GitHub The Download, 15 Aug 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: The Download: Open Source Emoji, Astro 1.0, Deranged Robots and more

Description

It's the dog days of summer, which means the news is slow. But Christina is still here to offer up the latest developer and open source news, including:

0:00 Intro
1:00 Git Merge 2022 https://git-merge.com
1:20 NPM Sigstore RFC https://github.blog/2022-08-08-new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open/ and the RFC https://github.com/npm/rfcs/pull/626
2:35 Astro 1.0 https://astro.build/blog/astro-1/ and Astro on GitHub https://github.com/withastro/astro
3:22 JS13kGames https://js13kgames.com/
4:15 VS Code 1.70 https://code.visualstudio.com/updates/v1_70
4:37 Microsoft OSS Emoji https://medium.com/microsoft-design/designing-in-the-open-source-5c62be73a599 and GitHub https://github.com/microsoft/fluentui-emoji and Figma https://www.figma.com/community/file/1138254942249677742
5:21 Should you Squash Merge or Merge Commit? Plz Debate https://www.lloydatkinson.net/posts/2022/should-you-squash-merge-or-merge-commit/
6:00 **Christina's Pick of the Week:** Robot Stepping Camera https://gizmodo.com/adam-beedle-youtuber-lego-cannon-smart-step-on-brick-1849395202 and YouTube video https://www.youtube.com/watch?v=I6gpKFjL6_8

Presented by: @ChristinaWarren

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

Astro hits 1.0 some npm security updates, open source emoji and the most deranged robot you'll ever see. All that and more on this episode of the download.

A

Welcome back to another episode of the download, I'm your host, christina warren senior developer, advocate at github, and this is the show where we cover the latest developer news and the coolest open source projects. So please like and subscribe to our channel my shirt this week. It's something I think I got it off of boot.com. I don't even know if you can see it. It's a name tag!

A

That's essentially just a funny sequel, joke cool all right, moving on it's the dog days of summer well, northern hemisphere summer, and you guys the news is slow, so we took last week off and I'll also be off next week, because I'm going back to atlanta to visit my family and to celebrate my mom's birthday, happy birthday mom, you rule all right, let's get into the news, okay, so the first thing I want to mention is that get merged.

A

2022 is about a month away, it'll be taking place on september 14th and 15th in chicago details are linked down below, but if you want the best conference about the get ecosystem well, this is it I'm going to be there alongside a ton of my colleagues.

A

So if you see me there, please say hello: next, let's talk about npm and security, okay, so for much the last eight or nine months, the topic of security and supply chain attacks has permeated a lot of different open source communities, including npm and npm, has made some really great strides to improve security in its ecosystem by requiring things like mfa for user accounts. But now the npm team has opened up an rfc.

A

That's a request for comment to discuss linking a package with its source repository and its build environment, and as the blog post, which I've got linked down below says, when package maintainers opt into the system, consumers. Other packages can have more confidence that the contents of the package match the contents of the linked repository.

A

The blog post goes into some detail about the history about why linking packages back to source code has been difficult in the past, but thanks to a project from the linux foundation and the open, ssf called six store. That process is actually easier and more secure than previous methods, because developers aren't required to manage their own cryptographic keys anyway. I think that this could be a really good solution for npm and even other communities too. But, as I said, this is an rfc.

A

So if you have comments or opinions, you can leave them in the issue which I've got linked down below alongside the blog post.

A

Next, in some oss project news, huge congrats to the astro team on hitting 1.0 this week, astro if you're not familiar, is a web framework. That's designed for making fast content focused websites and over the last 16 months, astro has amassed over 13 000 stars on github and 30 000 users, and I like it a lot because you can build a really fast website with a javascript framework, but that framework doesn't then have to be loaded on the front end.

A

So developers get a really nice experience when they're building a website, but then the performance is really top notch for end users, cool stuff. Anyway, more details are linked down below check out the astro, github repos for more information and just a tip. You can actually just deploy a static, astro site to github pages. If you want, though it works with lots of other static site hosts too moving on. I want to give a shout out and a heads up about js 13k games, 2022 and the next edition of the long-running javascript coding.

A

Competition starts on august 13th and it runs through september 13th. The theme for this year will be announced on the 13th, so be sure to check it out and js 13k games is an annual javascript coding, competition for html5 games and it's actually been been running since 2012. But what makes js 13k games fun is the file size limit for the competition is 13 kilobytes now remember: 640k should be enough for anyone, but 13k. That's just nuts anyway. The fun part of the competition is the file size limit.

A

You can check out the website link down below for the competition, as well as some tips and tricks resources and a look back at the last decade of competition. I really really love this next up. Vs code 1.7 was released recently and this update adds some title bar customization options and terminal improvements, including turning shell integration on by default. uh There's also some cool stuff happening, with the way that the markdown language server works.

A

Details are linked down below and remember that you can make contributions or file bugs within the vs code, repo, which is over on github all right. While we're talking about microsoft, let's go ahead and talk about how the design team has decided to make a very cool decision to open source, most of its recently updated, emoji library and they've, put that on github and on figma. Now the bad news first clippy is not part of the release, because apparently the microsoft lawyers knew that their this would lead.

A

People me uh to do really ridiculous things to computing's best icon. That said, there are still over 1500 emojis that are really fun and they're, fully open sourced. For you to use remix and do what you want with them and I've got the links down in the details are linked down below. I cannot wait for the internet to do what the internet does, which is to create horrific, horrific things with the eggplant all right. It's a slow news week. So, let's open up a good old-fashioned debate. This one comes courtesy of lloyd atkinson.

A

Who asks should you squash, merge or merge commit his post, which I've got linked down below outlines a lot of the basic arguments for both sides of the merge debate, but he hedges us to what option is best reddit had no such qualms in arguing about this? That's where I saw lloyd's post. I saw several hundred comments and look. I love a good flame war, so let me know your preferred merge method in the comments down below bonus points for the people who just want to comment, rebase and then leave.

A

You are my people all right and now it's time for my pick of the week, robot creator, adam beedle has made what might just be the most psychotic invention. I've ever seen. Sci-Fi author john scalzi actually remarked that it might violate the geneva convention and he's right. It might so basically adam created a robot that launches legos at your feet, forcing you to step on them or, as my old colleague, andrew liszewski, put it sadistic monster, creates a smart cannon that makes you step on legos.

A

I love this, so please watch adam's video which is linked down below and see the hilarity in the mayhem that he created using a webcam, some 3d printed parts and the opencv computer vision, library thanks. I hate it by which, of course, I mean that I love it all right. Let me know what sort of sadistic toy robot you would like to see adam build next in the comments down below or let me know your thoughts on any of the other stories we covered this week and remember to sound off on the squash.

A

Merge versus merge commit war down below too all right. That does it for me. If you liked this episode, leave me a like and subscribe to the github youtube channel for all your nerd needs. See you next time.