Create Pull Requests in GitHub for Windows

Just like our Mac client, you can now use GitHub for Windows to submit pull requests to GitHub or GitHub Enterprise, right from your desktop.

Create a pull request

We didn't forget forks, either! If you fork a repository and then want to contribute changes to the upstream repository, GitHub for Windows will keep track of upstream branches. This means less hassle when you're ready to contribute your changes back.

Upstream branches

Download GitHub for Windows and start sending pull requests now!

OctoTales • Epic Games

We recently caught up with some of our friends at Epic Games in Cary, NC a few weeks ago to talk about the latest developments with Unreal Engine and Unreal Tournament. Since opening up the engine source code on GitHub a year ago, they've released seven major updates that incorporate an array of contributions from the community such as @SRombauts' git plugin and much improved Linux support.

Our latest OctoTale captured some of Epic Games' stories and some of the amazing work that's going on in their passionate vibrant community. We think you'll enjoy it.

And finally, some more exciting news for fans of the Unreal Engine: as of this week, developers can enjoy free access to Unreal Engine 4!

CodeConf is Coming to Music City

This Summer, CodeConf will return for the first time since 2011.

c171cd48-b912-11e4-8550-78832c2ecbd4

Join us in downtown Nashville on June 25 & 26 for the third installment of the CodeConf series, where the community will come together to continue the conversation around open source, best practices, documentation, and collaboration at a two-day, single-track conference at the beautiful Bell Tower.

Come to CodeConf to hear new talks from thought-provoking speakers, connect with the open source community, and to participate in workshops with expert instructors. Hear all the latest from GitHub and open source project maintainers, and enjoy local food and music with developers from all over the world.

Come with an open mind, leave a better programmer.

Check out the website to sign up for updates, and follow along with @codeconf on Twitter.

The Game Off Returns!

GitHub Game Off III

The GitHub Game Off, our very own game jam is returning next week! We've had some great games submitted in previous years and can't wait to see what you come up with this year.

We'll announce the theme and the details on the blog on March 13th at 9am PST, so please stay tuned. We may even have a twist in store!

The official Twitter hashtag for the Game Off is #ggo15.

Piratocat Shirt

Gather your Ruby and Perl and get your ship ready to set sail into the Sea Es Es with the new Piratocat Shirt.

Piratocat Shirt

Watch out for that Octokraken!!!

Available in the GitHub Shop

See you at GDC!

The Game Developers Conference (GDC) is just a couple of weeks away, and we're giving away 20 expo passes so you can get in on the fun!

In addition to the expo itself, these passes give you access to all the gaming goodness you can handle, including the Game Career Seminar, the Independent Games Festival, and the Game Developers Choice Awards. For more information, please see the GDC passes page.

If you'd like to enter the contest, simply fill out the following short form and tell us about your favorite gamedev-related GitHub repository before Tuesday February 24th 11pm PST. GitHub employees will pick their favorite 20 submissions, and the winners will be contacted via email the following day. All winners will be responsible for their own accommodation and transportation.

GDC Expo Floor

Photo credit: Official GDC, CC BY 2.0

Don't forget to swing by the GitHub booth and say hi if you're there!

The new face of committing in GitHub for Mac

We’ve just redesigned GitHub for Mac’s Changes tab to make it even easier to review lots of changes, and to see what will be shared before clicking Sync:

A long list of changes in GitHub for Mac A long list of unsynced commits in GitHub for Mac

This means that you can focus solely on what’s most important to you: your changes.

We’ve also simplified and improved the process for fixing up a commit you’ve just made. Just click the “Undo” button in the pane that appears:

Recent commit pane with Undo button

And if you don’t want to worry about manually syncing your changes after committing, you can enable “Automatically Sync after Committing” from the Edit menu:

Automatically Sync after Committing in the Edit menu

This is yet another step toward our grand vision for GitHub for Mac, with plenty more to come, so give it a shot! If you already have GitHub for Mac installed, it will update itself to the latest version automatically.

As always, we’d love to know what you think. If you have any comments, questions or bug reports, please let us know.

Announcing: Git Merge Ticket Sales and Speaker Lineup

gitmerge graphic

Git Merge 2015 is heading to Paris April 8-9, and tickets are now on sale! Join us at the beautiful La Gaîté Lyrique for two days of Git festivities.

Tickets are $99 USD, and all proceeds will be donated to the Software Freedom Conservancy. Check out the schedule breakdown below:

April 8th: The Warm Up

On Wednesday, we've lined two options for you to choose from:

If you're looking for some serious skills, sign up for advanced Git training from 11am-3pm. Become a Git expert as you learn from some of the best trainers in the world in a casual workshop setting.

If you're looking for an adventure, join your fellow Git Merge attendees for guided tours of Paris, specially curated for you. Explore and enjoy Parisian food and culture before the conference gets underway.

By invitation only, we will also be holding a Git Contributors Summit on Wednesday for contributors and maintainers of core implementations. Email us at events@github.com if you're a Git contributor who would like to attend.

April 9th: The Main Event

Registration will open at 9am and the main event kicks off at 10am. We've assembled a group of speakers doing amazing things with Git, like:

  • Junio Hamano, Google
  • Rick Olson, GitHub
  • Angelos Evripiotis, Bloomberg
  • Emma Jane Hogbin Westby, author of Git for Teams
  • John Garcia, Atlassian
  • Dirk Lehmann, SAP
  • Wilhelm Bierbaum, Twitter
  • Edward Thomson, Microsoft

There will also be plenty of opportunities to discuss, learn, and collaborate on the future of Git with everyone in attendance. And of course we'll wrap up the evening with a Git birthday party that you won't want to miss.

We hope you'll join us in Paris to celebrate 10 years of Git and the future of things to come. Check out the full site for more details, and to purchase your ticket.

New GitHub Username Shirts in the Shop

Our newest shirt comes in two colors and makes it socially acceptable to write on your clothing with your GitHub username or project name.

Username Shirts

Available in the GitHub Shop.

Git 2.3 has been released

The Git developers have just released a major new version of the Git command-line utility, Git 2.3.0.

As usual, this release contains many improvements, performance enhancements, and bug fixes. Full details about what's included can be found in the Git 2.3.0 release notes, but here's a look at what we consider to be the coolest new features in this release.

Push to deploy

One way to deploy a Git-based web project is to keep a checked-out working copy on your server. When a new version is ready, you log into the server and run git pull to fetch and deploy the new changes. While this technique has some disadvantages (see below), it is very easy to set up and use, especially if your project consists mostly of static content.

With Git 2.3, this technique has become even more convenient. Now you can push changes directly to the repository on your server. Provided no local modifications have been made on the server, any changes to the server's current branch will be checked out automatically. Instant deploy!

To use this feature, you have to first enable it in the Git repository on your server by running

$ git config receive.denyCurrentBranch updateInstead

When shouldn't you use push-to-deploy?

Deploying by pushing to a Git repository is quick and convenient, but it is not for everybody. For example:

  • Your server will contain a .git directory containing the entire history of your project. You probably want to make extra sure that it cannot be served to users!
  • During deploys, it will be possible for users momentarily to encounter the site in an inconsistent state, with some files at the old version and others at the new version, or even half-written files. If this is a problem for your project, push-to-deploy is probably not for you.
  • If your project needs a "build" step, then you will have to set that up explicitly, perhaps via githooks.

See how this feature was implemented

Faster cloning by borrowing objects from existing clones

Cloning a remote repository can involve transferring a lot of data over the network. But if you already have another local clone of the same repository, it probably already has most of the history that the new clone will need. Now it is easy to use those local objects rather than transferring them again:

$ git clone --reference ../oldclone --dissociate https://github.com/gitster/git.git

The new --dissociate option tells Git to copy any objects it can from local repository ../oldclone, retrieving the remainder from the remote repository. Afterwards, the two clones remain independent; either one can be deleted without impacting the other (unlike when --reference is used without --dissociate).

See how this feature was implemented

More conservative default behavior for git push

If you run git push without arguments, Git now uses the more conservative simple behavior as the default. This means that Git refuses to push anything unless you have defined an "upstream" branch for your current branch and the upstream branch has the same name as your current branch. For example:

$ git config branch.autosetupmerge true
$ git checkout -b experimental origin/master
Branch experimental set up to track remote branch master from origin.
Switched to a new branch 'experimental'
$ git commit -a -m 'Experimental changes'
[experimental 43ca356] Experimental changes
$ git push
fatal: The upstream branch of your current branch does not match
the name of your current branch.  To push to the upstream branch
on the remote, use

    git push origin HEAD:master

To push to the branch of the same name on the remote, use

    git push origin experimental

$

The new default behavior is meant to help users avoid pushing changes to the wrong branch by accident. In the case above, the experimental branch started out tracking master, but the user probably wanted to push the experimental branch to a new remote branch called experimental. So the correct command would be git push origin experimental.

The default behavior can be changed by configuring push.default. If you want to go back to the version 1.x behavior, set it to matching:

$ git config --global push.default matching

See how this feature was implemented

More flexible ssh invocation

Git knows how to connect to a remote host via the SSH protocol, but sometimes you need to tweak exactly how it makes the connection. If so, you can now use a new shell variable, GIT_SSH_COMMAND, to specify the command (including arguments) or even an arbitrary snippet of Shell code that Git should use to connect to the remote host. For example, if you need to use a different SSH identity file when connecting to a Git server, you could enter

$ GIT_SSH_COMMAND='ssh -i git_id' git clone host:repo.git

See how this feature was implemented

The credential subsystem is now friendlier to scripting

When Git needs a password (e.g., to connect to a remote repository over http), it uses the credential subsystem to query any helpers (like the OS X Keychain helper), and then finally prompts the user on the terminal. When Git is run from an automated process like a cron job, there is usually no terminal available and Git will skip the prompt. However, if there is a terminal available, Git may hang forever, waiting for the user to type something. Scripts which do not expect user input can now set GIT_TERMINAL_PROMPT=0 in the environment to avoid this behavior.

See how this feature was implemented

Other

Some other useful tidbits:

  • Now Git is cleverer about not rewriting paths in the working tree unnecessarily when checking out particular commits. This will help reduce the amount of redundant work done during software builds and reduce the time that incomplete files are present on the filesystem (especially helpful if you are using push-to-deploy). See how this feature was implemented
  • Now git branch -d supports a --force/-f option, which can be used to delete a branch even if it hasn't been merged yet. Similarly, git branch -m supports --force/-f, which allows a branch to be renamed even if the new name is already in use. This change makes these commands more consistent with the many other Git commands that support --force/-f. See how these features were implemented

Additional resources

Don't forget: an important Git security vulnerability was fixed last December. If you haven't upgraded your Git client since then, we recommend that you do so as soon as possible. The new release, 2.3.0, includes the security fix, as do the maintenance releases 1.8.5.6, 1.9.5, 2.0.5, and 2.1.4, which were released in December.

Keeping GitHub OAuth Tokens Safe

While making your source code available in a public GitHub repository is awesome, it's important to be sure you don't accidentally commit your passwords, secrets, or anything else that other people shouldn't know.

Starting today you can commit more confidently, knowing that we will email you if you push one of your OAuth Access Tokens to any public repository with a git push command. As an extra bonus, we'll also revoke your token so it can't be used to perform any unauthorized actions on your behalf.

For more tips on keeping your account secure, see "Keeping your SSH keys and application access tokens safe" in GitHub Help.

Get ready for GitHub Universe, October 1-2 in San Francisco

GitHub Universe

GitHub is planning a conference like we've never planned before. Get ready for GitHub Universe – part festival, part conference, all for anyone who cares about making great software. From independent developers to large teams, open source to commercial apps and services: we're bringing together every part of the community to discuss how to design, build, and ship software.

Join us and over a thousand GitHub fans for two days of amazing community, industry-leading speakers, in-depth training, immersive activities, and the latest GitHub announcements.

Mark your calendar!

  • When: October 1-2, 2015
  • Where: Pier 70, San Francisco, CA

Stay in the know!

Between now and October, we'll be rolling out updates here on the GitHub blog and over on the GitHub Universe conference website. You can also sign up to get updates about the conference, including notifications when tickets go on sale and ongoing news about speakers and activities.

:rocket:

GitHub Security Bug Bounty program turns one

It's already been a year since we launched the GitHub Security Bug Bounty, and, thanks to bug reports from researchers across the globe, 73 previously unknown security vulnerabilities in our applications have been identified and fixed.

Bugs squashed

Of 1,920 submissions in the past year, 869 warranted further review, helping us to identify and fix vulnerabilities fitting nine of the OWASP top 10 vulnerability classifications. 33 unique researchers earned a cumulative $50,100 for the 57 medium to high risk vulnerabilities they reported.

Bounty submissions per week

We also saw some incredibly involved and creative vulnerabilities reported.

Our top submitter, @adob, reported a persistent DOM based cross-site scripting vulnerability, relying on a previously unknown Chrome browser bug that allowed our Content Security Policy to be bypassed.

Our second most prolific submitter, @joernchen, reported a complex vulnerability in the communication between two of our backend services that could allow an attacker to set arbitrary environment variables. He followed that up by finding a way to achieve arbitrary remote command execution by setting the right environment variables.

New year, higher payouts

To kick off our Bug Bounty Program's second year, we're doubling the maximum bounty payout, from $5000 to $10000. If you've found a vulnerability that you'd like to submit to the GitHub security team for review, send us the details, including the steps required to reproduce the bug. You can also follow @GitHubSecurity for ongoing updates about the program.

Thanks to everyone who made the first year of our Bug Bounty a success. Happy hunting in 2015!

Git Merge returns April 8-9th in Paris

Git will be 10 years old in April, and we're bringing back Git Merge to celebrate. Mark your calendars for April 8-9th to be a part of the only Git user conference of its kind.

Hosted at the La Gaîté lyrique in Paris' 3rd arrondissement, Git Merge will feature with sessions on using Git, scaling Git, and developing on Git from core Git maintainers.

La Gaîté lyrique

Tickets, session details, and hotel information will be available soon. Follow @github on Twitter for updates, or add your email to the list at git-merge.com and we'll let you know as soon as tickets are on sale.

Et voilà!

How to write the perfect pull request

As a company grows, people and projects change. To continue to nurture the culture we want at GitHub, we've found it useful to remind ourselves what we aim for when we communicate. We recently introduced these guidelines to help us be our best selves when we collaborate on pull requests.

Approach to writing a Pull Request

  • Include the purpose of this Pull Request. For example:
    This is a spike to explore…
    This simplifies the display of…
    This fixes handling of…
  • Consider providing an overview of why the work is taking place (with any relevant links); don’t assume familiarity with the history.
  • Remember that anyone in the company could be reading this Pull Request, so the content and tone may inform people other than those taking part, now or later.
  • Be explicit about what feedback you want, if any: a quick pair of :eyes: on the code, discussion on the technical approach, critique on design, a review of copy.
  • Be explicit about when you want feedback, if the Pull Request is work in progress, say so. A prefix of “[WIP]” in the title is a simple, common pattern to indicate that state.
  • @mention individuals that you specifically want to involve in the discussion, and mention why. (“/cc @jesseplusplus for clarification on this logic”)
  • @mention teams that you want to involve in the discussion, and mention why. (“/cc @github/security, any concerns with this approach?”)

Offering feedback

  • Familiarize yourself with the context of the issue, and reasons why this Pull Request exists.
  • If you disagree strongly, consider giving it a few minutes before responding; think before you react.
  • Ask, don’t tell. (“What do you think about trying…?” rather than “Don’t do…”)
  • Explain your reasons why code should be changed. (Not in line with the style guide? A personal preference?)
  • Offer ways to simplify or improve code.
  • Avoid using derogatory terms, like “stupid”, when referring to the work someone has produced.
  • Be humble. (“I’m not sure, let’s try…”)
  • Avoid hyperbole. (“NEVER do…”)
  • Aim to develop professional skills, group knowledge and product quality, through group critique.
  • Be aware of negative bias with online communication. (If content is neutral, we assume the tone is negative.) Can you use positive language as opposed to neutral?
  • Use emoji to clarify tone. Compare “:sparkles: :sparkles: Looks good :+1: :sparkles: :sparkles:” to “Looks good.”

Responding to feedback

  • Consider leading with an expression of appreciation, especially when feedback has been mixed.
  • Ask for clarification. ("I don’t understand, can you clarify?")
  • Offer clarification, explain the decisions you made to reach a solution in question.
  • Try to respond to every comment.
  • Link to any follow up commits or Pull Requests. (“Good call! Done in 1682851”)
  • If there is growing confusion or debate, ask yourself if the written word is still the best form of communication. Talk (virtually) face-to-face, then mutually consider posting a follow-up to summarize any offline discussion (useful for others who be following along, now or later).

These guidelines were inspired partly by Thoughtbot's code review guide.

Our guidelines suit the way we work, and the culture we want to nurture. We hope you find them useful too.

Happy communicating!