July 2023 Summaries

GitHub Copilot has been enhanced with a new AI model and advanced contextual filtering, offering developers more personalized and faster code suggestions. The improved AI model, developed with collaboration from OpenAI, Microsoft Azure AI, and GitHub, surpasses the previous Codex model with a 13% reduction in latency, thus boosting productivity. The addition of sophisticated contextual filtering further refines the relevance of code completions by accounting for a developer's specific context and usage patterns, resulting in a 6% improvement in code acceptance rates. These updates not only enhance developers' efficiency but also contribute to a more satisfying work experience by minimizing disruptions and maintaining workflow continuity. GitHub is committed to further enhancing the Copilot experience and will continue to share updates to keep developers informed on upcoming advancements.

In May 2023, the Decidim platform, widely used for digital citizen participation by entities like New York City and the European Union, addressed two critical security vulnerabilities identified by GitHub Security Lab. These included a cross-site scripting (XSS) vulnerability, which allowed attackers to perform actions on behalf of logged-in users through manipulated external links, potentially tricking citizens into endorsing proposals. The second vulnerability involved data exfiltration, enabling unauthorized access to sensitive information stored in Decidim's databases, facilitated by the Ransack library's default settings. Both vulnerabilities were mitigated with updated releases, highlighting the importance of robust security measures in open-source software to maintain trust in participatory digital processes.

GitHub has enhanced its merging and rebasing processes by adopting Git's new merge strategy, merge-ort, which improves performance and correctness without requiring a working directory. This strategy was integrated to address limitations of the previous libgit2-based method, which sometimes failed to meet user expectations for correctness compared to local Git command line operations. The implementation, rolled out via controlled experiments using the Scientist framework, demonstrated significant speed improvements, particularly in large repositories, with notable reductions in resource usage. Additionally, GitHub has employed the git-replay subcommand to optimize rebases, achieving substantial efficiency gains. While the current focus has been on merges and rebases, GitHub plans to further explore the use of merge-ort for squashing, reverting, and potentially unlocking new product features. The success of these efforts is credited to both the internal GitHub team and the contributions of the Git open-source community, especially Elijah Newren, who played a key role in developing merge-ort.

The EU AI Act aims to establish the first comprehensive AI regulation and set a global precedent, but it poses risks to open source AI by potentially treating upstream projects like commercial products, which could hinder open source development and conflict with the needs of developers and non-profit organizations. To address these concerns, a policy paper titled "Supporting Open Source and Open Science in the AI Act" has been published in collaboration with leading organizations such as Creative Commons and Hugging Face, offering guidance for policymakers. The paper emphasizes the importance of supporting the open source AI ecosystem, highlighting its role in fostering global public goods and shaping transparency and voluntary commitments. GitHub has played a pivotal role in representing the open source community in EU discussions, advocating for exemptions for developers to account for the unique aspects and potential risks of open source AI systems. GitHub's leadership continues to collaborate with various organizations to influence informed policymaking that accommodates open source innovation as AI policy evolves globally.

GitHub Copilot, launched in June 2022, has rapidly become a key tool in transforming the developer experience by leveraging generative AI to enhance productivity and satisfaction, ultimately impacting business outcomes. The widespread adoption of AI coding tools is underscored by a survey revealing 92% of U.S. developers already use such tools in their work. GitHub aims to empower organizations to innovate with confidence by introducing the GitHub Copilot Trust Center, which addresses concerns about security, privacy, compliance, and intellectual property. This platform provides transparency on how Copilot operates, including data usage, suggestion generation, and security measures. GitHub's commitment to guiding companies in adopting AI responsibly is demonstrated by ensuring Copilot aligns with organizational compliance, security, and accessibility requirements, further supported by scanning features to enhance secure development practices. As the landscape of AI evolves, GitHub is at the forefront, offering resources to help organizations navigate the implications of using generative AI while fostering a trusted developer experience.

Game Bytes offers a monthly overview of the game development landscape on GitHub, highlighting recent updates in game engines, open-source games, and game jams. The latest release from the Godot game engine, version 4.1, features numerous bug fixes and new functionalities while maintaining a faster release cycle. Bevy Engine 0.11, developed in Rust, enhances rendering quality and UI layout systems, while LibGDX 1.12 introduces new audio and graphics capabilities for Java developers. GDevelop has introduced 3D game creation as a default feature, broadening its no-code game development platform. The article also explores several games, such as Brogue CE, Thrive, Mindustry, Endless Sky, and Naikari: Eye of Chaos, each offering unique gameplay experiences from dungeon crawling to space trading. Additionally, tools like Dialogic for Godot and Icons Finder for Unity are introduced, showcasing innovative ways to incorporate dialogues and icons into game development. Upcoming game jams like GDevelop Game Jam #4, JS13KGames, and Game Off 2023 provide opportunities for developers to test their skills, while the standout game jam entry "Slay Yourself" challenges players with its turn-based RPG mechanics.

A developer shares her journey of creating an application that automatically generates nutritional information for recipes using OpenAI's GPT-3.5-turbo model and GitHub Copilot. Having resisted traditional meal tracking, she leveraged her skills to build a tool that parses natural language inputs to provide detailed nutrition facts. The blog outlines a step-by-step guide on using various technologies such as Next.js, React, Material UI, and Express.js to develop the app, highlighting the role of GitHub Copilot in enhancing productivity through its use of Large Language Models. The process includes setting up a server, configuring API keys, employing CORS middleware, and developing a functional front end with Material UI styling. The app's functionality is demonstrated by successfully returning nutritional data for a given recipe, and the developer encourages readers to explore and modify the open-source code available on GitHub.

GitHub has introduced repository rules to streamline branch protections across organizations, addressing challenges with managing scripts, cron jobs, and API calls. These rules allow for flexible targeting of multiple branch patterns and dynamic bypass scenarios, enhancing visibility and enforcement of compliance and security policies. GitHub Repository Rules are being effectively utilized by companies like Twilio and Thomson Reuters to balance developer autonomy with compliance and security needs. The rules provide consistency, allowing for governance of branch names, commit messages, and author email addresses, and can be trialed in evaluate mode to model potential scenarios. By integrating these rules, organizations can maintain code quality, prevent mistakes, and improve collaboration, with the option to set review standards and manage exceptions through a layered ruleset approach.

GitHub has announced a limited public beta release of GitHub Copilot Chat, a context-aware conversational assistant integrated into Visual Studio and VS Code, designed to enhance the developer experience by leveraging generative AI and GPT-4. This feature, part of GitHub Copilot X, aims to democratize software development by allowing developers to perform complex tasks quickly through simple prompts, thus increasing productivity and creativity. GitHub Copilot Chat offers personalized assistance, real-time guidance, and solutions for coding challenges, security issues, and code analysis, while helping developers stay focused in their integrated development environment (IDE). The tool is expected to significantly enhance productivity, potentially increasing global GDP by $1.5 trillion by 2030. Enterprise administrators can enable the beta for their teams, aiming to boost productivity and facilitate rapid learning and development.

GitHub has introduced the Issue Metrics GitHub Action, a tool designed to help developers and teams track and analyze key metrics related to issues, pull requests, and discussions, thereby enhancing project management and collaboration. This tool is beneficial for various roles, including maintainers, first responders, OSPOs, and product development teams, by providing insights into response times, workload, and process efficiency. It integrates seamlessly into existing GitHub Actions workflows and offers customizable options to suit specific project needs. The Issue Metrics Action simplifies the process of collecting these metrics by automating data gathering, allowing teams to focus on continuous improvement and effective decision-making. With easy setup and extensive documentation, GitHub aims to empower users to optimize their development cycles and foster a positive user experience.

GitHub's first internal Design Conference, LGTM, explored the impact of creative AI and inclusive design on developer experiences, emphasizing the importance of putting customers at the center of innovation. The conference featured discussions on how AI can transform software development by fostering creativity and increasing efficiency while highlighting the need for accessibility and inclusion from the outset. Speakers like Sally Woellner and Tobias Ahlin discussed AI's potential to break creative barriers and adapt systems to individual users, while Christina Mallon and Ather Sharif noted the challenges of designing for a spectrum of abilities. The event also showcased GitHub's commitment to storytelling through its brand, with initiatives like the Octocat Universe and GitHub Copilot, demonstrating how brand evolution can enhance user engagement and joy. The conference included diverse sessions with insights from internal and external experts, further reinforcing GitHub's dedication to innovation and user-centric design.

GitHub has identified a social engineering campaign targeting the personal accounts of employees in technology firms, particularly those in blockchain, cryptocurrency, and online gambling sectors, with some links to cybersecurity. The campaign, attributed to a North Korean group known as Jade Sleet or TraderTraitor, involves creating fake or compromised personas on platforms like LinkedIn, Slack, and Telegram to invite targets to collaborate on GitHub repositories containing malicious npm package dependencies. These packages act as first-stage malware, leading to further malicious activity on victims' devices. GitHub has responded by suspending related npm and GitHub accounts, filing abuse reports with domain hosts, and advising potential targets to scrutinize dependencies, review their security logs, and take precautionary measures like resetting devices and changing passwords if they have been targeted.

Over a decade after Marc Andreessen's prediction that "software is eating the world," generative AI, particularly large language models (LLMs), is now transforming technology with unprecedented speed. These models, capable of outperforming humans in specific tasks, are accessible even to those without advanced machine learning expertise. GitHub's engagement with LLMs, illustrated through its GitHub Copilot tool, showcases how developers can leverage these models for various applications, including code completion. The article explains the fundamentals of LLMs, emphasizing their ability to predict text sequences based on extensive datasets, while also acknowledging limitations such as potential misinformation, known as "hallucinations." By discussing the intricacies of prompt engineering—crafting context-rich prompts to enhance model output—GitHub highlights how it has harnessed LLMs to improve Copilot's functionality. This process involves prioritizing relevant context during code completion, balancing speed and accuracy, and optimizing the generative model's responses to developer inputs.

The latest Spring Release Radar highlights several noteworthy open-source projects and their major updates, showcasing the vibrant contributions from the developer community. QuestDB 7.0 introduces a new storage engine and UI enhancements for real-time SQL analytics, while Microsoft Kiota 1.0 releases a lightweight client code generator for OpenAPI and REST, with C# and dotnet as stable languages. JSON Crack 3.0 enhances its visualization capabilities with added features like graph editing and cloud functions. Yachay AI 1.0, a natural language model, demonstrates its ability to predict geo-coordinates from text inputs, offering unique visualization outputs. Chat Analytics 1.0 provides a web-based app for consolidating chat exports into a single HTML file with interactive statistics. Zammad 6.0 updates its help desk software with new mobile views and Microsoft Teams integration. NUKE 7.0 focuses on refining build automation processes by splitting Nuke.Common into multiple packages. VineJS 1.0 emerges as a fast, type-safe validation library for Node.js applications. Ionic Framework 7.0 brings improvements in UI toolkit features for mobile app development, while LocalStack 2.0 enhances cloud service emulation for AWS and Lambda applications running locally. These developments illustrate the ongoing innovation and collaboration within the open-source community.

Over the past decade, cloud computing has significantly transformed the technology industry, leading to a shift from product-based to service-based models, fundamentally altering how engineering teams operate and interact with customers. This transition, further accelerated by AI and the rise of DevOps practices, has blurred the lines between development, testing, and operations, fostering a more integrated approach to software development. Developers now work with multiple programming languages and frameworks, utilize Infrastructure-as-Code (IaC), and focus on continuous integration and continuous delivery (CI/CD) to ensure frequent, safe releases that meet heightened consumer expectations for reliability and performance. This evolution emphasizes customer-focused development, requiring continuous feedback, innovation, and learning to maintain competitiveness and customer loyalty in a subscription-based service economy. Companies are encouraged to adopt automation, implement quality checks early in the development process, and promote a culture of collaboration and transparency to navigate this complex landscape effectively.

The July episode of The ReadME Podcast explores the complexities and evolving paradigms in the programming world, focusing on the rise of TypeScript and its implications for codebase complexity and maintenance as discussed by open-source maintainer Jordan Harband. GitHub Senior Editor Mike Melanson elaborates on the evolution of gradual typing in JavaScript, while Aaron Gustafson from Microsoft highlights AI's potential in enhancing internet accessibility. Additionally, Kingsley Mkpandiok emphasizes the value of non-code contributions in open-source projects, advocating for inclusivity and the importance of diverse skills in community success. The episode also features insights from Kelsey Hightower on Kubernetes and the balance between openness and control in open-source projects, underscoring the role of humor in transforming communities.

In June, GitHub encountered two performance incidents affecting its services. The first incident on June 7 lasted over two hours and was caused by a specific customer activity that led to throttled job processing, resulting in workflow delays and issues with pull requests. The problem was traced back to a large number of pushes to a repository with a particular data shape, which exhausted the worker pool. GitHub resolved the issue by temporarily disabling the source and implementing changes to improve detection and recovery times. The second incident on June 29, lasting 32 minutes, was due to a failover test that inadvertently caused a production outage in parts of North and South America. This test revealed a network configuration issue in the secondary Internet edge facility, which has since been corrected. GitHub is addressing configuration and failover testing gaps to enhance resilience and is committed to ensuring high availability, with improved testing to minimize customer impact.

GitHub is enhancing account security by introducing passkey authentication, a move aimed at reducing reliance on passwords, which are the root cause of over 80% of data breaches. Passkeys offer a secure, privacy-preserving, and user-friendly method for protecting accounts, building on traditional security keys by providing easier configuration and enhanced recoverability. Unlike traditional methods like SMS and email, passkeys are unique to each website, preventing user tracking across different sites and aligning with the vision of passwordless authentication. Users can enable passkeys through GitHub's 'Feature Preview' settings, allowing for seamless registration and upgrading of existing security keys. Passkeys support cross-device authentication, letting users sign in on desktops using a passkey on a phone or tablet, and they can be synced across devices depending on the provider, ensuring continued access even if a device is lost. This initiative reflects GitHub's commitment to improving security without compromising user experience, and it invites user feedback to further refine the system.

GitHub is collaborating with the open source community to influence the EU's Cyber Resilience Act (CRA), aiming to enhance the cybersecurity of digital products, including those containing open source software, by enforcing stringent requirements on vendors. However, concerns arise as the CRA, while exempting open source developed outside commercial activities, may inadvertently threaten open source sustainability by regulating projects receiving donations, those with corporate developers, and potentially disrupting coordinated vulnerability disclosure processes. The current legislative text could impose burdensome compliance obligations on open source projects if corporate employees contribute, possibly leading to reduced corporate involvement and innovation in open source. Additionally, the requirement for immediate vulnerability disclosure could undermine established practices that limit exposure of unpatched vulnerabilities. As the ITRE Committee prepares to vote on the CRA, GitHub urges stakeholders to engage with policymakers to ensure the final legislation effectively supports open source's unique development model and resilience.

GitHub's new merge queue feature is designed to enhance team efficiency by managing pull requests in a way that reduces branch traffic jams and accelerates merge velocity. This feature is available for teams in managed organizations with GitHub Enterprise Cloud and public repositories, allowing multiple developers to commit code without the frustration of code conflicts. The merge queue creates a temporary branch with the latest changes from the base branch and other pending pull requests, ensuring all required status checks pass before merging. This process reduces post-merge build failures, as experienced by GitHub's enterprise customer Block, and minimizes the on-call burden for engineers. Repository administrators can enable the merge queue by setting branch protection preferences, while engineers can add pull requests to the queue and monitor their status. The merge queue provides a streamlined workflow that enhances collaboration and productivity within teams by integrating these capabilities directly into GitHub's platform.

GitHub has enhanced its Projects feature by integrating it into the GitHub CLI, making project management faster and more powerful for developer teams. The "project" command is now generally available, allowing users to manage and collaborate on GitHub Projects directly from the command line. This integration includes subcommands for creating, copying, listing, and viewing projects, as well as managing project fields and items. Users must ensure they have the appropriate permissions with the project auth scope, which can be configured via the terminal. The CLI also supports JSON formatting for command output, enabling advanced scripting and automation capabilities. Furthermore, GitHub Actions can now be used to automate workflows involving project commands. The previous gh-projects extension has been archived, and users are encouraged to transition to the new CLI command for future enhancements.

GitHub facilitates compliance and traceability for software teams, especially in regulated industries, by centering around pull requests to manage and document changes. This approach aligns with various compliance standards like PCI/DSS and ISO 27001, which require rigorous change management processes. By using GitHub's features such as Issues, Projects, Actions, and Releases, teams can effectively track changes, approvals, and deployments, integrating compliance into their daily workflows without significant disruption. This system not only aids in troubleshooting and understanding business impacts but also reduces the time and cost of audits, as GitHub retains detailed records of changes and approvals. Moreover, GitHub's practices support the creation of standardized, automated, and traceable workflows that enhance transparency and audit readiness, thereby improving the developer experience while ensuring compliance.

GitHub is committed to enhancing accessibility for developers, including those with disabilities, by reworking its code search and code view features. The project aimed to address accessibility barriers that led some developers to prefer raw code over the code view. Key areas of focus included redesigning the code search and query builder, the file tree, and keyboard navigation. The GitHub team collaborated with accessibility experts to conduct external audits, perform design reviews, and engage in office hours to address complex issues like proper filtering for code search, accessible file trees, and keyboard navigation. Challenges such as managing focus after changing sort orders and announcing search results for screen reader users were tackled by ensuring focus returned to the dropdown after page reloads and deciding to read out the header with the number of search results. The tree navigation was improved by creating an open-source TreeView that simplifies navigating through code, while keyboard navigation enhancements involved using a hidden `<textarea>` for cursor support, which aligns with a syntax-highlighted layer to aid both screen reader and keyboard users. Despite improvements, GitHub acknowledges ongoing challenges in achieving full accessibility and commits to continuous iteration and refinement of its tools to support all developers.

The ReadME Project's Senior Editor, Mike Melanson, explores how developers navigate paradigm shifts in the tech industry, highlighting insights from developers Nyah Macklin, Damien Katz, and Justin Searls. Nyah discusses how the shift towards free software has democratized tech access, allowing engineers from low-income backgrounds to thrive, while Damien reflects on his transition from object-oriented to functional programming, underscoring the importance of flexibility. Justin shares his experience with the rise of Ajax and the decision to bypass React, advocating for a focus on solving challenging problems rather than chasing trends. The conversation reveals that adaptability and a strong foundation in core skills are crucial for developers to succeed as technologies evolve, emphasizing that while new tools and languages emerge, understanding their lifecycle and impact is key to effective adoption.

GitHub has achieved new security and privacy certifications, highlighting its commitment to data protection and compliance. The platform's Information Security and Privacy Management System (ISPMS) was assessed against ISO/IEC 27701:2019 and ISO/IEC 27018:2019 standards, focusing on privacy information management and cloud data protection. Additionally, GitHub attained the Level 2 STAR Certification in the Cloud Security Alliance's STAR Registry, building on its existing ISO/IEC 27001:2013 compliance. These certifications demonstrate GitHub's dedication to safeguarding personal information and maintaining strong privacy standards, supporting features like GitHub.com, GitHub Enterprise Cloud, GitHub Advanced Security, and GitHub Actions. Furthermore, GitHub is beginning the process to participate in the Trusted Information Security Assessment Exchange (TISAX) to better serve enterprise customers in the automotive industry. These efforts underscore GitHub's focus on evolving its privacy and security measures to meet international data protection standards.

GitHub Security Lab focuses on enhancing the security of open-source software, including tools like SELinux, which is a Mandatory Access Control (MAC) system integrated into the Linux kernel. SELinux, developed initially by the NSA, operates by assigning security contexts to processes and resources to control access and enhance system security. It contrasts with the more common Discretionary Access Control (DAC) by focusing on the sensitivity of resources rather than ownership. The blog introduces SELinux to developers and administrators, explaining its architecture, including key components like the Security Server and Access Vector Cache, and how it enforces security policies through type enforcement. It also provides practical insights into SELinux policy creation, management, and troubleshooting, highlighting tools and examples to help users navigate its complexities. SELinux's integration with the Linux Security Modules framework allows it to hook into the kernel and manage permissions, offering a robust security mechanism widely implemented in systems like Android and Red Hat.

Embarking on a platform migration to GitHub involves a strategic focus on enhancing developer experience (DevEx) to modernize the software development environment and drive business transformation. Improving DevEx is pivotal in empowering developers, fostering innovation, and achieving faster release cycles, which contribute to increased revenue growth. Challenges such as prolonged time to first commit, outdated wikis, and security vulnerabilities need addressing through measures like a centralized knowledge base, fostering innersource collaboration, prioritizing application security, and automating CI/CD processes. GitHub emphasizes the importance of integrating these practices to streamline workflows and enhance productivity, suggesting that a focus on DevEx can significantly impact the overall success of software development initiatives.