims to fortify account security without compromising user experience, and it plans to explore passwordless authentication options in the future. This move follows GitHub's previous efforts to secure npm accounts, where it mandated 2FA for maintainers of high-impact packages, and reflects its commitment to safeguarding developers' accounts and maintaining the integrity of the broader software ecosystem. Despite the proven effectiveness of 2FA, adoption rates remain low, with only 16.5% of active GitHub users and 6.44% of npm users utilizing it, prompting GitHub to leverage its position to elevate security standards across the development community.

In April, GitHub faced three significant incidents affecting the availability of Codespaces and GitHub Packages, with each incident lasting several hours. The first incident on April 1 was caused by expired secrets that led to resource exhaustion in the US West region, spreading to other regions due to communication delays and limited access for secret rotation. To prevent future occurrences, GitHub has implemented resource monitoring and is transitioning away from dependency on secrets. On April 14, an investigation into contributing factors was initiated, with further updates promised in a future report. The third incident on April 25 involved increased CPU utilization in a GitHub Packages Registry database, caused by an unexpectedly high volume of "Create Manifest" commands. This led to internal server errors and user impact, which was mitigated by blocking the problematic activity and decoupling package listings from repository home pages. GitHub is addressing these issues through improved alerting, rate limiting, and performance fixes, while keeping users informed via their status page and engineering blog.

The post explores various management strategies for friendly forks, focusing on three GitHub-managed forks: git-for-windows/git, microsoft/git, and github/git. It highlights the importance of being part of the upstream community to maintain fork quality and outlines the different approaches each fork takes based on its needs. Git-for-windows/git and microsoft/git employ a proactive merging rebase strategy to integrate changes from the upstream, while github/git uses a cautious merge strategy, keeping releases one or two versions behind. The article provides scenarios to help readers choose a suitable management strategy for their own forks, emphasizing the need for careful management to enhance collaboration and project quality. It concludes by encouraging potential fork managers to consider their specific needs and possibly consult with experienced maintainers to find the best fit for their organization.