# Github
> Cloud-based platform used by developers to store, manage, and share their software code.

## Articles

### [Your alt text passes automated checks. That doesn’t mean it’s any good.](https://yomu.fyi/post/your-alt-text-passes-automated-checks-that-doesn-t-mean-it-s-any-good.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Taarik Ashenafi
- Published: Aug 24, 2026

Automated accessibility checkers reliably flag missing alt text attributes but frequently miss unhelpful descriptions like raw filenames or repetitive labels. To evaluate image description quality without generating excessive false positives, GitHub built an alt text plugin for the GitHub Accessibility Scanner. The tool combines five deterministic, zero-credential rules that evaluate strings and visual layout spacing with an opt-in vision model check for subjective context. Page context including headings and surrounding prose is extracted alongside images to guide the model using structured outputs and explicit anti-nitpick instructions. While deterministic checks catch unwritten text, the model-driven rule serves as an opt-in prompt for human review rather than an absolute verdict.


### [Using the GitHub Copilot SDK for Java](https://yomu.fyi/post/using-the-github-copilot-sdk-for-java.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Edward Burns
- Published: Aug 10, 2026

The GitHub Copilot SDK for Java offers a framework-agnostic client library to orchestrate AI agent sessions and tool execution directly from server-side Java code. Unlike framework-dependent alternatives, the SDK supports direct model providers such as OpenAI, Azure, and Anthropic through custom endpoint configurations without requiring a Copilot subscription. Developers can register tools declaratively using the experimental @CopilotTool annotation processor or dynamically through inline lambda definitions with ToolDefinition.from. When integrated into a Jakarta EE 11 application on Open Liberty, agent workflows run on container-managed virtual threads that propagate CDI and transaction contexts during blocking calls like sendAndWait. Real-time event subscriptions capture model execution steps and tool invocations to stream updates over WebSockets without exhausting platform threads.


### [Turn one giant AI-generated pull request to a reviewable stack](https://yomu.fyi/post/turn-one-giant-ai-generated-pull-request-to-a-reviewable-stack.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Julia Muiruri
- Published: Aug 4, 2026

Coding agents often consolidate full-stack features into monolithic pull requests spanning thousands of lines, resulting in delayed reviews and lower feedback quality. To resolve this bottleneck, engineers can decompose comprehensive features into ordered, single-concern layers using GitHub stacked pull requests and the gh-stack CLI extension. Distinct specialized agents handle individual branches—ranging from foundational data access modules up to client interfaces—while CI checks continuously evaluate each layer against the stack base. When reviewers request upstream modifications, running gh stack sync executes a cascading rebase across all dependent branches, preserving commit signatures and keeping the entire pull request chain mergeable.


### [Don’t stop early: Case-folding source code at memory speed](https://yomu.fyi/post/don-t-stop-early-case-folding-source-code-at-memory-speed.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Alexander Neubeck
- Published: Jul 31, 2026

GitHub's code search engine, Blackbird, must case-fold over 480TB of source code across 180 million repositories during indexing and query matching. To accelerate this operation on source code that is overwhelmingly ASCII, the engineering team replaced early-exit branching with an unconditional branch-free loop. The implementation tests uppercase ASCII ranges using wrapping arithmetic, modifies bits in place, and detects non-ASCII bytes with an accumulator register tested only after the loop completes. Eliminating data-dependent exits allowed LLVM to generate SIMD instructions and achieve throughput exceeding 45 GiB/s on an Apple M4 processor. The optimized implementation was released as the open-source Rust crate casefold.


### [Tame Dependabot: Group your updates, slow the cadence, keep security fast](https://yomu.fyi/post/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Bruno Borges
- Published: Jul 29, 2026

Dependabot often floods repository maintainers with individual daily pull requests for single patch bumps, wasting review and continuous integration resources. Microsoft's GCToolkit project mitigated this issue by updating its dependabot.yml configuration to group dependency updates using wildcard patterns and slowing the schedule interval to monthly. The project also expanded coverage to include Maven alongside GitHub Actions so all relevant package ecosystems receive managed updates. Because Dependabot processes security alerts independently of regular version schedules and enforces a default three-day package cooldown, critical vulnerability fixes remain fast while routine maintenance noise drops significantly.


### [The cost of saying yes has changed](https://yomu.fyi/post/the-cost-of-saying-yes-has-changed.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Dalia Abuadas
- Published: Jul 17, 2026

Generating initial code patches has become significantly cheaper with AI agents, shifting the primary expense of small feature requests from writing code to debating scope in meetings. Teams can use agent-generated patches as diagnostic probes rather than final deliverables, turning abstract scope debates into concrete artifacts that reveal true system touchpoints and risks. However, low generation costs do not translate to low ownership costs, as changes touching areas like authorization, compliance, or public contracts still demand significant human review. Constrained attempts allow engineers to price uncertainty quickly and shift scope discipline from pre-implementation speculation to evidence-based code review.


### [Better tools made Copilot code review worse. Here’s how we actually improved it.](https://yomu.fyi/post/better-tools-made-copilot-code-review-worse-here-s-how-we-actually-imp.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Napalys Klicius
- Published: Jul 10, 2026

When migrating GitHub Copilot code review from custom navigation tools to shared Unix-style CLI utilities—grep, glob, and view—benchmarks revealed higher review costs and fewer caught issues. Rather than an issue with the underlying tools, trace analysis showed the agent used general-purpose coding assistant instructions that triggered expansive repository browsing loops. In response, the team rewrote the tool guidance to enforce a review-specific workflow anchored to pull request diffs. The updated instructions direct the agent to narrow candidate call sites and files using batched discovery before reading minimal line ranges with view. This workflow tuning reduced average review costs by approximately 20% in production while maintaining review quality.


### [Automating cross-repo documentation with GitHub Agentic Workflows](https://yomu.fyi/post/automating-cross-repo-documentation-with-github-agentic-workflows.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: David Pine
- Published: Jul 8, 2026

Maintaining documentation across separate repositories often leads to severe lag because technical writers must reverse-engineer shipped features weeks after release. To address this in the Aspire project, the team implemented an automated pipeline using GitHub Agentic Workflows to bridge the product and documentation repositories. When product pull requests merge, a bash step maps milestones to docs release branches before an LLM agent evaluates the diff, drafts documentation updates, and emits structured pull request intents. A dedicated safe-outputs handler materializes these drafts via a scoped GitHub App and assigns the original code reviewers to verify accuracy. Across 396 product pull requests, the system generated 82 documentation pull requests that all merged with a median turnaround time of 44.8 hours.


### [From latency to instant: Modernizing GitHub Issues navigation performance](https://yomu.fyi/post/from-latency-to-instant-modernizing-github-issues-navigation-performan.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Natalie Guevara
- Published: May 14, 2026

GitHub Issues addressed navigation latency by shifting workloads to the client using a local-first, stale-while-revalidate architecture. To evaluate perceived delays, the team tracked user transitions through Highest Priority Content thresholds, aiming for instant rendering in under 200 milliseconds. The core implementation added a persistent client-side cache using IndexedDB, paired with a synchronous in-memory tier to serve hot issue payloads without asynchronous overhead. A selective preheating mechanism resolves missing cache entries for high-intent links without overburdening backend capacity with redundant requests. Following broad rollout, the proportion of instant React soft navigations increased from 4% to approximately 22%, yielding an overall cache-hit ratio of around 33%.


### [How GitHub uses eBPF to improve deployment safety](https://yomu.fyi/post/how-github-uses-ebpf-to-improve-deployment-safety.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Lawrence Gripper
- Published: Apr 16, 2026

Deployment scripts can introduce dangerous circular dependencies when they rely on services or assets from platforms that are currently experiencing outages. Blocking network access at the host level is impractical because stateful nodes continue serving live traffic during rolling deployments. To solve this, GitHub isolates deploy scripts into dedicated Linux cGroups and attaches custom eBPF programs via the cilium/ebpf Go library. The system uses socket-address hooks to redirect DNS queries to a userspace proxy that checks a domain blocklist, while egress packet hooks map DNS transaction IDs to process IDs. This approach successfully prevents deploy-time circular dependencies, provides full command-line audit logs for blocked requests, and speeds up incident recovery.