今日已更新 84 条资讯 | 累计 37333 条内容
关于我们

标签：#github

找到 1538 篇相关文章

AI 资讯

1a vez trabalhando com git com time: tudo que você precisa saber

Faz mais de 5 anos que eu não abria um PR ou issue técnica no Github, mas essa semana tenho aprendido algumas boas práticas e termos que reuni neste artigo. Introdução Essa semana eu fiz uma coisa simples: atualizei o README de um projeto open source, o 4noobs , da comunidade He4rt. Troquei um badge, ajustei o contraste de um logo, organizei umas pastas e adicionei um índice pra facilitar a navegação. Nada muito complexo no fim das contas. Só que antes de chegar no "nada muito complexo", eu passei um tempo enrolada com uma pergunta boba: "E se eu mandar isso direto pra branch principal e bagunçar tudo?" Se tu já sentiu esse friozinho na barriga antes de mexer num repositório que não é só teu, esse artigo é pra ti. Não importa se tu é dev há anos ou se nunca abriu um terminal na vida... A lógica por trás de "como contribuir sem quebrar nada" é a mesma e bem mais simples do que parece. Definição de Git Colaborativo Quando eu aprendi git há uns anos, aprendi somente o versionamento e a enviar os arquivos pra dentro do Github, mas ele é bem mais que isso, né? É através dele que times enormes interagem a respeito de um mesmo projeto de forma organizada, comentando, gerenciando tarefas, sugerindo melhorias e conhecendo o que os outros envolvidos estão fazendo. Isso é a parte do Git Colaborativo . O Git resolve isso com um conceito central: branches (ou "ramificações"). Cada branch é tipo uma cópia paralela do projeto, onde tu pode mexer à vontade sem afetar a versão "oficial" (geralmente chamada de main ou master ). Quando tu termina sua parte, tu propõe que essas mudanças sejam incorporadas de volta pelo Pull Request (PR) . Ou seja, o fluxo básico é: Tu cria uma branch nova a partir do projeto principal Faz as alterações lá, no seu espaço isolado Envia ( push ) essa branch pro repositório remoto Abre um Pull Request pedindo pra essas mudanças serem revisadas e, se aprovadas, unidas ( merge ) à branch principal Ninguém mexe direto na versão "de produção" do projeto. Isso

2026-08-20 原文 →
AI 资讯

Passing GSoC Midterms

Hey everyone! Weeks 7 and 8 are done, and the biggest news first: I passed the midterm evaluation🎉. Half of GSoC is behind me now. These two weeks were less about writing new classes and more about going back and making the ones I already had a lot stricter. Here is what happened. PR #1920: The RatioEstimatorBuilder This PR adds the builder for the NRE family, so NRE_A , NRE_B , NRE_C and BNRE all get the same typed interface that NPE and NLE already had. The builder itself was honestly the easy part. By now the pattern is well established, so it was mostly mirroring what already worked, with linear , mlp and resnet as the classifier options. The interesting part was what my mentor Jan Teusen suggested we bundle into the same PR. Some improvements to the base class PR #1920 was the first PR that proved the shared base class serves a third family. My Mentor, Jan pointed out that this was exactly the right moment to fix the validation gaps in that base, because then the NRE builder and the vector field builder that was coming next would inherit the fixes for free, instead of me retrofitting four builders later. So we folded a hardening bundle into the same PR: Invalid Literal values now raise at construction. This was the real gap. If you typed a wrong field name , Python already raised a TypeError for you. But if you typed a wrong value on a correctly named field, like z_score_input="idependent" , nothing happened until you called .train() and it blew up much later. Now it fails immediately. Model-incompatible kwargs now raise too. Passing num_blocks to a linear classifier used to be silently dropped, and the same argument on mlp crashed late. Both are caught at construction now by inspecting the target build function's signature. frozen=True on the config dataclasses. Configs are now immutable. If you want a different setting, you make a new object instead of mutating the old one. This sounds like a small thing but it removes a whole class of " I changed the config

2026-08-19 原文 →
AI 资讯

GitHub API Rate Limits: an Unauthenticated 304 Still Costs You a Request

No token. One IP. July 29, 2026: GET /repos/python/cpython 200 5996 B remaining 32 -> 31 + If-None-Match (no Authorization header) 304 0 B remaining 31 -> 30 + If-None-Match 304 0 B remaining 30 -> 29 + If-None-Match 304 0 B remaining 29 -> 28 Three conditional requests. Three 304 Not Modified . Zero bytes of body across all three. Three requests gone from a bucket of 60 per hour. I opened the terminal to write the opposite post. The short version: if you call the GitHub REST API without an Authorization header, an If-None-Match request that comes back 304 still decrements x-ratelimit-remaining . The ETag saves you bytes. It does not save you quota. GitHub's documentation states the claim five times on one page and attaches the condition to two of them, and that clause falls off easily when a sentence gets quoted on its own. The post I meant to write My working title was something like "poll GitHub for free with ETags". I believed it. I had read the sentence about 304 responses not using your rate limit, I had repeated it to other people, and the plan was a tidy little piece with a before-and-after budget chart. The first run killed it. remaining went down. My first reaction was that my counter reading was wrong, which is the normal reaction and usually the correct one. It was not wrong. So the post changed, and the finding turned out to be worth more than the one I went in with. Does a 304 count against the GitHub rate limit? What the docs actually say Here is the part that matters, and I want to be precise because it would be easy and dishonest to turn this into "GitHub's docs are wrong". They are not. On the page Best practices for using the REST API the claim shows up five times. Two of the five carry a condition; three do not. Here is the strict one, the only place on the page where the condition is spelled out as a header: "Making a conditional request does not count against your primary rate limit if a 304 response is returned and the request was made while c

2026-08-19 原文 →
AI 资讯

How We Built a Safe GitHub Bounty Lifecycle for MyZubster

How We Built a Safe GitHub Bounty Lifecycle for MyZubster MyZubster is evolving into a distributed ecosystem of repositories, services, automation, hardware projects, AI components, and contributor workflows. As the number of repositories and contributors increased, one problem became increasingly important: How do we automate bounty workflows without accidentally treating a GitHub event as proof of payment, verification, or settlement? We recently completed an important part of that architecture: a real-time GitHub bounty lifecycle system . And we tested it end-to-end. The lifecycle We use an explicit bounty lifecycle instead of assuming that an issue, pull request, or merge means a bounty has been completed. The lifecycle is roughly: text PROPOSED ↓ VALIDATED ↓ APPROVED ↓ FUNDED ↓ ACTIVE ↓ SUBMITTED ↓ UNDER_REVIEW ↓ VERIFIED ↓ REWARD_RECORDED ↓ SETTLEMENT_PENDING ↓ SETTLED The important part is that GitHub automation only controls a limited part of this flow. Today, GitHub can automatically move a bounty through: APPROVED ↓ assignment ACTIVE ↓ linked PR SUBMITTED ↓ review UNDER_REVIEW And then automation stops. GitHub Webhooks Across the Ecosystem We configured repository webhooks across 17 first-party MyZubster repositories. The subscribed events are: issues pull_request pull_request_review The central endpoint is: POST /api/github-bounties/webhook The backend is Node.js / Express and validates GitHub webhook signatures using: X-Hub-Signature-256 with an HMAC-SHA256 secret. Unsigned requests are rejected. For example: POST /api/github-bounties/webhook → HTTP 401 while valid GitHub webhook deliveries receive a normal application response. A Useful Production Bug: PM2 Had a Stale Secret One of the most interesting parts of the deployment was a real production debugging problem. GitHub was delivering webhook events correctly, but every delivery returned: 401 Unauthorized Cloudflare was healthy. The public API was healthy. The webhook route was healthy. GitHub delive

2026-08-19 原文 →
AI 资讯

The Most Dangerous File in Your Repo Might Be SECURITY.md

Developers write far more legally consequential prose than they think, and almost none of it is code. It's the SECURITY.md in the repo root. It's the "Security" page someone in marketing asked you to fill in three years ago. It's the status page update typed at 2 a.m., and the sentence in a customer notice specifying exactly which data was affected. The research summarized in this overview of what the evidence shows about cyber incident disclosure treats post-breach communication as a measurable discipline with predictable failure modes — and the enforcement record of the last three years has quietly turned it into an engineering discipline too. In the most closely watched cybersecurity case of the decade, the only allegation that survived a motion to dismiss concerned a technical description of access controls posted on a website. The claim that survived was written by engineers On July 18, 2024, Judge Paul Engelmayer of the Southern District of New York issued a 107-page opinion in the SEC's case against SolarWinds and its CISO. Most of it was a defeat for the agency. Claims built on blog posts, press releases, and podcast appearances were dismissed as non-actionable corporate puffery — statements too general for any reasonable investor to lean on. The theory that cybersecurity controls fall under "internal accounting controls" was rejected outright. Post-incident 8-K disclosures were held to be reasonable given what was knowable at the time. One thing lived: the company's "Security Statement," a technical page describing its practices to customers. The court let claims proceed specifically on its representations about access controls and password policy , because those were concrete enough to rely on and, as pled, contradicted by internal presentations, security assessments, and Slack messages. The SEC ultimately dismissed the whole action with prejudice in November 2025, so no liability was ever established — but the legal line drawn in 2024 didn't go anywhere.

2026-08-18 原文 →
← 上一页 下一页 →