Project
GitHub CLI (gh) is GitHub's official command-line tool for managing repositories, pull requests, issues, and workflows directly from the terminal.
GitHub retired Classroom on 28 August 2026, decommissioning its website and APIs after closing new sign-ups on 26 May. Educators who did not export their data before then have to rebuild what Classroom held themselves.
Reality
Glow counts more than 13,000 internal images in 900-plus public GitHub repos tied to developers at 300-plus organizations. Its report ties the uploads to coding agents that needed somewhere to show reviewers a screenshot a private repo could not render.
Reality
GitHub put workflow lockfiles in public preview, so onboarded Actions runs use the commits recorded in actions.lock even if a tag or branch moves. The lock does not assess whether the action is safe; that review stays with the team.
Reality
Anji Xu's open-source Claude Statuspane puts context use, five-hour and seven-day rate limits and session cost in a card above the Claude Code prompt. The readout lives on that one developer's screen, so whoever answers for a team's total agent spend still needs records kept somewhere central.
Reality
One developer's free static host sent HTTP 429 to every visitor after a daily visit quota ran out, while its deploy API still reported the release ready. Both green signals, deploy status and a scripted check, missed a ceiling that sat on the serving path.
Reality
Glow's PixelLeak report found coding agents exposed more than 13,000 private screenshots from over 300 organisations by hosting them in public GitHub repos. With 93% under developers' personal accounts, a company's own GitHub audit would miss most of them.
Perspective Coverage
3 publishersReality
One developer's weekly Claude Code skill update failed on 6, 13 and 20 September despite three layered fixes and an audit note reading "exit 0". The script caught and logged every failure correctly, but the log had no reader until the author opened it after the third one.
Reality
The failure landed on artifact upload, weeks after the pipeline went stable. The audit found ten near-identical Gradle caches, one per active branch, a hashFiles key that never matched anything, and 30-day retention on 70MB builds.
Reality
On a self-hosted spot runner, an instance AWS reclaimed and a genuinely broken test both produce the same red X, so this pipeline reads the raw job log for four host-only strings and re-runs only the jobs the host killed.
Reality
The watchdog's own death and its one true alert both surface as step 6 failing, so three nights of verifying nothing look identical to the night it caught a daily cron that had been dead for 70.4 days.
Reality
Reading soit-ai/soit v1.0.0 out of ghcr.io by hand shows how far a container signature reaches. It covers one digest, and the release tag survives as a string in the build predicate that nothing compares for you.
Reality
Enforcement is a bash script that counts files against the merge-base with the parent branch, so it bounds one diff at a time, and only if the agent chooses to run it. The 100 is an environment variable's default.
Reality
Permission rules accumulate from "yes, don't ask again" answers into a repo-local file, and because matching runs deny then ask then allow with no specificity tiebreak, a policy that reads correctly can still stall an unattended run.
Reality
RuntimeWire says it found the loop by taking apart OpenAI's shipped desktop build, and the optional merge step is the part that matters: it makes your branch protection config the only review your default branch gets.
Reality
Stacked pull requests are still in public preview, and the command that creates them is not the command that updates them. What the extension does remove is the author-side coordination cost that made "make your diffs smaller" an argument rather than a workflow.
Reality
A desktop app that shells out to openssl.exe and ffmpeg.exe can absorb a CVE with a few-megabyte drop-in. The author is unusually clear about the price: spawn latency, and a parser per tool.
Reality
A Mac utility replaces plaintext credentials with fake ones and injects the real value into an approved process after Touch ID. The pattern is now on every security team's evaluation list.
Reality
A reader argued a static check only proves a declaration exists in source control. The canary that replaced it went red on its first manual run against production, and one failure was two days old.
Reality
A solo founder says every rule in his agent system was written after a failure, and that only shell-level blocks held. The interesting part is the promotion threshold, not the count.
Reality