While GitHub obsess over shoving AI into everything, the rest of the platform is genuinely crumbling and its security flaws are being abused to cause massive damage. Last week Aqua Security was breached and a few repositories it owns were infected. The threat actors abused widespread use of mutable references in GitHub Actions, which the community has been screaming about for years, to infect potentially thousands of CI runs. They also abused an issue GitHub has acknowledged but refused to fix that allows smuggling malicious Action references into workflows that look harmless.

GHA can’t even be called Swiss cheese anymore, it’s so much worse than that. Major overhauls are needed. The best we’ve got is Immutable Releases which are opt in on a per-repository basis.

I don't want to give too much credit to Github, because their uptime is truly horrendous and they need to fix it. But: I've felt like its a little unfair to judge the uptime of company platforms like this; by saying "if any feature at all is down, its all down" and then translating that into 9s for the platform.

I never use Github Copilot; it does go down a lot, if their status page is to be believed; I don't really care when it goes down, because it going down doesn't bring down the rest of Github. I care about Github's uptime ignoring Copilot. Everyone's slice of what they care about is a little different, so the only correct way to speak on Github's uptime is to be precise and probably focus on a lot of the core stuff that tons of people care about and that's been struggling lately: Core git operations, website functionality, api access, actions, etc.

From GitHub CTO in 2025 when they announced they're moving everything to Azure instead of letting GitHub's infrastructure remain independent:

> For us, availability is job #1, and this migration ensures GitHub remains the fast, reliable platform developers depend on

That went about as well as everyone thought back then.

Does anyone else remember back in ~2014-2015 sometime, when half the community was screaming at GitHub to "please be faster at adding more features"? I wish we could get back to platforms (or OSes for that matter) focusing in reliability and stability. Seems those days are long gone.

GitHub is in a tough spot. From what I've heard they've been ordered to move everything to Azure from their long standing dataceners. That is bound to cause issues. Then on top of that they are using AI coders for infra changes (supposedly) which will also add issues.

And then on top of all that, their traffic is probably skyrocketing like mad because of everyone else using AI coders. Look at popular projects -- a few minutes after an issue is filed they have sometimes 10+ patches submitted. All generating PRs and forks and all the things.

That can't be easy on their servers.

I do not envy their reliability team (but having been through this myself, if you're reading this GitHub team, feel free to reach out!).

Have anyone checked out the status page? It's actually way worse than I thought, I believe this is the first time I am actually witnessing a status page with truly horrible results.

https://mrshu.github.io/github-statuses

To be honest, I’m not surprised that GitHub has been having issues.

If you have ever operated GitHub Enterprise Server, it’s a nightmare.

It doesn’t support active-active. It only supports passive standbys. Minor version upgrades can’t be done without downtime, and don’t support rollbacks. If you deploy an update, and it has a bug, the only thing you can do is restore from backup leading to data loss.

This is the software they sell to their highest margin customers, and it fails even basic sniff tests of availability.

Data loss for source code is a really big deal.

Downtime for source control is a really big deal.

Anyone that would release such a product with a straight face, clearly doesn’t care deeply about availability.

So, the fact that their managed product is also having constant outages isn’t surprising.

I think the problem is that they just don’t care.

Just to add a little bit of nuance to this not because I'm trying to defend GitHub, they definitely need to up their reliability, but the 90% uptime figure represents every single service that GitHub offers being online 90% of the time. You don't need every single service to be online in order to use GitHub. For example, I don't use Copilot myself and it's seen a 96.47% uptime, the worst of the services which are tracked.

Our security scanning runs on GitHub Actions — every PR gets checked before merge. When GitHub goes down, the security gate goes down with it. PRs pile up, devs get impatient, start merging without waiting for checks. That's exactly when bad code gets through. And they keep throwing engineers at Copilot while the stuff that CI/CD actually depends on keeps falling over.

Nothing unexpected. Microsoft has a remarkable talent for turning good products into useless ones. Skype is another good showcase of such talent.

IPv6 ignorance is the canary. There's plenty of architecture ignorance below the surface. The real question is why aren't they failing annual security audits?

https://docs.github.com/en/enterprise-cloud@latest/organizat...

I only use GitHub (and actions) for personal open-source projects, so I can't really complain because I'm getting everything for free¹. But even for those projects I recently had to (partially) switch actions to a paid solution² because GitHub's runners were randomly getting stuck for no discernible reason.

¹ Glossing over the "what they're getting in return" part. ² https://www.warpbuild.com/

I’m surprised it’s even as high as three nines, at one point in 2025 it was below 90%; not even a single nine.[0] (which, to be fair includes co-pilot, which is the worst of availabilities).

People on lobsters a month ago were congratulating Github on achieving a single nine of uptime.[1]

I make jokes about putting all our eggs in one basket under the guise of “nobody got fired for buying x; but there are sure a lot of unemployed people”- but I think there’s an insidious conversation that always used to erupt:

“Hey, take it easy on them, it’s super hard to do ops at this scale”.

Which lands hard on my ears when the normal argument in favour of centralising everything is that “you can’t hope to run things as good as they do, since there’s economies of scale”.

These two things can’t be true simultaneously.. this is the evidence.

[0]: https://mrshu.github.io/github-statuses/

[1]: https://lobste.rs/s/00edzp/missing_github_status_page#c_3cxe...

https://mrshu.github.io/github-statuses/ Even ignoring Copilot, they seem to be barely at 2 nines of uptime for any service component.

It's wild because they are one of the most used properties on earth and their uptime is actually incredible.

wait they still have 3 ninth, it really doesn't feel like that

but then their status center isn't really trust-able anymore and a lot of temporary issues I have been running into seem to be temporary, partial, localized failures which sometimes fall under temp. slow to a point of usability. Temporary served outdated (by >30min) main/head. etc.

so that won't even show up in this statistics

the real problem isn't the reliability numbers, it's that GitHub sold itself as an integrated platform, every service you adopt raises the blast radius, teams that treat github like any other external dependency, with fallback runners and artifact mirrors, aren't sweating this

when GitHub moved to react instead of server rendered pages ie erb/turbolinks/pjax was the start to the end.

the pages got slower, rendering became a nightmare.

then they introduced GitHub actions (half baked) - again very unreliable

then they introduced Copilot - again not very reliable

it's easy to see why availability has gone down the drain.

are they still on the rails monolith ? they speak about it less these days ?

Why have five nines when you can have nine fives?

“Microsoft Tentacle” - Now there’s a name for a new product line.

I have a little bit of sympathy for Github because if everyone is like me then they are getting 5-6x the demand they were last year just based on sheer commits alone, not to mention Github Copilot usage.

Hey, it's better than nine threes.

The availability expectations gap is interesting from an education standpoint. Students are tought that 99.9% sounds impressive without contextualizing what that means in practice — roughly 8 hours of downtime per year. For a platform that millions of developers depend on as critical infrastructure during work hours, that math hits very differently than it does for a consumer app.

The irony no one is talking about: AI makes quality code worse. Was bad enough already so imagine it now. I am expecting many more services to drop from 3 nines to 1 nine.

Anyone who used the phrase "measly" in relation to three nines is inadvertently admitting their lack of knowledge in massive systems. 99.9 and 99.95 is the target for some of the most common systems you use all day and is by no means easy to achieve. Even just relying on a couple regional AWS services will put your CEILING at three nines. It's even more embarrassing when people post that one GH uptime tracker that combines many services into 1 single number as if that means anything useful.

Embrace, extend, extinguish. Except the last one isn't quite going to plan...

It is annoying. But I bet they’re effectively being DDoS’d every day by AI agents now. I think the past year of that growth has destroyed any of their spare resources. It’s not really a scale problem I’d like to work on, tbh. Seems very hard.

Plus, the azure migration.

For solo and small team projects, I've started treating GitHub as distribution rather than infrastructure. Git itself is distributed — the repo on my machine is the source of truth. Deploy scripts that can run without GitHub Actions. Local backups of anything critical. It's a bit more work upfront, but the peace of mind when you see yet another incident on the status page is worth it.

I wonder how much of this is down to the massive amount of new repos and commits (of good or bad quality!) from the coding agents. I believe that the App Store is struggling to keep up with (mostly manual tbf) app reviews now, with sharp increases in review times.

I find it hard to believe that an Azure migration would be that detrimental to performance, especially with no doubt "unlimited credit" to play with?

You can provision Linux machines easily on Azure and... that's all you need? Or is the thinking that without bare metal NVMe mySQL it can't cope (which is a bit of a different problem tbf).

I worked on the react team while at GitHub and you could easily tell which pages rendered with react vs which were still using turbo. I wish we took perf more seriously as a culture there

Until paying customers start leaving en masse, they will continue to shovel out subpar service.

I'm amazed Microslop let us keep GitHub this long. Probably because they're training AI on it? To have a direct line to developers? I don't see why else they would've bothered with something that was so anti everything they stood for

Legitimately worse uptime than my self-hosted services. That's pretty funny.

GitLab isn't much better right now either unfortunately.

It's time to look for a decentralized Non-Hub alternative.

see also: https://thenewstack.io/github-will-prioritize-migrating-to-a...

A migration like this is a monumental undertaking to the level of where the only sensible way to do a migration like this is probably to not do it. I fully expect even worse reliability over the next few years before it'll get better.

I'm surprised GitHub got by acting fairly independently inside Microsoft for so long. I'm also surprised GitHub employees expected that to last

The real problem today IMO is that Microsoft waited so long to drop the charade that they now felt like they had to rip the bandaid. From what I've heard the transition hasn't gone very smoothly at all, and they've mostly been given tight deadlines with little to no help from Microsoft counterparts.

Pretty soon, the only 9 they’re going to have is the 9 8s…

Maybe they need to improve release strategy with Copilot AI Review =)

https://status.claude.com _anthropic has entered the room_

I'm somewhat surprised with Github's strategy in the AI times.

I understand how appealing it is to build an AI coding agent and all that, but shouldn't they - above everything else - make sure they remain THE platform for code distribution, collaboration and alike? And it doesnt need to be humans, that can be agents as well.

They should serve the AI agent world first and foremost. Cause if they dont pull that off, and dont pull off building one of the best coding agents - whcih so far they didnt - there isn't much left.

There's so many new features needed in this new world. Really unclear why we hear so little about it, while maintainers smack the alarm bell that they're drowning in slop.

Cheap, fast, and good. I see which two they chose.

I wonder if they are still running on a single MySQL machine

To me, Github has always seemed well positioned to be a one-stop solution for software development: code, CI/CD, documentation, ticket tracking, project management etc. Could anyone explain where they failed? I keep hearing that Github is terrible

Feb 10th post OP;

More recently:

Addressing GitHub's recent availability issues

https://github.blog/news-insights/company-news/addressing-gi...

(with a smattering of submissions here the last few weeks but no discussion)

ITT lots of complaining, not much building. Microsoft does not give a fuck what you think - they only care if the revenue line goes up. And the revenue line keeps going up despite this instability. Want to build the next unicorn? Build a GitHub competitor.

As of recently (workflows worked for months) I even have part of my CI on actions that fails with [0]

2026-02-27T10:11:51.1425380Z ##[error]The runner has received a shutdown signal. This can happen when the runner service is stopped, or a manually started runner is canceled. 2026-02-27T10:11:56.2331271Z ##[error]The operation was canceled.

I had to disable the workflows.

GitHub support response has been

“ We recommend reviewing the specific job step this occurs at to identify any areas where you can lessen parallel operations and CPU/memory consumption at one time.”

That plus other various issues makes me start to think about alternatives, and it would have never occurred to me one year back.

[0] https://github.com/Barre/ZeroFS/actions/runs/22480743922/job...

Just use git, problem solved.

Three nines is more than enough

Think the world would be a better place if 70-80% uptime were more tolerated. We really don’t need everything available all the time. More time to talk to each other, to think, more “slow time”.

Just don’t like the slop that’s getting us there.

"Agreed on the echo chamber point. For solo indie projects the overhead of GH Actions adds up though — I moved to self-hosted deploys and cut the complexity significantly. Different tradeoffs for teams vs solo."

Gitlab > Github you techbro msft bay area betas

[dead]

[dead]

[dead]

Why dont they just vibecode their way into stability? /s

Ever since Microsoft's acquisition of GitHub 8 years ago, GitHub has completely enshittified and has become so unreliable, that even self-hosting a Git repository or self-hosted actions yourself would have a far better uptime than GitHub.

This sounded crazy in 2020 when I said that in [0]. Now it doesn't in 2026 and many have realized how unreliable GitHub has become.

If there was a prediction market on the next time GitHub would have at least one major outage per week, you would be making a lot of money since it appears that AI chatbots such as Tay.ai, Zoe and Copilot are somewhat in charge of wrecking the platform.

Any other platform wouldn't tolerate such outages.

[0] https://news.ycombinator.com/item?id=22867803

Not owned by companies that help the US Federal Government illegally spy on their own citizens and murder children overseas:

Gitlab

Bitbucket

Sourceforge

Forgejo

Codeberg

Radicle

Launchpad

Owned by companies that help the US Federal Government illegally spy on their own citizens and murder children overseas:

Github

The 37 minutes of downtime last week cost us a deploy window during market hours. What's underappreciated: it's not just the raw downtime, it's that every CI/CD pipeline, every webhook, every deployment gate has GitHub as a single point of failure now. The centralization risk is real.