Let’s talk about securing open source projects
In celebrating GitHub Security Lab’s one-year anniversary, we explained that we’re expanding our research focus. Why did we make this decision? The decision stemmed from our work with the Open…
Git clone: a data-driven study on cloning behaviors
@derrickstolee recently discussed several different git clone options, but how do those options actually affect your Git performance? Which option is fastest for your client experience? Which option is fastest for your build machines?…
Get up to speed with partial clone and shallow clone
As your Git repositories grow, it becomes harder and harder for new developers to clone and start working on them. Git is designed as a distributed version control system. This means that…
GitHub joins amicus brief warning of systemic risk from private sector offensive actors
Today, GitHub joined an amicus brief in NSO v. WhatsApp, opposing the expansion of foreign sovereign immunity to private cyber-surveillance companies that act on behalf of foreign governments. GitHub joined…
Visualizing GitHub’s global community
This is the second post in a series about how we built our new homepage. How our globe is built How we collect and use the data behind the globe…
How we built the GitHub globe
GitHub is where the world builds software. More than 56 million developers around the world build and work together on GitHub. With our new homepage, we wanted to show how…
How to make DevOps your competitive advantage
2020 has been a year of change, with shifts to the way organizations of every size connect, collaborate, and build together. From our 2020 State of the Octoverse report to…
Learn about ghapi, a new third-party Python client for the GitHub API
Learn about ghapi, a third-party Python library and CLI client for the GitHub API. It includes tab-completion, integrated documentation and automatic pagination of responses. ghapi automatically manages required headers, query strings, route parameters, post data, and much more.
Happy anniversary GitHub Security Lab!
Last year at GitHub Universe, we introduced the GitHub Security Lab, which is committed to contributing resources, tooling, bounties, and security research to secure the open source ecosystem. We know…
Shifting supply chain security left with dependency review
Dependency review allows you to easily understand your dependencies before you introduce them to your environment. As part of a pull request, you can see what dependencies you’re introducing, changing, or removing, and information about their vulnerabilities, age, usage, and license.
Commits are snapshots, not diffs
Git has a reputation for being confusing. Users stumble over terminology and phrasing that misguides their expectations. This is most apparent in commands that “rewrite history” such as git cherry-pick or git rebase. In my experience,…
No cookie for you
The developer community remains the heart of GitHub, and we’re committed to respecting the privacy of developers using our product.
Reducing flaky builds by 18x
Part of the Building GitHub blog series. It’s four o’clock in the afternoon as you push the last tweak to your branch. Your teammate already reviewed and approved your pull request…
Token authentication requirements for Git operations
In July 2020, we announced our intent to require the use of token-based authentication (for example, a personal access, OAuth, or GitHub App installation token) for all authenticated Git operations.…
Powerful updates to temporary interaction limits
Temporary interaction limits have new, powerful, and flexible updates. You can now enable interaction limits for up to six months. In addition, you can limit interactions across all your personal…
Encapsulating Ruby on Rails views
Learn more about how we are bringing encapsulation to our views as we scale to over 4,500 templates in our Ruby on Rails monolith.
Inspired by Open Source: Balanced Employee Intellectual Property Agreement 2.0
GitHub is on a mission to accelerate human progress through developer collaboration. We do that by empowering our own employees to use their creativity to learn, play, and build great…
Introducing the new Campus Advisors program
GitHub Campus Advisors are teachers who are enthusiastic about teaching with Git and GitHub. Whether or not they come from a technical background, they’re deeply passionate about technology and sharing…
Introducing the New (and Improved!) Campus Experts Program
What we look for from applicants, plus an overview of how the application process works.
GitHub in the enterprise
During the last year alone, over 56 million developers created more than 60 million new repos and made more than 1.9 billion contributions on GitHub. These developers are building the…
Building together: GitHub partner ecosystem continues to grow
We detail the great momentum we’ve had with our partners at GitHub this past year, building a healthy ecosystem aimed at making our users more productive.
New from Universe 2020: Dark mode, GitHub Sponsors for companies, and more
Check out the latest announcements from GitHub Universe 2020, including dark mode, Sponsors for companies, improvements to Actions, dependency review, and more.
Now you C me, now you don’t, part two: exploiting the in-between
Aimed at developers, in this series we introduce and explore the memory unsafe attack surface of interpreted languages.
Release Radar
We’re here to bring you the latest and greatest releases for December 2020. These are exciting new releases from some of the coolest projects around. There’s everything from world-changing tech…
Your DevOps guide to GitHub Universe
GitHub Universe is almost here. For more on what to expect from this year’s stream, we sat down with virtual host, Brian Douglas, for a quick Q&A on GitHub Actions,…
Applying DevSecOps to your software supply chain
To best apply DevSecOps principles to improve the security of your supply chain, you should ask your developers to declare your dependencies in code; and in turn provide your developers with maintained ‘golden’ artifacts and automated downstream actions so they can focus on code.
The evolving role of operations in DevOps
GitHub’s team delves into answering the question “what are operations roles in the development and operations (DevOps) environments”. From automating the role of QA in DevOps and more for smaller, faster delivery cycles.
Improving the GHES release process: release candidates
In our ongoing “Building GitHub” series, we talk about some of the projects we’re working on to improve how efficiently we build GitHub, as well as increase GitHub’s availability, stability,…
Join our panel with WHO at GitHub Universe 2020!
The year 2020 has upended nearly every aspect of society. In a panel for GitHub Satellite back in May, we briefly covered some of the ways in which our social…
GitHub Availability Report: November 2020
Introduction In November, we experienced two incidents resulting in significant impact and degraded state of availability for issues, pull requests, and GitHub Actions services. November 2 12:00 UTC (lasting 32…
The State of the Octoverse 2020
Change is inevitable, and this year, it has been inescapable. We’ve had to find new ways to relate, learn, and balance both work and life at home. One thing has…
The ReadME Project shares innovative paths to DevOps success
GitHub has the privilege of partnering with thousands of organizations to improve their DevOps practices, from established enterprises transforming the way they work to born-in-the-cloud businesses. We often connect developers,…
Nbdev: A literate programming environment that democratizes software engineering best practices
Learn about nbdev, a new literate programming environment for Python.
Whatcha watchin’? Custom notification controls
Earlier this year, we upgraded the notifications experience on GitHub, focusing on filters that get you straight to the updates that matter most to you. Just last week, we shipped…
Take action: DMCA anti-circumvention and developer innovation
The Digital Millennium Copyright Act (DMCA) is a 22-year old United States law meant to strike a complicated balance between art, code, and speech on the net — impacting users…
Securing the fight against COVID-19 through open source
This blog describes a security vulnerability in the infrastructure that supports Germany’s COVID-19 contact tracing efforts. The mobile (Android/iOS) apps are not affected by the vulnerability and do not collect and/or transmit any personal data other than the device’s IP address. The infrastructure takes active measures to disassociate true positives from client IP addresses.
GitHub Archive Program: Making the archives beautiful
The GitHub Archive Program announces its latest milestone: storing collections of the most popular and depended upon open source repositories in beautiful art cases featuring 3D-printed and AI-generated artwork in significant libraries around the world.
Introducing split diffs in GitHub Desktop
The latest version of GitHub Desktop includes split diffs, PRs with Actions status, more control over stashing, and discarding changes from files.
Updates to our Terms of Service and Privacy Statement now merged
As part of GitHub’s commitment to developers, we open source the policies that govern our platform and welcome feedback at any time in our site-policy repository. When we make material…
Release Radar
We’re here to bring you the latest and greatest releases for November 2020. These are exciting new releases from some of the coolest projects around. There’s everything from world-changing tech…
Standing up for developers: youtube-dl is back
Today we reinstated youtube-dl, a popular project on GitHub, after we received additional information about the project that enabled us to reverse a Digital Millennium Copyright Act (DMCA) takedown.
Veterans Day spotlight: Finding careers and camaraderie through code
Today in America, it’s Veterans Day, a federal holiday to honor those who have served in the U.S. Armed Forces. As a veteran myself, I know that honoring veterans is…
How to get root on Ubuntu 20.04 by pretending nobody’s /home
Ubuntu 20.04 local privilege escalation using vulnerabilities in gdm3 and accountsservice (CVE-2020-16125, CVE-2020-16126, CVE-2020-16127)
GitHub Availability Report: October 2020
In October, we experienced one incident resulting in significant impact and degraded state of availability for multiple services.
Commit your vote on election day!
Closing that priority issue you’re working on can wait—put down your keyboard and vote! Millions of you already have, and your vote in national and local elections may just impact…
GitHub Game Off 2020 theme announcement
The theme for this year’s Game Off is MOONSHOT. moonshot – noun an extremely ambitious and innovative project the act of launching a spacecraft to the moon a hit or…
13 ghoulish games to play, hack and slash this weekend 👻
WARNING: This post contains zombies, werewolves, extra dimensional beings, mummies, and more! Proceed at your own risk. Trick or treat yourself to some fangtastic Halloween-themed games this weekend. These were…
GitHub Action Hero: Eyal Posener and “Go Action”
GitHub Actions gives you the power to automate your workflow. Connect with the tools you know and love. Have more freedom to innovate and be creative. Deploy to any cloud,…
Getting started with DevOps automation
This is the second post in our series on DevOps fundamentals. For a guide to what DevOps is and answers to common DevOps myths check out part one. What role…
Making GitHub CI workflow 3x faster
Using deferred compliance in GitHub’s CI process to improve developer productivity.
Building GitHub: introduction
An introduction to our blog series on GitHub’s investments in technical excellence.
Build a game this November with GitHub Game Off
Game Off, our annual game jam (a hackathon for building games) returns this weekend. Participants will be given a secret theme on November 1 and will have the entire month…
2020 GitHub Universe Micro-Mentoring Application
We’re thrilled to announce an opportunity to connect with employees at GitHub during GitHub Universe. This year, Universe will take place virtually December 8-10 and we’d love to “see” you…
Code Scanning a GitHub Repository using GitHub Advanced Security within an Azure DevOps Pipeline
In this blog post we demonstrate how to integrate the GitHub Advanced Security code scanning capability into our Azure DevOps Pipelines. We provide code snippets and examples that can guide you or your developers working to integrate Code Scanning into any 3rd Party CI tool.
Exploiting a textbook use-after-free security vulnerability in Chrome
In this post I’ll give details about how to exploit CVE-2020-6449, a use-after-free (UAF) in the WebAudio module of Chrome that I discovered in March 2020. I’ll give an outline of the general strategy to exploit this type of UAF to achieve a sandboxed RCE in Chrome by a single click (and perhaps a 2 minute wait) on a malicious website.
DevOps best practices Q&A: Automated deployments at GitHub
How GitHub measures and improves reliability, security, and developer happiness with automated deployments.
Vote, and contribute to democracy through open source
November 3 is election day in the U.S. Early voting is available in most states. If you haven’t yet, make a plan to vote. If you’re an employer in the…
Introducing the npm public roadmap and a new feedback process
npm is the world’s largest package registry, powering the world’s largest development community—JavaScript. Without them, npm would not be where it is today, and we know that maintaining open lines…
Hacktoberfest e GitHub ¡Presente!: celebrando comunidades open source em outubro
Outubro é um mês especial no mundo do desenvolvimento de software. Há 7 anos a Hacktoberfest — um festival que celebra a comunidade open source — incentiva pessoas desenvolvedoras a…
Diversity, inclusion, and belonging at GitHub in 2020
Like our global community, we’ve had a year of challenges and extremes at GitHub, and I’m grateful everyday for our culture as our foundation of strength and resilience. We started…
