January 2024 Summaries

In its first year, the GitHub Fund, in collaboration with M12, reviewed over 350 open source startups, ultimately investing in 10 companies that align with their belief in the critical role of open source and developers in software innovation. The fund's investments span various domains, including developer tools, AI, security, and cloud-native infrastructure, highlighting startups like Bytewax, CodeSee, and ToolJet. The initiative aims to strengthen the open source ecosystem, proving its financial viability and fostering paradigm-shifting technologies. Notable activities from the year included helping companies benchmark projects, offering speaking opportunities at GitHub Universe, and forming strategic connections with GitHub and Microsoft. Looking forward, the fund plans to continue investing in 8-10 innovative startups, particularly those focused on AI, security, infrastructure, and DevOps, while encouraging open source companies to engage with them.

Ensuring up-to-date dependencies in repositories is essential for maintaining project quality and security, as outdated dependencies can lead to vulnerabilities and performance issues. Dependabot automates the updating process by creating pull requests for new versions, but its configuration per repository can lead to inconsistent management. To address this, GitHub's Open Source Program Office developed Evergreen, a GitHub Action that streamlines the deployment of Dependabot version updates across all repositories within an organization. Evergreen automates the setup and configuration of Dependabot, ensuring uniformity and allowing developers to focus on code quality without the burden of manual updates. By triggering Evergreen on a schedule or manually, organizations can achieve consistent dependency management, thereby enhancing the security and stability of their projects.

GitHub's Developer Experience (DX) team faced the challenge of enabling fast and reliable development cycles in a distributed microservice system, which led to the creation of "Hubber Codespace" (HCS). HCS allows developers to locally simulate the entire GitHub ecosystem by configuring their development containers, thereby enabling them to test code changes within an integrated environment. This approach circumvents the complexities of monorepos and disparate service dependencies by bringing the ecosystem to the developers. The team evaluated several orchestration solutions, ultimately choosing Docker-Compose for its minimal maintenance burden and efficiency. To enhance user experience, a custom Golang CLI was developed to simplify interactions with HCS. By facilitating integration testing directly from developers' preferred environments and providing easy access to the latest GitHub ecosystem version, HCS improves engineering efficiency and ensures code reliability. The initiative reflects GitHub's developer-first mindset and commitment to containerization, significantly enhancing the development loop for GitHub's internal teams.

Recent research highlights the significant impact of developer experience (DevEx) on productivity and innovation, providing concrete data to support the benefits traditionally touted by anecdotal evidence. Conducted in collaboration with the company DX, the study identifies key DevEx factors—flow state, cognitive load, and feedback loops—as crucial contributors to individual, team, and organizational success. Developers with time for deep work and engaging projects report higher productivity, while those experiencing reduced cognitive load due to better understanding and intuitive processes feel more innovative. Efficient feedback loops are linked to increased innovation and reduced technical debt. As such, companies like Adobe and Etsy have emphasized the importance of investing in DevEx to enhance developer satisfaction and business outcomes. The study offers a framework and data-driven insights to help business leaders advocate for and measure the impact of DevEx, underscoring its role as a strategic lever for profitability and innovation.

GitHub has launched a new guide to help nonprofits and social sector organizations adopt open source software, emphasizing its potential to enhance collaboration, efficiency, and cost-effectiveness while supporting the Sustainable Development Goals (SDGs). This initiative aims to leverage open source technology for social good, offering examples like identifying drug candidates for diseases in low-income countries and supporting human rights groups with demographic data. The guide, adapted from a training developed for the United Nations, provides resources on implementing, contributing to, and maintaining open source projects, as well as building engaged communities. GitHub is also offering free Team accounts for qualifying nonprofits, encouraging them to utilize open source software to amplify their impact.

GitHub Copilot, an AI-powered coding assistant, extends its utility beyond code generation to support various aspects of a developer's workflow. It offers features such as generating commit messages, writing pull request summaries, running terminal commands, and assisting with error message explanations. GitHub Copilot can also help with debugging CI/CD workflows, fixing code inline, and generating documentation across different programming languages. The tool is integrated into multiple environments, including VS Code, GitHub CLI, and GitHub.com, with some advanced features available exclusively to Copilot Enterprise users. As a versatile aid, GitHub Copilot enhances productivity by reducing friction in the development process, making it a valuable addition to any developer's toolkit.

Achieving a flow state, a concept introduced by psychologist Mihaly Csikszentmihalyi, can significantly enhance developers' productivity, creativity, and overall happiness by immersing them in their tasks and blocking out distractions. This state is characterized by nine dimensions, including total concentration, clear goals, and a sense of effortless control, leading to increased motivation and innovative solutions. Developers benefit from flow state through improved collaboration, faster and more secure code, and heightened creativity, which also positively impacts business success by allowing teams to focus on larger problems without being overwhelmed by complex technological environments. Tips for achieving flow include optimizing the work environment, mapping out tasks, and finding joy in the work, which can be facilitated by tools like GitHub Copilot that assist in overcoming mental hurdles. By fostering a flow state, developers not only boost their productivity and well-being but also cultivate a continuous learning mindset that enhances their intrinsic motivation and problem-solving abilities.

The GitHub Innovation Graph, an initiative providing quarterly data on various metrics such as Git pushes, repositories, and programming languages, serves as a resource for understanding global software development trends. The Q3 2023 release introduced new data visualization features like stacked area charts for economy collaborators, facilitating insights into cross-economy software collaborations, particularly in response to global events like the increased support for Ukraine following the 2022 Russian invasion. Significant developments in the open-source ecosystem were noted, including TypeScript surpassing Java as the third most popular language on GitHub and the emergence of new licenses like MIT-0, used by AWS, and the Mulan license, the first dual-language open source license approved by the Open Source Initiative. The platform encourages users to explore and provide feedback on the Innovation Graph, emphasizing its role in fostering a better understanding of the dynamic software ecosystem.

Game Bytes, a monthly series exploring the game development landscape on GitHub, highlights recent updates in game engines, game jams, open-source games, and more. Notable updates include the release of VVVVVV 2.4 with translations and enhancements, Hypersomnia's first launch on Steam, and Hyperrogue's major update introducing new gameplay mechanics. Daggerfall Unity has reached version 1.0, bringing the classic RPG to modern platforms with improvements and mod support. In the realm of game engines, Heaps.io 2.0 offers new features for game development, and W4 Games has raised significant funding to bolster the Godot Engine ecosystem. Additional highlights include the playful GodotOS interface, the updated LDtk level editor, and ScummVM 2.8.0's expanded game support, including its debut on the App Store. The section also touches on game jam events like the Global Game Jam and 7DRL Challenge and features Grapple Pack as the Game Jam Game of the Month, showcasing its platforming puzzles and polished design.

The August Insider newsletter provides valuable insights into maximizing the use of GitHub Mobile with features like Issue Composer and customizable shortcuts. Issue Composer allows users to create and manage issues, document bugs, propose features, and engage in discussions directly from their mobile devices, with the added convenience of the new Property Bar feature for easy metadata addition. GitHub Mobile's Shortcuts offer the flexibility to access important items such as issues, discussions, or pull requests directly from the app's homepage, with extensive customization options including filtering by organization or repository and sorting by various categories. These tools aim to enhance productivity by enabling developers to contribute and stay engaged with their projects anytime and anywhere, making them mobile power users.

In December, GitHub experienced three service degradation incidents linked to a broad secret rotation initiative. The incidents, occurring on December 27, 28, and 29, were due to issues with HMAC secret rotation, failed authentication updates, and credential mismatches respectively, affecting codespace creations, email notifications, and user sign-ins. Each incident prompted immediate mitigation actions and prompted improvements in key rotation playbooks, documentation updates, and monitoring systems to enhance future response and reduce availability risks. GitHub encourages users to follow its status page for real-time updates and consult its Engineering Blog for more insights.

As AI tools continue to advance and become more integrated into developers' workflows, the perceptions and expectations of developers are evolving. A study by GitHub Next surveyed 25 developers to understand their views on AI assistance, revealing a dichotomy in tasks: tedious, repetitive ones that developers are eager to automate, and complex, engaging ones that require cognitive effort. While developers are open to AI alleviating the cognitive burden of complex tasks, they stress the importance of maintaining control and oversight, ensuring AI serves as a supportive partner rather than an autonomous entity. The study highlights developers' desire for AI to assist in sense-making and planning, while they retain decision-making authority, particularly in implementation. The findings suggest that AI tools should be designed to enhance developers' understanding and learning, ultimately fostering a collaborative environment where developers can focus on higher-level systems thinking. These insights are shaping GitHub's development of Copilot Workspace, aimed at facilitating a balanced partnership between developers and AI.

GitHub has completed an upgrade to its GitHub Actions-hosted runners, now offering more powerful 4-vCPU machines with 16 GiB of memory for open source developers using public repositories. This enhancement provides up to a 25% performance increase for Continuous Integration/Continuous Deployment (CI/CD) workloads without requiring configuration changes, allowing faster feedback loops and reduced build times. Since its introduction in 2019, GitHub Actions has been free for public repositories and supports the open source community by providing hosted build servers and automation capabilities. The recent upgrade is expected to further benefit open source projects by giving them access to enhanced resources—doubling their previous specifications for v-CPUs, memory, and storage—at no cost. This initiative underscores GitHub's commitment to the open source community, highlighted by the platform's extensive marketplace with over 20,000 actions and apps that aid developers in optimizing their workflows.

GitHub addressed a security vulnerability reported on December 26, 2023, through its Bug Bounty Program, which could have allowed unauthorized access to credentials within a production container. The vulnerability was promptly fixed, and all potentially exposed credentials were rotated as a precaution, despite high confidence that the issue hadn't been exploited beyond the bug bounty researcher. This vulnerability also affected GitHub Enterprise Server (GHES), but exploitation required an authenticated organization owner role, making it difficult to exploit. A patch for affected GHES versions was released on January 16, 2024, and customers are advised to apply it promptly. Credential rotations led to some service disruptions between December 27 and 29, prompting GitHub to enhance its procedures to minimize future downtime. Additionally, GitHub rotated its GPG commit signing key and other encryption keys used in GitHub Actions, Codespaces, and Dependabot, necessitating changes for users who verify commits outside of GitHub or have cached old keys. Users are encouraged to import the new public keys and push any unverified commits created before January 16, 2024, to their repositories by January 23, 2024. GitHub acknowledged the contributions of security researcher Ngo Wei Lin and encouraged continued participation in its Bug Bounty Program.

Uruguay is experiencing a significant increase in tech development, evident through the growing number of developers and repositories on GitHub and the establishment of its first AI lab, the Microsoft AI Co-Innovation Lab, which is the only one of its kind in the Southern Hemisphere. GitHub launched the Git Commit Uruguay program in 2022 to promote equitable tech opportunities for high school students and recent graduates in underserved areas of Montevideo, focusing on AI skills and featuring training in Git commands, AI-powered projects, and GitHub Copilot. The program, which began with 60 students and expanded to 105 in its second year, underscores the potential of education and inclusivity in tech, with plans to secure internships for graduates and expand further. Participants gained insights from industry leaders like Elianne Elbaum and Alejandro Pazos, enhancing their readiness for careers in the evolving tech landscape, while the program's growth from three to seven institutions highlights its success and impact on students' futures.

The GitHub Game Off, themed "Scale," saw developers create an impressive 632 games within a month, showcasing a wide range of creativity and technical prowess. The competition featured diverse entries, from microscopic worlds to expansive galactic adventures, each interpreting the theme uniquely. Highlights included games like "Glory to SCALE," a dystopian narrative; "Arithmometer," a card-playing strategy game; and "Grapple Pack," an action-packed escape game. The event celebrated not only the game's artistic and narrative achievements but also the community's dedication and passion. Developers demonstrated remarkable ingenuity in crafting these virtual worlds, leaving a significant impact on the game development community. The Game Off exemplified the potential of collaborative creativity in open-source environments, with participants eagerly anticipating future opportunities to further push the boundaries of game development.

As a sponsor of Ekoparty 2023, GitHub contributed several challenges to the Capture The Flag (CTF) competition, focusing on GitHub and Git functionalities to educate the security community on common security issues. This year's "retro" theme set challenges in a fictional 1994 high school, OctoHigh, blending educational content with entertainment. The first challenge, "Entrypoint," involved steganography to locate a hidden flag, while the second, "Snarky Comments," and third, "Fork & Knife," addressed vulnerabilities in GitHub Actions workflow, specifically code injection and the use of "pull_request_target." The fourth and fifth challenges, "Git #1" and "Git #2," focused on Git repository mechanics and forensics, requiring players to identify differences and retrieve removed tags within Git repositories. These challenges aimed to enhance participants' understanding of security in a fun and engaging manner, aligning with GitHub's commitment to improving security awareness within the community.

Certifications are positioned as vital tools for career advancement, providing individuals with opportunities to enhance their skills and boost their productivity and salary potential, while also serving as a proof of competence for employers. GitHub has expanded its certification program, previously limited to employees and partners, to all customers globally, offering a range of certifications such as GitHub Foundations, GitHub Actions, GitHub Advanced Security, and GitHub Administration. These certifications cover fundamental GitHub concepts, automation of software development workflows, advanced security for enterprise-level code, and maintaining a secure GitHub environment, respectively. Each certification path is supported by detailed study guides, and successful candidates receive verified credentials through Credly. The program aims to empower individuals to become GitHub experts and enhance their professional capabilities.

Introducing a new security tool to developers can be challenging due to competing priorities and cultural differences, but it is essential as security becomes a foundational responsibility for developers. Successful implementation requires comprehensive internal documentation, clear goal-setting, recognition of success, and seamless integration into existing workflows. Strategies such as creating a supportive wiki, involving executive leadership, and hosting engaging events like hackathons can foster a security culture. It is crucial to involve cross-functional teams and enable developer-to-developer learning, ensuring the tool becomes part of normal processes rather than additional work. By focusing on these approaches, companies can organically grow a team of security champions and integrate security into the developer workflow, promoting the idea that security is a shared responsibility.

DevSecOps is an approach in software development that integrates security into the software development lifecycle (SDLC) from the outset, ensuring vulnerabilities are addressed early on rather than post-release, thereby reducing risk and minimizing remediation costs. Despite its benefits, developers often find DevSecOps challenging due to fragmented tool integration and added responsibilities, which can lead to complexity and development delays. Improving the developer experience in DevSecOps is crucial, with strategies including involving developers in security decisions, adapting security features to their environment, maintaining trust through effective alert systems, and utilizing AI and automation to streamline vulnerability detection and remediation. By fostering clear expectations and communication through security champions, organizations can enhance collaboration between engineering and security teams, leading to the faster delivery of secure software. The importance of making security tools more usable for developers and continuously improving DevSecOps practices was a focus at GitHub Universe 2023, with discussions emphasizing the integration of AI and the importance of creating a seamless developer experience.

GitHub has announced a strategic shift in its software development kits (SDKs) by introducing two new generated SDKs in Go and .NET, marking a departure from the traditional Octokit. This transformation, facilitated by Microsoft's Kiota, a tool that generates SDKs from OpenAPI definitions, aims to provide more dynamic and flexible tools for developers. The choice of Kiota aligns with GitHub's goal to embrace modern technology that offers immediate updates and introduces new features to the SDK landscape. The Go and .NET SDKs reflect GitHub's commitment to serving a diverse developer community, leveraging Go's efficiency and scalability alongside .NET's versatility. This initiative is not just about code generation but rather about unlocking new possibilities for developers, focusing on removing usability barriers and empowering them to create innovative solutions on the GitHub platform. GitHub invites community participation to contribute insights and feedback to shape the future of its SDK offerings.