July 2022 Summaries

Promoting open source projects effectively requires clear communication of their value and benefits to both users and potential contributors. Klint Finley, senior editor of The ReadME Project, gathers insights from experts Segun Adebayo, Tasha Drew, and Aaron Francis on strategies for successfully marketing projects, highlighting the importance of addressing meaningful problems and articulating these solutions in simple terms. They emphasize the need to engage with communities through various channels, such as social media, podcasts, and meetups, while maintaining clear and accessible documentation to lower the barrier for adoption and contribution. Responsiveness, kindness, and openness to feedback are crucial for fostering a supportive environment that encourages involvement from individuals with different skill levels. Personal branding and effective communication styles can enhance how maintainers present themselves and their projects, while strategic participation in events can significantly boost visibility and interest. Ultimately, the experts encourage a balanced approach between maintaining and evangelizing projects, ensuring that projects are stable before promoting them widely.

GitHub Sponsors has expanded its reach to 30 new regions, bringing the total to 68, in an effort to provide more open-source developers and organizations with financial support opportunities. Launched three years ago, GitHub Sponsors aims to connect open-source creators with potential sponsors in various markets, and now includes countries such as Argentina, Indonesia, and Saudi Arabia, among others. This expansion allows developers in these new regions to sign up immediately, provided they have a bank account in one of the supported countries, and comes at a time when the number of GitHub developers in these areas has grown by 39% over the past year. The platform has also enhanced its user experience with an improved GitHub Sponsors Explore tool, which now focuses on maintainers rather than projects, allowing for easier identification and support of dependencies. New filters enable users to view first-level dependencies and maintainers supporting one-time sponsorships, with additional ecosystems like Golang and Rust's Cargo recently included. This milestone aligns with GitHub's mission to foster fulfilling careers in open source and emphasizes the ongoing commitment to expanding support for developers globally.

June saw significant updates in the world of open source projects, with a noticeable focus on Node.js tools. Grafana 9.0 introduced a plethora of enhancements for metric visualization, including new UI features and query builders. Fastify 4.0 was released, offering faster performance and new logging capabilities, supported by the updated Pino 8.0, which now includes asynchronous logging. Whylogs 1.0 aims to standardize log formatting, and Git Stats 3.0 provides terminal access to Git statistics. ZX 7.0 allows for efficient script writing by merging JavaScript capabilities with Bash, while Prisma 4.0 enhances data-driven application development with improved client APIs and availability. CodeStream 13.0 enhances collaborative coding with better GitHub integration, and Capri 4.0 introduces support for Svelte in static site generation using islands architecture. EvoBot 2.0 adds music playback capabilities to Discord servers. The GitHub Release Radar encourages community submissions and highlights the use of GitHub Discussions for real-time feedback on new releases.

CVE-2022-20186 is a vulnerability in the Arm Mali GPU's memory management code, which was reported and subsequently patched in the June update for Pixel devices. The flaw allows attackers to map arbitrary physical pages to GPU memory, leading to potential arbitrary kernel code execution and root access on devices like Pixel 6. The vulnerability underscores the attractiveness of GPU drivers as targets for attacks due to their complex and error-prone memory management code, which can often lead to undetectable memory corruption. Exploiting this vulnerability involves manipulating the memory pools and GPU page tables to access and write arbitrary kernel memory, bypassing traditional mitigations like kernel control flow integrity. The patching process for this bug highlighted typical delays in the Android ecosystem, with public visibility of patches before official releases contributing to potential exploitation windows. The post also discusses the intricate nature of Android's branching system and the challenges it poses in timely patching, while noting the possible overlap with a separate CVE ID, CVE-2022-28348.

GitHub has introduced a new and improved version of GitHub Projects, integrated with GitHub Issues, designed to enhance the planning and tracking capabilities for development teams. This tool offers a flexible, spreadsheet-like interface that allows users to filter, sort, and group issues and pull requests, enabling seamless planning and collaboration directly linked to the code. With features like custom fields, real-time updates, and automation capabilities, GitHub Projects aims to streamline workflows and reduce the time spent on administrative tasks, allowing developers to focus on critical work. The platform supports various chart visualizations for better insights and integrates automation through APIs and GitHub Actions. Future enhancements will include dependencies and relationships management, richer workflows, timeline visualization, and a mobile experience, with a commitment to continuous updates based on user feedback. Mario Rodriguez, GitHub's Chief Product Officer, has been instrumental in the development and expansion of this tool, reflecting his dedication to improving developer experiences and tools.

GitHub has introduced GitHub Community, a unified platform that consolidates the GitHub Community Forum, GitHub Education Forum, and product feedback into a single space within GitHub, utilizing org-level GitHub Discussions for enhanced user interactions. This integration aims to streamline the user experience by providing a centralized resource hub where users can access learning materials and inspiration without needing multiple logins, thereby addressing the issue of outdated or unsupported information found on various non-GitHub sites. While browsing the content does not require a GitHub login, signing in allows users to actively participate by posting questions, answers, and feature requests, fostering a collaborative environment for both individual users and large enterprises.

GitHub has announced enhancements to the npm registry, focusing on improving security and developer trust by introducing a streamlined two-factor authentication (2FA) experience, linking npm accounts with GitHub and Twitter for verified identity, and a new command for auditing package integrity. The improvements include a more user-friendly 2FA process in npm CLI version 8.15.0, allowing login and publish authentication via the web browser and offering features like "remember me for 5 minutes" to reduce friction. Additionally, developers can now officially link their GitHub and Twitter accounts to npm, ensuring verified account data and enhancing account recovery processes. All npm packages have been re-signed using a secure ECDSA algorithm, with the ability to verify package integrity through the newly introduced "audit signatures" command in npm CLI version 8.13.0. These measures aim to bolster the security of the npm ecosystem, with plans to enforce 2FA for high-impact accounts and further improve account recovery through automated identity verification.

To-do lists are a ubiquitous tool for managing both personal and professional tasks, and GitHub Issues serves as a central component for developers to organize and propel their projects forward. This text explores how GitHub’s expanded project capabilities can enhance personal productivity by organizing tasks by priority and status, as demonstrated by Senior Software Engineer Jed Verity. By creating personal projects, individuals can efficiently manage their workload, track progress, and streamline professional evaluations. The text encourages users to customize their project experience, utilizing GitHub Actions for automation and maintaining task visibility through private settings. The adaptability of GitHub projects offers endless possibilities for personal organization, inviting users to explore and share feedback on this versatile feature.

GitHub has leveraged both internal and external academic research to inform the development and improvement of GitHub Discussions, a tool designed to enhance community conversations within the platform. Initially created to separate open-ended discussions from actionable issues, GitHub Discussions has evolved based on studies like Dr. Hideaki Hata's, which confirmed its effectiveness in improving community productivity and planning. Further enhancements, such as the maintainer dashboard, were influenced by recommendations from researchers like Dr. Denae Ford and Mariam Guizani, focusing on attracting and retaining contributors through improved community insights. Additionally, research by Márcia Lima and Dr. Igor Steinmacher highlighted the prevalence of duplicate discussions, prompting GitHub to develop features to identify and manage these duplicates, thereby improving the user experience. Through these collaborations, GitHub continues to refine its tools to better serve the needs of developers and maintainers.

A well-tuned CI/CD pipeline is essential for development teams aiming to deliver high-quality software quickly, yet pipelines should be customized to meet specific team needs. To enhance CI/CD workflows, integrating automated tests for performance, device compatibility, and accessibility can significantly streamline processes, while automated security testing, including tools like Dependabot and code scanning, is crucial for maintaining robust security throughout the software development lifecycle. Implementing phased testing strategies can expedite feedback loops and ensure comprehensive testing from unit tests to regression testing as software approaches production. Adopting blue-green deployments can reduce downtime and facilitate safer rollouts by allowing traffic to be redirected between versions, while infrastructure-as-code (IaC) offers flexibility by automating infrastructure provisioning alongside application deployment. Establishing checkpoints for automated rollbacks ensures quick recovery from production issues, and leveraging community-built GitHub Actions workflows can further optimize CI/CD pipelines.

In the June edition of Open Source Monthly, Rizel Scarlett highlights the project Zag.js, which integrates design systems and state machines to streamline UI development across frameworks like React, Vue, and Solid.js. Announced by Segun Adebayo, Zag.js offers framework-agnostic UI component patterns, using state machines to manage component logic, simplifying state management and enhancing adaptability. Adebayo, also known as Sage, created Zag.js after experiencing challenges with cross-framework development while working on ChakraUI. Additionally, the blog features the GitHub Docs project, praised by Ashley Bass for its contributions from MLH fellows, and encourages participation in open source through various channels, including GitHub’s Twitch and Twitter communities.

GitHub Copilot, an AI-powered coding assistant, has transitioned from a limited technical preview to general availability, with feedback indicating it significantly enhances developer productivity and satisfaction. To substantiate this, GitHub conducted a study involving surveys and anonymized data from over 2,000 U.S.-based developers to assess whether Copilot truly boosts productivity. The research found a strong correlation between Copilot usage and improved productivity, with the acceptance rate of its code suggestions serving as a key indicator. Developers reported that while Copilot's suggestions often required refinement, they appreciated the starting point it provided, enabling them to focus on building software. These findings were presented in an academic paper at PLDI’s MAPS '22 conference, highlighting Copilot's role in increasing productivity by offering valuable coding insights and maintaining developers' workflow momentum.

Open source communities are crucial for the sustainability, growth, and improvement of open source projects, which are foundational to many software systems and processes. Effective communication and managing community expectations are vital challenges within these communities. Key elements that characterize sustainable open source communities include having a comprehensive README file, good-first-issues for newcomers, clear contribution guidelines, a solid Code of Conduct, respectful language in discussions, and a commitment to mentorship. README files provide essential project information and can enhance productivity, while good-first-issues help orient new contributors. Contribution guidelines and a Code of Conduct establish the rules for engagement and behavior, fostering a welcoming and respectful environment. Encouraging respectful language in discussions ensures a safe and trusted community space, while mentorship helps develop contributors, enhancing the overall quality and sustainability of the project. Insights from the 2021 State of the Octoverse highlight these practices as integral to thriving open source communities.

Emilia Lazer-Walker, a Toronto-based artist and engineer, details the collaborative and inclusive development journey of "A Little Game Called Mario," an open-source project on GitHub using the Godot engine. The project encourages contributions from a diverse pool of participants, including non-coders, by automatically building and releasing new game versions on itch.io whenever a pull request is merged. To manage contributions and mitigate merge conflicts, the team leverages GitHub Actions to automate workflows, such as building and publishing the game and generating real-time contributor credits. The project also prioritizes inclusivity by using the GitHub contributors API for crediting, allowing contributors to update their displayed names easily. They have implemented preview builds and a GDScript auto-linter to maintain code quality and consistency. The community-driven nature of the project has led to the creation of additional systems, such as JSON schema validation and collision layer checks, showcasing the empowerment and ownership felt by contributors in enhancing the game's development process.

In June, GitHub experienced several incidents affecting service availability, with significant events occurring on June 1, 21, 28, and 29, as well as a follow-up on incidents from May 27. The June 1 incident involved delays in GitHub Actions due to excessive load on a proxy server caused by misdirected data analysis queries, which were later moved to a dedicated setup. On June 21, users with certain subscriptions faced Copilot access issues due to API authentication errors, affecting around 20% of active users, with a fix implemented promptly. The June 28 incident involved degraded availability for Codespaces, with an ongoing investigation, while June 29 saw multiple services impacted, with details to be shared in a future report. The May 27 incidents were traced back to high traffic loads on API requests, particularly the login endpoint, with responses adjusted to mitigate future occurrences. GitHub is committed to improving service reliability through enhanced testing, alerting, and procedural updates, with further insights available on their status page and engineering blog.

Earlier this month, GitHub introduced a new API that allows users to upload dependency information directly from build tools or container scanning services, enhancing the completeness of dependency graphs beyond static scans of checked-in manifest files. This API aims to provide a more comprehensive view of dependencies and improve vulnerability alerts. GitHub also announced new partner actions, such as Anchore's sbom-action and NowSecure's Mobile SBOM, which generate software bills of materials (SBOM) and enhance visibility into nested dependencies for various ecosystems, including mobile and Scala projects. These tools enable automated security analysis, vulnerability detection, and Dependabot alerts by populating the GitHub Dependency Graph with detailed SBOMs. Additionally, Aqua Trivy, a free cloud-native security scanner, can now be used to populate the dependency graph with comprehensive data, further expanding the functionality available to developers.

GitHub's internal use of its own products underscores the company's commitment to leveraging its suite of tools for comprehensive software development and operational efficiency. The Security Team, led by Chief of Staff Ben Balter, employs GitHub's new projects experience and GitHub Actions to streamline planning, manage cross-functional initiatives, and automate routine tasks, thereby reducing administrative overhead. By assigning Directly Responsible Individuals (DRIs) and using metadata filtering, the team ensures transparency and alignment across objectives, enabling stakeholders to track progress from high-level goals down to specific tasks. GitHub Actions further enhances this process by automating issue updates and project board management, facilitating seamless communication and accountability. This approach not only optimizes internal workflows but also serves as an example of how GitHub's products can support a collaborative and efficient work environment.