November 2022 Summaries

GitHub has introduced a calendar-based versioning system for its REST API to facilitate the evolution of the API while ensuring a smooth migration path for existing users. This new versioning strategy allows for the introduction of breaking changes, such as deleting response fields or endpoints, by releasing a new version named after its release date, with previous versions remaining accessible to avoid forcing immediate upgrades. Users can specify their preferred API version using the X-GitHub-Api-Version header, and non-breaking changes will remain available across all versions. The versioning applies solely to the REST API, not affecting the GraphQL API or webhooks. GitHub commits to supporting previous versions for at least two years but anticipates providing longer support in practice. The initial version under this system is 2022-11-28, mirroring the API's existing state, and users are encouraged to update their integrations accordingly. Future versions will be accompanied by changelogs, upgrade guides, and proactive communication through blog posts and emails to ensure developers are informed and equipped to manage updates efficiently.

Machine learning enthusiast Seth Juarez shares his excitement about recent GitHub Universe announcements that enhance the integration of machine learning projects on GitHub, particularly through improvements in Jupyter Notebooks and the use of GitHub Codespaces. Juarez discusses the benefits of using Jupyter Notebooks for the exploration phase of machine learning, despite challenges in collaboration and remote access. He highlights the enhanced rendering capabilities and NbDime's side-by-side code difference display within GitHub. The introduction of GPUs for Codespaces and zero-configuration notebooks are praised for enabling effective remote execution and model building, with Juarez successfully running a PyTorch time-series analysis project in a browser. He underscores the importance of transitioning exploratory code to scripts for MLOps practices and appreciates the new debugging capabilities for model building using VS Code. Juarez also notes the support for JupyterLab, allowing users to maintain their preferred ML workflows, and invites feedback on further improvements for integrating machine learning with GitHub.

The 2022 Octoverse report by GitHub highlights the transformative impact of open-source software on developers and businesses over the past decade, with a significant increase from 2.8 million to over 94 million developers using GitHub. Open source now underpins more than 90% of global software, with businesses increasingly adopting and investing in open-source technologies, leading to the formation of large open-source communities around commercial projects. The report identifies three major trends: the rise of infrastructure as code, with languages like Hashicorp Configuration Language gaining traction; the growing involvement of big tech in open-source communities; and the tendency for first-time contributors to engage with commercially backed projects such as Next.JS, React, and VS Code. In 2022, developers initiated 52 million new open-source projects on GitHub, contributing over 413 million times, showcasing open source as a critical engine of growth. More than 30% of Fortune 100 companies now have open source program offices, emphasizing the strategic importance of open source in modern software development.

Flexible work has become increasingly integrated into daily life, with tools like GitHub Mobile facilitating productivity away from the desktop. GitHub Mobile allows users to stay connected with their team, manage projects, edit files, and handle pull requests directly from their mobile devices, whether they're waiting for takeout or at the airport. Recent updates enhance the mobile experience by allowing quick access to projects, rendering project tables in a list layout for easier navigation, and enabling users to edit, delete, or preview project content. The app also supports on-the-go code editing and management of pull requests, allowing users to commit changes, create new branches, and monitor pull request checks. Additionally, repository filters help users sort and find repositories based on various criteria, supporting seamless workflow management across iOS and Android platforms.

GitHub has introduced a new code search and navigation feature designed to enhance developer productivity by making it easier to search, navigate, and understand code across vast repositories. This new tool comes with an advanced search interface on GitHub.com, offering suggestions, completions, and filtering options by various dimensions like repository and language. Built from scratch with a focus on performance, the search engine uses powerful qualifiers and expressions to deliver results in milliseconds, effectively prioritizing relevant results. Additionally, the redesigned code view integrates browsing and navigation, featuring a file tree to provide context and facilitate easier exploration of codebases. This initiative follows a technology preview phase with substantial developer feedback, emphasizing the tool's importance in daily workflows, and aims to continue improving through user input.

GitHub has introduced several new features to enhance project management for development teams, including tasklists, roadmaps, and auto-archive capabilities. Tasklists, a highly requested feature, allow teams to easily map and track tasks using Markdown, providing progress tracking and task organization. Roadmaps offer a strategic view to align teams and stakeholders on future plans, integrating seamlessly with existing project layouts. The auto-archive feature helps maintain project cleanliness by automatically archiving completed or stale items, reducing manual cleanup. These enhancements aim to streamline project management and increase developer velocity by consolidating work into an integrated view, with GitHub Projects continuing to evolve with these capabilities. Mario Rodriguez, GitHub's Chief Product Officer, emphasizes his commitment to developing tools that support developers, drawing from his extensive experience at Microsoft and GitHub.

GitHub has launched a public preview of GitHub Actions Importer, a tool designed to streamline the migration process from existing CI/CD systems to GitHub Actions, particularly beneficial for organizations with extensive CI/CD setups. This tool simplifies the migration by offering distinct phases, including planning, auditing, and forecasting, to assess existing CI/CD usage and facilitate the transition. GitHub Actions Importer can automatically convert over 90% of tasks, although some workflows may require manual adjustments, particularly for secrets, self-hosted runners, and unsupported build steps. It offers a command-line interface for auditing and forecasting current CI/CD usage, helping organizations plan their migration strategy by analyzing pipeline complexity and compute capacity. Custom transformers can be developed for tasks that cannot be automatically converted, and the tool supports a dry-run feature to validate conversions before actual migration. GitHub also provides a self-serve migration option using IssueOps, allowing organizations to perform migrations without installing GitHub Actions Importer locally.

GitHub's Codespaces has become generally available for all Free and Pro plan users, offering cloud-based development environments that streamline setup and maintenance for developers, individual learners, and open-source project maintainers. This service allows users to start coding immediately, benefiting from standardized, reproducible environments and a variety of tooling options, such as JetBrains IDEs and JupyterLab, to cater to diverse developer preferences. Codespaces now also supports GPU-powered environments for data science and machine learning tasks, enhancing collaboration and efficiency. With new features like repository templates and prebuilt codespaces, GitHub aims to accelerate development processes, enabling faster contributions and scaling for organizations. The introduction of organization-level APIs and administrative policies further supports large-scale management, while LinkedIn Learning offers free Codespaces-enabled courses to aid skill development. Overall, Codespaces is celebrated for its impact on reducing environment setup time and enhancing collaboration, reflecting a significant shift in the software development landscape.

The Octoverse 2022 report by GitHub explores the role of open source software (OSS) in the social sector, focusing on its potential to improve outcomes for global communities, especially during crises. GitHub's Social Impact, Tech for Social Good team highlights the ability of OSS to reduce redundancy and foster inclusive development, as exemplified by their collaboration with the World Health Organization (WHO) to establish the first Open Source Program Office (OSPO) in the UN system. This initiative aims to enhance WHO's software development processes and promote the use of OSS tools like DHIS2, which has been instrumental in COVID-19 response efforts across 69 countries. The report underscores the socioeconomic benefits of OSS in low- and middle-income countries and its potential to advance the Sustainable Development Goals (SDGs) by making digital public goods more accessible. Furthermore, it emphasizes the importance of developing tools to enhance the discoverability of digital public goods on GitHub and highlights the increasing investment in open source program offices by companies, alongside shifts in governmental policies and the need for improved supply chain security in open source technologies.

The Octoverse 2022 report from GitHub highlights the significant shift towards open source software among companies, with more organizations investing in open source initiatives and establishing open source program offices (OSPOs) to manage their involvement. This trend is driven by the recognition of open source software's integral role, with 97% of applications using open source code, and the benefits it brings, such as enhanced security, brand building, and global developer support. Over 30% of Fortune 100 companies have adopted OSPOs, which are crucial for developing policies and procedures around open source activities, despite challenges like the lack of universal approaches and inadequate tooling for managing open source contributions. GitHub is collaborating with other organizations to address these issues, aiming to facilitate broader OSPO adoption and sustain open source engagement, which ultimately benefits the entire community. The report also forecasts increased emphasis on OSPO teams, investment in open source, and the development of standardized tools to ensure project health and sustainability.

GitHub, marking its 15th anniversary, continues to evolve its platform to meet the increasing complexity of software development with a focus on enhancing the developer experience through integration and innovation. Key announcements include the expansion of GitHub Copilot, an AI-powered coding assistant, to be more accessible for businesses, and the introduction of "Hey, GitHub!," which allows voice-based interaction with Copilot. GitHub Codespaces now offers free monthly usage for individual developers, enabling faster project initiation without hardware constraints. Additionally, GitHub has enhanced its code search and navigation features and introduced new planning and tracking tools like GitHub Projects, aiming to streamline development workflows. The platform is also strengthening its security offerings with features like private vulnerability reporting and expanded CodeQL support for Ruby. Emphasizing its commitment to open source, GitHub launched initiatives such as the GitHub Accelerator and a $10 million fund to support open source developers and projects, aiming to foster a sustainable and innovative open source ecosystem.

GitHub has launched initiatives to support the open-source ecosystem by introducing the GitHub Accelerator and the M12 GitHub Fund, aiming to foster careers and startups in open source. The GitHub Accelerator will fund 20 developers globally, providing a $20,000 stipend and mentorship to help them grow their projects and secure sustainable funding. Meanwhile, the $10 million M12 GitHub Fund, in collaboration with Microsoft's venture arm, targets seed-stage open-source developer tools, with the first investment in CodeSee, which aids developers in understanding their code repositories. These efforts are part of GitHub's broader strategy to enhance the open-source economy, exemplified by the success of GitHub Sponsors, which has raised over $25 million for developers and projects, and underscores the importance of supporting maintainers to enable full-time contributions to open source.

The Octoverse 2022 report highlights the widespread use of open source software by over 90% of companies and underscores the challenge of ensuring its financial sustainability, especially for developers maintaining critical software. GitHub, positioned at the intersection of open source communities and companies, has witnessed positive trends in sustainability, such as financial support from companies to open source foundations and the creation of open source program offices. However, this support often doesn't reach the developers directly. To address this, GitHub launched GitHub Sponsors in 2019, providing a platform for direct financial support to maintainers, aiming to foster sustainable careers in open source. The Sponsors for Companies program, currently in Beta, is designed to streamline company contributions, with plans for broader availability. The report emphasizes the need for companies to support open source projects directly and adapt to best practices in sponsorship while maintaining project autonomy. As the open source ecosystem evolves, GitHub is committed to expanding support tools and learning from the community to enhance sustainability.

GitHub's Octoverse 2022 report highlights the increasing importance of supply chain security in the open source software (OSS) ecosystem, as vulnerabilities have been exploited by malicious actors to compromise major projects. With much of modern digital infrastructure relying on open source, the rapid development pace can sometimes lead to inherited vulnerabilities. GitHub is actively working to enhance security measures through initiatives like the GitHub Security Lab, Dependabot, and GitHub Advanced Security, which aim to help developers quickly identify and address vulnerabilities. Additionally, GitHub is collaborating with the Open Source Security Foundation to implement signing, attestations, and policies to ensure safer dependencies. The report stresses the need for a collective commitment from companies, developers, and governments to improve OSS security, alongside the development of advanced alerting tools and practices that focus on building secure code from the outset.

The Octoverse 2022 report highlights the increasing attention open source software (OSS) is receiving from governments and policymakers, driven by its critical role in security, autonomy, competitiveness, and transparency. Governments are adopting OSS to enhance transparency, efficiency, and modernize systems, and are focusing on securing the OSS supply chain due to vulnerabilities in popular dependencies. This interest has led to initiatives like the European Union Cyber Resilience Act and the German Sovereign Tech Fund, aimed at securing digital infrastructure. There is a trend of establishing Open Source Programs Offices (OSPOs) within government organizations to better manage and invest in OSS. The report underscores the need for more research to document the economic and social benefits of OSS, as seen in the European Commission's study showing its significant economic contribution. As governments recognize their role in the global open source ecosystem, the report anticipates further policy development and research to support OSS innovation and security.

GitHub aims to enhance its platform to support developers and companies in driving innovation by introducing new features and integrations, particularly focusing on AI, cloud-based development environments, and collaboration tools. The platform now includes GitHub Copilot, an AI-powered coding assistant, which improves developer productivity by offering real-time code suggestions and allowing voice interaction through "Hey, GitHub!" Additionally, Codespaces provides a cloud-based development environment that reduces setup time, now offering up to 60 free hours monthly for individual developers. GitHub Projects has been improved for better planning and tracking, with features like roadmaps and task lists, and GitHub Mobile extends these capabilities to mobile devices. For enterprise users, GitHub Enterprise Cloud and Server offer enhanced security and CI/CD solutions, including GitHub Actions Importer for streamlined migrations and CodeQL for Ruby support to identify vulnerabilities. GitHub is also investing in the open-source community with initiatives like the GitHub Accelerator and GitHub Fund to support maintainers and projects financially. These updates aim to simplify software development and foster a collaborative environment for developers worldwide.

GitHub Enterprise Server 3.7 introduces a series of enhancements aimed at improving scalability, security, and developer collaboration. This release includes features such as reusable workflows and Google Cloud Storage support for GitHub Actions, enhancing the automation and scalability of workflows. A newly introduced security overview provides a centralized view of security alerts, while SCIM user management streamlines user provisioning and suspension via identity providers. To encourage innersource practices, new policies and workflows simplify repository management and enforce organizational compliance. Additionally, improvements in code scanning alerts facilitate more collaborative security reviews, and the dependency submission API enhances the visibility of software dependencies. These updates collectively aim to support both developers and administrators in maintaining a secure and efficient development environment.

The blog post discusses the design decisions and migration strategies for implementing column encryption in a Rails application using ActiveRecord::Encryption. The focus is on migrating existing plaintext or previously encrypted columns to a new encryption standard and handling key rotation. The authors opted for a custom approach using a "previous encryptor" strategy to manage plaintext during migration and a feature flag mechanism to control the rollout of the new encryption system. The post also addresses challenges encountered, such as dealing with false alerts in audit logs due to the changed_in_place? method, and outlines how to use the MaintenanceTasks gem for backfilling records. By adding a new encryption key, the migration process ensures records are re-encrypted with the latest key, thereby maintaining data security. The guide aims to assist organizations in adopting ActiveRecord::Encryption for securing sensitive database information.

Software developers, like other creators, are key copyright holders, but the unique nature of code presents challenges when applying traditional copyright rules. GitHub is actively involved in policy discussions to represent developers' interests, especially in relation to technical measures like upload filtering that are unsuitable for code. These measures can lead to false positives and unintended consequences, such as the wrongful removal of critical code, which can disrupt entire developer ecosystems due to the interdependent nature of software. GitHub has participated in consultations with the US Copyright Office, which recognized that automated detection doesn't effectively address code infringement and requires human review. Unlike other copyrighted works, much of the code on platforms like GitHub is open source and intended for sharing, making automatic takedown measures particularly problematic. GitHub continues to advocate for policies that acknowledge these distinctions and provides legal support for developers through its DMCA Takedown Policy and Developer Defense Fund.

In October, GitHub experienced four significant incidents impacting the availability of its services, with further insight provided into a September incident affecting Codespaces. On October 26, a major issue affected most Codespaces customers for nearly four hours, with ongoing investigations to determine the root cause. On October 13, a recent deployment led to increased error rates in the Projects API due to a database validation issue, resolved within 48 minutes through a rollback and subsequent testing improvements. The October 12 incident involved a global configuration change for Codespaces that caused a schema conflict, resulting in service degradation for over three hours before a complex rollback restored functionality. On October 5, a rapid influx of webhook events due to automated user activity led to a backlog and service delays, resolved by disabling the automated accounts and updating webhook delivery processes. An earlier incident on September 28 involved missed steps in a secret rotation checklist, causing traffic disruptions in Codespaces, which were mitigated by rerunning the missed steps and enhancing monitoring and processes for future secret rotations.

The collaboration between GitHub and Arm aims to transform IoT software development by integrating Arm Development tools directly into GitHub Actions, facilitating cloud-native development for IoT developers. This partnership addresses the challenges faced by developers, such as the complexity of setting up software stacks and licensing issues, by providing preconfigured Arm tools within GitHub Actions, enabling developers to focus on coding rather than infrastructure. GitHub Actions offers a powerful continuous integration/continuous delivery (CI/CD) platform that enhances development velocity and reliability, allowing developers to efficiently create and test IoT applications without the need for physical hardware. This integration supports horizontal scalability and changes the billing model to one based on workloads rather than software licenses, offering a streamlined and cost-effective solution for IoT development, particularly in critical sectors such as Industrial Automation, Medical, Automotive, Railway, and Avionics.

Game Off is an annual game jam organized on itch.io that invites participants to create a game inspired by the theme of clichés, such as "a blast from the past" or "skating on thin ice," by the submission deadline of December 1. Participants can use any game engine or programming language to build their games and must store their source code on a public GitHub repository. The event encourages creativity with clichés from various sources, including movies and video games, and offers a platform for newcomers to explore game development with numerous open-source resources available. Once the jam concludes, submissions are rated on categories like Gameplay, Graphics, and Innovation, with standout entries highlighted on the GitHub Blog. The Game Off community on itch.io and a community-run Discord server provide opportunities for collaboration and support, while Git and GitHub resources are available for those unfamiliar with version control or the GitHub platform.

All In for Students is expanding its program for the 2023 cohort to introduce more college students to open source, providing them with education, technical training, and career development opportunities to prepare for internships in the tech industry. Launched as a pilot in 2021, where all participating students secured internships with major tech companies, the program is now scaling up from 30 to 300 students and broadening its reach to 26 diverse colleges and universities, including HBCUs, HSIs, community colleges, and institutions for Native American education. The curriculum has been streamlined to focus more on practical experience, reducing online coursework by 60%, and offering virtual and in-person hackathons to ensure all students gain technical expertise. Partnered with a wider range of organizations, the initiative aims to cater to students with varying interests and commitments, promoting a more inclusive open-source community and encouraging diverse career paths beyond traditional corporate roles.

In June, a feature was introduced to allow developers to block suggestions of code over 150 characters that match public code, which was helpful but limited in scope. To address more use cases, new capabilities are being launched in 2023 for Copilot, including providing developers with an inventory of similar code found in public GitHub repositories and the ability to sort this inventory by criteria like repository license and commit date. This enhancement is illustrated with a common JavaScript example, showing how developers can leverage these features to identify code fragments, understand their origins, and decide on the best implementation strategy while maintaining the flow of development. With these features, Copilot aims to responsibly innovate and enhance developer experience by offering insights into the broader community context of code suggestions.