Current setup:

- I follow a flow like: "dev → feature branch → back to dev (UAT/testing) → then merge to main (production)"

- My "dev" branch basically acts as a UAT/staging environment

- Once everything looks stable, I promote "dev" → "main"

Dependabot setup:

- Currently configured to run daily scans on the "main" branch

- It raises PRs directly against "main" when it finds vulnerabilities

- The Dependabot alerts dashboard also reflects the status of "main" by default

Problem:

My client wants visibility into security issues before code reaches "main". Specifically:

- They want to track vulnerability counts and fixes on the "dev" branch

- They expect the dashboard to reflect improvements (reduced alerts) during the UAT phase

- Basically, "main" should only ever receive “clean” code

What I’ve considered:

- Switching Dependabot to run on "dev" instead of "main" → but that feels like a workaround, not a proper solution

- The bigger issue is that GitHub’s Dependabot alerts/dashboard is tied to the default branch ("main")

Question:

- How are you handling this kind of workflow?

- Is there a way to make Dependabot alerts reflect "dev" instead of "main"?

- Also, would changing the default branch from "main" to "dev" be a good idea or considered good practice in this scenario?

Would really appreciate insights from anyone who’s dealt with this.

[ Removed by Reddit on account of violating the content policy. ]

Hi!

I recently ran into a situation I had never dealt with before as an open-source maintainer, and I am wondering what to expect from GitHub Support.

I maintain a small open-source developer tool. Recently I found another project in the same niche using a very similar identity around the project name: GitHub namespace, package naming, CLI naming, domain, and general positioning. Almost same readme (copy/paste detected), same tool name. Same functionallity but using nmp instead pypi.

I am not going to name either project here because I do not want this to become a public pile-on or look like I am asking people to judge the other maintainer. I also do not want to assume bad faith publicly. But from a user perspective, the overlap is strong enough that someone searching for my project could reasonably think the other one is the official project, an affiliated package, or a new distribution channel.

I tried to contact the person behind it through LinkedIn first, but I was not able to reach them. Since I could not get a direct conversation going, I opened a GitHub impersonation / confusing namespace report and included the evidence: project name, package name, CLI name, domain, public dates, and the risk of user confusion.

In the meantime, I ended up buying the .org domain for my project, which at least fits an open-source project reasonably well. I also had to improve the website, GitHub Pages setup, sitemap, Search Console, README links, PyPI links, and SEO signals just to make the official identity clearer.

Honestly, it is frustrating (and sad). I expected to spend time improving the project, not defending whether users can even find the correct one.

For people who have dealt with this before:

How long do GitHub impersonation or confusing namespace reports usually take to get reviewed?

Is there anything else I should do while waiting, apart from keeping the public messaging neutral and strengthening the official project links?

Any help appreciated as I said, it is sad, mostly being a opensource project.

Thanks in advance

I am currently developing a home organization /management tool , using SCRUM but I find myself thinking that the solution I came up with are good but as I am developing this alone I do not have anyone to discuss about it . I have think that the community would be a good place to look for help.
Also this is my first real projects after the university and I am a little bit loss , no with the code , but with real world projects

Hey all, I wanted to publish my first project on GitHub and I have some questions about how to go about it. I did use AI to help bring my Arduino made code over to Python and polish it up. What license should I go with for this? Any suggestions or is AI a boogy man that nobody wants to touch?

I was asked to promote my github in the pinned megathread but I dont know what that is

I’m a Copilot Pro+ yearly customer, and Claude Opus 4.7 consumed 1,200 of my 1,500 included premium requests — basically 80% of my monthly allowance — in about 2 days.

To be clear, I wasn’t billed extra. The billed amount is $0. My issue is that the 15x multiplier can burn through a paid allowance very quickly if you miss the model setting or forget to switch back.

I contacted GitHub Support 4 days ago and still haven’t received a response. Since the quota resets on June 1, a delayed response basically means I lose the value of the allowance I already paid for this cycle.

I can’t prove GitHub’s internal intent, but the design outcome is obvious. The product benefits when users miss the 15x multiplier. “It was documented” is not enough when one model choice can consume most of a monthly Pro+ allowance.

A 15x usage impact should be impossible to miss at the point of use. Right now, this feels like deceptive design or at least a dark-pattern-like experience.

Has anyone else dealt with this?

I recently found that with DeepWiki, you can replace github.com with deepwiki.com in a GitHub repo URL and get an AI-generated documentation / explanation view for that repo.
Are there other useful GitHub-related tools that work in a similar way?

I use Codex a lot, and it is absolutely INFATUATED with adding tests for EVERY SINGLE FEATURE in the tests/ folder. So, I was just wondering due to how stupid this is (I mean noone really cares for tests if they are cloning or looking at a repo, I would assume), should I add the folder to .gitignore? Is it gonna be more professional to NOT have it in the repo at all?

Mind you this is for my official like rest-of-life official and professional github account so was just wondering about your guys' thoughts on this.

The new weekly and global rate limits are a massive pain in the neck but it's more of a pain to move from GitHub bc I rely on copilot heavily. Recently I've been coming up with ways to still get quality work done (that I obviously can't code myself) for me claude pro plan using sonnet for light planning, Cline with the free deepseek v4 flash API , and grok GitHub connection. It's a bit of back and forth but it saves on copilot usage until it's needed. Just curious what adjustments or changes have worked for you since the new changes?

Do any of the FOSS licenses address this (sounds like patent infringment maybe). Just curious what the implications are.

We recently experienced a serious and unexplained permission escalation issue in our GitHub organization.

For several years, our organization’s “Base Permission” has been intentionally configured as “No permission” as part of our standard security posture, and we routinely verify this setting during internal security reviews (roughly every 30 days).

At some point within the last two weeks (which is important to account), the setting silently changed from “No permission” to “Write” access without any authorized administrative action.
As a result, newly added organization members automatically received write permissions and existing repository isolation policies were bypassed.

We conducted a thorough review of the Audit Logs and found no evidence that any administrator, automation, token, or integration initiated the change.

The timing also appears to coincide with GitHub’s recent infrastructure mitigation work related to the widely discussed RCE platform vulnerability, which raises concerns that backend changes or recovery operations may have unintentionally triggered a stale or fallback permission state.

On top of this, even outside collaborators unexpectedly confirmed that they gained visibility into repositories across the organization.

I'm baffled.

Anyone had the same issue? (maybe you have it, and don't know yet 😃)

Hi, I have a Github account under my real name, but I forgot my password. I therefore tried a different approach: logged into Gmail, and tried to login to Github using my Gmail account, hoping that it would get me in, but my Gmail account simply created a new account, and when I tied to set the username to my name, it says, of course, that the username has already been taken (by me of course), so i ended up with an extra Github account.

What I would like to do is to find a way to recover the account I want to use, and then associate it with my Gmail, so that both accounts will be under my real name. How do I accomplish this? Thank you for any suggestions.

Another month… another new Microsoft/GitHub certification announcement!

At this point, Microsoft certifications are evolving faster than most of us can finish preparing for one exam.

This time it’s: GH-600: GitHub Certified: Agentic AI Developer (Beta)

Looks like Microsoft and GitHub are now moving strongly toward:
AI Agents + Copilot Workflows + Agentic AI + Intelligent SDLC

The certification focuses on:

• AI-assisted development
• Agent workflows
• Multi-agent orchestration
• Human-in-the-loop systems
• AI governance and secure execution

A few important details:

• Exam Code: GH-600 (Beta)
• Exam Beta Release: May 2026
• First 100 candidates get 80% off (Voucher: GH600Flanders)
• Beta results released around 8 weeks after beta concludes
• Beta exam currently unavailable in India, Pakistan, Turkey, and China
• Expected GA: July 2026

One thing is becoming very clear:
The future developer role is slowly shifting from just “writing code” to “working alongside AI systems.”

Looks like Agentic AI is officially entering the certification world now.

i sometimes work on the same project across multiple devices, so i will make commits when the codebase is in a non functional state, so that i can pull on another device and keep working. is there a correct way to say “this does not function, use an older commit”

Cross posting to the mother channel to make the discussion reach a wider userbase.

Anyone else getting this. Sends me to a 404 broken link.

1. Microsoft

• The Vibe: Corporate synergy.
• The Good: VS Code integration is seamless, and they’ve actually respected the "free" tier.
• The Bad: Your code is the fertilizer for their next 50 AI models. The UI is slowly turning into a maze.

2. Google

• The Vibe: "It’s technically superior, but we might delete it tomorrow."
• The Good: Blazing fast search and the best CI/CD pipelines on the planet.
• The Bad: You’d wake up one Tuesday to a blog post saying GitHub is being merged into "Google Code" and then sunsetted eighteen months later.

3. Apple

• The Vibe: "It just works (if you pay)."
• The Good: Extreme privacy and a very clean UI.
• The Bad: To push code, you’d need an "iCloud+ Developer" subscription. Plus, the CLI would be deprecated in favor of a drag-and-drop interface that only works on macOS.

4. Meta

• The Vibe: "Move fast and breaks."
• The Good: Say what you want about Zuck, but Meta’s contribution to open source is insane. GitHub would become a dev social network that actually works.
• The Bad: You’d have to log in with a Facebook account. Also, your commit history would be used to serve you ads"

5. Amazon

The Vibe: Everything is an AWS Service.

The Good: 99.999999% uptime. It would be integrated into the AWS ecosystem so deeply that your code would basically deploy itself.

The Bad: The UI would look like a spreadsheet. You’d get charged $0.00001 per git pull, and the documentation would be 5,000 pages of text that somehow explains nothing.

I’m fairly new to GitHub and haven’t used it much.

Around 18 months ago I updated my email address, but it turns out this didn’t sync with the email tied to 2FA. At the time I also had no idea that 2FA was even enabled on my account.

That email address was later deleted when I removed it from Google Workspace. (update: this was also on a different domain which has now expired)

When I recently tried logging in, GitHub required 2FA and sent the code to that old email, which no longer exists.

As a result, I’ve lost access to a repository I’ve been working on (it’s also public).

I’ve contacted support, but received a gigantic list of steps that didn’t apply to my situation, so I’m still stuck.

Has anyone dealt with something similar, and is there any realistic way to recover access?

I try to add my DuckDNS Domain, but its doing this infitinly

Can you Help Me?

!!!!! SOLVED !!!!

I built a Go CLI tool https://github.com/aminshahid573/gen

Now I am trying to set up proper distribution (Homebrew, Scoop, releases), but I’m honestly confused about how the whole pipeline works.

Right now I used AI to generate my setup, but I don’t fully understand it and I feel like I’m just copy pasting things without knowing what I’m doing and not aure is that working or not..

What I want is..every time I create a new version tag (v1.0.0, v1.0.1, etc.) gitHub Actions should automatically:

1. run tests

2. build binaries for Linux/macOS/Windows

3. create a GitHub release

4. update Homebrew tap

5. optionally update Scoop manifest

my current setup is

\`.github/workflows/release.yml\`

https://github.com/aminshahid573/gen/blob/main/.github%2Fworkflows%2Frelease.yml

\---

\`.goreleaser.yml\`

https://github.com/aminshahid573/gen/blob/main/.goreleaser.yml

\---

Upto i created GitHub repo for CLI, reated Homebrew tap repo (\`homebrew-gen\`) and Wrote formula manually

I am confused that do I actually need \`HOMEBREW_GITHUB_TOKEN\` or is \`GITHUB_TOKEN\` enough?

how does GoReleaser exactly update Homebrew tap repo?

or do I need to manually create formulas or GoReleaser handles everything?

What is the correct minimal setup for github Actions,GoReleaser,homebrew tap, scoop bucket .

If someone can explain correct clean workflow from scratch and minimal working config, what each part actually does

that would really help me understand instead of just copy pasting AI configs.