How GitHub Gave Every Repository a Durable Owner in 45 Days
I led an initiative to validate ownership for every active repository at GitHub, archiving over 8,000 abandoned projects in under 45 days. By implementing custom properties and automated enforcement, we transformed repository ownership from an ambiguous gap into a foundational security requirement, ensuring every active codebase has a clear, validated owner.
For recurring security workflows that fan out across the entire organization, ambiguity presents a real risk.
- roadbuster
If there weren't "clear owners," who was approving code changes for merge?
Every other major arm of Microsoft has been tasked with burdensome controls over tracking any and all production changes to source code, but Github was operating without a useful system and record of ownership for nearly 80% of its repos (11000/14000)?
- simonw
A previous employer hit the problem where there were a ton of legacy features that didn't have clear owners and so it wasn't clear where to route bug reports.
Their solution was to build a catalog of every feature and then assign EVERY one of them to an existing team.
Teams might end up responsible for features that they had never seen before and had no knowledge of... but that was fine, because every other team was in the same situation.
It worked great. Bugs got fixed. Teams figured it out.
- dotwaffle
Needing to list an "executive sponsor" (an individual, not a role or a team) for each and every item in a service catalogue seems like mindless bureaucracy.
Meanwhile, having "custom properties" attached to each repo feels very much like administering JIRA, and schema-less YAML blobs that pervade the GitOps world.
Is it just me, or isn't the glaringly obvious solution to this an actual database and API, rather than just tacking on random bits of metadata that have no real-time validation etc?