June 2023 Summaries

Game Bytes is a monthly series that explores the world of game development on GitHub, highlighting various aspects like game engine updates, open-source games, mods, and game jams. This edition covers projects such as the Text Engine, a JavaScript-based engine for creating text adventure games, and Beyond All Reason, a real-time strategy game with a growing community. It also features Sine Rider, a game about graphing equations developed by Hack Club students, and GDTLancer, a space simulator inspired by classics in the genre. The article mentions post-processing effects for Unity, the role of GitHub Copilot in game development, and contributions to ScummVM through Google Summer of Code. It also highlights recent game jams and the game jam game of the month, Neo City Express, which blends arcade racing with a visual novel format.

GitHub Enterprise Server 3.9 introduces a suite of features aimed at enhancing collaboration, security, and observability for developer teams. This release includes a new time-based view in GitHub Projects, allowing for better visualization and automation of project roadmaps. Developers can benefit from improved code and secret scanning capabilities, with easier setup and monitoring, to protect against vulnerabilities and unauthorized disclosures. The release also enhances observability by adopting the OpenTelemetry structured log standard and introduces tools for better appliance management, such as improved logging and migration status visibility. For scaling, the Actions Runner Controller enables auto-scaling of self-hosted runners using Kubernetes, responding efficiently to webhook events. These updates aim to streamline workflows and bolster security, allowing organizations to innovate with confidence.

GitHub Copilot, launched a year ago as an AI pair programmer, has significantly impacted the software development landscape by increasing productivity and developer satisfaction. The tool has been adopted by over one million developers and 20,000 organizations, generating more than three billion lines of accepted code. Research, conducted with Keystone.AI and Harvard Business School, suggests that generative AI tools like Copilot could enhance developer productivity by 30%, potentially adding the equivalent of 15 million developers to the global workforce by 2030, boosting global GDP by over $1.5 trillion. GitHub Copilot particularly benefits less experienced developers, helping democratize software development and close the labor gap. Open-source innovation on GitHub has surged, with increased activity in generative AI projects, driven by a diverse group of contributors. GitHub Copilot for Business has also seen widespread adoption, with companies like Duolingo reporting a 25% increase in developer velocity, indicating a shift towards AI-powered development. This trend highlights an inextricable link between developers and AI, suggesting a future where AI enhances rather than replaces human potential in the software industry.

The public beta release of actions-permissions introduces a tool designed to enhance the security of GitHub Actions workflows by recommending the minimal permissions necessary for their operation. Historically, GitHub workflow tokens had broad read and write permissions by default, but a finer-grained permission model was introduced in 2021, setting new repositories and organizations to read-only by default. Despite this, many workflows still operate with more permissions than needed. The transition to a least-privilege model is encouraged as a best practice but poses challenges, as altering permission settings can disrupt existing workflows that rely on broader permissions. To facilitate this transition, GitHub has released a set of Actions that monitor and enumerate permissions required by workflows, with the Monitor action installing a local proxy to assess interactions with the GitHub API and the Advisor action summarizing permission recommendations. Users can apply these recommendations to enhance security and stop using the tools once the appropriate permissions are set, with the flexibility to adjust permissions for future workflow iterations. The beta aims to assist users in adopting a more secure permission model, and feedback is encouraged to refine the tool.

The June episode of The ReadME Podcast delves into the often-overlooked importance of non-code contributions in open-source projects, highlighting how roles like technical writers, community managers, and marketers significantly enhance user experience without altering code. Featuring guests like Kyler Middleton and Kelsey Hightower, the episode explores the challenges of using open-source software in regulated environments, the balance between openness and control, and the complexity of scaling massive projects like Kubernetes. Middleton discusses her diverse career path and the role of Terraform in infrastructure sharing, while Hightower offers insights into Kubernetes' future and advice on simplifying complex technology. The episode also touches on how open source contributes to nuclear fusion research and provides practical career advice, emphasizing the need to preserve community insights and the transformative power of humor in tech communities.

GitHub has developed a new code view designed to enhance the code reading experience by introducing features such as a file tree, symbol navigation, and code search integration, all while maintaining speed and usability for millions of users. The development process involved overcoming significant performance challenges associated with rendering large files, which were initially addressed through typical React optimization techniques but ultimately required the implementation of virtualization. Virtualization significantly improved load times by only rendering lines visible in the viewport, but it initially compromised the browser's native find-in-file functionality. To resolve this, GitHub introduced a dual-layer solution: a hidden textarea containing the full text for accessibility and findability, and a visible, virtualized syntax-highlighted overlay. This approach preserves both performance gains and user functionality, enhancing the code reading experience without turning GitHub into an IDE. The solution also involved innovating in syntax highlighting and HTML generation to further optimize performance, making the new code view faster and more feature-rich than its predecessor.

Andrzej Mazur, a game developer and founder of Enclave Games, discusses the evolution and milestones of the Gamedev.js community, which began in 2012. Initially centered around local meetups, the community expanded internationally with the Gamedev.js Weekly newsletter in 2014 and the first Gamedev.js Jam in 2020. The 2023 edition saw 201 game submissions, with 91 participating in the Open Source challenge by sharing their game source code on GitHub. The post highlights the top 13 games selected by experts for their creativity, graphics, and gameplay. It encourages developers to engage with the community through various platforms and emphasizes the importance of sharing source code to foster advancement in game development. Mazur also mentions the upcoming js13kGames 2023 competition, which mandates sharing source code to participate, underscoring the community's commitment to open-source collaboration.

Generative AI coding tools like GitHub Copilot are revolutionizing how developers manage coding tasks, from documentation to unit test generation, though they present a learning curve that can lead to frustration when outputs are not as expected. Understanding how these tools process information and adjusting communication methods is crucial for effective use, as seen in examples where prompt adjustments led to more accurate code generation. This guide, authored by developer advocates Rizel Scarlett and Michelle Duke, explores best practices for prompt crafting with GitHub Copilot, emphasizing the importance of setting clear goals, simplifying requests, and providing examples. The document also highlights the necessity of adhering to good coding practices and experimenting with prompts to achieve desired results. Developers are encouraged to critically assess AI-generated code and to view the current phase of generative AI technology as one of trial and error and collective learning.

The United States Patent and Trademark Office (USPTO) has proposed rule changes that could make it more difficult to challenge low-quality patents, a move that has raised concerns from the Linux Foundation and the Electronic Frontier Foundation among others. These changes threaten to reverse the progress made by the Patent Trial and Appeal Board (PTAB), established by Congress in 2011 to provide a cost-effective means for the public to contest patents that are not novel or obvious. The PTAB has been instrumental in reducing litigation costs and combating patent trolls, which can hinder innovation, particularly affecting developers, startups, and open-source projects. The proposed restrictions are seen as counterproductive to technological advancement, despite the USPTO's intention to prevent "patentee harassment." Critics argue that the ability to challenge weak patents is crucial for fostering innovation and maintaining a fair patent system. The call to action encourages developers and supporters to use the USPTO’s public comment system to oppose these rules and protect a system that benefits creative and technological progress.

GitHub has launched a redesigned site-wide navigation as a public beta, aiming to enhance user experience by making the platform more user-friendly, accessible, and integral to various workflows. This new navigation retains familiar functionalities while introducing improvements like breadcrumbs for better wayfinding, a site-wide menu accessible via a hamburger button to quickly reach frequently used features, and a more responsive design across all devices. The updates integrate code search and the command palette for efficient navigation and preserve key elements like the Mona logo for home access. Emphasizing accessibility, the navigation framework was rearchitected to ensure a consistent experience for users with disabilities, leveraging GitHub’s open-source design system, Primer, for ongoing support and improvements. Users can try out the new navigation and provide feedback during the beta phase, with the option to toggle the feature on or off.

CodeQL, a static analysis tool developed by Semmle and acquired by GitHub in 2019, is designed to automatically scan applications for vulnerabilities and assist with manual code reviews. It employs data flow and taint analysis to identify code errors, check code quality, and detect vulnerabilities across various programming languages such as C/C++, Java, Python, and more. A key feature of CodeQL is its ability to analyze code by creating a database of facts about a program, which can be queried using a specialized language, QL, to find vulnerable patterns like SQL injection. CodeQL is integrated with GitHub Actions, enabling code scanning in CI/CD pipelines for public repositories, and its queries are open-source, allowing contributions from the community. The tool provides security researchers and developers with capabilities for automated scanning, variant analysis, and assistance during manual code reviews, enhancing application security by preventing vulnerabilities from being introduced. CodeQL's flexibility extends to the creation of databases either by downloading from GitHub or generating locally, with support for both interpreted and compiled languages, enabling robust and scalable security assessments of codebases.

Between April and May, GitHub experienced several incidents affecting its services, including GitHub Copilot, Packages, Codespaces, and others, due to issues such as configuration changes, database errors, and cloud provider outages. On April 25, a faulty configuration change led to degraded performance in GitHub Copilot, while GitHub Packages encountered database connection errors on April 26, necessitating a database migration to prevent recurrence. An outage in the East US cloud region impacted GitHub Codespaces on April 28, which was mitigated by redirecting traffic to a healthier region. In May, various services faced challenges, including connection pool exhaustion, a database bug, and increased write latency, leading to disruptions on multiple days. GitHub's response included manual interventions, audits, and updates to configuration and monitoring systems to improve resiliency and reduce the time to detect and resolve such issues. These efforts aim to prevent future occurrences and enhance the overall reliability of GitHub services.

Developers today are increasingly reliant on generative AI tools, with 92% of U.S.-based developers at enterprise companies already using them to enhance productivity, collaboration, and code quality. A survey conducted by GitHub and Wakefield Research reveals that developers prioritize a positive developer experience, which includes efficient tools and workflows that enable them to enter a flow state and drive impact. Despite advancements in DevOps, developers still encounter challenges such as waiting on builds and tests, which hinders their ability to upskill and innovate. The survey emphasizes the importance of collaboration, with developers working in teams averaging 21 members, and highlights the need for performance metrics that reflect collaboration, communication, and code quality, rather than just output quantity. AI coding tools are seen as a means to improve individual and team performance, allowing developers to focus on higher-value tasks and potentially reducing burnout. The integration of AI into existing workflows is viewed as enhancing efficiencies rather than altering the software development lifecycle, suggesting a positive outlook for the future of developer satisfaction and productivity.

GitHub has introduced an open-source tool called the accessibility-alt-text-bot, designed to enhance accessibility in GitHub Issues, Discussions, and Pull Requests by reminding users to add meaningful alt text to images. Alt text is crucial for individuals using screen readers and other assistive technologies as it provides a description of the image's intent, ensuring inclusivity for people who are blind, have low vision, or have cognitive disabilities. The bot aims to alleviate the burden on individuals who frequently advocate for accessibility by automating reminders, thereby reducing advocacy fatigue and burnout. Users can implement this bot by installing it in their repository's workflows, where it will monitor activities and prompt users to include alt text when necessary. This initiative is part of GitHub's broader effort to integrate more accessibility features into its platform and foster a more inclusive open-source environment.

GitHub has introduced GitHub Enterprise Importer (GEI), a self-serve tool designed to facilitate seamless migrations to GitHub Enterprise Cloud, allowing teams to transfer code, history, and collaboration context such as pull requests and comments. This tool supports migrations from platforms like GitHub Enterprise Server, Azure DevOps, Bitbucket Data Center, and Bitbucket Server, and is also available for existing GitHub.com customers to adopt Enterprise Managed Users. GEI has been utilized by over 2,000 customers for migrating more than 400,000 repositories, with an average repository migration time of 70 seconds. To aid in planning migrations, GitHub provides documentation and expert services for complex transitions, emphasizing that consolidating to a single source code management tool can enhance developer productivity and security. Additionally, GitHub Actions Importer supports the migration of CI/CD pipelines from platforms such as CircleCI, GitLab, Jenkins, and now Atlassian’s Bamboo Server and Data Center, with a public beta available for the latter. With Atlassian ending support for Bitbucket Server, GitHub sees this as an opportune moment for organizations to transition.

GitHub's bug bounty team has introduced a swag store and revamped its VIP program, aiming to enhance engagement and reward researchers for their contributions to securing GitHub. The new swag store offers exclusive bug bounty-branded items as a bonus alongside monetary rewards, while the revamped VIP program, operating for five years, now features clearer criteria for invitation, including earning at least $20,000 and submitting two reports in the last two years. Invited researchers, known as Hacktocats, gain benefits such as early access to beta features, interaction with GitHub engineers, and exclusive swag. These initiatives are part of GitHub's broader strategy to foster partnerships with talented security researchers, strengthening the security of its products and community.

Developer experience (DevEx) is crucial for optimizing the efficiency and satisfaction of software development, examining the interplay between developers, processes, and tools. It emphasizes creating an environment that reduces friction and enhances productivity, satisfaction, and collaboration among developers. The history of DevEx shows a slow industry adaptation despite the abundance of tools and technologies, leading to fragmented experiences that pressure developers to continually adapt. Improvements in DevEx can significantly enhance business outcomes, including faster time to market, increased revenue, and better customer satisfaction. Metrics for measuring DevEx lack standardization but often include deployment frequency and lead time for changes, while effective strategies involve research, user testing, and ongoing feedback from developers. Generative AI is set to play a transformative role in DevEx by streamlining workflows and reducing cognitive load, with tools like GitHub Copilot already contributing to this evolution. As development grows more complex, prioritizing DevEx is vital for maintaining competitive advantage and achieving business goals.

Maintainer Month, celebrated throughout May, brought together the open-source community to honor and support the crucial work of project maintainers. Over the course of the month, 16 organizations coordinated 42 events, including meetups, workshops, conferences, and podcasts, to engage nearly 500 maintainers globally. Highlights included major events like the Linux Foundation's Open Source Summit in Vancouver and JupyterCon in Paris. Key themes focused on achieving balance, planning for leadership succession, and securing corporate funding, with notable discussions on these topics featured in various podcasts and stories. The month also saw initiatives like Bloomberg's FOSS Fund nominations and GitHub's sponsorship matching program, emphasizing the importance of financial support for open-source projects. Personal stories, such as those shared by Kelsey Hightower and Filippo Valsorda, highlighted the challenges and successes of maintainership, while the community was encouraged to continue supporting maintainers beyond the month through gratitude and sponsorship.

GitHub has introduced the All In CHAOSS DEI Badging initiative as part of its commitment to enhancing diversity, equity, and inclusion (DEI) in the open-source community through the All In for Maintainers program. This initiative aims to help open-source project maintainers showcase their efforts in promoting DEI by creating a DEI.md file that outlines attention to four key CHAOSS DEI metrics: Project Access, Communication Transparency, Newcomer Experience, and Inclusive Leadership. Projects can apply for DEI badges at various levels, starting with Bronze, which involves an evaluation of their DEI.md file to ensure appropriate language and practices. The initiative encourages ongoing reflection and improvement rather than assessing projects' DEI capabilities definitively. It also emphasizes privacy, ensuring that all data remains anonymized and reports are sent only to the applying maintainers. GitHub seeks collaboration from the global open-source community to test and develop this pilot program further, with the ultimate goal of fostering more inclusive communities and empowering developers.

Mobile applications are an integral part of daily life, offering convenience and access to various services. GitHub has invested in GitHub Mobile to enable developers to work from anywhere, focusing on project management, code security, and community connection. With mobile app downloads reaching 255 billion in 2022, ensuring application security and data privacy is critical. GitHub has launched a beta for code scanning in Swift to detect vulnerabilities and plans to support Swift security advisories with Dependabot alerts. The platform already supports Kotlin, and both languages are crucial for mobile development on Android and iOS. Code scanning with CodeQL can now identify security issues specific to Swift, enhancing application security. Additionally, Swift is being added as a supported package ecosystem in the GitHub Advisory Database. To further engage the security research community, GitHub's Security Lab has opened a Bug Bounty program for Swift and Kotlin, offering bonuses for CodeQL query submissions to find and prevent bugs in open-source projects.

GitHub has introduced the Stale Repos Action, a tool designed to identify and report inactive repositories within an organization, aiding in the effective management of open source projects. This action, developed by GitHub's Open Source Programs Office (OSPO), allows organizations to make informed decisions about archiving or reviving dormant projects by providing a report on repositories with no activity over a configurable period. The tool is open source and involves setting up a workflow in a chosen GitHub repository, with customizable parameters such as the number of inactive days. It generates a Markdown report detailing inactive repositories, facilitating discussions with maintainers about project status. This initiative aims to enhance the organization and stewardship of open source catalogs while encouraging community collaboration.

GitOps is an operational framework that leverages Git repositories as the single source of truth for managing infrastructure and application configurations, thereby enhancing automation, consistency, and auditability in DevOps practices. The principles of GitOps, as outlined by the Linux Foundation’s OpenGitOps, include managing systems declaratively, ensuring desired states are versioned and immutable, automatically pulling desired states, and continuously reconciling actual system states against them. The integration of GitOps practices allows for a full history of changes, facilitating auditability and governance through branch protection rules and quality checks. This approach extends beyond applications to infrastructure management, using tools like Ansible or Terraform, and has been exemplified by GitHub's open-source identity and access management solution, Entitlements. While GitOps can streamline workflows and reduce manual errors, it requires careful implementation of security and quality assurance measures to maintain integrity and reliability in CI/CD environments.

Git 2.41 introduces several enhancements and bug fixes thanks to contributions from over 95 individuals, 29 of whom are new contributors. Among the notable improvements is the default generation of cruft packs, which efficiently store unreachable objects, preventing system resource strain by consolidating them into packfiles with auxiliary files tracking their age. Another significant update is the default creation of on-disk reverse indexes, which enhance performance by pre-computing and storing index mappings, resulting in faster operations such as git push and object size determination. Credential management has been improved with support for passing WWW-Authenticate headers, enabling more granular access control through OAuth scopes. The release also streamlines branch comparison tasks by introducing a new formatting atom, %(ahead-behind:<base>), which reduces processing time. Git fetch now includes a --porcelain option for machine-friendly output and a fetch.hideRefs option, enhancing connectivity checks by narrowing the focus to specific remotes, which is particularly beneficial for resource-constrained systems. Finally, git fsck has been updated to detect corruption in reachability bitmaps and on-disk reverse indexes, ensuring repository integrity.

Maintaining open source projects involves significant responsibilities such as developing features, addressing issues, and fostering community engagement, which can be overwhelming for a single individual. To mitigate burnout, project maintainers often seek trustworthy co-maintainers by elevating active contributors within the community. This process involves identifying individuals who exhibit initiative and collaboration skills, offering them guidance, and gradually increasing their responsibilities. Different approaches are used for onboarding, such as informal mentoring or more structured processes like those at Python’s triage team. Onboarding includes introducing new maintainers to communication channels, sharing internal documentation, and providing administrative support. Disputes are resolved by focusing on technical issues, maintaining open communication, and understanding diverse perspectives. In rare cases, maintainers may be removed if they consistently breach conduct codes. Delegation is crucial for maintainers to share workload and leverage diverse expertise, with encouragement to let others take the lead on ideas and tasks, fostering a collaborative environment.