标签：#Git

GitHub热门项目 | | Stars: 4,187 | 6 stars today | 语言: TypeScript

GitHub热门项目 | A list of tools that are open-source, in-browser, and require no-signups! | Stars: 2,671 | 50 stars today | 语言: TypeScript

GitHub热门项目 | 🤗 The largest hub of ready-to-use datasets for AI models with fast, easy-to-use and efficient data manipulation tools | Stars: 21,899 | 5 stars today | 语言: Python

GitHub热门项目 | High-Quality Voice Cloning TTS for 600+ Languages | Stars: 9,811 | 83 stars today | 语言: Python

GitHub热门项目 | | Stars: 2,487 | 1,141 stars today | 语言: TypeScript

I have spent more than six years shipping production software and I have no public repositories worth showing you. Everything substantial I have written at work lives in private repositories belonging to the companies I wrote it for, and confidentiality obligations do not lapse when a role ends. So I cannot hand you the code, and I am not going to. That is not caution for its own sake. An engineer who sends a prospective employer another company's source code has told you exactly what they will do with yours. The restraint is part of what you are assessing, and I would want the same restraint applied to my work later. Which leaves a real problem. "I was the principal author of the web application" and "I contributed to the web application" are the same sentence to a reader who cannot check either. Most engineering CVs resolve this by getting louder. I think the only honest resolution is to publish the measurement method rather than the artefact, in enough detail that someone familiar with the tools can judge the figure on its own terms without ever seeing the repository. Here is the method I actually used, what it does badly, and the places where applying it forced me to shrink a claim I would have preferred to keep. Three measurements, in increasing order of rigour All-branch commit count. Total authored activity. Do not use this. It counts abandoned branches, spikes and experiments, and it inflates — usually in favour of whoever is most willing to commit. It is the number that makes contribution graphs look impressive and says the least about a codebase. Production-branch commit count, scoped to tenure. What reached customers, while you were there. Better, because it excludes work that never shipped, and because scoping to tenure stops you either taking credit for years of history that predate you or being penalised for them. But it still counts commits, and a commit is a unit of activity, not a unit of code. Commit share rewards granular committers and punishes p

GitHub热门项目 | AI enabled pair programmer for Claude, GPT, O Series, Grok, Deepseek, Gemini and 300+ models | Stars: 7,609 | 40 stars this week | 语言: Rust

GitHub热门项目 | Rust GUI components for building fantastic cross-platform desktop application by using GPUI. | Stars: 13,942 | 199 stars today | 语言: Rust

GitHub热门项目 | Miles is an enterprise-facing reinforcement learning framework for LLM and VLM post-training, forked from and co-evolving with slime. | Stars: 2,469 | 55 stars today | 语言: Python

Every AI code review metric you track measures the hour before merge, and that is precisely the hour when the least information exists. Acceptance rate, test pass rate, and review approval all describe how a patch looked in isolation, not how it behaves under real traffic. Revert rate is the only signal that arrives after the system has voted, which makes it the least gameable number in your pipeline. This article argues that you should stop celebrating AI patch acceptance and start measuring how many of those patches come back. Why the pre-merge metrics lie A green test run proves that a patch fits the expectations you encoded last quarter, not the behavior your users will hit tomorrow. Reviewers approve diffs under time pressure, and a cleanly formatted AI patch reads as competence even when its logic is wrong. The merge is where the real evaluation begins, and the revert is the only verdict that carries operational weight. Nobody plans a revert, so the metric cannot be gamed by prompt tweaks or review theater. The argument is not that pre-merge review is useless; it is that pre-merge signals saturate quickly. Once your review gate catches the obvious failures, the remaining defects are exactly the ones that look fine in review. Those defects surface as incidents, hotfixes, and reverts, which means your post-merge telemetry is the only source of new information. Treating acceptance as a quality metric is like judging a deployment by how well the rollout script ran. The artifact: a revert attribution watch The workflow below attributes every revert commit to the patch that caused it and computes a per-source revert rate. It requires only a git history, which makes it reproducible on any repository that has survived a few incidents. Run it on a local clone first, because a read-only analysis should never touch shared state. Step 1: List every revert commit in your window. git log --all --since = "90 days ago" --grep = "^Revert " --format = "%H %s" Step 2: Extract th

In the fast-paced world of software development, every second counts. Seamless tool interaction is not just a convenience; it's the bedrock of high developer productivity . Even seemingly minor hitches, like a non-functional 'copy link' button, can subtly erode efficiency, leading to frustration and lost time. A recent GitHub Community discussion highlighted just such an issue, where a user reported that the 'Copy link' button in Pull Requests (PRs) was consistently failing, specifically when using the Arc browser on macOS. This isn't merely about a broken button; it's a window into the complex interplay between browsers, web APIs, and the essential tools we rely on daily. The Reported Problem: A Month-Long Frustration The original post by vovapyc detailed a persistent problem: the 'Copy link' button in GitHub PRs had been broken for at least a month. The user specified their setup: Arc browser, MacBook Pro M1 Pro, and macOS 26.2. For dev teams, product managers, and delivery leads, a recurring point of friction like this, preventing a quick share of a PR link, represents a tangible drag on workflow. Imagine the cumulative time lost across a team if every developer had to manually copy URLs from the address bar multiple times a day. GitHub's automated response, while a standard and necessary part of their feedback loop, acknowledged the feedback and assured the user that their input would be reviewed. However, it didn't immediately offer a solution or explanation for the bug, leaving the user, and potentially others experiencing similar issues, in limbo. Diagram illustrating the three gates: Secure Context, Document Focus, and User Permission, that must be passed for the Clipboard API to function.## The Expert Insight: It's Likely the Browser, Not GitHub The true insight, and the crux of this discussion, arrived from hoangperry . Their comprehensive breakdown suggested that the issue was almost certainly browser-specific rather than a core GitHub bug. This distincti

A San Francisco “Hot List” is trying to buck stereotypes about dating in tech circles amid wider debates about the value of being perceived as attractive.

The agent is already in your workflow. The failed build is where it goes blind. AI coding agents have moved from novelty to daily tool. In Stack Overflow's 2025 Developer Survey, 84% of developers said they are using or planning to use AI tools in their development process, up from 76% the year before, and about one in seven professional developers now use AI agents at work every day . Among developers who have used agents at work, roughly 70% agree the agents have reduced the time they spend on specific tasks . There is one place, though, where that agent still tends to go dark: the failed CI run. The pipeline turns red, and your agent (like you) is handed a wall of log output from jobs it did not write, covering steps it did not touch. It has to reconstruct what actually broke before it can fix anything. That reconstruction is the expensive part, and it is exactly the part Latchkey is built to remove. This piece is about a clean division of labor. Latchkey's self-healing CI repairs the failures that are about your environment, not your code. For the failures that are genuinely about your code, Latchkey does not guess and patch on your behalf. Instead it hands your own coding agent a complete, structured account of the failure over the Model Context Protocol, so your agent can fix the bug with full context instead of starting from a log file. Two kinds of red build, and only one of them is yours to fix Almost every failed build is one of two things. Either the environment let you down (a flaky network, a full disk, a process killed for memory, a missing tool, configuration that drifted), or your code is actually wrong (a compile error, a failing test, a broken assertion). These two cases want opposite treatment, and conflating them is how teams end up rerunning pipelines and hoping for green. Latchkey's self-healing CI handles the first case. When a step fails on a Latchkey managed runner, Latchkey detects the failure, diagnoses the cause, and applies a fix while t

The Pipeline Became the Attack Surface For most of the last decade, we treated the CI/CD pipeline as plumbing: invisible, trusted, and mostly ignored until it broke. That assumption is no longer safe. The clearest signal came in 2025, when attackers stopped going after the software a pipeline builds and went after the pipeline itself. This week's research pass pulled together three shifts that are all landing at once: a supply-chain attack that redefined the threat model, GitHub's response in its 2026 security roadmap, a pricing change that quietly rewrites the cost math, and a persistent gap between how much teams trust AI in general and how little they trust it inside CI. Here is what the sources actually say. The tj-actions attack changed the threat model On March 14, 2025, researchers discovered that the popular tj-actions/changed-files GitHub Action had been compromised. According to Palo Alto Networks Unit 42, the action was used by over 23,000 GitHub repositories at the time ( Unit 42 ). The mechanics are worth understanding, because they explain why this matters beyond one action. Attackers injected code that dumped the CI/CD runner's memory and wrote sensitive environment variables and secrets straight into the workflow logs. They retroactively modified multiple version tags to point at a single malicious commit, so pipelines that pinned to a tag rather than a commit SHA pulled the payload ( Unit 42 ). The incident is tracked as CVE-2025-30066, described as allowing remote attackers to discover secrets by reading action logs ( GitHub Advisory Database ). The compromise did not start with tj-actions. Unit 42 traced it back through a leaked personal access token that reached reviewdog/action-setup , a dependency in the chain, with earlier steps going back to late 2024 ( Unit 42 ). In other words, the pipeline's own dependency graph was the delivery vehicle. The takeaway is not "avoid one bad action." It is that the automation running your builds is now a firs

Most "best CI/CD tools" lists are twenty logos in a table, ranked by nothing in particular, with the author's product at the top. This is not that. It is a map of the categories, what each one exists to solve, and how to tell whether you need it yet. I work at Latchkey, so I will say plainly where we sit: we are one option inside one of the six categories below, and I will tell you when we are the wrong answer. Read the rest as a map, not a pitch. A note on what is missing here: I have not invented benchmark numbers or quoted prices for tools I do not operate. Vendor pricing changes often enough that any figure I write today is wrong by the time you read it. Where a number matters, go to the vendor's own pricing page. The mistake most teams make Teams usually shop for CI/CD tools by asking "which one is best." That question has no answer, because the tools are not competing with each other. They are stacked on top of each other. A team that adopts a build accelerator to fix a slow pipeline, when the actual problem is that half their failures are flaky, has bought a faster way to fail. A team that adds pipeline observability before they have enough pipeline to observe has bought a dashboard nobody opens. The useful question is narrower: which layer is currently your constraint? Answer that, and the tool choice inside the layer is usually obvious. Here is the whole landscape in one view. Layer What it solves When it becomes your bottleneck CI platform Running the pipeline at all Never; this is where everyone starts Runners and compute Where jobs run, and how fast they start Queue time or runner cost is visible Build acceleration Doing less work per run Full rebuilds dominate your wall clock Supply chain security What the pipeline is allowed to reach You ship to production or touch customer data Observability and cost Where time and money actually go You cannot answer why last week was slow Artifacts and registries Storing what the pipeline produces You publish images

Two things are true about software delivery in 2026, and they are pulling in opposite directions. The first: AI is now writing a large share of the code that reaches your pipeline. CloudBees' 2026 State of Code Abundance Report found that AI generates or assists in writing 61% of the average enterprise codebase, and that 81% of enterprise leaders report an increase in production issues tied to AI-generated code. The same report names a confidence gap worth sitting with: 92% of leaders say they are confident in the production readiness of that code, even as the failures climb ( CloudBees, 2026 ). The second: the place best positioned to catch those failures, the CI/CD pipeline, is where teams trust AI the least. JetBrains' TeamCity team reported that 73% of organizations do not use AI in their CI/CD pipelines at all, and 78.2% do not delegate tasks to AI in CI/CD workflows, even though general AI usage in development work exceeds 90%. When asked why, 60% cited unclear use cases or value, 36% cited a lack of trust in AI-generated results, and 33% cited data privacy concerns ( JetBrains TeamCity, 2026 ). That is the trust gap. More machine-written code is arriving, more of it is breaking in production, and the pipeline that should be the safety net is the one room teams will not let automation into. This piece is about why that hesitation is rational, and what automation has to look like to deserve a different answer. Why the pipeline is different The JetBrains analysis put its finger on the reason cleanly: development workflows tolerate experimentation because feedback is immediate and cheap. CI/CD is the opposite. It demands consistent, reproducible signals, and the cost of an error is high. A coding assistant that guesses wrong wastes a few seconds of your time. A pipeline that guesses wrong can hide a real defect, ship it, or erode the one thing a pipeline exists to provide: a trustworthy answer to the question "is this build good?" So the bar for automation in CI/

GitHub热门项目 | Algorithm powering the For You feed on X | Stars: 32,574 | 37 stars today | 语言: Rust

This project started with a simple goal: run Kubernetes without keeping an EKS cluster online every day. In I Wanted Kubernetes Without an Always-On EKS Bill , I built an always-on k3s lab on my home server and proved that I could deploy, update, and roll back an application. The rollback worked, but it exposed the next problem. Kubernetes restored Version 2 while the saved YAML still declared Version 3. I corrected the file manually, but the recovery depended on repairing the running cluster and its saved instructions separately. In The Rollback Worked. My Next Deploy Could Break It Again , I designed a safer path. The automated build process would test and publish an exact image, then stop at a Git pull request. Git would record the reviewed version. Argo CD, running inside Kubernetes, would make the cluster follow that record. Now I needed to prove that the design worked outside a diagram. I followed one release from source code to running Pods. Then I tested two opposite failures: The cluster was wrong while Git was correct. Git contained a bad setting while the cluster followed it correctly. Those experiments showed both the value and the limit of GitOps. Automation can make the cluster match Git, but it cannot decide whether the human-approved version in Git is a good one. CI Built the Release but Did Not Deploy It The GitHub Actions workflow—my continuous integration, or CI, worker—ran the application tests and checked the Kubernetes package before building anything. Its job was to prove and publish a release, not to change the cluster. After validation, Buildx created a Linux AMD64 image with the full source commit baked into /version : docker buildx build \ --platform linux/amd64 \ --build-arg "APP_VERSION= $GITHUB_SHA " \ --tag " $image_name : $GITHUB_SHA " \ --provenance = mode = max \ --sbom = true \ --push \ application After publishing the image, CI read its registry digest. A digest is the image's content fingerprint: if the image changes, the digest

Learn how to run parallel agents in the GitHub Copilot app, and experience the moment it stops feeling scary and starts feeling powerful. The post GitHub Copilot app for Beginners: Run several agents at once appeared first on The GitHub Blog .

Your first AI patch should fail closed today. Do not ship a feature on day one. Prove one target file can revert cleanly now. You joined a messy repo this morning. The assistant wants a wide rewrite. Your job is a tiny reversible cut only. This drill gives you a blast-radius file first. You fill it before any model writes code. Then a short script checks the revert path. Why day-one AI diffs explode Cheap code is not cheap to unwind. One extra import can touch auth. One extra migration can lock deploys. You will not know the architecture yet. You also should not pretend otherwise. A blast-radius file makes unknowns explicit fast. If the file cannot name a revert, stop. You do not prompt for more code. You shrink the change until revert is boring. What you will build today You will add two artifacts on your branch. Keep both files in the first PR. blast_radius.py — the contract for this change. scripts/check_blast_radius.py — the fail-closed proof. The contract is the source of truth. The checker is the only merge gate. No green checker means no review yet. Step 1: Freeze one target file Pick one production file you can read. Do not pick a whole folder. Do not pick generated vendor code. git ls-files '*.py' '*.ts' '*.go' | head -n 40 TARGET = src/billing/invoice.py wc -l " $TARGET " git log -n 5 --oneline -- " $TARGET " Read the last five commits on that file. Write two plain sentences in notes. Pick a smaller file if you cannot yet. You now have a hard fence. Everything outside that fence is forbidden. Your assistant may not cross it. Step 2: Write the blast-radius contract Create blast_radius.py at the repo root. Keep the dict small. Fill every field with your own hands. # blast_radius.py # Day-one contract. Humans edit this. Models do not. BLAST = { " change_id " : " day-one-001 " , " intent " : " Add a fail-closed guard on invoice totals. " , " target_files " : [ " src/billing/invoice.py " , " tests/billing/test_invoice_flag_off.py " , " blast_radius.py " , " scr