Hacker News Reader

Comment by habosa | Hacker News Reader

GitHub’s most important product at this point is probably the API. It’s incredibly comprehensive so it’s easy for tools to augment or replace pretty much any part of the experience.

So many teams with private repos only use GitHub for the basics (version control, access management) and then use third party compatible tools for the rest. Linear for issues, Buildkite for CI, Graphite for code review, etc.

The API allowed me to build CodeApprove (codeapprove.com), which is the code review interface I always wanted GitHub to have. And teams that share my preferences can use it a la carte without losing the rock solid foundation of GitHub.

I know it’s not great that we’re all locked into this platform that is owned by a megacorp that hasn’t always been friendly, but it’s at least a great platform.

View on HN

Agreed that their API is the most important thing, but IMHO they're not doing a particularly great job of it. You've got two separate API systems (REST and GraphQL) that overlap but with neither a superset of the other, two separate ID systems, no help in handling the wide range of incompatible API versions used by old GHE instances in the field, OAuth apps vs Apps that have different constraints on the APIs they're allowed to call and with no clear migration path between them, important bits of functionality used by their own UI that aren't available through the API at all, a convoluted API quota system, etc.

Frankly, a lot of it feels like they were trying to deprecate and replace an older system with the shiny new thing, then realized halfway through that they couldn't and now we're stuck with two somewhat incompatible ones for the foreseeable future. They could really use a strong tech lead on this.

It feels this way with PATs as well, with legacy PATs still necessary for most of the things I use them for, despite being pushed into the newer ones. And the documentation is terrible. I had the exact same thought, the PAT transition feels like an unfinished feature as does the API transition.

For me the API transition is even more bizarre since it’s almost trivial to wrap REST calls with GraphQL.

What it feels like to me is a mounting level of serious technical debt which isn’t being addressed, and if that’s not a sign of trouble in a product like GitHub, I don’t know what is.

What is PAT?

https://docs.github.com/en/authentication/keeping-your-accou...

Personal Access Token

The only reason holding me from using granular PATs is that they _must_ have an expiration date and the maximum is one year.

Yeah - I understand why they do this but I reckon they could have made them renewable without having to replace the tokens themselves.

Also granular PATs still don’t work everywhere.

Reply on news.ycombinator.com