Engineering governance at GitHub scale

GitHub now serves more than 100 million users, and 90% of the Fortune 100 relies on the platform. Sustaining that kind of reach while continuing to ship new products pushed the engineering organization to formalize how it manages technical debt, reliability, and observability. The result is the Fundamentals program, a cross-functional governance effort built around three pillars: Accessibility (A11Y), Security, and Availability.

The program depends on culture as much as process. It blends grassroots participation from individual teams with consistent sponsorship from engineering leadership, and it invests in tooling that reduces manual overhead. The underlying assumption is simple: anything done more than once should be automated as much as possible.

How progress is measured

Fundamental Scorecards are the measurement backbone. Each scorecard tracks how well a service or feature meets a defined standard, and every scorecard maps to one of the three pillars. For instance, the secret scanning scorecard supports Security, while Durable Ownership supports Availability. The scorecards are iteratively updated to reflect evolving customer needs, and some are expected to mature into concrete technical controls where a deviation could trigger incident response or even an automated deployment freeze.

Every service maintains a YAML file in its repository that records service tier (0 through 3, based on business criticality), quality of service classification, service type, and ownership details like sponsor, team name, and contact information. The scorecards read these files to determine which services to monitor. If a service fails a scorecard requirement, an action item is generated with an SLA, and a corresponding issue is automatically created in that service’s repository. This keeps remediation work directly in the developer workflow, so engineers don’t have to chase down separate tracking systems.

Several scorecards are currently active across the organization:

  • Durable ownership: ensures each software asset has defined owners and communication channels. Supports Availability and Security.
  • Code scanning: uses CodeQL to detect security vulnerabilities during development. Supports Security.
  • Secret scanning: tracks secrets in GitHub’s own repositories to mitigate risk. Supports Security.
  • Incident readiness: configures services to alert owners, determine incident cause, and support on-call engineers. Supports Availability.
  • Accessibility: enforces accessibility standards so developers with disabilities can build on GitHub.

An example secret scanning scorecard showing 100% compliance for having no secrets in the repository, push protection enabled, and secret scanning turned on.
Example secret scanning scorecard

Building accountability into the workflow

Fundamentals work exists alongside regular product shipping, not instead of it. The program makes sure fundamental goals are included in strategic plans, with resources allocated each quarter and weekly check-ins to track progress and clear roadblocks. Risks are surfaced to leaders before they become full incidents, support is available to teams mitigating action items, and requirements apply consistently to every service regardless of team size or structure.

A structured set of roles keeps the governance machinery running:

  1. Executive sponsor: a senior leader who provides resources, guidance, and strategic direction.
  2. Pillar sponsor: an engineering leader who oversees the overarching focus of a given pillar across the organization.
  3. Directly responsible individual (DRI): collaborates organization-wide to make decisions, set focus, and establish program tempo.
  4. Scorecard champion: maintains a specific scorecard by adding, updating, and deprecating its requirements.
  5. Service sponsor: accountable for the health of the teams and services they oversee.
  6. Fundamentals delegate: coordinates Fundamentals work with service owners, supporting sponsors and helping to prioritize committed work.

Making the results visible

A dedicated Fundamentals dashboard surfaces all services with unmet scorecards, sorted by service tier and type and filterable by service owners and teams. This gives engineering leaders and delegates a clear operational view of where action is needed.

The measurable outcomes so far include:

  • Durable ownership compliance across services, with each one required to have an executive sponsor, a named team, and a communication channel on Slack.
  • Resolution of active secret scanning alerts in repositories associated with services in the GitHub organization — some of those repositories were 15 years old and are now durably owned.
  • Incident readiness standards for business-critical services that are continuously tightened as customer needs evolve.
  • Audited and accurately updated service tiers, ensuring critical services are held to the highest standards.

Tier 1 Services Out of Compliance [Count: 2]
Service Name Service Tier Unmet Scorecard Exec Sponsor Team
service_a 1 incident-readiness john_doe github/team_a
service_x 1 code-scanning jane_doe github/team_x

Continuous improvement as a long-term commitment

The Fundamentals program achieves sustainable results by defining expectations and then embedding the work to meet them in regular engineering culture. Organizational priorities are set at every level, and the entire workforce stays involved in the monitoring process. Publicly recognizing wins — even small ones — reinforces momentum, and the emphasis on collaboration over enforcement has been key to keeping an organization-wide governance effort running effectively. For users, the goal is a platform that predictably remains available, secure, and accessible as their requirements grow.