January 2023 Summaries

GitHub is committed to fostering a collaborative and equitable future in software development by promoting open source contributions and addressing diversity, equity, and inclusion (DEI) challenges. Through initiatives such as Global Campus, All In for Students, and All In for Maintainers, GitHub aims to skill individuals from underrepresented backgrounds, providing them with training, education, and resources necessary to engage in open source communities. These programs not only focus on skilling future developers but also emphasize creating a welcoming environment for new contributors, particularly from underserved communities, by offering tools and support for maintainers to automate inclusive practices. GitHub's collaborations with corporate partners, nonprofits, and educational institutions aim to bridge gaps in resources and access, leading to a diverse ecosystem that drives innovation. As part of these efforts, GitHub has committed to skilling 5,000 people from underrepresented tech backgrounds within the next three years and expanding its reach to nearly 90 partner schools, focusing on Historically Black Colleges and Universities, Hispanic Serving Institutions, and Community Colleges.

In response to a security incident on December 7, 2022, where unauthorized access to certain repositories was detected, GitHub has revoked three certificates—two Digicert code signing certificates used for Windows and one Apple Developer ID certificate—to prevent potential misuse. The incident involved a compromised Personal Access Token that cloned repositories used in the development of GitHub Desktop and Atom. Although no customer data was exposed and no unauthorized changes were made to the code, encrypted code signing certificates were accessed but remained secure due to password protection. As a precaution, GitHub decided to revoke the certificates by February 2, 2023, resulting in certain versions of GitHub Desktop for Mac and Atom becoming non-functional. Users are advised to update GitHub Desktop to the latest version and downgrade Atom to an earlier version to avoid disruptions. The company emphasizes its commitment to security and urges users to follow the recommended actions to maintain the functionality of these applications.

Overview Object Graph Notation Language (OGNL) is a Java-based expression language frequently used in frameworks like Apache Struts and Atlassian Confluence, which has historically been vulnerable to remote code execution (RCE) attacks due to OGNL injections, such as the notable Equifax breach. Although protection mechanisms have been developed to mitigate these vulnerabilities, researchers like Alvaro Munoz have demonstrated how these can still be bypassed using advanced techniques, such as leveraging AST nodes and using OGNL's inherent features to access restricted classes and execute arbitrary code. Munoz describes various methods to circumvent these protections, including exploiting the OGNL AST to evaluate expressions and leveraging BeanMap and other techniques to bypass sandbox restrictions, ultimately showcasing the challenges in sandboxing expression languages like OGNL. Despite the absence of new vulnerabilities being reported, these findings highlight the ongoing need for robust security measures in applications utilizing OGNL, and the research has led to a $5,600 donation to UNHCR from bug bounty earnings.

Balancing compliance with developer efficiency is crucial for software development, as compliance allows software to operate globally within varied regulatory environments. GitHub, utilized by 100 million developers and 90% of the Fortune 100, emphasizes the importance of understanding the location of code and developer access to ensure security, integrity, and availability. The CIA Triad framework helps manage access, and GitHub's enterprise account structure facilitates holistic access management. Continuous Compliance, akin to Continuous Integration/Continuous Delivery (CI/CD), is essential for fast, seamless compliance testing and audits, with AI and machine learning offering promising advancements. By integrating compliance into daily workflows, developers can meet regulatory requirements without disrupting their productivity, paving the way for improved communication, efficient audits, and cost savings. Future discussions will explore practical methods to maintain compliance while fostering developer satisfaction and productivity.

In 2019, GitHub set a goal to reach 100 million developers by 2025, a milestone it achieved two years early, reflecting the platform's expanding global reach and diverse user base. Developers today are not confined to tech companies but represent a varied group working across different industries and regions, including Southeast Asia, Africa, and South America, with significant growth in countries like India and Brazil. This diversity is democratizing the perception and role of developers, who are now contributing to a range of fields such as scientific research, healthcare, and AI. GitHub emphasizes its commitment to supporting developers by providing tools and initiatives like GitHub Copilot and GitHub Next, which aim to enhance the software development process and foster innovation. Under the leadership of Thomas Dohmke, GitHub has focused on empowering developers to collaborate effectively and address complex global challenges, demonstrating the platform's vision of being a home for all developers.

The bug bounty team celebrated its eighth year with several notable events, including a live hacking event and participation in DEFCON 30, while engaging with the community through feedback, which led to the creation of a new swag store. This initiative was driven by researchers' enthusiasm for swag and their desire to showcase their involvement in the program. The GitHub Bug Bounty swag store allows researchers to earn points through their reports, redeemable for exclusive items like t-shirts and stickers, complementing their bounty rewards. The program's success relies heavily on collaboration with talented security researchers, and the team expresses gratitude for their contributions, emphasizing the importance of submissions in maintaining the security of products and the community. More information about the program, including its scope, rules, and rewards, is available on their website.

In 2021, Google launched its Pixel 6 series, an "all-Google" phone except for one small component: the Arm Mali GPU, which became the focus of a significant security vulnerability, CVE-2022-38181. This vulnerability, which allowed arbitrary kernel code execution and root access on a Pixel 6 device, was initially reported to the Android security team but was later handed over to Arm, who released a patch in October 2022. The vulnerability exploited weaknesses in the GPU's memory management system, particularly involving Just-In-Time (JIT) memory. It highlighted a broader issue of delays and mismanagement in patching security vulnerabilities within the Android ecosystem, often leaving devices exposed to exploits for extended periods. The article draws attention to the ongoing challenges of timely patching and the importance of addressing security issues comprehensively to prevent them from being exploited in the wild.

GitHub has announced that it will completely sunset Subversion support on GitHub.com by January 8, 2024, and a subsequent release of GitHub Enterprise Server in early 2024 will also remove it. Originally introduced in 2010 when centralized version control systems like Subversion were more prevalent, GitHub supported Subversion to facilitate a gradual transition for users to Git. However, with Git now accounting for up to 94% of developer usage and Subversion requests on GitHub dwindling to less than 0.02%, Subversion support no longer aids in migration to Git. The maintenance cost of supporting Subversion, combined with Git's recent enhancements in handling workflows like sparse checkout and partial clone, has led GitHub to focus solely on Git. Ahead of the discontinuation, GitHub plans to conduct brief brownouts to phase out remaining Subversion usage.

GitHub has integrated GitHub Actions with its mobile app, allowing users to manage workflow automation directly from their mobile devices. This update focuses on enhancing the user experience with pull requests by enabling users to view the status of checks, access detailed logs, and take actions such as canceling or re-triggering runs. The app provides a redesigned interface for viewing pull request checks and their related workflow summaries, and users receive push notifications upon the completion of workflow runs. This ensures that users remain informed and can manage actions without needing to constantly monitor their devices. The mobile app is available for both iOS and Android, and users are encouraged to provide feedback through a public feedback community.

Open source software is integral to nearly all the software used daily, with contributions from a vast community of developers driving innovation and societal progress. GitHub, as a hub for over 94 million developers, emphasizes the significant benefits of open source, such as lowering barriers, creating opportunities, and securing the software supply chain. However, challenges like tech skepticism and nationalism threaten this ecosystem, highlighting the need to communicate open source's value to those unfamiliar with software development. GitHub has created videos to illustrate the importance of open source and encourages sharing these resources to discuss its impact. The platform also invites community feedback on policies affecting developers and promotes discussion on ensuring developers' rights to innovation and collaboration, with further engagement opportunities available through their developer policy repository and Twitter.

GitHub effectively utilizes its own platform to enhance cross-functional collaboration in product and feature releases by employing tools such as GitHub Projects and GitHub Actions. These tools enable seamless management and communication across various teams, including engineering, social media, and product operations, by tracking necessary tasks and automating updates and workflows. A structured process begins a month before release, using GitHub Issues to detail new features and coordinate the involved teams through an integrated project board. This board reflects real-time changes and supports filtering for specific needs, facilitating efficient project management and stakeholder communication. The visual and customizable nature of GitHub Projects allows different teams to easily access relevant information, ensuring that all parties, from leadership to customer success teams, are informed and aligned, ultimately streamlining the release process.

Dependabot, a tool for automating security updates in software dependencies, has expanded its capabilities to address vulnerabilities in transitive dependencies, which are indirect dependencies within a project's dependency graph. Previously, developers had to manually update chains of ancestor dependencies when vulnerabilities were detected in transitive dependencies. By leveraging npm's audit functionality, Dependabot can now resolve these vulnerabilities more efficiently by identifying and updating only the necessary dependencies without causing unnecessary changes. This enhancement has significantly reduced update-not-possible errors, particularly in JavaScript projects, where more than 80% of Dependabot's security updates occur. With the rollout of this feature in September 2022, Dependabot users benefit automatically, and plans are in place to extend similar functionality to other package managers as they develop comparable features.

Secret scanning is a tool used by application security teams to mitigate the risk of leaked credentials, such as passwords and API keys, by checking the validity of exposed tokens. With GitHub's new validity checks feature, teams can determine whether a GitHub token is still active or if it was ever active, aiding in the prioritization of remediation efforts. This process involves opening a secret scanning alert to ascertain the status of a leaked token, and in cases where validity cannot be accurately determined—such as with tokens from GitHub Enterprise Server instances—guidance is provided for remediation. Additionally, GitHub plans to extend validation capabilities to include secrets from over 100 secret scanning partners.

DevOps practices can significantly enhance how application teams deliver business value, but the misuse of antipatterns—such as focusing too much on short-term goals and tools without considering people and processes—can lead to poor results. Antipatterns include unscalable team structures, insufficient "shift-left" practices for testing and governance, and overemphasis on tools rather than team dynamics. Addressing these issues involves using cloud-native strategies, integrating security and governance early into continuous integration processes, and fostering effective communication and collaboration within teams. GitHub provides solutions like leveraging declarative patterns, integrating testing tools with code for early quality control, and using frameworks like SPACE to measure productivity and happiness. By overcoming these antipatterns, organizations can improve team success, productivity, and satisfaction while delivering business value more effectively.

New versions of Git have been released to address security vulnerabilities CVE-2022-41903 and CVE-2022-23521, affecting versions 2.39 and older, as well as a Windows-specific issue CVE-2022-41953 in Git for Windows. These vulnerabilities involve Git's commit formatting mechanism and .gitattributes parser, which can potentially allow arbitrary code execution through integer overflows. The Windows-specific issue involves the Git GUI's $PATH lookup, which could execute untrusted code when cloning repositories. Users are advised to upgrade to Git 2.39.1 to mitigate risks, with additional steps recommended for those unable to update immediately. The vulnerabilities were discovered through an audit by X41, sponsored by the Open Source Technology Improvement Fund, and the fixes were developed by engineers from GitLab, GitHub, and the git-security mailing list. GitHub has also implemented measures to prevent exploitation of these vulnerabilities on its platform, scheduling updates across its services and crediting various contributors for their discovery and resolution efforts.

Dependabot alerts have been a critical security feature on GitHub for the past five years, enabling developers to address over 80 million dependency-based vulnerabilities. Historically, these alerts were only visible to admin users, limiting the developers' ability to act on them. In a developer-first move, GitHub announced that starting February 7, developers with repository write or maintain roles will be able to view and address Dependabot alerts by default, enhancing code security management. This change does not affect custom roles or organization permissions and does not alter alert notifications or repository watching settings. Developers can manage their alert notifications by visiting GitHub's settings to adjust how and when they receive notifications, such as opting for weekly email digests instead of immediate notifications. This update aligns with GitHub's continued efforts to prioritize security and empower developers, as emphasized by GitHub's Product Manager Erin Havens.

The GitHub CLI team has introduced several enhancements to improve the experience for extension developers and users, including the release of go-gh 1.0, a Go library for extension authors, and the gh/pre-extension-precompile action for automated compilation and release of extensions. The 2.20.0 release introduced new commands like gh ext browse and gh ext search, facilitating easier discovery and installation of extensions. The former offers an interactive Terminal User Interface for exploring extensions, while the latter is designed for scripting and automation. A detailed guide on developing a CLI extension using go-gh is provided, illustrating the process from creating a basic extension to integrating features such as repository selection, API interaction, and output formatting. The blog also discusses releasing extensions using the cli/gh-extension-precompile action, which compiles executables for various platforms. Future plans for the GitHub CLI include more accessible browsing options, support for nested extensions, and improved documentation and flexibility of the precompilation action. The team encourages user feedback and contributions to further enhance the CLI's capabilities.

The tenth annual Game Off concluded with an impressive 562 entries created in under a month, showcasing a wide range of innovative and unique games under the theme "cliché." Participants submitted games across various genres, including first-person shooters, puzzle games, and platformers, using languages such as C, C#, and JavaScript. The competition attracted considerable engagement, with 7,284 ratings and thousands of hours of playtime, resulting in a diverse array of winners. Noteworthy among them were "Neon Square Resurgence," which won first place overall, and "A Taste Of Their Own Medicine," which took first place in gameplay. The games, available to play and download on itch.io, were praised for their creativity and polish, contributing to the event's success as the largest Game Off to date. The event, organized by Lee Reilly from GitHub Developer Relations, exemplified the vibrant spirit of the game development community and set the stage for future competitions.

Dependabot, a tool used for keeping repositories' dependencies up-to-date and addressing vulnerabilities, generated over 75 million pull requests in 2022 and is now being improved to reduce noise by becoming more selective in its activity based on user interaction. The new updates include halting pull request creation on inactive repositories where Dependabot pull requests have been untouched for 90 days, although alerts and manually requested pull requests remain unaffected. This change, which also stops automatic rebasing after 30 days of inactivity, will be gradually rolled out through January 2023 across individual and organization-owned repositories, extending to GitHub Enterprise Cloud and Server customers. The updates aim to enhance efficiency, particularly for self-hosted GitHub Actions runners, and continue to evolve based on user feedback to make alerts and requests more relevant. Dependabot will notify users of its status via banners and offers a simple reactivation process through various actions, including merging or closing a pull request or updating configuration files.

In the blog post by Chris Reddington, the focus is on enhancing security in software development by leveraging GitHub Actions with OpenID Connect (OIDC) to eliminate the need for passwords when deploying to cloud providers. Traditional methods of cloud deployment often require managing numerous service principals and credentials, leading to significant operational complexity and security risks, such as credential leaks. OpenID Connect, built on OAuth 2.0, allows GitHub Actions to generate an ID token that can be exchanged for a short-lived access token from the cloud provider, thus establishing a trust relationship between GitHub and the cloud service. This approach simplifies CI/CD workflows by using OIDC to authenticate directly with cloud providers, thereby reducing the risk of credential leaks and the need for regular password rotations, moving closer to a passwordless deployment environment.

As of June 12, 2023, GitHub Actions has introduced two new features in public beta—required workflows and configuration variables—aimed at improving DevOps processes by standardizing policies and reducing duplication across repositories. Required workflows enable DevOps teams to enforce consistent CI/CD practices organization-wide without configuring each repository individually, enhancing security, compliance, and deployment. These workflows become mandatory status checks on pull requests, preventing merging until successful completion. Configuration variables complement this by allowing non-sensitive data to be stored as plain text, facilitating easier reuse and parameterization across repositories, which addresses feedback for customizable workflow values. These features collectively simplify the management and protection of software assets, offering a streamlined approach to applying consistent standards.

GitHub aims to facilitate secure software development by offering tools that enhance security with minimal friction for developers, beginning with features like secret scanning and Dependabot, which can be enabled with a single click. The company has introduced a "default setup" option for code scanning that simplifies the process for Python, JavaScript, and Ruby repositories by allowing activation without a .yaml file. This feature is designed to help open-source developers and enterprises quickly enable code scanning, providing immediate insights to identify and address vulnerabilities without workflow disruptions. GitHub plans to extend this capability to all languages supported by the CodeQL analysis engine over the next six months, prioritizing languages based on popularity and build complexity. Users can access the new setup via the "Code security and analysis" section in the repository settings, choosing between a default or advanced setup, with the default offering an automatic configuration summary tailored to the repository's contents. This advancement underscores GitHub's commitment to enhancing software security while maintaining a seamless developer experience.

GitHub has introduced Category Forms for repository maintainers to create templates for discussions, streamlining the process of starting new discussions by ensuring all necessary information is included from the outset. This feature simplifies the workload for maintainers by making it easier to triage discussions, while also assisting users in creating content with all relevant details. Category Forms function similarly to Issue Forms, allowing maintainers to set up discussion templates that correspond to specific Discussion Categories, stored in the .github/DISCUSSION_TEMPLATE/ directory. Users do not need to alter their approach to using GitHub Discussions, as the integration is seamless. Potential applications of this feature include creating templates for bug reports, design feedback, and feature requests, which can enhance the organization and quality of discussions across various projects.

In December, GitHub experienced no performance issues, but a report details an incident in November that affected GitHub Packages and GitHub Pages. On November 25, an alert was triggered due to an outage impacting GitHub Packages, causing unavailability of container, npm, and NuGet registries, while RubyGems and Maven registries remained functional. This outage also disrupted GitHub Pages, leading to CI build failures and timeouts on repository landing pages. The issue stemmed from a third-party database provider's regional outage, which was mitigated before GitHub could execute a failover. Recovery ensued as the provider addressed the problem, prompting GitHub to consider enhancing resilience and automating failovers for future incidents. For ongoing updates, GitHub directs users to their status page and engineering blog.