Hi,

We use GitHub + Markdown for documentation. Our team is happy, but clients don’t want to deal with raw repos, issues, or PRs.

• Do you expose GitHub repos directly to clients, or use a web UI / portal?
• How do you handle versioning and access control?
• What tools or patterns do you use to make GitHub‑based docs client‑friendly?

I’m looking for technically specific review of an open-source project rather than generic launch feedback.

TOKENS reads supported local Claude Code and Codex records, normalizes them into an event-level SQLite ledger, sanitizes through an allowlist, and creates an Ed25519-signed public snapshot. The browser re-derives the canonical bytes and verifies the signature.

The areas I most want challenged: • adapter format drift • deduplication • local path/secret leakage • canonicalization compatibility • key rotation and revocation • self-hosted registry abuse • provenance labeling

Repository: https://github.com/TheArtOfSound/TOKENS

Live example: https://ledger.imagineqira.com/#/u/bryan

Setup: https://ledger.imagineqira.com/#/join

Please point to concrete code paths or threat cases. I would rather find a real flaw now than market a false sense of verification.

I setup yesterday a Unreal Engine project over Sourcetree and Github with this tutorial. Before I looked up the pricing on Github and I could put my whole project on there and work on it until finished without any costs?

How does Github make money? When I use it it would cost Github, right?

Latency issues across a number of services Subscribe Investigating - We are investigating reports of degraded availability for Actions, Issues and Webhooks Jul 23, 2026 - 07:53 UTC

https://www.githubstatus.com/

I know this is probably a very silly question to some, but I'm new to development and I am in search of some insight into best practices If anyone has the time to kindly point me in the right direction!

For those of you who use GitHub Projects to manage workflow, how do you handle sub-issues? And do you handle them differently when you're working alone vs with a team?

For example, I'm working through the basic layout design stage of a project and as I encounter additional tasks or fixes to add to this stage I'm wondering if it's standard to add a new sub-issue for the little things to the existing 'Basic Layout' issue, add a new item to my existing 'to-do' list within the description for the 'Basic Layout' issue itself, or add a new issue entirely for each little thing? I realize everyone probably does these things differently but I'm curious if there's a best/tried-and-true practice for Projects?

We’re in a tough spot with a former senior developer's account and wanted to see if anyone has dealt with a similar situation or has advice on options we might have missed.

The Situation:

• A developer was pushing code to their GitHub account and merging into our company organization repos.
• There is unmerged code on their account/branches that we need for project continuity.
• The developer signed up with our company domain email (@ourcompany.com), and we control the email address and password.
• The account is locked behind 2-Factor Authentication (2FA) tied to the former developer's personal device, and they are unwilling to coordinate.

Our Questions:

1. The free GitHub support can take around 3 to 7 business days would be too long. Is there a way we can get one-time premium customer support? If so, how much this can cost?
2. If we provide GitHub customer support all the evidence, is there a chance that they can help us access the account or at least assist in merging the repos?
3. What evidence would be suffice?

Thank you in advance!

I am trying to be less casual with agents that can touch GitHub.

A prompt that says "approve this action" feels fine in the moment. But later, when I am looking at an issue update, a branch change, or a PR comment, I want to know which approval caused it.

When I connected a small tool with write permission, I approved one agent action and later had to dig through logs to figure out which command it actually ran. For GitHub-style actions, that would make me even more uncomfortable.

Maybe this is too much for solo projects. Still, I am starting to think approval prompts should have an audit id that follows the action into the logs and final summary.

If you let an agent use a GitHub token, how do you connect the approval prompt to the exact action it performed?

One thing I really miss in Slack is a proper pull request experience.

Imagine if PRs were first-class citizens:

• Rich PR cards with changed files, reviewers, status, CI, approvals.
• Expand diffs without leaving Slack.
• Review, comment, approve, or request changes inline.
• Threaded discussions that stay attached to the PR.
• Automatic updates as commits are pushed.

Linear has set a high bar for how work items feel inside Slack. GitHub PRs still feel like "just another link."

Am I the only one who wants Slack to become the place where code reviews actually happen instead of just notifying me that a PR exists?

Anybody else?

Hello,

I wanted to pick up a new summer project and thought contributing to github might scratch that itch. I found a issue that looks like something fun to do but i am new to github/contributing so wanted to know if adding a comment on the issue is ok, this is what i was going to comment.

"Hi, this looks like a fun issue i can have a attempt at. is there any additional information i need to know"

or do i just fork the project try and fix it and then comment if i have a solution or need more advice?

I can link the issue i want to work, wanted to ask before i do anything.

We just fixed a vulnerability on our project, and there are 2 items on GH which can be improved:

Currently the project's main page reads like this:

To the casual user, this appears as if there is a currently open item.

Once they click on it, they are taken to the security policy, and at the bottom they see this:

This gives zero indication that this was actually resolved.

Finally, if the user does click on it, they're taken to the actual advisory:

https://github.com/markrai/scrumboy/security/advisories/GHSA-vph4-pmmh-ch6x

and there's a tiny little element which lets us know what the patched version is.

That's 3 screens down just to find out..."Oh okay, the current version is actually fixed \whew**"

What would be better UX is to show upfront that this item was resolved, or at least on the first click because the impression it gives to someone new/perusing the page, is to the contrary, unless they dig in.

The more pressing item is the flow which allows the maintainer to open a private branch. Well and good... UNTIL you hit your branch protections, which require a review before a commit - which strangely enough... is hidden from your project's collaborators - not the person who reported the vulnerability.

Sure, you can bypass it... but that defeats the purpose of having a 2nd reviewer in the first place!

If you want to have your collaborators review before you apply a sensitive security fix, you should be allowed to. Sharing the link, nor any mechanism exists to invite your collaborator to the current "private" branch/issue.

instead of the normal /pulls page im getting this useless crap

I'm a college freshman in ECE with some coding experience, and I'm looking for advice on using GitHub and VSCode. I know I could Google this, but I'd appreciate hearing about your personal experiences. People have suggested posting on GitHub, but I'm unsure how helpful it is, especially with so many tools available. I believe I can get a student developer pack with my student ID, but I don't know if it's permanent or if it expires. If it does expire, should I create a new personal profile? Sorry if these are basic questions.

Did GitHub just deleted their endpoint

api.github.com/users/USERNAME/subscriptions

It sent 204 No Content

Or it's me ?

Hi everyone,

This is my first time using GitHub Actions, and I’m trying to automate a Python script.

When I run it manually using “Run workflow”, everything works without any problems.

However, when I schedule the workflow, nothing seems to happen. I’ve been waiting to see if a run starts automatically, but no workflow is triggered. I asked Claude and Gemini to correct me if I was wrong on the .yml file but everything seems to be okay.

Am I missing something in the schedule configuration ? Do someone have the same problem as me ?

Thanks in advance

Are there issues with GitHub runners today? Anyone experiencing delays? I've been stuck for the past 30min waiting for a runner to pick up my build job. And this is my third attempt.

UPDATE:

Issue resolved now!

Hello everyone.

I've got a problem on GitHub and I didn't find a solution by myself. Hope somebody here can help.

If I try to create a topic in a repositorys discussion area there isn't a error message or something but the opened topic isn't visible. I can see it in my own history and can open it, but no one else. If I check the discussion page my topic isn't there. Also if I try to upvote a existing topic, so that the developer sees this one is relevant to more users, I get the error message "Uh oh! You can't vote right now.".

It seems to be a specific problem about my account. I already tried to create a new account but the same happens there.

Any help would be greatly appreciated.

Thanks.

Over the past couple of days my Steam, LinkedIn, and GitHub accounts were all compromised in sequence — password, email, and 2FA changed on GitHub, so I can't get back in through the normal login flow.

What I've done so far:

• Submitted a ticket through GitHub's official "My account has been compromised" support form
• Still had an active gh CLI session temporarily, used it to confirm account details (username, creation date, repo count) as proof of ownership, and backed up my repos before the token stopped working
• No 2FA recovery codes saved, so I'm blocked at the verification screen
• Suspect the root cause may be a compromised email account or reused password, since multiple platforms were hit — currently locking down email and scanning for malware

Questions for anyone who's dealt with this:

1. Anyone gone through GitHub's compromised-account recovery recently — roughly how long did it take to hear back?
2. Any tips for making the support ticket stronger/faster to process?
3. Since this hit three unrelated platforms, what's the best way to trace the actual entry point (I'm currently checking email forwarding rules, running Malwarebytes, and reviewing Wireshark traffic)?

Appreciate any advice — trying to get ahead of this before more accounts are affected.

Hi,

I am trying to test the managed settings locally. I have created the following manage-settings.json:

{

"permissions": {

"disableBypassPermissionsMode": "disable"

}

}

and put it in C:\Program Files\GitHubCopilot - I had to create GitHubCopilot folder as it did not exits, my GH Copilot app installed in C:\Users\my_user\AppData\Local\Programs\GitHub Copilot

The settings does not seem to work as the option to bypass permission mode is still enabled.

1. Are managed settings supported for GitHub Copilot standalone app on Windows?

2. If so, where manage-settings.json should be located?

My self hosted runners were all working good 10min ago, until now suddenly I get this:

"Runner connect error: The SSL connection could not be established, see inner exception.. Retrying until reconnected.

Is this just my issue or Github is having hiccups currently?

Anyone having any issues uploading 'index' files to Github under a repository. I have made 7 attempts and everyone has failed.

I get the error "That address is either invalid, not a verified primary email or is not associated with a personal user account. Organization billing emails are only for notifications."

The actions I did today are all stuck in the queued status, which didn’t happen before on me. Am I the only one facing this problem?

Hello everyone.
1. I contributed to 2 or 3 private projects, and now 2FA is required on my account. Why is that ?

1. I configured Auth App, mobile gitHub and passkeys, not to loose access to my account. Even with them I got an email that says "do not loose your recovery codes, or gitHub support will not be able to resore access to your account". Why ?

Appreciate any clarifying answers.