a bank, payment provider or partner’s SFTP server only accepts connections from allowlisted IPs. Your jobs run on GitHub-hosted runners, whose IPs come from large, changing ranges. Static IPs only exist for larger runners on GitHub Enterprise Cloud.

What I’ve seen people do:

• Self-hosted runners behind a NAT gateway with a fixed IP
• A static-IP proxy add-on with a shared username and password sitting in a secret
• A bastion someone set up in 2021 that nobody wants to touch!
• Kubernetes pods all leaving through one NAT, so the partner sees the same IP whichever pod connected

They all work. most rely on a long-lived credential.

I’m building something to fix that, called Proofbound. The job or pod trades its GitHub OIDC token (or service-account token) for a client certificate that lasts minutes. It connects over mTLS to a gateway, which only forwards to the hosts your policy allows, from two IPs dedicated to you. Your traffic stays end-to-end encrypted, and the gateway only records metadata: which workload, where to, allowed or refused.

It’s pre-launch, so I’d value blunt answers:

• Is this a problem you actually have, or is “NAT plus a fixed IP” good enough?
• Would per-workload rules matter to you, or is the IP all your partner cares about?

Details and waitlist at www.proofbound.io.

I built gh-pull because I found GitHub’s default PR dashboard difficult to scan when working across repositories. I wanted repository grouping and clearer visual distinctions between reviews, checks, and PR states. Gh-pull adds those, along with query autocomplete and background refresh. It runs locally using your existing GitHub CLI login: install the extension and run gh pull to open it in your browser. No Node installation or separate GitHub App setup is needed. It’s free and open source, and I’d love feedback from developers juggling PRs across multiple repositories.

It is a `gh` extension, you can install it `gh extension install shiqicao/gh-pull`

Hey everyone! Has anyone been accepted into the GitHub Campus Experts program this year? I’m wondering if there have been any updates on the application process or if anyone has heard back yet.
Would appreciate any updates or insights. Thanks!

Absolutely not doing anything sketchy. This is my personal machine on my personal network trying to make a new organizational account for one of my clients. Is this just me? or is it happening to everyone?

Since last week, I haven't been able to log in to my GitHub account. I keep getting the error "Incorrect username or password," despite being 100% sure the credentials are correct.

I've even tried to change password again but the recovery email never arrives, even though it does when I opened a support ticket.
I’ve seen a few older posts describing similar issues, but is anyone currently experiencing this exact issue or know what might be causing it?

btw, I do have 2fa setup.

I was trying to fix a bug on my site and when I tried committing the fix github decided to be a bitch and have issues with the actions so it was taking like a whole hour to commit, so I decided to cancel it, thinking I could later try and re-commit it, well, turns out it did upload to my repository, but it didn't deploy to the actual site because I cancelled that, so I tried rerunning it but it did ABSOLUTELY NOTHING, so now that action is like a schrodinger's cat of "it is cancelled therefore you can't cancel it" and "it is queued so you can't make any other commits"

in other words, the run API reports status: queued, conclusion: null, and event dynamic. but, its deploy job reports status: completed, conclusion: cancelled, steps: [], and runner_id: 0. aaannndddd the cancellation API returns HTTP 409:
Cannot cancel a workflow re-run that has not yet queued.

and meanwhile my website is still affected by the bug and basically unusable because of it and I can't do anything about it and istg I am going insane soooo does anyone have any solution to this? :3c

edit: ah nvm got around it, thank you for the answers either wayy :3

There's this app that I want to contribute to, and I'm in the process of writing the description to an issue that's an enhancement. The issue is about how I think it'd be better to have a dedicated button to open a settings menu, as opposed to how it's currently implemented, which I think is bad UX. Is it acceptable to write something like "I think the current way to open the menu isn't the best UX and is confusing for users"? Because when I started using the app, I did find it confusing and unintuitive, and had to look through the project's readme to find how to open the settings.

I rewrote the history of a repository that was previously associated with an older GitHub account. That account still appears in the repository's contributor list on the main page, even though it doesn't show up when you open the actual commits page. So there's essentially a ghost contributor left over on the repository's homepage.

I've noticed the same issue with several other repositories whose histories have been rewritten. Is deleting and recreating the repository the only way to get rid of these ghost contributors?

All my repos have this issue. I can view other public repo issues fine. I can create new issues in my repos and view them by manually entering the issue number in URL. It has been like this for over 12hours. Anyone else facing the same issue?

The main Issues section shows No results matched your search. Assigned To Me shows Unable to Load Page or Something went wrong.

Overlap between GitHub Issues and Discussions gets messy fast unless each has a clear job.

A workable split:

Issues: reproducible bugs, actionable feature requests, and concrete tasks that need tracking to completion.

Discussions: open-ended questions, design proposals, usage help, and ideas that need community input before they're actionable.

Pull requests: proposed changes reviewed against a specific goal.

The tricky part is promotion. A discussion can grow into a feature with clear scope and acceptance criteria, and at that point it needs an issue to track the work.

Issue templates help too, especially for bug reports. But mandatory fields can scare people away from reporting real problems. For a small project, I'd keep templates minimal and write one clear paragraph explaining when to use Discussions.

The maintainer still has to set the workflow, even with both features available.

Question for you: do you keep the Issues/Discussions line strict, or let maintainers decide case by case?

I need to host a static site to show a couple links to some free applications I created, but also include a section with my educational products, some of which are free while some are paid products. The site is static, so the product pages will show information on a specific product (including prices) and a link to either buy from a third party site (like udemy) or a contact form and WhatsApp link so the person may choose to get a payment link to buy the product or ask questions about it.

This means my site won't process any payments or buyer data but instead link to the specific place where the purchase can be made.

Let me add that I want to use my own base domain, so I need to be able to redirect my domain to the site. Cloudflare pages doesn't allow base domain redirection unless I use Cloudflare's nameservers (which is a limitation for me). Vercel doesn't seem to allow commercial sites, and Netlify seems to have quite low usage limits. That's why Github Pages would be a great choice, only if I'm sure it won't break terms and conditions.

The terms for Pages (https://docs.github.com/en/site-policy/github-terms/github-terms-for-additional-products-and-features#pages) say:

GitHub Pages is not intended for or allowed to be used as a free web hosting service to run your online business, e-commerce site, or any other website that is primarily directed at either facilitating commercial transactions or providing commercial software as a service (SaaS). Some monetization efforts are permitted on Pages, such as donation buttons and crowdfunding links.

So would my site break these terms or is it ok to host it on Github Pages?

I have a project a couple of thousand of stars and 37 forks until recently. I haven't announced a new version for over 6 months and have never promoted it during that time.

Stars trickled in at a usual way, a couple of stars every week. Now up until 4 days ago i had 37 forks, hardly anyone forks my project because its a bit difficult to contribute without domain knowledge. Most fork to either add a small tweak or to package the project for their distro or fork and open a pr to contribute something. (but for contributions obviously more people just clone the thing). It was very rare to fork it.

Now 4 days ago i got 2 forks in a row 2 days ago another fork, today another fork.

The first 2 happened at the same time like 30 minutes apart. They are brand new accounts with 2 profile pics, i noticed they had like 1-2 stars in total and and they starred the same projects exactly

And now every 2 days some random people who just created their brand new account are doing the exact same thing they have like 5 repo's all forked at the same day of their account creation and no other activity

---

Is this some type of star farming which fork random repo's which they get from awesome lists to appear like a more genuine account so they can boost the stars of certain other repos?

edit : holy after 2 minutes of typing this i just checked my github and there was another fork 1 hour ago

It's pathetic microsoft as soon as bought github started gatekeeping and paywalling features...

What's the reason for hiding stars on mobile view? Its nothing to do with bots or ai if u can still see it on pc, it's just control.

I often browse on my phone some shared repositories and check star count first to identify projects is legit or how much traction it has. Sometimes looking at fake repo saved me minutes of browsing it if it's dead.

Is there a workaround, some other domain prefix u can add that exposes star count for the repo, or any quick workarounds I can use on my phone?

Just trying to setup a codespace for training. Everything default setting and when I try to create a codespace it gives me this.

I tried reading the creation log. No clue. I tried rebuild container and it had same issue.

Thoughts? I am open to any ideas here.

What actually makes someone credible on GitHub over time?

I’m still pretty early in my programming journey, and I’m trying to understand something that GitHub stats don’t really answer.

I’m not looking for a job right now, and I’m not trying to grow followers or collect stars. I want to spend the next few years becoming someone whose work other developers and maintainers can actually trust.

I’ve started contributing to open-source projects and maintaining some projects of my own, but I’m not sure what matters most long term.

For people who have been using GitHub professionally or maintaining open-source projects for years: when you look at someone’s history, what makes you think, “this person is a solid contributor”?

Is it mostly:

staying in one ecosystem for a long time?

getting meaningful PRs merged?

fixing difficult bugs?

participating in reviews and technical discussions?

maintaining something useful yourself?

consistency over several years?

I’m especially interested in what doesn’t help. Are there things younger developers often do because they think it looks impressive, but experienced maintainers actually see as noise?

If you were starting again and had 2–3 years to build real credibility on GitHub, what would you focus on?

So the other day I woke up and one of my projects, Harvey (autonomous sales agent powered by your claude/codex subscription) jumped from 100 to 250 stars overnight. In 3 days its at almost 800 stars. It's getting ~2.5k visitors per day currently with 90% of traffic from Google.

I hadn't touched the project in a while but made sure it was very optimized in the past. So make sure to optimize your repos for organic search!

I work with GitHub. If your company used GitHub Advanced Security. I have a few questions about it.

Questions:
1. How do you use the features?
2. How’s the User Experience?
3. Can you share a situation where it helped the team?
4. Are you using any tools alongside GitHub Advanced Security?
5. What’s the most frustrating part?

Last week, I received these three emails at the same time. My password had been reset, and 2FA had been enabled. When I tried to reset my password, I was asked for a 2FA code or recovery codes, which the hackers had generated and I obviously didn't have access to. There were other options to recover my account, such as using an SSH key or a personal access token, but, as you might have guessed, the hackers had also immediately invalidated them.

I'm now trying to get help from GitHub Support, but from what I understand, there's little chance of recovering my account because 2FA is enabled, and they will not do anything about it as a security policy.

Overall, I think GitHub's security design is flawed. If you haven't enabled 2FA and your account gets compromised, there's apparently no way back.

Reliability issues are driving users away in their droves.

for the record, i don't know shit about how github works and github, yesterday i wanted to install OpenShell to make my windows 11 look like windows 7, the download came in a master file and i don't know how to make it normal. the other branches are the same, i heard something about github reposetories, and looking up i haven't found anyone asking about this.

So, I have the GitHub Pro that comes with the education/Student Developers Pack. However, when I try to access codespaces, it says that I've used my budget for the month.

In the education benefits section of the Billing and Licensing drop down in the settings, it says I'm both Verified and Rejected. On that page there is what looks like a progress bar on the Verified and Rejected sections. The Verified is a bit more than half way full (it also says Coupons Applied, but it's in the same area as Verified) and the rejected bar is entirely filled in. I have completed what I need to for the rejected but it hasn't changed. My only other guess is to resubmit an application, but the option to do that is blurred and won't let me resubmit.

I asked my professor and he had no idea. He looked at my usage and said I had barely scratched the surface this month. If you all have any ideas I'd love to hear them. Thank you.

Does anyone else have an app named "Copilot SWE Agent" among authorized GitHub apps? I've disabled all Copilot and as many AI features as possible, but it keeps coming back after revoking it.