# GitHub API GitHub APIs are REST and GraphQL interfaces for extending and customizing GitHub integrations. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## SDK vs CLI vs MCP, a dev story DevFeed: [SDK vs CLI vs MCP, a dev story]() Original publisher: [Read original article]() Author: Anthony Viard Published: 2026-09-17T16:00:00Z Content type: opinion Language: en Sources: [Postman Blog]() Topics: [SDKs](), [MCP Server](), [Command-line interface](), [GitHub API](), [Claude Code](), [GitHub]() Tags: [ai-agents](), [claude](), [cli](), [code](), [general](), [mcp](), [mcp-server](), [model-context-protocol](), [postman](), [sdk](), [sdk-generation]() ### AI overview A developer compares SDKs, command-line tools, and MCP servers as ways for an agent to access the GitHub API. Using an internal release-readiness tool as a case study, the article explains that SDKs suit scheduled, predefined code while interactive agent use may require more improvisation. ### Source excerpt SDK, CLI, or MCP server for your agent? I measured the token cost and auth tradeoffs of all three against one real API. See which to pick. The post SDK vs CLI vs MCP, a dev story appeared first on Postman Blog. ## GHarchive data has become unreliable for measuring GitHub activity DevFeed: [GHarchive data has become unreliable for measuring GitHub activity]() Original publisher: [Read original article]() Author: KD (noreply@blogger.com) Published: 2026-09-03T16:00:00Z Content type: opinion Language: en Sources: [Google Open Source Blog]() Topics: [data](), [datasets](), [GitHub](), [Crawler](), [GitHub API](), [Open Source](), [GraphQL]() Tags: [collect](), [data](), [dataset](), [datasets](), [github](), [google](), [google-open-source](), [graphql](), [open-data-sets](), [open-source](), [oss](), [pipeline](), [pull-requests](), [retention](), [stream](), [volume]() ### AI overview This article examines the reliability of open source data, focusing on GHarchive's coverage of GitHub events. It argues that GHarchive should not be used for real-time or volume-based metrics because event retention has declined and some activity is omitted by the GitHub Event stream and API limitations. ### Source excerpt by Sophia Vargas, Google Open Source & Andrew Nesbitt, Ecosyste.ms Every second, open source contribution quietly shapes the software we rely on, and yet our view of this open ecosystem is surprisingly opaque. Open source development is performed in public spaces -- we can see the commits, issues and comments, the APIs and endpoints are free to use -- the logs are just sitting there, so why can't we just collect all of the data? ...Said every researcher, everywhere. However in most cases of open source related data, we are only looking at part of the whole. Why am I writing this post? Because many of us (including many business decision-makers) are too comfortable with unsubstantiated data. We've gotten used to it. Our models assume that it's smelly and we adjust the logic and weights to compromise. When it comes to open source, our confidence is even lower, even though our resulting decisions can directly impact individuals whom we collectively depend on. Let's consider one of my favorite datasets: GHarchive. Started as a hobby project in 2011, this crawler has amassed more than 15 years of event data from GitHub. While this source provides a historical record of open source development on GitHub, as a real-time or comprehensive source of metrics, it's unreliable and should not be a source for volume-based metrics. In 2025, GHarchive captured 14% fewer events than in 2024, despite steady growth in platform adoption. Since 2025, we estimate that data retention in GHarchive has fallen to ~50% and in 2026 it may be as low as 20% for some event types (see figure below). Prior to 2025, you could make the general assumption that the majority of events would be represented in this pipeline. Since 2025, we must now assume we may be missing at least half of events and possibly more -- not to mention all of the additional activity that's left out of the event API (see GitHub's GraphQL API.) The crawler logic behind this dataset is simple: give me all the events from the GitHub Ev ## Context Layer for AI SDLC: What It Is and How to Build Yours DevFeed: [Context Layer for AI SDLC: What It Is and How to Build Yours]() Original publisher: [Read original article]() Author: Zohar Einy Published: 2026-08-10T11:34:08Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [Artificial Intelligence](), [AI Agent](), [sdlc](), [context window](), [API](), [GitHub API](), [GitHub](), [Security]() Tags: [ai](), [ai-agent](), [api](), [context-window](), [cost](), [engineering](), [github](), [how-to](), [sdlc](), [security]() ### AI overview This article explains context layers for AI-driven software development. A context layer consolidates continuously updated information about services, ownership, dependencies, runtime state, permissions, and organizational relationships so agents can query one accurate model instead of repeatedly combining data from separate tools and APIs. It discusses what to include, whether to build or buy, possible uses, return on investment, measurement, and implementation, while reporting an 80% reduction in per-query agent cost in Port's measurements. ### Source excerpt Learn what a context layer is, what goes into one, whether to build or buy one, and how it cuts AI agent costs across the SDLC. ## Coordinated GitHub API enumeration and access token abuse DevFeed: [Coordinated GitHub API enumeration and access token abuse]() Original publisher: [Read original article]() Author: Julie Agnes Sparks Published: 2026-07-08T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [GitHub](), [GitHub API](), [Security](), [API](), [Authentication](), [OAuth](), [GraphQL]() Tags: [api](), [auth](), [authentication](), [github](), [networks](), [oauth](), [security](), [tokens](), [tooling]() ### AI overview Datadog Security Research describes coordinated campaigns abusing the GitHub API to enumerate organizations, repositories, and users. The activity combines automated scraping, ghost accounts, compromised OAuth tokens, and personal access tokens; in some cases, attackers progressed from public-data enumeration to cloning private repositories. ### Source excerpt Datadog Security Research has tracked multiple coordinated campaigns enumerating GitHub organizations, repositories, and users through the public GitHub API, abusing leaked access tokens, and cloning private repositories. ## How to Sell Access to a Private GitHub Repo DevFeed: [How to Sell Access to a Private GitHub Repo]() Original publisher: [Read original article]() Author: Ayush Agarwal Published: 2026-03-28T00:00:00Z Content type: tutorial Language: en Sources: [Dodo Payments Blog]() Topics: [GitHub](), [GitHub API](), [API]() Tags: [api](), [developer-tools](), [github](), [guide](), [how-to](), [license-keys](), [payment](), [payments](), [repo]() ### AI overview This guide explains how to sell access to a private GitHub repository using Dodo Payments license keys and the GitHub API. It describes an automated flow in which a successful payment triggers a webhook that invites the customer to the repository. ### Source excerpt Learn how to sell access to a private GitHub repository using Dodo Payments license keys and the GitHub API to automate invitations on successful payment. ## Building a /now Page That Updates Itself DevFeed: [Building a /now Page That Updates Itself]() Original publisher: [Read original article]() Published: 2026-03-23T00:00:00Z Content type: tutorial Language: en Sources: [Alex Korbonits]() Topics: [Astro](), [GitHub Actions](), [GitHub API](), [GitHub Pages](), [RSS Feed](), [builds]() Tags: [api](), [astro](), [github](), [github-actions](), [github-pages](), [javascript](), [rss]() ### AI overview A tutorial on building an Astro /now page that fetches GitHub activity and Goodreads data at build time, then uses scheduled GitHub Actions rebuilds to keep the page current. It also covers local SSL issues and manually maintained content. ### Source excerpt How I added a /now page to my Astro blog that pulls live GitHub activity and Goodreads data at build time -- and rebuilds itself every morning without me touching anything. ## How to Query GitHub for User Contributions in a Specific Timeframe DevFeed: [How to Query GitHub for User Contributions in a Specific Timeframe]() Original publisher: [Read original article]() Author: Chris Hager Published: 2025-10-10T00:00:00Z Content type: tutorial Language: en Sources: [Chris Hager]() Topics: [GitHub](), [GraphQL](), [GitHub API]() Tags: [api](), [contributions](), [github](), [graphql](), [how-to](), [query](), [repositories](), [timeframe](), [tracking]() ### AI overview A tutorial showing how to use the GitHub GraphQL API to list public repositories a user contributed to during a specified timeframe, with an optional modification to include commit counts and format the output. ### Source excerpt I needed needed to find all public GitHub repositories a user has contributed to within a specific timeframe, and wanted to share - and record for myself - the API query I learned. This can be a useful for generating reports, tracking progress, analyzing activity over a certain period, and more. Use the GitHub GraphQL API We leverage the GitHub GraphQL API to get the list of public repositories a user contributed to within a specific timeframe, using the contributionsCollection field to specify a time range and retrieve contributions made by a user during that period. ## Experiments with POSSE DevFeed: [Experiments with POSSE]() Original publisher: [Read original article]() Published: 2024-05-13T03:28:54Z Content type: opinion Language: en Sources: [Jeremy Kun]() Topics: [Mastodon](), [Hugo](), [GitHub Actions](), [Netlify](), [GitHub](), [GitHub API](), [static-site-generator](), [Python](), [Serverless](), [Markdown](), [Command-line interface]() Tags: [cli](), [github](), [github-action](), [github-actions](), [hugo](), [indieweb](), [markdown](), [mastodon](), [netlify](), [posse](), [python](), [shortform]() ### AI overview The author describes an experiment that automates POSSE syndication by converting Hugo shortform posts into Mastodon threads. Netlify triggers a serverless function, which uses the GitHub API to start a GitHub Actions workflow; a Python script parses Markdown, publishes the thread through Mastodon.py, and records URL mappings in the repository. ### Source excerpt POSSE stands for Publish (on your) Own Site, Syndicate Elsewhere. I first heard about it from Cory Doctorow. I'm experimenting with automation to convert posts tagged shortform into Mastodon threads (I'm mathstodon.xyz/@j2kun). I'm using Hugo as a static site generator, with the source a (private) GitHub repository, and Netlify for deployments. After a deployment, Netlify calls a serverless function that hits the GitHub API with a POST request to trigger a GitHub action workflow. ## Fetch and Render GitHub Markdown without CORS DevFeed: [Fetch and Render GitHub Markdown without CORS]() Original publisher: [Read original article]() Author: Sam Edwards Published: 2024-05-02T16:55:50Z Content type: tutorial Language: en Sources: [Handstand Sam]() Topics: [Cross-origin resource sharing (CORS)](), [GitHub](), [GitHub API](), [Markdown](), [Front end](), [Web Development]() Tags: [api](), [cors](), [frontend](), [github](), [javascript](), [markdown](), [security](), [security-vulnerabilities](), [web]() ### AI overview A tutorial on embedding a GitHub project's README on another website from a frontend-only page. It explains why iframes and direct cross-origin fetching fail, then explores the GitHub API, JSONP, Base64 decoding, and rendering the retrieved content. ### Source excerpt I wanted to embed the contents of my GitHub project on another website, but the path to get there wasn't straightforward. Here are the roadblocks I hit, and how I got around them. Skip to the end if you just want the final solution. Idea 1: Render in an iframe I'd love to just create [...] ## Using the GitHub GraphQL API with Apollo Studio Explorer DevFeed: [Using the GitHub GraphQL API with Apollo Studio Explorer]() Original publisher: [Read original article]() Author: Ceora Ford Published: 2022-03-03T15:39:31Z Content type: tutorial Language: en Sources: [Apollo Blog]() Topics: [GitHub API](), [GraphQL](), [GitHub]() Tags: [github](), [graphql](), [guide](), [how-to](), [personal-access-token](), [workflows]() ### AI overview This tutorial explains how to use Apollo Studio Explorer with the GitHub GraphQL API. It covers the API's capabilities, setup and personal access token authentication, and guides readers through building three useful queries. ### Source excerpt GraphQL APIs provide data that can be extremely useful to you, your team, or your project. Being able to test and run queries for GraphQL APIs can help you build well-designed queries for your application. Apollo Studio Explorer helps you do this. This is especially useful when you're working with large APIs that contain lots of types and fields. The GitHub GraphQL API is one such API. So let's test out Apollo Studio Explorer by building queries for the GitHub API. ## 8 Free to Use GraphQL APIs for Your Projects and Demos DevFeed: [8 Free to Use GraphQL APIs for Your Projects and Demos]() Original publisher: [Read original article]() Author: Kurt Kemple Published: 2021-06-22T12:04:08Z Content type: tutorial Language: en Sources: [Apollo Blog]() Topics: [GraphQL](), [API](), [GitHub API](), [apollo-server]() Tags: [apis](), [community](), [demo](), [examples](), [free](), [github](), [graphql](), [learn](), [projects]() ### AI overview This article presents eight free GraphQL APIs that developers can use for demos, workshops, learning, and example queries, including SpaceX, SWAPI, Rick and Morty, Countries, PokeAPI, DexAPI, Anilist, and GitHub. ### Source excerpt Whether you're trying to build a demo, create a workshop, or learn how GraphQL works, it's nice to have some examples to reference instead of having to build your own. While Apollo Server makes building your own API a delight, sometimes you don't want to get your hands dirty if you don't have to. As luck would have it, some really awesome GraphQL APIs are available that you can use for free! ## GSoC 2019 - Developer Web Interface for ReactOS (Final Report) DevFeed: [GSoC 2019 - Developer Web Interface for ReactOS (Final Report)]() Original publisher: [Read original article]() Published: 2019-08-20T00:00:00Z Content type: article Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [Website](), [Development](), [API](), [GitHub](), [GitHub API]() Tags: [api](), [details](), [developer](), [development](), [features](), [free](), [github](), [gsoc](), [open-source](), [os](), [react](), [reactos](), [report](), [tests](), [ui](), [web](), [web-interface](), [win32](), [winapi]() ### AI overview A final report on a ReactOS developer web interface that combines GitHub, BuildBot, and Testman data to help developers track commits, builds, and tests in one place. The report describes implemented filtering, pagination, and client-side rendering, along with planned search and interface improvements. ### Source excerpt Introduction Developer Web Interface for ReactOS is a web tool to support the development of ReactOS. The main goal of this project is to develop a platform for ReactOS developers to easily track Commits, Builds and Test details. The web Interface makes API calls to various endpoints of GitHub, BuildBot and Testman API and interrelates them and renders a simplified view of Commit, Build and Test details at one place, so developers don't have to visit different sites to view different details, our web Interface collects all details and displays at one place. ## GSoC 2019 - Developer Web Interface for ReactOS (Week 3 & 4) DevFeed: [GSoC 2019 - Developer Web Interface for ReactOS (Week 3 & 4)]() Original publisher: [Read original article]() Published: 2019-07-10T00:00:00Z Content type: article Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [GitHub API](), [ui](), [GitHub]() Tags: [api](), [developer](), [free](), [github](), [gsoc](), [open-source](), [os](), [react](), [reactos](), [ui](), [win32](), [winapi]() ### AI overview A GSoC 2019 progress update for the ReactOS developer web interface describes using the GitHub API to retrieve branch and commit data, including the top five commits from a branch. It then reports a UI improvement: replacing a basic commit table with a collapsible panel intended to display the API information. ### Source excerpt Hello Everyone !! Until week 2 we made API calls to the Branches and Commits Endpoint of the GitHub API and rendered it. So at the end of week 2, we were able to fetch Top 5 commits from any of the branches as required. Week 3 UI Improvement Till week 2 we just had a simple table showing a few very basic information about the commits. So we designed a collapsible Panel which can contain all information required from the API. ## GSoC 2019 - Developer Web Interface for ReactOS (Community Bonding and week 1,2) DevFeed: [GSoC 2019 - Developer Web Interface for ReactOS (Community Bonding and week 1,2)]() Original publisher: [Read original article]() Published: 2019-06-07T00:00:00Z Content type: article Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [React](), [Redux](), [JavaScript](), [GitHub API](), [Heroku](), [Pull Request]() Tags: [api](), [free](), [heroku](), [javascript](), [open-source](), [os](), [react](), [reactos](), [redux](), [win32](), [winapi]() ### AI overview A GSoC 2019 student describes developing a React and Redux web interface for ReactOS. During the community bonding period and first two weeks, the project included learning the frontend technologies, connecting to GitHub API endpoints, rendering commits, pull requests, and branches, and deploying the application on Heroku. ### Source excerpt Introduction Hey Everyone, I'm Ayush Kumar Sinha, A 2nd Year CS undergraduate from VIT Vellore, India and a GSoC student this year under ReactOS : ) How I got to know about the project While scrolling through the list of accepted Orgs of 2018 (with filters like web, C++, javascript)I bumped into ReactOS. Hey!! they are building Windows-like OS from scratch, Sounds cool :). But the project ideas look quite hard with my existing C/C++ skills. ## Golang: cache things using interfaces DevFeed: [Golang: cache things using interfaces]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2018-12-17T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [Caching](), [Go Language](), [interface](), [Testing](), [GitHub API]() Tags: [api](), [caching](), [golang](), [interface](), [pretty](), [redis](), [testing]() ### AI overview A tutorial on using interfaces and a decorator-style wrapper to add caching to Go clients. It explains how this approach avoids a global cache, reduces direct dependencies, and makes caching logic easier to test, with a GitHub API example and possible extensions to Redis and SQL-backed applications. ### Source excerpt Caching things can be hard to do and hard to test. In this post I'll demonstrate a convenient way of doing that using interfaces. ## How I gained commit access to Homebrew in 30 minutes DevFeed: [How I gained commit access to Homebrew in 30 minutes]() Original publisher: [Read original article]() Author: Remind Published: 2018-08-07T00:00:00Z Content type: article Language: en Sources: [Remind]() Topics: [Homebrew](), [Security](), [supply chain attacks](), [Jenkins](), [GitHub](), [Environment Variables](), [OAuth](), [GitHub API](), [incident]() Tags: [backdoor](), [credential-theft](), [curl](), [environment-variables](), [github](), [homebrew](), [incident](), [jenkins](), [npm](), [permissions](), [rubygems](), [security](), [supply-chain-attacks]() ### AI overview A security researcher describes gaining commit access to Homebrew repositories through a GitHub API token exposed in a publicly accessible Jenkins environment. The access was tested and then reported to Homebrew maintainers, highlighting risks to package-manager infrastructure and software supply chains. ### Source excerpt This issue was publicly disclosed on the Homebrew blog at https://brew.sh/2018/08/05/security-incident-disclosure/ Since the recent NPM, RubyGems, and Gentoo incidents, I've become increasingly interested, and concerned, with the potential for package managers to be used in supply chain attacks to distribute malicious software. Specifically with how the maintainers and infrastructure of these projects can be targeted as an attack vector. On Jun 31st, I went in with the intention of seeing if I could gain access to Homebrew's GitHub repositories. About 30 minutes later, I made my first commit to Homebrew/homebrew-core. Let's get leaky My initial strategy going in was based on credential theft; find if there were any credentials leaked by members of the Homebrew GitHub org. An OSSINT tool from Michael Henriksen called gitrob makes automating this search really easy. I ran it across the Homebrew organization, but ultimately didn't come up with anything interesting. Next, I took a look at previously disclosed issues on https://hackerone.com/Homebrew. From there, I found that Homebrew runs a Jenkins instance that's (intentionally) publicly exposed at https://jenkins.brew.sh. After some digging, I noticed something interesting; builds in the "Homebrew Bottles" project were making authenticated pushes to the BrewTestBot/homebrew-core repo: This got me thinking, "where are the credentials stored?". I noticed the "Environment Variables" link on the left, which led to an exposed GitHub API token: I tested it locally to see what scopes the token had: $ curl https://api.github.com/user/repos -u $GITHUB_API_TOKEN:x-oauth-basic | jq '.[] | {repo: .full_name, permissions: .permissions}' { "repo": "BrewTestBot/homebrew-core", "permissions": { "admin": true, "push": true, "pull": true } } { "repo": "Homebrew/brew", "permissions": { "admin": false, "push": true, "pull": true } } { "repo": "Homebrew/formulae.brew.sh", "permissions": { "admin": false, "push": true, "pull": true } } { " ## SSH into AWS using Github for RBAC DevFeed: [SSH into AWS using Github for RBAC]() Original publisher: [Read original article]() Author: sasha@goteleport.com (Sasha Klizhentas) Published: 2017-04-25T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon Web Services](), [GitHub](), [ssh](), [Access Control](), [AWS IAM](), [Single sign-on (SSO)](), [Authentication](), [Auth0](), [GitHub API]() Tags: [access-control](), [auth0](), [authentication](), [aws](), [aws-iam](), [github](), [github-credentials](), [saml](), [ssh]() ### AI overview This tutorial explains how to use GitHub as a centralized identity source for AWS access. It covers configuring AWS Console SSO, mapping GitHub teams to AWS IAM roles and SSH access rules, and using Auth0 with SAML 2.0 and Teleport Enterprise to control and audit access. ### Source excerpt How do you let employees access AWS infrastructure using GitHub credentials, restrict access by team, and configure SSH with GitHub? This post covers it all. ## GitHub API Lacks a Read-Only OAuth Scope DevFeed: [GitHub API Lacks a Read-Only OAuth Scope]() Original publisher: [Read original article]() Published: 2015-10-18T07:19:15Z Content type: opinion Language: en Sources: [Jolly Good Code]() Topics: [GitHub](), [OAuth](), [GitHub API]() Tags: [api](), [github](), [oauth](), [scope]() ### AI overview The article argues that GitHub's API lacks a read-only OAuth scope, limiting how applications can use the API without write access. ### Source excerpt We love the GitHub API, because it allows us to do creative things with GitHub. But GitHub's API lacks a Read-Only OAuth Scope. ## Download only part of a repository in github DevFeed: [Download only part of a repository in github]() Original publisher: [Read original article]() Author: Suresh Alse (noreply@blogger.com) Published: 2015-09-06T19:09:00Z Content type: tutorial Language: en Sources: [Life Plus Linux]() Topics: [GitHub](), [GitHub API](), [Bootstrap]() Tags: [api](), [download](), [github](), [linux](), [project](), [repo]() ### AI overview A tutorial explains how to download only part of a GitHub repository instead of cloning the entire project. It presents svn export as a straightforward approach, including an example for downloading the docs directory from the Bootstrap repository and saving it under a different name. ### Source excerpt Sometimes you would want to download only a part of a repository in Github but you don't want to download / clone the entire repository, specially when the repo is huge or has too many other things that you are not interested in. There are many ways to do this. For example you can do a shallow clone, or you can use Github API (there is a limit on number of requests per hour)..etc. However, none of them are simple and straightforward. I recently found out that Github supports svn to some extent. So I tried the age old svn export to download a part of the project I was interested in. And it worked. svn export https://github.com///trunk/ For example: If you want to download only docs from Bootstrap repository, svn export https://github.com/twbs/bootstrap/trunk/docs Now, suppose you want to download it with a different name, svn export https://github.com/twbs/bootstrap/trunk/docs bootstrap-docs ## GitHub Authentication with Octokit DevFeed: [GitHub Authentication with Octokit]() Original publisher: [Read original article]() Published: 2014-08-03T00:00:00Z Content type: tutorial Language: en Sources: [Radek Pazdera]() Topics: [GitHub](), [OAuth](), [GitHub API](), [Authentication]() Tags: [api](), [callback](), [client](), [framework](), [github](), [oauth](), [scope](), [token]() ### AI overview This tutorial explains how to implement GitHub OAuth authentication with the Octokit toolkit and Sinatra. It covers redirecting users to GitHub, handling the callback and code parameter, exchanging application credentials for an access token, and using token scopes to limit API actions. ### Source excerpt Using Sinatra + Octokit to get an OAuth token from GitHub ## PullRequest Coverage Blammer Maven Plugin DevFeed: [PullRequest Coverage Blammer Maven Plugin]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2014-03-18T00:00:00Z Content type: article Language: en Sources: [Carlos Becker]() Topics: [pull-requests](), [test-coverage](), [Maven](), [ci](), [Code review](), [GitHub API]() Tags: [api](), [ci](), [code-coverage](), [code-review](), [github](), [maven](), [pull-requests](), [test-coverage]() ### AI overview The article describes a Maven plugin that automatically reports insufficient test coverage for new lines in pull requests. It integrates with the GitHub API and runs in CI alongside other code-quality plugins. ### Source excerpt At the company I work Pull Requests are part of our culture.