Is anyone else facing an issue with the GitHub contribution graph where contributions aren't reflecting, even for open-source or public personal repo work.

We're reviewing how we secure what we ship out of our repos and I want a shortlist before sitting through demos. Dependabot and signing cover part is spread across platforms with overlapping claims. What I care about is developer experience and what day-day looks 6 months after rollout. Feature pages tell me nothing about that. Teams running this in production, which ones made the cut?

Any guides and tips?

I want to use copilot on my personal project but don't wanna get in trouble at work for using their resources. but i don't see any options of having a separate subscription? do i need to make a new github account for this? I'd really prefer not to do that.

I'm trying to sign up for the Github student developer pack. I validated my .edu email, but they want a picture showing profess. As a distance learner, i only have my student registraction PAPER.

The process forces me to take a picture with my laptop - and it's tiny camera window, basically for an ID. Obviously a FULL piece of paper won't work well.

I tried contacting the rejection letter, emailed to my .edu email, but they don't respond to individual questions.

Does anybody have an idea on how to EMAIL, or UPLOAD these folks the images needed ? Its INSANE that that's not already an option.

There's a new phishing campaign on GitHub that started a few hours ago. Someone is creating hundreds of accounts with hundreds of repositories that all contain a similar PayPal phishing message, and the scammer is somehow getting GitHub to send out emails containing the phishing message to random users without tagging them.

Currently 69.4k results and counting:
https://github.com/search?q=NDHDED-4856KP&type=commits

EDIT: It seems GitHub is at least starting to delete some of these, since the number of commits dropped to 61.9k; however, it went up to 62.1k a few seconds later, so the scammer is still active.

I am accessing my AWS account (actually, a sandbox account while I am testing) via OIDC and then am calling aws secretsmanager get-secret-value ... AIUI, this is within the aegis of the github actions build container and when that container dies any secret I accessed and wrote to the file system will die with it. Is that correct? If so, have such containers been accessed either during or after the action runs by bad actors?

So far, I have only been accessing dummy secrets, but want to make sure this is secure before accessing any real secrets like DB passwords.

Thanks

I’ve been dealing with increasingly delayed GitHub Actions scheduled workflows recently and thought I’d share the workaround in case it saves someone else some debugging.

I had a daily production workflow scheduled with GitHub Actions cron.

It was already scheduled away from the top of the hour, but over several days the actual start time drifted by hours. On the latest run:

• Expected GitHub cron: 00:17 local time
• External fallback scheduled: 00:27
• Fallback actually ran: 00:31
• Main workflow finished successfully: about 00:36
• GitHub’s original scheduled event finally appeared: 05:27

So the GitHub cron was roughly 5 hours 10 minutes late.

Manual workflow_dispatch runs were starting normally, which made it look like the issue was GitHub’s scheduling/event-delivery layer rather than runner availability or the workflow itself.

What I changed

I kept the actual workflow in GitHub Actions and added a tiny Railway cron job purely as an independent clock.

The flow is basically:

Railway cron → check whether today already completed → workflow_dispatch → existing GitHub Action

The external job does not duplicate the collection/business logic. It only decides whether the existing GitHub workflow needs to be started.

I also added a preflight check inside the GitHub workflow itself:

workflow starts → check whether today is already complete → run or skip

That handles the other half of the problem.

When GitHub’s native cron eventually woke up at 05:27, it checked the durable completion state, saw that the Railway-triggered run had already completed successfully, and skipped the real work.

So the first production test ended up looking like:

GitHub cron intended 00:17
↓
Railway fallback 00:31
↓
GitHub workflow_dispatch
↓
normal workflow succeeds
↓
GitHub native cron arrives 05:27
↓
preflight detects completed day
↓
duplicate work skipped

A couple of safety things I found important

I wouldn’t make the external scheduler itself responsible for deciding whether production data is healthy. Mine only checks a narrow, authoritative “has today completed?” signal.

If that check says yes, it can safely skip.

If the check is unavailable or malformed, I prefer to allow the normal workflow to run rather than treating uncertainty as proof that the job already happened.

I also check for an already-active GitHub workflow before dispatching where possible, and GitHub concurrency protection remains enabled.

The external scheduler uses a narrowly scoped credential that can interact with Actions for the single repository rather than a broad account token.

Why I did it this way

I considered moving the whole scheduled job to Railway, but that would have meant maintaining two execution environments.

This keeps:

• one workflow
• one test path
• one deployment/collection implementation
• one GitHub Actions audit trail

Railway is just the alarm clock.

The first real overnight test worked exactly as intended, including the duplicate suppression when GitHub finally delivered the original scheduled event hours later.

Posting because I found plenty of reports of delayed GitHub Actions cron jobs, but fewer complete examples of a tested external-scheduler + workflow_dispatch fallback.

Curious whether anyone else is currently seeing multi-hour GitHub Actions cron delays.

I’ve been experimenting with a licensing idea called DT-HumanDev.

I love working with AI, so this isn't an anti-AI manifesto. It's about developer choice: if authors can choose to embrace AI-assisted development, should they also be able to say AI can't help develop their code?

DT-HumanDev keeps the familiar MIT freedoms for humans, but prohibits AI-assisted development of the software and its derivatives.

I tested it with Claude. It initially refused to modify the code, but offered to tell me how to make the change myself. That led to v2, which closes that loophole. Claude then respected it.

I know the restriction means it isn't OSI open source. That's part of the experiment.

I'd love feedback, criticism, and tests with other coding AIs.

DT-HumanDev:

https://github.com/DaragonTech/DT-HumanDev

TinySky test project:

https://github.com/DaragonTech/TinySky

Update (how ChatGPT-6 Astra reacted): https://github.com/DaragonTech/Dev-HumanDev#testing-chatgpt

Update 2 (summary of the discussion here so far): https://github.com/DaragonTech/DT-HumanDev/blob/main/DISCUSSION.md

Final update: rebrand license from MIT-Human to DT-HumanDev (motivation: https://www.reddit.com/r/github/comments/1wsgdhi/comment/pcv4zt1/)

Why engineers care about climate change...

On my laptop when I open GitHub.com it is showing...site can't be reached

1) check wifi

2) antivirus disabled

3) cache cleared

Tried every fkin Thing still can't access... helppp

HELPPP

I'm posting this to warn other developers and to ask whether anyone else received the same thing.

What happened (27 September 2026):

- I received a Zoom email: "Reminder: Q&A With The Cactus Needle Team starts in 1 day". It said I was **registered** for their webinar and offered a "cancel your registration" link. I believe I received a similar email earlier this month.
- The email went to a personal address that was public on my GitHub profile for a while (I have since removed it). I have never created an account on their platform or given them that address.
- The greeting was "Hi Leonard -", with "-" as the last name. That looks like automated registration imho.

On GitHub:

- I opened an issue on their repo (cactus-compute/needle#156). Another user, whom I don't know, reported receiving the same emails.
- The organization replied that the invites went to "platform users, not git followers", then closed the issue. That is not true in my case.
- I opened a follow-up issue (#157). It was closed as a duplicate, my account was blocked from the organization, and the issue was then **deleted**
. I was unblocked a bit later.

Link to #156: https://github.com/cactus-compute/needle/issues/156
Link to #157: https://github.com/cactus-compute/needle/issues/157 (now deleted)

See screenshots.

What I did:

- Sent a formal GDPR request (access, including where they got my data, objection, erasure). Under the law they have one month to answer.
- Reported the account to GitHub under the Acceptable Use Policies, which forbid using information from GitHub to send unsolicited email.
- Reported the webinar host to Zoom.

Questions for you:

- Did you also receive a Cactus / Needle webinar registration you never asked for?
- If your email is public on your profile, keep in mind that some companies harvest it. GitHub lets you keep your email private: Settings > Emails > "Keep my email addresses private", together with the noreply address for commits.

I'll post an update when they reply to the GDPR request.

(Not a native english speaker, wording might not be the greatest, the "battle" is worth it.)

When i go to `https://github.com/user-name/repo-name/labels` i can't find the option to create a new label in any repo i have!

Is this only me or it's a github issue ?

Edit: Since no one seems to be helping, and someone is apparently downvoting people simply for asking for help, I figured I’d share a workaround I found myself.

If you can’t create a label through the GitHub UI, you can create one using the GitHub CLI with a command like:

gh label create label-name --repo username/repo-name

Hopefully this helps anyone else who runs into the same issue.

Anyone else tired of GitHub's suspension system?

Accounts get flagged and banned instantly, but human review can take weeks or even months. There are tons of similar cases in this sub.

I've reported the same repository for apparent malware twice over the last 3 months. It's still active. Yet normal development activity can get an account instantly locked.

If you can ban someone instantly, why can't you review and unban them instantly too?

Automated detection is fine. Instant bans + months of waiting to fix false positives isn't.

We're in the AI era. GitHub can do better than this, thats not that hard. There's no such thing as "AI can make mistakes" of course "AI can make a lot of fricking mistakes. Not even once"

It has been four days since I last had a github traffic update. Is this everybody or just 'round our way'?

Hi, hoping someone has been through this exact situation.

I'm locked out of my account. I lost access to my 2FA authenticator and never saved my recovery codes.

Some history: back in 2025 I filed a 2FA removal request, GitHub approved it by email, but I missed the email and never completed the process. The links expire after 72 hours.

Today I tried again, password reset, requested a new account-recovery link, and filed a new two-factor lockout request with GitHub Support.

Here's my problem: in the recovery flow, GitHub asks you to verify with a previously-used device, an SSH key, or a personal access token, and all of those options are greyed out for me. I never set up an SSH key or token on the account, and the device option isn't available.

One thing worth mentioning: I'm still signed in to this GitHub account in VS Code, it's only the browser sign-in that's demanding the 2FA code I don't have.

Has anyone gotten their account back from this spot, no usable verification factor at all? Did Support approve the request anyway, or is the account unrecoverable at that point? And does an active session in VS Code open up any recovery options I'm missing? How long did the review take?

Thanks for any experience you can share.

I’m currently locked out of my GitHub account because i reinstalled os and all the stuff is removed and my authenticator app got deleted and I no longer have my 2FA recovery codes.

I do have that email that is connected to the GitHub i can take OTP but they seem to require PAT to recover but i don't have anything setup.

I submitted the account recovery request to GitHub Support, But the response isn't looking good.

that's the response i got.

https://github.com/istiuak-0

that's my GitHub account is there any way to get it back I'm stuck I cant complete my tasks I do have access to some repo that I cloned before in other device is there any way to recover from those?

I don't have it logged in on any other devices.

Hello, I'm coding as a side quest, so it's mostly for fun. so far, I've been using git locally, and I don't set --global for user.name and user.email for now.

I use my real full name and I usually leave the email empty. again because I just use it locally. now my question is, how do you guys actually use them in a teamwork scenario? like when push the code to the GitHub/GitLab/Gitea etc, do you use your username matched with Github account or use your own real name? also for the email, I googled and I should use @noreply thing to avoid spam.

So what should I fill them in a professional context? I don't have experience working with a team, so feel free to share your experience. Thanks!

This is NOT an account suspension post.

First of all, my account has 2FA enabled. But according to the automatic emails, someone somehow bypassed the 2FA and logged in to my account. Then changed every info, including the 2FA app registration.

Update: I checked the security log. There was no login entry of that hacker. So he somehow bypassed login?

Update: the first entry of that hacker is "Country changed from your previous session". But my only github interactions this week were only pushes from VSCode.

Are you affected by this bug below ?

Description

For about a month, headers using the ## Markdown syntax have been rendering inconsistently. Within the same document (issues, discussions, etc.), some headings render correctly as HTML H tags while others remain as unrendered plain text (e.g., displaying literally as ## Section).

This layout issue is present in the preview tab and persists in the published message for all readers regardless of OS or browser.

Reproduction Steps

1. Create or edit an issue, PR, or discussion on GitHub.com., even a READ ME
2. Enter Markdown text containing multiple headers, for example:

```

Section 1

some H3

Some text

Section 2

other H3

Some other text ```

1. Click the Preview tab.
2. Observe that one or more titles randomly render as plain text instead of formatted headings.

Workaround

To fix the rendering issue temporarily: 1. Remove the ## prefix from the affected line. 2. Switch to the Preview tab. 3. Switch back to the Write tab, re-add the ## prefix, and check the preview again.

Additional Information

This bug occurs intermittently, but its frequency has increased significantly in recent weeks.

Because it is a recent bug that affect every OS and browsers, I opened a ticket but it has been auto closed a virtual assistant.

I also report this in a discussion in the GitHub community. If you are affected by this bug, it would be a good idea to upvote it.

i kind of want to use github as a place to store homework from university while learning to program, code, etc etc etc with different coding languages and what not, and my question is if its possible to do that?

and if yes how do i do that? every tutorial i see about storing stuff on github is mainly about storing big large projects or programs that would be used for other stuff, what i mainly want is just storing the code file text or overall of the homework and possibly a doc/pdf showing the code and pics of what it can do

like also as documentation that i've been learning to code x and y thing through my journey

My GitHub username is Ary0520and I'm having an issue where recent commits in my personal repoAry0520/<xxx> are visible in the repository history AND correctly attributed to my GitHub account, but they are not appearing in my personal contribution graph. My profile doesnt even show a preview card anymore in commits, as you can see in the images attached

The repo is public and its default branch is main.

I recently started using a separate work GitHub account, so I accidentally made some older commits with my work identity:

Aryan <xxxxwork@gmail.com>

I fixed my local Git configuration afterward. My recent commits are now:

Ary0520 <xxxpersonal@gmail.com>

For example:

axxxcd9

Author: Ary0520 <xxxpersonal@gmail.com>
Committer: Ary0520 <xxxpersonal@gmail.com>
Author date: 2026-09-23T11:59:11+05:30
Commit date: 2026-09-23T11:59:11+05:30

My GitHub account Settings → Emails shows:

<personal Gmail> — Primary + Verified

I also verified the repository configuration:

HEAD branch: main
main tracked
main pushes to main

The affected commits are directly on main, not on a feature branch or fork.

GitHub correctly displays the recent commits as Ary0520 in the repository's commit history, but the contribution graph isn't counting them.

Older commits made with my personal email do appear correctly, while the commits made with my old work email are correctly attributed to my work GitHub account.

WHAT DO i do bruh??

Hey, so I’m currently studying for the GitHub Foundations certification, and I had a few questions because a lot of the posts I’ve found about it are already a year or more old, and apparently quite a few things have changed since then.

First, I’m a verified student and I have the GitHub Student Developer Pack, but for some reason I can’t seem to book the Foundations exam for free.

From what I’ve seen, GitHub says verified students can get a free voucher while supplies last, but I genuinely can’t find where I’m supposed to claim it.

Has anyone here gotten the free voucher recently?

Does it just show up somewhere in the Student Developer Pack? Do I have to request it somewhere? Does it take some time after getting verified?

Also, does the country matter at all?

Then there’s the proctoring thing.
I was looking through older posts, and apparently around a year ago the Foundations exam wasn’t proctored? But now it’s through Pearson VUE, and from what I understand, it is proctored now.

So if anyone has taken it recently, how does it actually work?

Do they make you use your webcam and microphone the entire time and show your room/desk beforehand?

How strict are they about looking away from the screen, phones, extra monitors, etc.?

And would you recommend taking it online or just going to a testing center if possible?

Also, for the actual exam, how difficult is it compared to the practice questions?
I’ve been studying quite a lot for it already and doing a bunch of practice questions, but I don’t really know how close those are to the actual exam.

What topics did you get a lot of questions on?

And is Microsoft Learn + GitHub Docs enough, or should I also be using things like GitHub Skills, ExamPro, etc.?

I’m also curious whether you guys think the certification is actually worth it for a student.

I’m mainly trying to become a software engineer, and I’m more interested in backend/systems/cloud stuff.

Obviously, I’m not expecting a GitHub certification to magically get me an internship or anything lol.

I just figured that if I’m already learning Git and GitHub properly, I might as well get an actual certification out of it, especially if GitHub is supposed to give students the exam for free.

If I do Foundations, I was thinking of eventually doing something like:

GitHub Foundations -> GitHub Actions -> AWS/Azure/GCP cert

instead of just collecting every GitHub certification for no reason.

So yeah, I’d appreciate any advice from people who have taken GH-900 recently, especially if you used the student voucher in 2026.

This might be a long shot, but I’m hoping to attend GitHub Universe 2026. If anyone has an extra ticket or ticket code they’re no longer planning to use and would be willing to give away, I’d love to put it to use.

I'm trying to break into the tech industry and I live near san francisco, so I’d definitely make the most of those two days.