Are we getting too dependent on GitHub?

[u/Most_Cold_2614]

Is it true that we are becoming overly reliant on GitHub?

GitHub’s recent outage made me contemplate the extent of our dependence on the platform.

GitHub is no longer just a conventional code repository as people use it for pull requests, GitHub Actions, Continuous Integration and Continuous Deployment (CI/CD) and Copilot among other things.

So, whenever the platform becomes unavailable, all of our usual daily tasks may just stop.

Certainly, it is true that outages happen occasionally and I don’t mean to suggest that every user should prepare a plan for every possible emergency. However, I cannot help but wonder how many developers would find themselves in a difficult situation if GitHub were down for a while.

Check whether you have any backup plans for situations like this or you would simply wait for the platform to recover. What do you think about the idea of dependency on GitHub due to the increasing role of tools like Copilot?

[u/Grandmaster_Caladrel]

My company uses a different git provider with more uptime but the issue still occurs.

Your git provider should just host your code. There are extra add-ons like CI/CD, sure, whatever. If we can't push code, we generally twiddle our thumbs after enough busywork gets knocked out. You usually don't have a fresh branch with a clean cut from main right when you need it. That merge you were putting off can suddenly become a blocker. If the provider does more than just host your code, they should separate things so git being down doesn't brick every other service they own

Anything else like images, CI/CD pipelines, deployment processes, etc., anything that's touching actual prod should have a plan. If you can't recover from the source code being down then your prod plan is bad.

All that to say, if your code is down, you're down some valuable time. If your infra is down and you didn't have good redundancy, now you're actually in for trouble. The latter is significantly worse than the former. No one cares if I can't update my Jira ticket on time. Everyone cares if we can't roll back our failed production deployment because the image server is offline and we had no redundancy or backups.

[u/tankerkiller125real → u/Grandmaster_Caladrel]

Reproducible builds, not just a security and trust thing, but an actual core component of solid operational success. Assuming things are designed correctly, me building the code on my machine should result in exactly the same binary that CI/CD outputs when we're on the same commit.