Best Practices For Saving Submission Timestamps

[gchallen]

I'm new to GitHub classroom but very excited to use it for the first time. Thanks to all for the hard work that went into this project.

I'm trying to determine the best way to ensure that we have reliable timestamps for student submissions, given that it's well-known that Git commit timestamps can be altered. The deadline support that was added recently isn't sufficient for us, since we let students continue to submit after the deadline with penalties, and also frequently need to modify deadlines for individual students, etc.

Assuming that pushes constitute submissions that we want to grade, it seems like we could set up an organization webhook logger to record all push timestamps. But then if that logger goes down, we might miss a chunk of pushes. I had assumed (whoops) that GitHub recorded push timestamps somewhere, but I've been poking through the API and there doesn't seem to be a query interface for push timestamps. (Correct me if I'm wrong.)

So how do GitHub Classroom users work around this problem? Any advice or hints would be greatly appreciated.

[gchallen]

Answering my own question: we developed a small node.js-based logger for GitHub webhook events. It both saves them to a MongoDB instance so that the timestamps are preserved, and also fires off messages using RSMQ to start autograding. Here's the repo: https://github.com/cs125-illinois/githublogger. It probably won't work perfectly for your setup, but it's a starting point.

I'm still wondering if there is a better way to do this, however.

[nicholascw]

@gchallen Hi, Challen, as one of your CA, I would recommend you to do a trusted timestamp signing process when running the test case or commiting the work.

[tarebyte]

@gchallen it might be helpful to post your questions over in the GitHub Education Community forum https://education.github.community

[d12]

Hey @gchallen ,

I believe the existing Deadline feature meets your usecase.

When the deadline happens, Classroom grabs the SHA of the latest commit on each of your student's default branches, and saves the reference to that SHA as the submission. This cannot be altered or amended later.

This also doesn't stop students from submitting after the duedate. As long as they don't force-push over the submission SHA, their submission will remain untouched.

I'm going to close this for now, but let me know if you have any other questions.

[gchallen]

Unfortunately the deadline feature doesn't really meet our needs. For a large class a single deadline is fairly impractical, since there will be a dozen students with exceptions for a variety of reasons. And once you can ascertain when they submitted you've solved the more general problem. But I'm assuming that this is useful for people teaching smaller courses.

Anyway—we solved this problem as described above. I guess there is also a way to query push timestamps using GitHub as an authoritative source.