June 2022 Summaries

The MLH Fellowship, in collaboration with GitHub, provides a 12-week internship alternative for aspiring software engineers, allowing them to gain hands-on experience by contributing to essential open-source projects. The Spring 2022 cohort saw participants like Courtney Wilson and others praising the transformative experience and the opportunity to work with teams such as GitHub Docs and StandUpMan, leading to personal and professional growth. The program emphasizes diversity, with fellows bringing unique experiences and a passion for learning, and offers exposure to projects like Program Equity and M&E Insight, which focus on social good and international development, respectively. The fellowship continues year-round, with new cohorts offering opportunities to work on impactful projects and learn about the latest technologies in the open-source community.

Open source projects often evolve from individual developer initiatives into dynamic communities, necessitating a shift in focus from personal coding to community management. Klint Finley of The ReadME Project interviewed developers who have successfully navigated this transition, discussing their experiences and insights. Panelists, including Chrissy LeMaire of dbatools, Fred Schott of Astro, and Jem Gillam of Graphile, shared how their projects grew organically into communities, emphasizing the importance of inclusivity, proactive communication, and setting clear guidelines like codes of conduct. They highlighted the value of a welcoming environment for contributors of varying skill levels and the significance of leading by example to maintain a supportive and non-judgmental community atmosphere. The discussions underscored the challenges and strategies involved in fostering a healthy open-source community, with a focus on accommodating contributions, ensuring diversity and inclusion, and setting the tone through positive engagement.

The text discusses the challenges of using collaboratively-developed source code as a communication medium and highlights the importance of well-crafted commits in Git repositories to address these issues. Commits are described as more than just incremental save points; they serve as a historical record of code changes with human-readable messages that can effectively convey the narrative of a project. The author emphasizes the need for commits to be organized, small, and atomic, ensuring they contribute to a coherent story that is easy for reviewers and developers to understand. The text provides guidelines for structuring commits to enhance readability and maintainability, such as outlining the narrative and using tools like interactive rebase to reorder or split commits. Additionally, it stresses the importance of clear commit messages that explain the intent, context, justification, and implementation of changes to aid in code review, bug finding, and root cause analysis, ultimately improving the quality and reliability of software development projects.

Git's FSMonitor feature, introduced in version 2.37.0, significantly enhances the performance of Git commands like `git status` in large monorepos by reducing the need for extensive worktree searches. FSMonitor operates as a long-running daemon that receives file system change notifications, allowing it to efficiently track modified files and directories in real-time. This reduces the fixed cost of repeated searches, as it uses tokens to group changes, ensuring subsequent commands focus only on altered files. By integrating FSMonitor with the core.untrackedcache, Git optimizes the search for untracked files, offering a substantial speed boost by avoiding redundant checks. FSMonitor is easy to enable with a simple configuration change and is available on macOS and Windows. Complementing FSMonitor, the sparse checkout feature allows users to exclude unnecessary files from their worktree, further enhancing performance. Additionally, Git's compatibility with external tools like Watchman means that users can choose between built-in and third-party monitoring solutions to suit their specific requirements, making large repositories more manageable and efficient.

The text explores the exploitation of CVE-2022-1134, a type confusion vulnerability in V8, the JavaScript engine for Chrome, allowing remote code execution within Chrome's renderer sandbox upon visiting a malicious site. The vulnerability resides in the SuperIC feature, a component with a history of exploitable issues, and involves complex interactions between V8 and Blink, Chrome's rendering engine. The document details the optimization processes of inline caching in V8, describing how this caching speeds up property access through dynamic profiling and optimization. It highlights the intricacies of JavaScript's super property access and the caching mechanisms that can lead to vulnerabilities. The text also delves into the technical nuances of exploiting these vulnerabilities, including constructing primitives for arbitrary read and write operations by leveraging Blink objects like DOMRectReadOnly and DeviceMotionEvent. It underscores the critical need to understand both V8 and Blink's interactions to uncover and exploit such vulnerabilities, pointing out the sophisticated expertise required by attackers, as evidenced by similar exploitations in other contexts like the high-profile Tianfu Cup. The document concludes with reflections on the necessity for research focused on the intersection of V8 and Blink in vulnerability discovery.

GitHub's Git Systems team is implementing security enhancements in GitHub Enterprise Server version 3.6, following similar updates on GitHub.com, by altering supported algorithms and keys for SSH and discontinuing the unencrypted Git protocol. Key changes include removing DSA key support, mandating RSA keys with SHA-2 for new uploads, disabling the HMAC-SHA-1 algorithm, and allowing Ed25519 host keys, while the unencrypted Git protocol will be off by default but can be re-enabled by administrators. These updates aim to maintain robust cryptographic security by moving away from outdated technologies susceptible to known attacks. The changes are mostly consistent with those on GitHub.com, but offer certain configurability for GitHub Enterprise Server administrators to cater to different operational needs. Users can ensure their readiness by utilizing tools like ghe-find-insecure-git-operations to identify insecure operations, and the transition should be smooth for those using recent SSH clients, with DSA client keys being rare and non-default for over a decade. GitHub is committed to ongoing security monitoring and will update the community as deprecated features naturally decline in usage.

Git 2.37 introduces several significant updates and improvements contributed by over 75 developers, including new mechanisms for managing unreachable objects, built-in filesystem monitoring for better performance on Windows and macOS, and full integration of the sparse index feature to enhance Git operations in large repositories. Among the key features, cruft packs allow for more efficient management of unreachable objects by storing their ages in auxiliary tables, while a new filesystem monitor removes the need for external tools to speed up status checks. Additionally, enhancements in the sparse index feature now support all Git commands, significantly boosting performance, especially for the "git stash" command. The release also deprecates certain sparse checkout patterns in favor of more efficient ones and introduces a new "batch" fsync strategy for faster file updates. Other notable updates include improved handling of partial clones, functionalities for safer credential management, and performance improvements through the porting of "git add -i" from Perl to C. The release promises further technical insights in upcoming blog posts and invites contributions to ongoing development projects.

GitHub has expanded its Advisory Database to include curated security advisories for languages compiled to run on the BEAM virtual machine, such as Elixir and Erlang, aiming to enhance the security of software supply chains by providing comprehensive vulnerability information and remediation guidance. This addition brings the database's coverage to nine ecosystems, including Composer, Go, Maven, npm, NuGet, pip, RubyGems, Rust, and now Erlang, allowing developers to check for security issues directly on GitHub. The database, which is open source and licensed under Creative Commons Attribution 4.0, supports contributions from the community, enabling security researchers and enthusiasts to add relevant information about Hex packages. This initiative is part of GitHub's broader mission to offer free and open security data to empower the industry, and is led by Madison Oliver, a senior security manager at GitHub with extensive experience in vulnerability reporting and response.

GitHub recently concluded Maintainer Month, a dedicated period aimed at celebrating and providing additional support to the open-source projects on which it relies. As part of this initiative, GitHub distributed $500,000 among over 900 maintainers of its open-source dependencies who are also registered with GitHub Sponsors. This initiative underscores GitHub's commitment to the sustainability of open-source projects, emphasizing the importance of companies contributing back to the projects they depend on, which can include hiring developers or facilitating contributions from their employees. GitHub Sponsors, launched three years ago, has facilitated millions of dollars in support across 38 regions, bolstering thousands of open-source projects and maintainers. Maintainer Month featured a variety of events, including conferences, meetups, and podcasts, that allowed maintainers to connect, share experiences, and receive recognition. The initiative encourages individuals and organizations to continue supporting maintainers through GitHub Sponsors, highlighting the importance of ongoing investment in the open-source community.

GitHub has introduced new features to manage Codespaces effectively, aiming to reduce waste and ensure compliance with budgets for organizations. Inactive Codespaces will now automatically delete after 30 days of inactivity, with users notified 24 hours prior to deletion, and this retention period can be adjusted up to 30 days. Organization administrators can set a maximum retention period that overrides individual settings, providing more control over costs and security. Additionally, organization-level REST API and CLI commands are now in public beta, enabling admins to programmatically manage Codespaces at scale, including listing, stopping, and deleting them across repositories. These updates apply to new Codespaces created after the release and are available across GitHub Free, Team, and Enterprise Cloud plans, with a call for user feedback to refine these features further.

GitHub Copilot, an AI-powered tool designed to assist developers in writing and completing code, has been made generally available to individual developers, marking a significant shift in software development by integrating AI into coding processes. This tool, which functions as an editor extension, offers real-time code suggestions that range from individual lines of code to entire methods and algorithms, thereby enhancing productivity and allowing developers to focus more on solving complex problems. GitHub Copilot, developed from the collective knowledge of global developers, supports various coding languages and integrates with popular coding environments like Neovim and Visual Studio Code. It is offered free to verified students and maintainers of popular open-source projects to foster community support. With its ability to suggest syntax and code in numerous languages, GitHub Copilot aims to make coding easier and faster, and it is set to be extended to companies later in the year.

Recent advancements in the automotive sector have led to a significant digital transformation, emphasizing the integration of complex software systems within modern vehicles. These systems, controlled by millions of lines of code, demand rigorous quality and safety standards, such as ISO 26262 and the newer ISO 21434, to prevent critical failures and cybersecurity threats. GitHub, in collaboration with Woven Planet, has introduced CodeQL queries aligned with CERT C++ and AUTOSAR C++ standards to aid developers in achieving these compliance requirements, specifically for ISO 26262 Part 6, which focuses on software-level product development. GitHub’s code scanning tool leverages CodeQL to detect and alert developers of security bugs in real-time within pull requests, facilitating the development of secure and compliant automotive software without hampering collaboration or agility. By open-sourcing these CodeQL queries, GitHub aims to foster global innovation and collaboration in embedded software development, encouraging contributions to enhance the query capabilities and promote their use across repositories.

GitHub has introduced a new API to enhance its dependency graph, which traditionally relied on static scans of manifest files to identify project dependencies and alert users to vulnerabilities. This API allows users to upload dependency information directly from their build tools, providing a more comprehensive view by combining build-time detection with static scanning, especially beneficial for package managers like Gradle and sbt, where dependencies are determined at build time. The API, currently in beta, includes a GitHub Action for Go to support transitive dependency detection, and users can create custom actions or submit dependencies directly, allowing for a more accurate and complete dependency graph. GitHub is actively seeking user feedback to improve the functionality further and plans to enhance features such as viewing metadata, accessing historical submissions, and integrating this data into scenarios like dependency reviews.

The article delves into the exploitation of a use-after-free (UAF) vulnerability, CVE-2022-22057, found in the Qualcomm GPU driver affecting devices with Snapdragon 888 chipsets, such as the Samsung Galaxy Z Flip3. This vulnerability allowed for arbitrary kernel memory read and write, enabling the disabling of SELinux and execution of commands as root. Despite the existence of various security mitigations like Samsung's Realtime Kernel Protection (RKP) and Kernel Control Flow Integrity (kCFI), which complicated the exploitation, the author successfully bypassed these by using techniques such as exploiting race windows and manipulating kernel scheduling. The article highlights the challenges posed by kCFI and automatic variable initialization but demonstrates the power of arbitrary memory read/write capabilities. It also critiques Qualcomm's disclosure practices, highlighting how patch gapping can potentially expose vulnerabilities before they are publicly disclosed, thereby offering a window for exploitation by skilled attackers.

Each month, noteworthy open source projects with significant updates are highlighted, showcasing a variety of innovations ranging from 3D printing software to developer tools and asset management systems. May's featured releases include Cura 5.0, which enhances 3D printing experiences with a new slicing engine and M1 support; Apollo 2.0, which simplifies centralized management of application configurations, now compatible with multiple Java Runtime Environments; Snipe-IT 6.0, an asset management tool that eliminates the need for spreadsheets and offers improved compatibility and performance; Ghost 5.0, designed for content creators with new features for managing memberships and analytics; FX 23.0, a terminal JSON viewer now rewritten in Go for better performance; and Enioka Scan 2.0, an Android barcode scanning library with updated APIs for faster operation. The article encourages community participation in open source development and invites project submissions for future highlights.

Prebuilding codespaces is now generally available, offering a streamlined, "ready-to-go" template that includes pre-installed source code, editor extensions, project dependencies, and configurations to expedite the setup process for new codespaces, particularly beneficial for complex or large codebases. Following its public beta, feedback has led to enhancements such as scheduled prebuilds, failure notifications, and improved readiness indicators. This feature has notably benefited companies like Vanta, reducing developer onboarding time from days to minutes. Repository administrators can manage prebuild configurations through various triggers—every push, configuration change, or a custom schedule—allowing for optimized trade-offs between environment freshness and GitHub Actions usage. Additionally, billing for prebuilds involves costs for Actions minutes and storage, with options to manage storage costs through template retention settings. Available on GitHub Enterprise Cloud and GitHub Team plans, this feature aims to support monorepos and multi-repository scenarios in the future, with ongoing improvements driven by user feedback.

Vulnerabilities in open source software are primarily caused by mistakes, but malicious actors can also introduce malware, which is typically removed and not included in the standard disclosure process like the National Vulnerability Database. GitHub employs automated scanning, security research, and community input to detect such malware, and now documents these incidents in the GitHub Advisory Database after removal. This database supports GitHub’s supply chain security features, including Dependabot alerts, which notify users of malware and vulnerabilities. Users can enable these alerts under the "Code security and analysis" tab. The GitHub Advisory Database, providing security advisories that enhance GitHub's supply chain security solutions, has been freely available and licensed under Creative Commons, ensuring ongoing community access and use.

Git Merge, a conference focused on uniting the Git community, is scheduled for September 14-15 in Chicago, Illinois, featuring a day of technical talks and pre-conference workshops for Git users of all levels. All proceeds from ticket sales will be donated to the Software Freedom Conservancy to support free and open-source software initiatives. Proposals for talks are currently being accepted until July 10, with notifications sent by July 22. The event is made possible through sponsorships and community partnerships, emphasizing its communal nature rather than corporate interests. The conference's promotion and organization are managed by Lee Reilly, a Senior Program Manager at GitHub Developer Relations.

Dark mode has transitioned from an optional feature to a user expectation, yet implementing it remains challenging for many teams, particularly when creating multiple themes. GitHub's dark mode, revealed in December 2020, was developed through a complex process involving extensive trial and error and the use of a Figma file with over 370,000 layers. To streamline future color palette creation, GitHub developed Primer Prism, an experimental tool that is part of GitHub's Primer ecosystem, aimed at creating cohesive, consistent, and accessible color palettes. Primer Prism allows users to define tones, choose colors, and test them by adjusting lightness curves and ensuring perceptual uniformity using the HSLuv color space. This tool facilitates the creation of dark high contrast, light high contrast, and colorblind themes for GitHub by allowing easy adjustments and visual testing, with plans for further integration with GitHub and Figma. Primer Prism is open source and invites user feedback, though it remains in an experimental phase prone to bugs and changes.

Open source software (OSS) is critical to the global digital infrastructure, with 97% of codebases incorporating it, yet there is a need for governments to play a more significant role in supporting the OSS community. Although security has been a primary focus, the development of a comprehensive federal OSS policy requires collaboration between policymakers and practitioners. A roundtable discussion in Washington, D.C., highlighted the need for a federal Open Source Program Office (OSPO) to coordinate OSS efforts across government agencies. Participants discussed the challenges and opportunities in federal open source publishing, emphasizing the importance of strategic funding and learning from private sector practices. The event also explored international perspectives, such as the EU's open source policy objectives and Germany's Sovereign Tech Fund, while stressing the necessity of sustained funding and global cooperation. GitHub, a participant in these discussions, aims to promote OSS as a public good and has initiated research projects to analyze platform usage and economic impact. The roundtable encouraged diverse stakeholders to envision the transformative potential of OSS, with GitHub advocating for open source collaboration across government levels and sectors.

Open Source Monthly's June edition explores the realm of open hardware, highlighting its principles and potential applications, from automobiles to laptops, emphasizing the accessibility of schematics and designs. The featured project, Modos, focuses on creating digital devices like the Modos Paper Laptop using open-source tools, aiming to cater to users who experience eye strain and prefer distraction-free environments. The project, led by Alexander Soto, strives to develop an ecosystem of E-Ink devices while solving technical challenges and seeking community contributions. Additionally, Theater.js, a JavaScript animation library, is spotlighted as a project of interest for its intuitive design and animation capabilities. The publication encourages community engagement and contributions to open-source initiatives, inviting readers to participate in projects like Modos and Theater.js, and to stay connected through various GitHub platforms and events.

GitHub emphasizes the importance of JavaScript performance and browser compatibility, adopting strategies like updating compilers to support modern ECMAScript standards, such as ES2019 and ECMAScript 2020, to enhance user experience. This approach leverages progressive enhancement, ensuring users on older browsers can still access basic features, while those on modern ones enjoy improved performance. GitHub uses analytics, such as parsing User-Agent headers, to understand browser usage patterns, which inform decisions on browser support and feature deployment. Chrome dominates with over 70% of traffic, followed by Firefox, Edge, and Safari. To maintain code compatibility across diverse browsers, GitHub employs linting and polyfills, though they focus on a minimal set of polyfills to optimize performance. Tools like the browser-support library help determine feature support and manage compatibility issues effectively. GitHub's commitment to delivering a fast and reliable service is supported by data-driven decisions and tools that align with their principles, ensuring seamless interactions for users across different browser environments.

The blog post from GitHub Security Lab's series on the OWASP Top 10 Proactive Controls focuses on practical guidance for open-source software developers to securely implement identity management within applications. It emphasizes the complexities of managing digital identities and outlines various authentication methods: passwords, multi-factor authentication (MFA), cryptographic-based authentication, and single sign-on (SSO). The post advises on using SSO for simplicity, handling passwords with strong creation and storage guidelines, and employing MFA to enhance security. It also details cryptographic-based methods like session and token authentication, urging developers to prioritize secure configurations and practices. Overall, the post aims to equip developers with strategies to fortify their applications against identity-related security threats.

Dependabot updates are now generally available on GitHub Enterprise Server (GHES) 3.5, allowing for the automatic updating of dependencies via pull requests—a feature long requested by GHES users. This update builds on existing Dependabot alerts and security updates by introducing Dependabot version updates, which help keep dependencies current and reduce vulnerabilities. Setting up Dependabot on GHES requires enabling GitHub Actions (though not supported on cluster configurations), configuring self-hosted Linux runners with internet access, and installing Docker. The GHES setup process includes enabling the dependency graph and Dependabot features in the Management Console, with the entire process documented in GitHub's resources. The integration of Dependabot with GitHub Actions enables monitoring and management similar to other actions but requires self-hosted runners, as the tool analyzes dependencies to suggest the lowest secure versions. The post encourages feedback on this new feature and offers links for further guidance on implementation.

Entitlements is a GitHub-based open-source solution designed to streamline Identity and Access Management (IAM) by integrating directly into developers' workflows. It uses a Git repository as the source of truth and manages configurations through pull requests, ensuring a durable audit trail for access requests and approvals. The tool addresses common IAM challenges such as auditability, scalability, and access management during organizational changes by leveraging GitHub.com's capabilities for self-service, manager review, and periodic re-approval of high-risk configurations. Entitlements allows users to create automatic groups based on various criteria, ensuring that access is updated appropriately with business changes, and supports scalability by enabling a small team to manage extensive IAM needs across numerous services and teams. The project, which has been developed over several years with contributions from GitHub employees, is now open for community feedback and contributions to enhance its functionality for broader use.

GitHub has introduced Achievements Profiles in a public beta to celebrate developers' contributions and milestones on the platform, allowing them to display accomplishments like participating in significant projects such as NASA's Mars flight or having code stored in the Arctic Code Vault. These achievements, which users can choose to display or hide, provide a way for developers to share their journey and contributions through new badges and visualizations, including a 3D contribution graph. While initial achievements are limited, GitHub plans to expand them over time to better reflect developers' passions and milestones, encouraging community feedback to shape future offerings.

GitHub Global Campus has introduced the Community Exchange platform, providing a collaborative space for student developers to connect, learn, and contribute to open source projects. This initiative addresses the challenge of finding a safe and engaging environment for students to enhance their skills and gain exposure. Community Exchange enables students to discover and star repositories, submit their own projects for collaboration or educational purposes, and manage their showcased work. It aims to foster a supportive community where students can build portfolios, expand their networks, and develop maintainership skills. By joining Global Campus, nearly two million student developers can leverage the platform to advance their open-source journey, participate in the GitHub Education community, and access numerous opportunities for professional growth.

In response to unauthorized access detected in December 2022, GitHub announced the revocation of certain Atom code signing certificates, prompting users to update to a previous version before February 2, 2023. Atom, introduced in 2011 as a customizable text editor, was sunsetted on December 15, 2022, due to declining community involvement and the emergence of more advanced cloud-based tools. GitHub decided to focus on enhancing the cloud-based developer experience with platforms like Microsoft Visual Studio Code and GitHub Codespaces. Although Atom has not seen significant feature development in recent years, it has been maintained for security and stability. The retirement reflects GitHub's commitment to prioritizing technologies that support the future of software development while acknowledging the community's efforts in contributing to Atom's success. As Atom's repositories are archived, GitHub aims to assist users with their transition to alternative solutions.

Dependabot, now generally available on GitHub Enterprise Server (GHES), addresses the challenges of managing dependencies and security vulnerabilities by automating updates, which previously required significant manual effort. Before its introduction to GHES, development teams spent considerable time manually tracking and updating dependencies, often delaying upgrades until critical issues arose. This was due to the architecture of GHES, which initially limited Dependabot's deployment. By porting Dependabot’s backend to run on Nomad and adapting it for self-hosted GitHub Actions runners, GitHub made it possible for GHES users to automate dependency updates efficiently. The result means teams can now manage updates more easily and focus on feature development rather than patching vulnerabilities, enhancing security and productivity. The author, having experienced the challenges firsthand, expresses satisfaction in contributing to Dependabot's integration with GHES, which promises to benefit developers globally.

GitHub Skills is introduced as a new platform to enhance learning and skill development for users at all levels of their GitHub journey, leveraging the power of GitHub Actions for a streamlined and adaptable experience. It replaces the Learning Lab, which will be deprecated on September 1, 2022, and offers courses on popular topics like GitHub Pages and Continuous Integration. GitHub Skills is designed to be accessible, offering free courses in public repositories and on self-hosted runners, with private repositories being free until users exhaust their monthly GitHub Actions minutes. The platform also allows users to create custom courses using a free, open-source template, encouraging users to transition to this updated learning experience.

GitHub has expanded its supply chain security features to include support for Rust, the fastest-growing language on the platform, enhancing developers' ability to manage dependencies and patch vulnerabilities. Through the GitHub Advisory Database, which includes over 400 Rust vulnerabilities sourced primarily from RustSec, developers can access actionable security advisories. The dependency graph analyzes Cargo files to map project dependencies, facilitating Dependabot's alerts and automatic pull requests for updating vulnerable dependencies. While these features are automatically enabled for public repositories, private repositories require manual activation. The dependency review GitHub Action offers an additional layer of security by scanning pull requests for new vulnerabilities in Rust dependencies, preventing their introduction into the codebase. Dependabot alerts and security updates further streamline the process by notifying developers of new vulnerabilities and automatically upgrading affected packages. Overall, these tools provide comprehensive security measures to maintain the integrity of Rust projects hosted on GitHub.

The text discusses the transformative experience of using GitHub Actions for CI/CD processes, contrasting it with a more manual and error-prone release process at a previous job. GitHub Actions is highlighted as a native CI/CD tool within GitHub, allowing for automated workflows triggered by various webhook events. The platform offers over 13,000 pre-written workflows in the GitHub Marketplace, which can be customized using YAML files and are capable of integrating with third-party services like Slack and Amazon ECR. The author emphasizes the versatility of GitHub Actions in automating tasks across various domains, from continuous integration and deployment to release management and project planning. Additionally, the text provides insight into the use of pre-built workflows and the potential for customization to fit specific project needs, while recommending resources for those interested in learning more about building and optimizing GitHub Actions workflows.

Technical interviews present challenges for both candidates and interviewers, as they require a balance of assessing technical skills and social capabilities, often through methods like whiteboarding, take-home exams, and numerous interviews. A panel of experts, including Dana Lawson, Kathy Korevec, and Ian Douglas, discussed alternatives to traditional interview practices, emphasizing the importance of relevant exercises, flexibility in evaluation methods, and the potential for candidates to demonstrate their problem-solving abilities in various formats. They highlighted the benefits and drawbacks of techniques such as pair programming, starter projects, and technical conversations, advocating for a more inclusive, tailored approach that allows candidates to showcase their strengths in ways that align with their personal circumstances and the specific role. The experts also offered tips for remote interviews and underscored the value of providing feedback, especially for entry-level candidates, to foster improvement and growth. The discussion is part of a GitHub initiative to improve the open source community by sharing insights and best practices.

GitHub has introduced several new features for its Enterprise customers aimed at enhancing security and user management. Enterprise administrators now have exclusive control over inviting outside collaborators to repositories, which limits this ability to prevent unauthorized access. A new feature in public beta allows enterprise owners to revoke pending member invitations, adding another layer of user management. Additionally, Enterprise account owners can now view actor IP addresses in audit logs for events related to private repositories, enhancing security compliance. GitHub Advanced Security customers gain the ability to view Dependabot alerts at an enterprise level and conduct dry runs for custom secret scanning patterns, further aiding in risk management and security optimization. These updates reflect GitHub's ongoing commitment to providing robust security and management tools for its Enterprise users.

GitHub's "All In" initiative is a community-focused effort to enhance diversity, equity, and inclusion within the open-source sector, engaging over 1,000 community members and 17 founding partners. The inaugural GitHub All In for Students pilot, aimed at under-resourced students, achieved over 90% internship placement in collaboration with universities and corporate partners like Microsoft, Red Hat, and Intel, providing stipends and technical resources. The All In for Maintainers program is designed to support open-source maintainers with DEI training, informed by a comprehensive Maintainer’s Listening Tour, which identified key areas for improvement such as DEI resources and inclusive practices. As the initiative completes its first year, GitHub plans to expand its impact, inviting more participants to contribute to the ongoing journey of promoting diversity and inclusion in open source.

GitHub has launched its Sponsors program in Brazil, enabling open-source developers and organizations to receive financial support, reflecting the platform's commitment to providing equal opportunities for developers worldwide. This expansion is particularly significant as Brazil's GitHub community has experienced over 40% growth annually, now comprising over 2 million developers, including tens of thousands contributing to open-source projects. To celebrate this milestone, GitHub organized a virtual meetup on June 2, 2022, to connect local maintainers and provide guidance on setting up GitHub Sponsor profiles, alongside participating in the TDC Innovations conference to discuss the program and GitHub's security tools. The launch in Brazil follows the program's availability in India, marking another step in GitHub's efforts to enhance support for the global open-source ecosystem.

In May, GitHub.com experienced three significant incidents affecting service availability. On May 20, increased CPU utilization due to a permissive API throttling configuration caused latency and errors in the GitHub Container registry, which was mitigated by throttling requests and resetting the database state. On May 27, two separate incidents further affected services like GitHub Actions and API requests, with investigations still ongoing. A follow-up to an April incident revealed that a code change in the billing pipeline mistakenly inflated charges for GitHub Actions and Codespaces, resulting in incorrect billing and service disruption. This was addressed by reverting the change, repairing data, and implementing stricter code review processes. GitHub is committed to improving service reliability and keeping users informed through updates and their status page.

GitHub Actions offers a flexible solution for automating development workflows, including CI/CD, with GitHub-hosted runners providing a server-free environment for running jobs. However, challenges arise when these jobs need access to resources on a private network, such as signing services or package registries. To address this, GitHub has provided documentation detailing three approaches to connect GitHub-hosted runners to private networks, each with its own advantages and tradeoffs. The options include using the GitHub Actions OpenID Connect (OIDC) token through an API gateway, creating a temporary overlay network with WireGuard, or employing a commercial solution like Tailscale. While these solutions vary in complexity and cost, they aim to offer flexibility for different user needs, alongside the option of self-hosted runners for those who can manage their server infrastructure.

Maintainer Month is a dedicated time in June for open source project maintainers to connect, share, and be celebrated for their essential role in the software ecosystem. This initiative includes various activities, events, and resources organized by different organizations and individuals to support and recognize the hard work of maintainers. Highlights include virtual meetups, conferences, and discussions on topics such as mental health and burnout, providing a platform for maintainers to address challenges and collaborate. Participants are encouraged to contribute their own activities or resources by submitting a pull request, fostering a community-driven approach. Year-round resources for maintainers are also available, covering guides, interviews, and surveys from platforms like GitHub and CNCF, offering support and insights into open source maintainership.

Choosing the right GitHub plan involves understanding the features and limitations of each option, with the Free plan being well-suited for individuals, small teams, or open-source projects by offering unlimited public and private repositories, automatic security updates, and 2,000 CI/CD minutes per month. The Free plan's community support and unlimited collaborators make it appealing even for medium and larger teams. However, as teams grow or require more advanced features, the Team plan, priced at $4 per seat per month, provides additional capabilities such as Codespaces, advanced review features, and enhanced support. GitHub Actions and Packages are included in the Free plan, with public repositories enjoying unlimited Actions and 500MB of storage. The Enterprise plan is recommended for organizations needing advanced security and collaboration features, offering granular controls and a comprehensive developer platform.