diff --git a/content/posts/forge_fragmentation/cover.webp b/content/posts/forge_fragmentation/cover.webp new file mode 100644 index 0000000..83a620f Binary files /dev/null and b/content/posts/forge_fragmentation/cover.webp differ diff --git a/content/posts/forge_fragmentation/index.md b/content/posts/forge_fragmentation/index.md new file mode 100644 index 0000000..9ea9ac4 --- /dev/null +++ b/content/posts/forge_fragmentation/index.md @@ -0,0 +1,112 @@ +--- +title: "Handling the great code forge fragmentation" +date: 2026-05-15T20:29:05-04:00 +tags: ["software development", "self-host", "hugo"] +--- + +{{< figure src="/cover.webp" alt="Picture of shower tiles that look like 10x developer git history" caption="The kind of developer I hope to be someday" >}} + +It seems like there are a lot of people either leaving or talking about leaving Github, a very prominent one being [Mitchell Hashimoto](https://mitchellh.com/writing/ghostty-leaving-github). +Fragmentation seems inevitable, as people/companies start to distribute among the various options (Codeberg, self-host Forgejo, Gitlab, etc...). +I think the decision Hashimoto makes with ghostty will potentially set the tone for how the death of Github will happen. +I have some scattered thoughts about the situation: + + +* [Tracking activity across providers](#tracking-activity-across-providers) +* [Some kind of trust system is needed to stop AI slop](#some-kind-of-trust-system-is-needed-to-stop-ai-slop) +* [Get your username locked in NOW](#get-your-username-locked-in-now) +* [Is self-hosting the right tool to stop AI slop?](#is-self-hosting-the-right-tool-to-stop-ai-slop?) +* [Mirroring self-hosted repos to Github for engagement](#mirroring-self-hosted-repos-to-github-for-engagement) +* [Conclusion](#conclusion) + +## Tracking activity across providers + +I hope to someday be a 10x bathroom tile developer with a git contribution heatmap being a solid color. +I have already had an issue with tracking my progress working on repositories split between my self-hosted Forgejo instance and Github. +I'm a simple man that wants to see my contributions measured on a public heatmap for both satisfaction and motivation. +So I solved this problem for myself with a go script and hugo module that you can use to create a git heatmap combining data from multiple hosting platforms. +Just takes one go command to generate the activity file, some hugo config changes, and a simple shortcode embedded in your hugo markdown. + +[[Github repo available here]](https://github.com/aselimov/-hugo-unified-git-activity) + +{{< git-heatmap >}} + +I also have some random thoughts I wanted to write out about the whole situation. + +## Some kind of trust system is needed to stop AI slop + +I think the years of allowing contributions from anyone with an account is over for open source. +Maintainers are drowning in AI generated PRs/issues from unvetted sources. +Even though AI contribution quality is reported to be improving[^1], the core volume issue isn't. +The current system is requiring maintainers to wade through PRs/issues that potentially took 0 human effort/time to produce. +Even if some of them are useful/correct, the sheer volume makes the entire system intractable. +You guys already probably know this. + +Hashimoto has a solution to this called [vouch](https://github.com/mitchellh/vouch) that is currently being developed. +It tracks approved/blocked contributors on a repo basis using a Github actions workflow by appending usernames to a `VOUCHED.td` file. +The syntax of the file is: + +``` +# Vouched contributors for this project. +# +# See https://github.com/mitchellh/vouch for details. +# +# Syntax: +# - One handle per line (without @), sorted alphabetically. +# - Optional platform prefix: platform:username (e.g., github:user). +# - Denounce with minus prefix: -username or -platform:username. +# - Optional details after a space following the handle. +aselimov +github:aselimov +``` +This is a step in the right direction, but I still think a trust system needs to be built into the forge platform. +Ideally you would also be able enable vouch chaining somehow. +Effectively + +``` +aselimov VOUCHED by user1 on repo1 +user1 VOUCHED by user2 on repo2 +aselimov indirectly VOUCHED for repo2 +``` + +I think we need a web with some barrier of entry to ensure contributors are high quality and motivated instead of bots that will write hit pieces[^2]. + +## Get your username locked in NOW + +If we are transitioning to a vouching based trust model you are going to want to lock in a consistent username across the main platforms. +That way, if a cross-platform trust chain is established, you will have fewer issues from username squatters impersonating you. +Seems like the main Github alternatives are: + +- Codeberg +- Gitlab +- Bitbucket + +Personally I think Codeberg/self-hosted Forgejo is the best option, but you probably should make an account on each just in-case. + +## Is self-hosting the right tool to stop AI slop? + +Self-hosting Forgejo is the maximally guarded vouching system. +In most cases[^3], the host disables account creation to not get inundated with spam/malware. +To get account access, you have to reach out to either the host or a known admin to get registered. +Probably this means sending an email, LinkedIn message, DM on x, etc... +I'm not completely opposed to this concept if I ever spin up a project successful enough to be targeted by the slopocalypse. + +## Mirroring self-hosted repos to Github for engagement + +My current workflow does involve mirroring all of my repos to Github to enable some level of community engagement. +The main motivating factor is to enable some sort of issues tracker, but receiving PRs is a nice bonus. +Migrating the PR from Github to Forge requires manual effort on my part which acts as a hardening step. +It ensures that I need to approve the PR before it gets anywhere close to my CI. +This could be a layer of protection if my brain stops working, and I start introducing vulnerable actions[^4] by mistake. + +## Conclusion + +- Add a [unified git activity map](https://github.com/aselimov/-hugo-unified-git-activity) to your hugo site! +- Establish your username/identity on all of the major forges. +- I have no idea where things are going from here or if Github can recover. + + +[^1]: Curl maintainer talking about how the AI slop storm has actually turned high quality . +[^2]: A maintainer of matplotlib closed a PR because it was a good first issue for a human and the PR was opened by an openclaw bot. The bot then wrote a blog post naming the maintainer as an anti-ai gatekeeper +[^3]: I've done this on my instance and I think it's the Forgejo default setting. +[^4]: Using `pull_request_target` can allow someone opening a PR to execute code in the runner context. diff --git a/go.mod b/go.mod index 3863b13..a8c6789 100644 --- a/go.mod +++ b/go.mod @@ -3,6 +3,6 @@ module forge.alexselimov.com/aselimov/AlexSelimov.com go 1.26.2 require ( - forge.alexselimov.com/aselimov/hugo-bearcub v0.0.0-20260513113449-9c0ae949af83 // indirect - forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260513113347-46315d9a6267 // indirect + forge.alexselimov.com/aselimov/hugo-bearcub v0.0.0-20260516000128-2c2a275a9564 // indirect + forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260516000031-0c7f7a685358 // indirect ) diff --git a/go.sum b/go.sum index f48d843..24280cf 100644 --- a/go.sum +++ b/go.sum @@ -8,6 +8,8 @@ forge.alexselimov.com/aselimov/hugo-bearcub v0.0.0-20260513112159-33a7006c5f99 h forge.alexselimov.com/aselimov/hugo-bearcub v0.0.0-20260513112159-33a7006c5f99/go.mod h1:yNsYHfwQFEPfvp/YCo4b31+AD1Jz4eAQDiBCW9F0YZY= forge.alexselimov.com/aselimov/hugo-bearcub v0.0.0-20260513113449-9c0ae949af83 h1:QNKO+21iDo4AprTRy19285XgS2amrbaHNksO+/crNDs= forge.alexselimov.com/aselimov/hugo-bearcub v0.0.0-20260513113449-9c0ae949af83/go.mod h1:isWmhtAP5ucugCRq11yoL1Q/MFKzXzikaO3826rWJTQ= +forge.alexselimov.com/aselimov/hugo-bearcub v0.0.0-20260516000128-2c2a275a9564 h1:7RVGiz6nIvTb/ERQ0u9MjTLA/Yq2Xjun1/zZyTbHxMw= +forge.alexselimov.com/aselimov/hugo-bearcub v0.0.0-20260516000128-2c2a275a9564/go.mod h1:L550lxcgzgIei1w3dKvOTnga43J9NBtkzo7i3wl7chc= forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260512025533-3c48c2bd2d53 h1:19rdUTj2Bn/bbBfioKhQBV4fsTTMRBIUVvfH1332Ykk= forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260512025533-3c48c2bd2d53/go.mod h1:YcxJyQNzPOmoJ/9LYHlPrZLVqMI25izS4j+lMqJgXH0= forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260512033457-620121b50553 h1:9XSeGiKCVd3kJ27hZMYOb8NwsMbr21IfirxXEAQ295E= @@ -18,3 +20,7 @@ forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260513112041-d forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260513112041-d9784bdbd43d/go.mod h1:YcxJyQNzPOmoJ/9LYHlPrZLVqMI25izS4j+lMqJgXH0= forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260513113347-46315d9a6267 h1:Z+LYfP8DE7Rxr9su2QtcL4dSiK7e5gNvLVDCcae21Z4= forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260513113347-46315d9a6267/go.mod h1:YcxJyQNzPOmoJ/9LYHlPrZLVqMI25izS4j+lMqJgXH0= +forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260515103247-d29732c17e45 h1:EdGikBECzIvdsndjVDqfgbcK9qv7S5fZyC4BPxE5GW0= +forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260515103247-d29732c17e45/go.mod h1:YcxJyQNzPOmoJ/9LYHlPrZLVqMI25izS4j+lMqJgXH0= +forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260516000031-0c7f7a685358 h1:NovauVNIvi+6TW41HfUvSpYoOcwIJI9FdlY7f6Snfjc= +forge.alexselimov.com/aselimov/hugo-unified-git-activity v0.0.0-20260516000031-0c7f7a685358/go.mod h1:YcxJyQNzPOmoJ/9LYHlPrZLVqMI25izS4j+lMqJgXH0=