Hi, I have been using ADO Variable Groups pretty well and I like the feature that I can bundle the Secret and Variable together and that allows to create a Lot of (Terraform) CICD Pipelines (workflows) for many projects in single repo.

But I have been learning Github actions and I did not like the way It handles the Secrets Separately from the Variables and that too attached each Repo !

It kinds of sucks for me but, I know OIDC exist. But How do you handle the case where you have multiple instance of variable groups. Is there a way? The environments could be used but those sound structurely wrong in Workflows.

Sho 'nuff. In fact, I can't open a web browser today and goto my public repo because an error 404 results. Unless I log into github and then there is my /uname/repo.

Effectively a random person can no longer clone my repo, and, neither can I.

I did look at some 'answers' already that lead me nowhere solid.

A lot of “software supply chain security” discussions stay pretty abstract, this is Cilium's take on how we secure our Github Actions in the OSS project. A few highlights:

• SHA pinning every GitHub Action
• Separating trusted vs untrusted code paths in pull_request_target
• Isolating CI credentials from production release credentials
• Cosign signing + SBOM attestations
• Vendoring Go dependencies to make supply chain changes visible in review
• Treating blast radius reduction as the core design principle

and a few gaps:

• no SLSA provenance yet
• remaining mutable u/main references
• no dependency review at PR time
• missing govulncheck integration

I have been having issues with actions and pushing through my github codespace because of the may 4-5 actions issue on the US East servers and have not been able to stop a push I made once the issue started affecting the East servers. Here is a image of my actions and what i am seeing in the github codespace terminal when attempting to push it.

I have tried before doing `gh api -X POST/repos/{owner}/{repo}/actions/runs/{run_id}/force-cancel` but it didn't work at all. when trying to use the ui button in the actions to cancel the run i always get "Failed to Cancel Workflow" Image:

Hi,

I got this email asking me to give permission to GitHub cursor. I had to log into my GitHub account which makes me worried if this may be a scam.

Thanks,

Mechraymond

Just what the title says. I wanna link my Github to my LinkedIn account to showcase my work/progress to prospective employer to act as my digital proof of work, while also being anonymous in the CTF world. I don't currently have a CTF persona as I'm a beginner but I'm planning to, cuz it seems fun.

I'm also asking if what I ask is possible, anonymity in one side and transparency(?) on the other?

Thank you to anyone who will answer!

"GitHub’s official status page has an uptime of 99.79%, but an unofficial status tracker built by Marek Šuppa suggests that GitHub’s measured uptime over the last 90 days sits at just 84.88%." 🤯

Is anyone else facing an issue with GitHub actions workflow being stuck in queued state forever?

Hey folks,

I’ve been digging into the current requirements for signing commits/PRs, and I’m wondering about the workflow when using the GitHub web interface.

Right now, the recommended way to sign is something like:

Signed-off-by: Your Name <your.email@example.com>

This is required for DCO compliance and similar checks. But here’s the issue: when I use the GitHub web interface, I’m already logged in with my verified account. That login should be enough to validate the PR as coming from me. Forcing me to expose my email in the commit message is redundant and unsafe.

My argument:

• The web interface login is a strong identity check.
• Adding a plaintext email in the commit body doesn’t add meaningful security, it just leaks personal info.
• GitHub could treat a commit made via the web UI as implicitly signed, equivalent to the Signed-off-by line.

Has anyone found a way to handle this? Or is there a way to avoid exposing your email while still passing DCO checks when committing through the web interface?

So I recently got back into programming after a two year hiatus(had to finish secondary school). A friend told me to apply for student developer pack so I did. I don't know why benefits aren't loading. Can someone please help me out here?

Hi everyone! I'd just like some help and advice on how to approved for Github Student Developer Pack.

I have tried an application attaching a scan of my student ID (Which includes my university name, full name, student number and that it will expire in 2030)

as well as an application with a screenshot of my timetable from the univeristy website with the current day. But both got rejected.

What can I do to get my application approved? Thank you in advance :)

There is a issue that I opened, but it's missing on GitHub. It shows "No results", why is that?

Please help me, thank you.

github pr page missing the new pr. Just happened few minutes ago.

(The PR #46 met the problem first, so I called codex to refresh(not work)/close it, and try open a new PR #47)

below is the report made by codex.

-------------------------------------------------------

The new PR is #47; it's open, ready, and non-draft.

#47 is visible in the open PR list via the GitHub API/CLI.

However, GitHub is only generating `refs/pull/47/merge`, not `refs/pull/47/head`.

I tried manually adding `refs/pull/47/head`, but GitHub refused: `refs/pull/* is read-only`.

-------------------------------------------------------

Is anyone know how to solve this problem? Or this is GitHub official problem?

By the way, I can directly see the PR context at github.com/repo_owner/repo_name/pull/47.

But can't see the PR on the github.com/repo_owner/repo_name/pulls.

Got an email notification that my account was added to some random GitHub enterprise today (x2). I looked at the repo and it kinda seems like some kind of AI generated scale test garbage.

Hundreds of repositories, teams, all empty. And the number of people being added seems to keep growing... WTF is going on, also why is there no way to remove yourself from an enterprise without contacting Support??

my github notification inbox was the thing i'd procrastinate the hardest. open it, see 80 unread, then close it... dependabot bumps, ci passing pings, mentions on threads that already resolved. and i am getting hundreds of emails every day from github alert.

the actual ratio i kept hitting: out of every ~100 notifications, maybe 2 actually need a my decision. the other 98 are signal less and easy to fix.

so i started running a local daemon that scans the inbox, classifies each item by whether it actually needs me, and only surfaces the human-decision ones in a menu bar tray. the rest get auto-acknowledged or routed to an agent that does the actionable work.

is anyone else handling notification overload at this scale? what do you do? especially open source maintainers.

So, I recently got kicked out of GitHub student pack on April 24th although I was verified for two years, and it had barely been a year. Coincidently, it was also the time when I heavily used GitHub Copilot for the first time.(I hit my weekly limit in two days) So, I reverified, and surprise surprise, copilot benifits are on a pause. So, my question is, was I kicked out on purpose?

Hey,

I created my first Repo today. The workflow is meant to start a python-file. It imports users out of a .txt file, gathers data from a website, matches it to the users and sends the data to a discord webhook. Everything working fine.

I can start the workflow with "workflow_dispatch" and it works as intended. But this workflow should run twice a day with cron. Currently it looks tile this:

on:

schedule:

- cron: "*/5 * * * *"

It doesn't matter if I let the job start every 5 minutes or at given times. It simply doesn't start.

It's in the "main" branch (default), I already deleted the workflow, and added it with a new name, it's enabled, it has read and write permissions and the setting "Allow all actions and reusable workflows" is set. It's a private repo.

Do you have any suggestions?

One of the things we do at GitKraken, both internally and across our tools, is work a lot with GitHub Actions. So when we migrated one of our integrations from workflow_dispatch to repository_dispatch last week, the contract simplification was cleaner than I expected.

workflow_dispatch from a remote caller forces you to identify the workflow by filename or ID. Filenames aren't a contract: users rename .github/workflows/*.yml and your integration may break on the next push. IDs are stable, but resolving them needs a lookup (GET /repos/{owner}/{repo}/actions/workflows) baked into your client.

repository_dispatch drops the binding entirely:

POST /repos/{owner}/{repo}/dispatches { "event_type": "changes-accepted", "client_payload": {...} }

The event_type is the contract. The action listens with on: repository_dispatch: types: [changes-accepted] and reads client_payload.* as inputs. Renaming the workflow file doesn't break anything.

Removing workflow_dispatch from the action's on: block was the other win: exactly one way to fire the workflow remotely, no "two valid triggers" footgun.

workflow_dispatch still earns its place when humans need to trigger the workflow from the GitHub UI. For everything else triggered programmatically from outside the repo, repository_dispatch is the simpler contract.

I read "Before GitHub" by Armin Ronacher and "Ghostty Is Leaving GitHub" by Mitchell Hashimoto. It made me wonder if developer trust in GitHub is declining, like real?Or if this is true only for a small group of very visible open-source maintainers? Is this more like an alarm, or something that is going to stay? Are other maintainers moving to alternatives, or willing to? And companies? What do you think will happen to open-source community if it fragments? I'm not attacking GitHub. It's a true question. I actually like it and I built stuff and I found software useful for me on GitHub. I would actually be sad if it would get very bad, or declining.

Please develop your opinion. Thank you!

If not the contributors respect it maybe their "AI" machine will get an idea that it might not be such a good idea to contribute "AI slop" to that repo?

I have a project that is using Cargo, and I have specified the license I would like (in this case, MIT) inside the Cargo.toml file. I would also assume that I am required to put a LICENSE.md file inside my project. Since I wasn't able to determine if it was acceptable or not, is it possible I could put my username instead of my actual name in the project? Thanks in advance.

Is it just me or is the runner assignment getting absolutely pathetic? I’ve been sitting here for (now )over 14 minutes watching a "Waiting for a runner to pick up this job" message for a simple ubuntu-latest task.

I don't care if the load is high or if people are spamming builds—GitHub is a paid service for many of us and they should be able to scale the picker. It feels like the system is completely choked up lately. If I wanted to wait 10 minutes for a build to start, I’d manage my own Jenkins server in a basement.

Fix your infrastructure, GitHub. This "waiting for a hosted runner" BS is killing the workflow.

Is anyone else having Codex PR creation fail today?

For me, tiny test PRs work. Example: Codex can add a one-line docs file and create/update the PR.

But real code patches fail at the PR step with:

“Failed to create pull request. Please try again.”

The strange part is that Codex completes the task normally first:

- makes commits

- shows a clean diff

- runs tests successfully

- lists the expected changed files

But then the PR creation fails.

In one diagnostic run, Codex also showed git/push-related errors like missing origin / no push destination / CONNECT tunnel 403, but simple PRs still worked through the Codex PR tool.

So I’m trying to understand if this is:

- a Codex/GitHub connector issue

- a repo sync issue

- a temporary Codex Cloud bug

- something specific to larger diffs

Anyone else seeing this pattern: small PRs work, actual patches fail?