[BidClub_]
Latent Space · · 83 min

GitHub’s Agent Era: 14x Commits, 200M Developers, Copilot’s Next Act — Kyle Daigle

swyxKyle Daigle

YouTube ↗
TL;DR

  • Agent-driven activity is simultaneously GitHub’s strongest demand signal and its largest near-term execution risk. swyx cites 1 billion commits in 2025 versus 275 million per week by April—roughly a 14-billion annual pace if growth were merely linear—and the GitHub guest says it is still accelerating. GitHub now handles “more in a month than we did in a year last year,” making this both a “hard time” and its most exciting period.

  • The infrastructure response requires architectural rewrites, not ordinary capacity expansion. Actions needs materially more CPU as agent-driven PR growth produces more builds; permissions remain concentrated around the database internally called MySQL 1; and larger monorepos are changing average push and PR sizes. The GitHub guest calls the new scaling vector “diagonal”—neither vertical nor horizontal—and expects “fewer and fewer” availability incidents over the next three months as step-change fixes land.

  • Copilot’s strategic center has shifted from code completion toward a common runtime for agents across the software lifecycle. GitHub initially pursued general and per-customer fine-tuning, only for rapidly improving foundation models to “Sherlock” that roadmap. Its response is a shared SDK and harness spanning the Copilot desktop app, CLI, cloud agents, security remediation, issue triage, documentation checks, and parallel task execution.

  • Enterprise AI differentiation is becoming a context-and-permissions problem rather than a model-access problem. The most valuable workflows look backward across PRs, web posts, Obsidian, Teams transcripts, Slack, and email before recommending the next few days of action. Work IQ and Foundry IQ matter because they connect existing corporate stores while retaining enterprise security and compliance controls: “It’s all just context.”

  • Small, composable skills are proving more durable than monolithic agent workflows. GitHub’s internal teams are “ending the era of these massive beautiful perfect skills,” instead sharing narrow capabilities that can be recombined for each role. The same summarization primitive must produce different judgments for marketing, analysts, customers, or sales—or users immediately ask, “Did AI make this?”

  • AI disproportionately amplifies leaders who combine technical pattern recognition with expertise accumulated elsewhere. The GitHub guests describe using AI to “crank up 15 agents on Saturday” while their children play lacrosse, then applying years of business knowledge to revenue planning or product creation. That removes low-value slide production but not the chief-of-staff role: roles “don’t all go away, they just change” toward human connection, coordination, and judgment.

  • Trust, not code generation, may be the binding constraint on agentic development. If one agent writes a PR and another reviews it, “the trust is kind of diffuse”; technical verification still does not answer whether humans, enterprises, and regulators feel safe accepting it. GitHub therefore favors configurable reputation heuristics and costly signals such as sponsorship over universal rules, while acknowledging that stars, account age, and contribution counts are all gameable.

  • Microsoft’s OpenClaw interest signals a platform bet extending from enterprise context down to operating systems and compute. A useful personal agent needs computer access, but a workplace version also needs OS-level sandboxing so an employee can “use that claw and not get fired.” The opportunity is to supply reusable platform components across Windows, cloud sandboxes, inference, CPU, and silicon—not have every team recreate the same top-level agent product.

Digest · the substance, structured for research

1. Thomas Dohmke’s technical roots now span GitHub operations and Microsoft marketing

  • Dohmke joined GitHub as a developer 13 years ago, building webhooks, APIs, and the platform layer before leading engineering teams through roughly 2018. He also helped launch the first GitHub Actions at Universe in October 2018, before moving deeper into business leadership. He named Semmle, Dependabot, Pull Panda, and npm among the post-acquisition additions.

  • His expanded remit combines GitHub’s COO role with responsibility as Microsoft’s developer CMO. The connective tissue is translation: developers and enterprise buyers need “two very different messages,” while the company itself must preserve GitHub’s distinctive operating culture after the Microsoft acquisition.

  • Coding was never the hardest part in Dohmke’s telling: “The problem has always been, like, people.” His public philosophy follows from that—“tell the truth, be authentic, show people how to use it,” then let products speak for themselves.

2. GitHub uses AI to look backward before it plans forward

  • Dohmke’s renewed commit activity is less about returning to conventional application development than connecting scattered information. His core pattern is “less building forward” and more “a recursive loop backwards”: reconstruct what happened, determine what worked, then adjust the next three or four days.

  • One workflow examines the day’s PRs, public posts, three months of prior work, Obsidian notes, Teams transcripts through the Work IQ MCP server, and Slack. Only after assembling that history does it produce the week’s actual messaging plan.

  • Applying this across roughly 3,000 employees required a rule: “No one has to change how they work.” GitHub distributes a CLI and shared skills that can read the tools employees already use—primarily GitHub, Teams, email, and Slack—rather than demanding adoption of another destination application.

  • For a globally remote company, those retrospective reports recover information people miss outside an office. Findings can be posted automatically into GitHub issues or discussions, with the Copilot desktop app, GitHub Actions, and agentic workflows continually running when Dohmke opens his laptop.

3. Atomic skills are replacing brittle mega-workflows

  • GitHub’s internal practice is moving away from elaborate, end-to-end skills. The GitHub guest argues that “weeks go by, months go by, things change,” leaving a tightly coupled mega-skill difficult to repair; the better abstraction is “the Legos we’re using,” with the instruction book assembled as needed.

  • swyx suggested that inputs need not fit exactly as long as they are roughly contained, and proposed orchestration skills that call narrower primitives. The guest agreed, while stressing that even a seemingly universal primitive such as summarization changes meaning with its audience.

  • A summary for an analyst briefing is not the summary needed for a customer meeting, marketing plan, or communications review. The emerging complexity is a matrix of atomic capabilities and professional context; its small permutations determine whether output feels credible or provokes, “Did AI make this?”

  • Unlike conventional plugin infrastructure, a skill can be opened after a bad response and corrected with “English words.” That editability is the “magical” building block, although teams still need to learn which instructions reliably produce the desired judgment.

4. AI returns former developers to creation without erasing human work

  • swyx asked whether this is a golden age for former developers who became executives. The answer centered on pattern recognition and problem solving: technical fluency matters, but the greater advantage is combining it with ten-plus years of business, operational, or domain knowledge.

  • The argument extends beyond executives to developers with nonlinear histories—people who studied something else, changed careers, or left software and returned. With AI, the guest can “crank up 15 agents on Saturday, you know, while my kids are doing lacrosse,” recovering the original magic of making something and showing it to another person.

  • During annual revenue planning, he gathered internal context, built a small SQLite-backed application, and generated an entire presentation without touching the slides manually. A deliberately restrained skill made it “humanly bad,” and neither the CRO, CFO, nor their teams raised the fact that AI had produced it; the provenance simply did not matter.

  • swyx pushed back that overtly AI-made slides can honestly signal possible errors. The larger point survived: a chief of staff no longer needs to spend hours formatting decks, but remains valuable for connecting people, identifying meetings, and coordinating travel—just as the role moved from opening letters to handling email.

5. GitHub’s supply-chain strategy trades standardization for compatibility

  • When swyx challenged whether Actions is GitHub’s largest security problem, Kyle Daigle said the literal code in repositories is “probably” the greater source. Actions evolved from GitHub Services executing users’ arbitrary Ruby code toward strong containerization, though unpinned workflows—following v1 or “latest”—retain dependency-style risk. The old version of Pages was another example of infrastructure that ran code separately from Actions.

  • GitHub is using Azure compute under the hood for some parts of its new Dev Compute service, allowing small VMs to start rapidly for containerized tool calls.

  • The npm acquisition was primarily about keeping infrastructure that “powered the internet” running and scaling. GitHub invested in backend and manifest work and tightened 2FA and token policies, but every security improvement can also create a “snow day for developers” by breaking a contract accumulated over roughly 15 years.

  • swyx proposed replacing packages with source that an agent inspects, trims, and vendors. The GitHub guest saw value—“all things old or new again”—in smaller dependencies, but rejected it as a complete solution: agents can be persuaded code is safe, so static analysis, runtime testing, and tools such as GitHub Advanced Security or Socket remain necessary.

6. Agentic pull requests turn verification into a trust problem

  • GitHub historically lets communities develop practices before cementing them into platform defaults. That posture becomes harder when “80% of your PRs” come from agents, because prompt requests, richer artifacts, and alternative review flows each solve only part of the problem.

  • The discussion’s unifying diagnosis is that “ultimately we’re trying to codify trust.” When one agent writes code, another agent reviews it, and a human inspects the result, extra evidence can improve verification—but “the trust is kind of diffuse,” while acceptance still often rests on a known person’s approval.

  • swyx anticipated a tipping point when machines become measurably safer than human developers. The GitHub guest compared it with trusting a Waymo enough to look at his phone but distrusting other self-driving systems even while watching the road: statistical proof and the human feeling of safety mature at different speeds, especially under multinational regulation.

  • A maintainer’s vouch system may delight one community and fail another. The discussion sees sponsorship as a stronger, costly expression of support, but prefers configurable agentic heuristics—accepted PRs, linked social history, project-specific rules—because universal thresholds merely teach attackers to age accounts, inflate stars, and manufacture contribution histories. The broader trust vector may eventually involve some form of human digital ID.

7. Two hundred million developers expand GitHub’s market—and muddy its signals

  • Mario Rodriguez acknowledged that stars and commit counts are passive, gameable signals; GitHub’s anti-abuse response remains partly “whack-a-mole,” now assisted by AI. Yet he thinks explosive star growth also reflects a genuine zeitgeist, not merely purchased popularity.

  • GitHub has passed 200 million developers, prompting swyx to object that this means people with accounts, not necessarily developers. Rodriguez rejected the distinction as premature gatekeeping: if someone turns an idea into running code—even with AI—that person has entered the same journey toward databases, bugs, and deeper technical understanding.

  • Experiments such as Spark reinforced one platform tenet: GitHub may add a low-code veneer, but it should “never” hide the code. Rodriguez wants software creation to resemble changing a light switch—something anyone can attempt—without pretending everyone should open the breaker box.

8. Agent activity has made this GitHub’s best and hardest era

  • Asked whether GitHub faces an easy or difficult moment, Mario Rodriguez answered “a hard time,” then called it the “best and most exciting time” he remembers. Activity that previously justified an annual Octoverse report is now expanding so quickly that GitHub does more in a month than it did in a year previously.

  • swyx supplied the starkest comparison: 1 billion commits in 2025, followed by 275 million per week by April—on pace for 14 billion annually if linear. The GitHub guest said the pace was “still speeding up,” while swyx pressed why other systems have survived 14× growth without similar downtime.

  • Thomas Dohmke said failures are appearing in new places: not the historically unreliable webhooks, which were rewritten, but novel permission combinations spanning many objects. GitHub also feels every outage internally because employees operate through the same github.com rather than a protected private version—“the promise of dogfooding.”

  • He offered no exemption for extraordinary demand: “None of this is an excuse. We have to do the work.” What GitHub intends to restore is the older community contract of publishing technical explanations and having engineers describe what failed after fixes are complete.

9. GitHub must scale diagonally, not merely up or out

  • Actions is a major pressure point because more agents create more PRs, more PRs produce more builds, and more builds require CPU. GitHub still needs GPUs, but CPU capacity has become an explicit constraint, driving expansion beyond its data centers into additional Azure and cloud compute.

  • Broad outages often trace to permissions, many of which still touch the database internally called MySQL 1. GitHub has spent years pulling pieces out of it using Vitess and other technologies; Shale was born from that work.

  • Workload shape has also reversed earlier assumptions. The industry had moved toward more, smaller repositories; GitHub is now seeing more large monorepos, sometimes containing huge blobs, while average pushes and PRs are no longer the sizes old services expected. Git infrastructure and job-queuing systems therefore need redesign, not tuning alone.

  • Historically GitHub could scale vertically with larger databases or horizontally by adding servers. Dohmke says neither suffices under compute constraints and changing payloads, forcing “diagonal” rewrites of services operating for 10 or 15 years. Recent weeks were already better, and he expects fewer incidents over the next three months as material fixes deliver step changes.

10. Copilot is becoming a shared agent runtime across the SDLC

  • After Copilot’s successful code-completion launch, GitHub spent roughly a year to a year and a half pursuing fine-tuning—both a stronger common model and customer-specific models. Then the next generation of foundation models arrived, competing coding tools accelerated, and the models “Sherlocked us a little bit.”

  • GitHub’s answer is a single SDK and harness underlying its coding agent, CLI, desktop application, and cloud agents. Daigle highlights model choice, bring-your-own-key support, improved post-training, language-specific models, and the Copilot app as his current daily driver.

  • The product boundary now extends across security remediation, every incoming issue, documentation drift, deployment, and parallel task orchestration. Instead of filing an issue to preserve an idea before working on it, a developer may simply tell an agent, “Just build this,” while established projects still use issues alongside agents.

  • GitHub’s distinctive ambition is eventually to behave as Kyle, swyx, or a particular team would behave, using rules, memory, dependencies, and accumulated practice. Daigle concedes that full personalization is “an open research problem,” especially when team methods intentionally change.

11. Ambient context is the form factor Daigle thinks coding still lacks

  • When swyx asked whether agents have covered every SDLC surface, Daigle called the premise “hyper myopic.” Even background coding agents usually lose everything outside code for mundane security and governance reasons, despite software depending on specs, email, team discussions, business priorities, and current demand.

  • His desired form factor is “actual ambient AI”: while implementing a feature, the system should know every relevant document and conversation, then carry the group’s taste, judgment, and earned expertise into the code. OpenClaw is interesting because it connects the data sources a person cares about, not merely because it provides another launcher for coding tasks.

  • swyx said he would welcome an agent reminding him to drink water, but not rerouting his car. Daigle separately said he was not claiming AGI, only that systems should remember preferences users have already expressed repeatedly.

12. Microsoft is rebuilding the platform beneath work-safe agents

  • Microsoft’s dedicated OpenClaw leadership reflects the agent’s personification of a system that understands someone, accesses their resources, and can operate a computer. In the workplace, that requires better Windows and OS-level sandboxing: “I need to be able to use that claw and not, like, get fired.”

  • The Microsoft guest argues that Microsoft should supply reusable platform components instead of having everyone build the same top-line product. That means contributing to open source, redesigning operating systems for agents as additional users, and tracing requirements through cloud sandboxes, CPU, inference, and Azure’s silicon layer—“we’re at physics problems.”

  • The practical objective is that “how I build on the weekend should be how I build at work,” even inside a Fortune 100 or Fortune 500 company. Work IQ and Foundry IQ act as context engines across existing stores while retaining security and compliance, making enterprise AI useful without creating an immediate shutdown over leaked information.

  • swyx observed that GitHub’s Copilot and Microsoft’s Work IQ teams should sit together because they share the same context problem; the guest said that collaboration has already been happening for months. His suggested question for Satya at Build: what does he believe will be true in two or three years, and why will Microsoft’s consolidation of context, inference, and agent work pay off?

Cargo

I just find that the folks who came from a different career, went to school for something else, went off and did this random thing, and then became a software developer—or were a developer, did a random thing, and came back—learning that extra set of information, learning those extra skills, and now having the power of AI, where I can crank up 15 agents on Saturday while my kids are doing lacrosse, that's really powerful. I think it gets me back to that feeling of creation, and it's very hard to replicate that in most other senses.

Before we get into today's episode, I just have a small message for listeners. Thank you. We would not be able to bring you the AI engineering, science, and entertainment content that you so clearly want if you didn't choose to also click in and tune into our content. We've been approached by sponsors on an almost daily basis. But fortunately, enough of you actually subscribe to us to keep all this sustainable without ads and we want to keep it that way. But I just have one favor to ask all of you. The single most powerful, completely free thing you can do is to click that subscribe button. It's the only thing I'll ever ask of you. And it means absolutely everything to me and my team that works so hard to bring the Inspace to you each and every week. If you do it, I promise you we'll never stop working to make the show even better. Now, let's get into it.

Shawn Wang

Okay, we're here with Cargo, CEO of GitHub. Welcome.

Thomas Dohmke

Yeah, thanks for having me.

Shawn Wang

You're not just the CEO of GitHub. People know you as that.

Thomas Dohmke

Yeah.

Shawn Wang

You have a new role.

Thomas Dohmke

Yeah, so I have an expanded role now. I mean, we've been working—I've been working—at GitHub for 13 years and doing all things developer. I joined as a developer myself, and now I'm also responsible as the CMO of Developer for Microsoft. All the learnings and passion for developers, how we work with them, how we communicate, and how we bring our products to market—we're also bringing that expertise to the broader Microsoft ecosystem and helping every developer that uses a Microsoft product, or would like to, have a similar experience to what they've had with GitHub over the years.

It's a very different role in some ways, but it's also just building on the experience that I've had at GitHub: tell the truth, be authentic, show people how to use it, and then let the products speak for themselves. I'm not just doing that with GitHub, but with all of Microsoft.

Shawn Wang

Yeah. We'll be releasing this in conjunction with Build. You have lots of stuff planned, and we can touch on that whenever it's appropriate.

I think one of the interesting things is that I rarely meet a COO who's also a CMO. I think you're very outward-facing, and you're very confident publicly. That's rare. Do you actually view yourself as COO? What's your thing?

Thomas Dohmke

I think for me, it's been funny. The titles have always felt a little strange to me. I joined GitHub as a developer, you know. I wrote so much of the—

Shawn Wang

Let's bring that up.

Thomas Dohmke

Yeah.

Shawn Wang

Yeah, you wrote the backend.

Thomas Dohmke

Yeah. I was going through some old photos when folks were talking about how things were being built and how others would build GitHub. I built webhooks and worked with teams building the API. I built the platform layer—anything that integrated with GitHub. Up until really 2018, I built or ran the engineering teams, and that's where the beginning of my passion always was: helping people build things and deliver them to their customers.

Being a developer building for developers was always super unique. As my role expanded, it became my ability to talk to not just developers, but also enterprise customers and business leaders, and have this translation layer. Through all those years, GitHub has always operated pretty uniquely. Post-pandemic, working remotely was not as novel as it was when GitHub started in 2008, but all that expertise of running remote teams and doing it well became this sort of bigger role, ultimately turning into the COO role: How do we operate GitHub in the way that GitHub has always operated after the Microsoft acquisition?

For me, I still code. I love coding, but the problem has always been people. It's a much harder problem to support our own employees, and it's a harder problem to communicate to developers and enterprise buyers what we're building and why it matters, because those are 2 very different messages. Getting to work in the mix of COO, CMO, and also just being a developer is what's kept me at GitHub for so long.

Shawn Wang

Apparently, your commits have gone up.

Thomas Dohmke

Yeah.

Shawn Wang

What's this? What's going on?

Thomas Dohmke

You called me out pretty aggressively. As you can imagine, you can see my normal era of being a developer in the 2013–2014 era, then moving into management and ultimately the COO role. I think what you see there is me really getting back to coding thanks to AI.

Similar to connecting problems between how to market, how to operate a business, and how to code, I find that building agents and workflows that connect very disparate problems is what's driving this. Some of it is writing software, but a lot of it is connecting a ton of different data sources to help me out. That is completely me really diving in on the AI side and trying out our tools and everyone else's tools.

For me, building for the nontechnical leader—though I'm technical—and figuring out how we're able to use these tools for more than just the simple call-and-response that I think a lot of nontechnical employees do when they're told, "You have to use AI," is really important. Everyone uses ChatGPT, Copilot, Claude, or whatever, but I want to get into how this is going to help me out.

It's not the simple example of "I need to write a blog post." It's helping people find workflows like, "I need you to go through all the PRs today. I need you to go through everything that we've posted online. I need you to go through what we did over the last 3 months. Go through all of my Obsidian notes for any mentions of this, then go through my transcripts at work."

We use Teams, so I can use Work IQ, call that MCP server, grab all the transcripts, go through all of Slack, and then build me out the plan of what this week's messaging actually was. That's something that was impossible before. For me, what most of this launch is actually about is less building forward. It's actually a recursive loop backward.

I'm always looking at what happened first. Go back through the week and tell me what we did, what worked, and what didn't work. Then tell me, in the next 3 or 4 days, what would you tweak based on this sort of looking backward and then looking ahead a little bit? I find that to be so much more valuable, especially for nontechnical people, because LLMs are very good at that retrospection—finding all the patterns, pulling them out, and then applying that retrospection to just a couple of days or a short period of time.

It's all a bunch of apps that I've built and launched, like a bunch of internal tools that I use. I use the new GitHub Copilot app, the desktop app with workflows. Every time I crack open my laptop, it's running workflows for me. It's just a ton of different stuff, and of course it all ends up on GitHub.

Shawn Wang

Of course, that's where stuff is hosted. Man, there's so much to ask you. I was going to leave the "How do you run a company with AI?" thing to the end, but I have to ask one thing. You said you're looking back at the week and understanding what happened. When you say "we"—

Thomas Dohmke

That's 3,000 people.

Shawn Wang

Yeah.

Thomas Dohmke

Yeah.

Shawn Wang

How?

Thomas Dohmke

When we started rolling out AI internally beyond engineering, one of the things I was really passionate about was that we had to do this in a way where no one had to change how they work. I don't want to have to teach you a tool, and I don't want to have to teach you something new. We tried out a few tools, but most of them didn't work because I had to get you on board and teach you how to use them.

What we've actually ended up doing is building a set of skills internally. We each have our own set of skills, and we've been distributing the CLI even to the nontechnical folks. We're effectively just giving it access to read everything that we're writing. For us, that's usually GitHub, Teams, email, and Slack—Teams for video chat, generally speaking.

Shawn Wang

Teams and Slack?

Thomas Dohmke

Yeah, we use Teams for video communication, but we don't use it for chat. We use GitHub for a long, long history, right? We always talk about ChatOps, and everything is built into Slack—every command, every flow—

Shawn Wang

Even though you've been acquired for, I don't know, 8 years now, you still use that?

Thomas Dohmke

Yeah, it's a purpose-built tool for us.

Shawn Wang

And I think the reality is that moving off of it would be so bluntly expensive, simply because all the tooling is baked in with that paradigm. They both have their pros and cons, but they don't work the same way at all.

Thomas Dohmke

Yeah. I mean, we still use a bunch of different tools because they're the purpose-built tools that we need.

Shawn Wang

But the same doesn't go for the rest of Microsoft, presumably. Various teams operate in various ways. I think it just matters what you're trying to do. Yeah, yeah.

Thomas Dohmke

But we do work across every tool that we use. By giving everyone access to all of that context in the new Work IQ MCP server, which is quite cool if you live in the M365 world, I can ask it all these backwards-facing questions, and it's incredibly important for our teams that are working remotely.

There's a lot of stuff you miss when you're not in an office, and we are spread out all over the world. So most of that is looking back, and then we post either automatically into GitHub issues or discussions these sorts of findings or our industry reports—what's happening this morning, today, or yesterday.

A little automation gets run. We'll use the app, or we might use GitHub Actions with our agentic workflows, just to go do that run. Then we push it into GitHub and keep having a conversation. Usually, for us, it's about looking back and looking forward on the nontechnical side.

Then, of course, for a lot of those folks, it's also building an app, pushing it to GitHub Pages, or pushing it somewhere to host it. It's just enabling everyone with that power of, "It's going to take me a week to figure this out." Instead, we're going, "I built a skill. Let's put it into a repo. We'll all share that skill together," and then we'll use the CLI—or now the app—just to run it.

Shawn Wang

How do you manage the bloat of skills like everyone has their thing and they're trying to promote it to the rest of their peers in your org? And obviously whoever becomes a skill influencer internally becomes an AI leader, right, of sorts. I assume you have those. And I assume it's a mess like

Cargo

I think the reality is there's two pieces. First is I think that we're ending the era of these massive, beautiful, perfect skills that are just not any of those things. What we found is that we're really talking about incredibly micro skills that are just doing one thing for us very, very well, versus a skill that's going to do that full report. It's usually a single skill that's going to identify the most important marketing information given any MCP server. It's less about stitching a bunch of tools together and having it produce this mega output, because then weeks go by, months go by, things change, and you want to tweak your mega skill and you're screwed. Now we're really just talking about the Legos we're using and letting the instruction book be something we're all putting together.

Shawn Wang

Anyway, so um yeah, this is one of those like download anything, transcribe anything, and then you can string together the atomic skills that do one thing well into some kind of orchestration skill that calls other skills. I assume—does that match?

Thomas Dohmke

Yeah, I think so. I think that the—

Shawn Wang

Summarize anything.

Thomas Dohmke

Totally. For me, summarizing something—I do communications and PR, analyst relations and marketing, and customer activities—my approach to summarizing everything is very different for each one of those contexts. If I'm summarizing something for an analyst, that's very different from how I'm probably going to summarize something for a customer meeting or an engagement.

Kyle Daigle

That's the difference when we're talking about the tools I might use on Saturday, or the skills I might use on a Saturday when it's just for Kyle. Those have an atomic, actual tool underneath—or maybe a skill—and then Kyle cares about X.

But when we're talking about work and enabling the marketers and communicators, it's the atomic: this is what good summarization is, and then this is what I care about for marketing, for communications, or whatever. I think that's the interesting matrix problem when we go from a developer set of concerns to all kinds of different professions. What that word means to me is different from what it means to you, and different from what it means to the analyst or the salesperson.

And that's where I think the matrix mess is that we're just starting to find. It's not these mega-skills; they're all just slight permutations, but those permutations are really important. It's the difference between someone reading this and going, "Did AI make this?" Or, "This makes total sense, and I would expect this when I'm giving a briefing to Gartner," or whatever else.

swyx

Yeah. I think the beauty of it maybe is that you don't have to be that careful about what goes in there. It doesn't have to exactly fit, as long as it's roughly contained in there. I used to complain about plug-in hell—when you have a framework and then 100 things that you need to integrate. GitHub used to be bloated with all these things, and now we don't need them anymore.

Yeah.

swyx

Now you just use skills.

Kyle Daigle

Yeah. Oh, and I think the most magical thing is that I can also crack it open. I could change how the plug-in is coded, or I could do that now with AI, but I think there's something more magical about getting a response back and being able to say, "That's not right." Then you just crack the skill open and type English words. It's different.

That building block is very unique. Once I get everyone to understand how to best make those changes to get the most power out of them—

swyx

Is there a common framing among your peer group of people like you for something I'm feeling, which is true? Is this a golden age for former developers who are now in leadership? You can wield the tools, you would know the right words, and you're maybe not too close to the details, which doesn't matter. But you're more effective than someone who doesn't come from that background.

I think the secret has always been your ability to identify patterns and solve problems. For folks like myself who don't code day to day anymore, that has made me successful as a developer, made me successful as COO, and now as CMO.

Now that I have access to Git and can write code, I'm applying that pattern-finding and problem-solving ability. I know enough about how to say, "I want to make an app, and I don't want to break out of jail or create something that's not going to be able to work, be deployed, or scale."

That ability to apply all that additional business knowledge and still code is what makes that so interesting to me. It's slightly different from some of the other technical leaders who became business leaders and are now going back to their apps and updating them. Good for them. But I think the much more interesting thing is, "Now I have this whole new set of expertise over 10-plus years. Why not take that and use that as a developer with these AI tools?"

So I definitely think that makes me more powerful, but I think that's true for every developer as well. Most of the developer friends I still have also have some other underlying skill and passion. There are really talented, very linear computer science software developers, absolutely.

I just find that the folks who came from a different career, went to school for something else, went off and did this random thing and then became a software developer—or were a developer, did a random thing, and came back—are learning that extra set of information and those extra skills. Now they have the power of AI, where I can crank up 15 agents on Saturday while my kids are playing lacrosse.

That’s really powerful, and it gets me back to that feeling of creation. It’s very hard to replicate that in most other senses. That first time you build an app, click it, and show someone—that’s magical. Being able to do that not just in code, but across all kinds of different assets, is huge.

We were doing our revenue planning. Every year, we talk about what it’s going to look like for the next year, and, of course, there are slideshows everywhere talking about what we’re going to talk about and what the narrative is. As you said, I thought, “I could probably just build something to do this,” so I wouldn’t have to build the whole spreadsheet and pass it to my team. We went through this process, I got all the information, and used the skills I mentioned.

I built a little app that made it easier to look at some of the information in a SQLite database. I ultimately built this entire presentation without touching any of it. I thought, “I’m just going to present this to our CRO, the CFO, and their teams without mentioning that I built it with AI.” I built a skill to make it look very much not AI-driven—not pretty, but clearly not AI. Don’t do anything interesting; just go exactly through it.

It used my notes from Obsidian and all the context I mentioned before, including the plans, and it never came up once that it was AI-generated.

swyx

Yeah.

Kyle Daigle

Never once. Exactly. It didn’t matter. Now I can take that tool and say, “Look, I don’t want you to go build slideshows. They’re just helping us share information with each other. If this thing can do it with a little bit of crafting from you, and then we can look at it together, awesome.” There’s no value in all that extra work.

I think the ability to make it look humanly bad and build a little app to manipulate the data is part of that upside for developers who are now in leadership roles. The thing that I feel like I said before—that’s all a people problem. I know if you’ve used Cowork to build a slide deck unless you spent a bunch of time to not—

swyx

Okay. Well, I think there’s a certain charm to just being blatantly AI. You’re honest about the fact that there may be mistakes here that I cannot vouch for. How much value is there? But anyway, the real question I want to ask is: You were a chief of staff to Thomas Dohmke, and in the pre-AI world, that job would have involved preparing slides for me and all that. Now you do it yourself?

Yeah. I still have a chief of staff, because the difference is sort of the discussion every time we have some sort of technology evolution. It’s not that the jobs or the roles all go away; they just change.

I don’t have someone spending all their time building out slides for me in presentations, because I don’t need that anymore. Now I need a person who’s able to find all the different connections between humans in those discussions and help me figure out, “Okay, I should be meeting with this group and this team. They have an opportunity, and I’m going to be in San Francisco today and Seattle tomorrow.” Those human-connection aspects are still incredibly valuable and have always been a big part of the chief of staff role.

Chiefs of staff aren’t opening up letters to process anymore; they’re doing email. It’s the same thing. Now they’re not building as many presentations because they have the ability to have AI take that on for them and share it with me. Great—let’s keep moving, because it’s allowing us to go faster and make better decisions more quickly.

swyx

Yeah. Awesome. We can dive into more productivity insights as we go. I did want to do a brief history of GitHub. We started here, and you were also involved in the npm acquisition. I wanted to touch on that, and then more recently, bring us up to the present day, where we’re having uptime issues—which, transparently, you’ve already addressed publicly, but we’ll discuss on the podcast. Did I miss anything? Any other major highlights? Obviously, it’s a lot of years to cover.

Yeah. I think one highlight was that, right before the acquisition closed in 2018, I got to launch the first version of GitHub Actions at GitHub Universe.

swyx

They’re that young?

Yeah. It was October of 2018, I think. I was an engineering leader on that project and got to launch it. Then we did acquisitions of npm, as you said, Semmle, Dependabot, and Pull Panda—a whole bunch of things.

swyx

Pull Panda, right?

Yeah. Pull Panda did well on developer experience. That was the big shift after the acquisition: I joined the sort of business side.

swyx

I need to press you on some of these things, because you were there, right? How often do I get to talk to someone who was there? Is Actions the number-one source of security issues on GitHub?

Oh, shit. I think the number-one source of security issues is probably the literal code in everyone’s underlying repositories. I would say, further back than that—if you remember, I had this graph; I didn’t say this before—this is ultimately webhooks.

swyx

Yes.

Kyle Daigle

If you look at the graph, it says Hookshot, Hookshot FE for front end, and then it says GitHub Services. Back in the old days, we had a repository that was Ruby code. You could write any Ruby code in there, and we would execute that on your behalf as a service. If you were trying to integrate with something, we would run it for you.

Of course, there were no containers, because it was 2014. There was some isolation, obviously, but it was mostly separation at the server level. That’s an example, as is the very old version of Pages, which ran on its own containerization infrastructure, not on Actions. Pages is an all-time great product; it powers the internet to some degree.

Those were places where, clearly, there were no issues, to my knowledge. But I was looking at those things and thinking, “Okay, we can’t be running arbitrary Ruby code on everyone’s behalf.” We containerized all of that into Actions. Now the containerization is really good. Most folks aren’t pinning it to a particular SHA, so that’s a big source of pain for people if they’re doing something similar to dependency management—just using `v1`, `newest`, or `latest`.

That journey—from “we’re just going to run all this arbitrary code and it’ll basically be okay” to where we are now—has led to really good containerization. We have a new underlying agent-containerization service. We’re using it under the hood through Azure compute for some parts of the new Dev Compute service.

With Dev Compute, you can run things really fast and spin up small VMs very quickly. When you’re doing a tool call, you can just do it containerized.

swyx

Exactly. Yeah. I mean, look, that grows into the full software development life cycle. Code hosting was just the start, and it’s grown beyond that. Let’s talk about npm, because I think that’s also a very major point in the industry. I do think it was looking for a home and was kind of struggling as a business, right? I don’t know how you characterize that whole acquisition and how it—

Mario Rodriguez

Yeah. When we were talking to the team, I think the big thing for both of us was to find a way to keep npm—which was basically powering the internet then, and way more so now, to some degree—running, keep it going, and continue to scale. It was having scaling problems. If I recall, back at that time they were doing some rewrites.

swyx

I mean, that’s cute compared to now.

Yeah, well, that’s the thing. When I’m talking to folks now, there are so many more underlying uses of npm than there were back when we had them join GitHub.

But that was ultimately the goal. It was really like, okay, we used to have Pages; we have the world’s code. Let’s make sure that we can keep npm running well for the world.

We put a bunch of time and investment into fixing some of the underlying backend changes, some of which we talked about, like the manifest work, et cetera. And now we’re really trying to bring the security posture of npm up to speed.

But it is a unique challenge in that every move we make to make it more secure will break a lot of people. Security is paramount, and we take it very seriously. Anytime we have a problem with GitHub where we make a change that makes us more secure but hurts people, there’s a snow day for developers, or a really bad fire that they have to go put out.

We’ve changed the 2FA policies, and we’ve changed the way the tokens work. When we find tokens that have been exposed or potentially exposed, we invalidate them.

swyx

I love that feature of GitHub that creates issues.

But that’s the thing: we’re trying to push the community forward without necessarily doing something that is going to break the contract that’s been in place for 15 years—or close to it—on npm.

swyx

Yeah, I think so. Now we’re talking about open source and publishing. I think there’s something here with what people are calling “slop forks,” which I think Malte from Vercel is doing.

Yeah.

swyx

Part of me thinks, well, the way to get past any vulnerability is: let’s just get rid of the concept of npm. We only publish source code, and anytime you want to import it, you have your coding agent look at it and then adapt whatever subset you’re going to use into your code—vendor it, but as an AI-vendored dependency. Is that realistic? I don’t know. Will that solve all our security issues? I don’t know.

Mario Rodriguez

I mean, I don’t think it will solve them. Mitch Hashimoto was just talking about this today, and in some ways, it’s all things old or new again. Absolutely, vendoring everything—I remember in 2013—

swyx

Yeah, we must return.

That’s what I mean. We were vendoring everything. We were having actual discussions around, “Should we take this full thing? Why is this so big? We only need this one file.”

So I do think there’s something true there, where either taking only what you need or having the dependencies get incredibly small over time will help to some degree. But it’s not going to solve the fundamental problem, I don’t think, because of the vulnerabilities. An agent looking at them can be convinced in a million different ways that something is secure or not and pull it in.

We can do static code analysis or runtime testing to say whether the code works or not. That is the step that needs to continue to be invested in. The question is just how much scope it should have: is it this enormous project that I’m pulling down, or should it be this smaller piece?

Either way, most companies are running some amount of security checking on the packages that they’re bringing in or vendoring. I think that won’t change. That’s what Advanced Security does to some degree. Socket does to some degree. Everyone is doing a piece of that.

How we each do that, especially when we’re talking to enterprise customers, is very different. No one wants one single way to do it. I think that’s always been GitHub’s unique position in the world.

I talk a lot to maintainers, and I talk a lot to folks about this. We rarely start a process or a practice and push it onto the community. We usually wait for the sort of RFC process, socially or literally, with everyone agreeing, and then we’ll cement something in.

If it's your role in GitHub, we don't want to shape the whole thing; we want it to be figured out. But how do you balance that role in the industry to keep everything as secure as possible, make sure you're not going to be compromised as a human because that's usually how it all happens, and not create a process or lock us into a flow that you're not going to like, or Mitchell's not going to like, or other open source projects aren't going to like? That's always been a tricky balance for us. I think that's something we haven't talked about enough. We're not going to be able to fix everything for everyone in a way that everyone is going to like, so tell us what is working. We hear from him and we'll fix up just like we do all other kinds of maintainers.

But that process between making those types of improvements and being more secure, and creating—I forget what he calls it. It’s not the proof process, not the claims process. Do you know what I’m talking about? His projects have a way for you to vouch.

swyx

Thank you. Yeah, he has a vouch system for saying, “Hey, you should accept my PRs.”

I just built this into GitHub. I don’t know.

swyx

Well, see, that’s the thing. You say that, and Mitch and his community really like this. Then I’ll go talk to other maintainers globally, and they’re like, “No, this doesn’t work for me.”

Yeah.

Mario Rodriguez

That is the tension, but also the beauty of GitHub, depending on which way you look at it. We want to help maintainers, so we create all these tools to let you have more control over how much you take in from AI and PRs. But you can also use this project. If it takes off and becomes the de facto standard, then we probably wouldn’t enforce it, but we would add it in, because that’s the flow we tend to follow.

swyx

Yeah, a lot of people don’t know the history of the pull request.

Sure.

swyx

That’s something that GitHub standardized, basically.

Mario Rodriguez

Yeah. It was a very messy process beforehand, and now we have the benefit of it being the process. Now we have to figure out the next best process, what adaptations need to change, and what a pull request looks like when 80% of your PRs are just coming from your agents and not from other developers.

swyx

Do you like the prompt request idea from Peter?

I think each idea has its merits. I’m not trying to say anything good or bad, but I feel like I’ve seen versions of this. We have Entire, Thomas’s startup, taking all the assets of what you’ve built and putting them in. I think that has great ideas. There are all these various permutations of the PR flow.

But I think the reason there’s not a single answer is that ultimately we’re trying to codify trust. We’re trying to say, “Okay, if Shawn reviews this, I’m going to trust it because you’re Shawn, or you’re the senior developer, or you’re the whatever.”

Right now, when we’re working in a flow where an agent writes code, another agent reviews code, and then Kyle goes and looks at it, the trust is diffuse. Most of the tools we’re talking about are focused more on verification flows. We have more assets to look at, so I can probably say whether this is a good PR or not. But that still doesn’t solve the human problem of looking at a PR and wanting to know whether you can trust it.

We still tend to use human signals for that.

swyx

Mitchell approving it, or Kyle approving it, or whatever.

So I think that’s why most of these options haven’t really solved it. Ultimately, it’s a social problem. It’s a human problem to review it and agree, or you fully trust the tool and imbue that tool with full trust, which I think in some cases absolutely exists.

swyx

So, in the same way that there will be a tipping point in society when we don’t allow humans to drive anymore—

Because machines are measurably better than humans.

swyx

I’m looking for that tipping point, right? Waymo is ridiculously expensive. Someday we’ll have Waymo on a desktop. I don’t know. What does that change in the equation?

I took a Waymo here, and I was on my phone, not looking around at all. There are other self-driving vehicles that I would not trust while staring at the road. I think that trust is something that is—

swyx

Is this a Zoox thing?

I think that is both. I think that is both, you know, like—

swyx

There’s Zoox in this robotaxi.

Alessio Fanelli

Well, I mean, depending on what level of self-driving, my point is that I think part of that is a mixture of verifiable proof—how many accidents, how much data, and so on—and the human aspect of how I feel when I'm in this car, what it tells me, etc. That's why I think some of these AI tools tend to imbue me with more of that feeling of trust, even if the data says this is 100% accurate. I feel like it takes more time for us to decide, “Should I trust this or not?”

That's in the soft sense of startups with high-agency weekend projects and open source. Then there are enterprises and regulated industries and everything else, and that is an even harder problem to solve because even when it is fully verified, not only do you have to have trust from the humans on the team, you probably have to have trust from multinational governments around the world and regulating agencies. Until we tip over to your point on the human EQ side of it—“I feel okay, this feels okay, I've been proven enough”—the ball won't start to roll a lot faster. We'll end up getting to, “Okay, we can trust this and feel good about it,” in the most difficult cases.

You know, if human trust is the thing that matters, I feel like GitHub, as the developer social network, could maybe do more there. Vouching is one system, but we have star counts and contributor rights, and that's it. I feel like there should be more in that space. I don't know if there are any other design decisions that could help there.

Mario Rodriguez

I mean, I think that one of the places that we don't really expose right now in this sort of way is some degree of hard trust and support. For me, Sponsors is a good example of that. It costs you something to prove that you believe in my project and trust me to some degree, or want to support me at the very least.

Alessio Fanelli

Okay, so payments for open source. Why not?

Mario Rodriguez

As we keep moving forward, there's more and more projects where I'm adding more and more dollars into Sponsors personally because I want to support them. I also know enough of their work that I want to support them, even though I've probably never met them in person.

The thing that I don't love about stars or commit counts or anything else is that, ultimately, even with all of the various de-spamming, deduplication, and anti-abuse work that we do, these are not active social signals. They're passive ones that are ultimately gamifiable. You may trust me, but another open source maintainer may not, and on what heuristic should you be trusting me? I think that's kind of where some of our thinking is right now: What signal from me is most important to you?

If you can define that, potentially, honestly, in an agentic workflow, that's what we see some of these open source projects do. You have GitHub Actions, and then you have an agentic workflow that's calling AI, and you're setting these rules: If Kyle has submitted and gotten accepted PRs across any given project, has a social handle tied to his account in GitHub, and that social account is older than a certain amount of time—really complex measures that matter to you, because most open source projects have that heuristic built into their heads, if not written down in the contributing guidelines—you could take that and apply it, and then just say, “Oh, we're not going to accept this PR.”

Building something that is malleable to everyone's needs is a little bit better than going, “Hmm, this account's too young,” because what happens? The attackers just go and create a multitude of accounts and wait until they age up. “It needs to have a certain amount of stars.” That's how star inflation happens. “It needs to have a certain amount of repositories with PRs.” They all just create repositories and submit PRs to each other, and then they come in and do something nefarious. It's hard to find the measure.

I think we're looking more at how we can provide you tools so you can choose what's best for you. Of course, we'll give you some standards, but the trust vector gets down to some version of human digital ID. Everyone's been talking about, “How do I prove that it's me on the internet?”

Shawn Wang

Give me your eyeballs. Exactly. I've got to keep moving on topics, but obviously I could go all day on this because I've been involved in GitHub and open source my entire professional career.

Stars are very superficial. Everyone knows it. But I think time to 100,000 stars is the fastest I've ever seen, right? People just reached that in, I don't know, months. At the same time, I don't trust it. How many of these are real or bought or whatever? I don't know how to ask this, but what can we do about it? Are stars broken? Are stars fine?

Mario Rodriguez

I think that there's 2 pieces. Obviously, we're constantly trying to find ways in which our users are producing spam, which I would include as only doing star gamification. When we find them, we pluck them out.

Shawn Wang

Like a whack-a-mole.

Mario Rodriguez

It's 100% like a whack-a-mole, now powered by AI to be helpful. But I think more so what I'm seeing is that a lot of the fastest time to X tends to be because we're now inviting so many more people into software development on GitHub that the zeitgeist is just swarming.

Shawn Wang

It's not just developers.

Mario Rodriguez

It's not you and I. However you want to define what a developer is, it's not just folks who have been coding for a very long time. It's folks who may have started coding or only joined in since the AI era. What's the latest Octoverse number? I know 80 million was my last memory for the number of developers on GitHub.

Shawn Wang

Oh, we're over 200 million now.

Mario Rodriguez

Yeah, yeah, yeah. Over 200 million developers now.

Shawn Wang

But it's not developers, right? It's people with a GitHub account.

Mario Rodriguez

This is the biggest debate that everyone loves to have at GitHub at this point. From my perspective, I think there's clearly a difference between a professional enterprise developer and developers. But I think the idea that we should be splitting hairs or segmenting developers in the early era of software development is not worth our time.

Shawn Wang

You get into gatekeeping.

Mario Rodriguez

100%, because I wasn't a developer when I started writing code. I cloned the thing 7 years before I learned to code, and then I wrote about my learning-to-code journey, and people called me a fraud because I had a GitHub account.

Shawn Wang

And I'm like, “Well, no, I just use GitHub.”

Mario Rodriguez

I mean, I remember that. I remember those sets of posts, and that's why I fight very clearly on the line of this: If you create code, if you have an idea and turn it into some way of saying, “I'm going to run it and use the app right now,” you may still use AI in that moment, but that's okay. At some point, you're going to do the next thing. You're going to have to learn about this database, fix a bug, whatever. We're all on some same journey.

Those people are also hearing about the great new agent skill package or a new CLI tool or a new whatever, and those projects are going up because you want to be a part of this moment, just like I wanted to be a part of the Ruby community when Ruby was popping off when I started becoming a developer. Now I can just click the star button.

So, yes, there's clearly some amount of spamming and gamification that we're working against, but I really think we're just seeing this whole new cohort of folks who are moving from technology to technology because they're not working on a 20-year-old software application. They're working on a side app that they built on the weekend for their friends or for their new idea or whatever. That's how you see these enormous charts going up and to the right with stars.

Alessio Fanelli

I think something that's remarkable is the persistence that GitHub extends to those folks. Usually, when I see platforms go into a new audience, they usually have to have a second platform with a different name that wraps the main platform. Somehow GitHub has been able to persist and extend, and it's friendly and whatever. It's nice.

Mario Rodriguez

That's partially why I think, as we've tried to move into more low-code things, we started working on GitHub Spark as a way to build an app and run it. The reality is that anytime we try to put even a veneer on top of it, we still always show you the code. That's kind of a tenet.

We're never going to hide the code from you, ever. That's the whole point. However, I think what we learned with things like Spark is that, for most developers, the real value of Spark is an easy runtime. You may have a runtime or a host that you're going to use for that, or you just build something and run it, but the package that makes it even simpler isn't really needed for folks who are trying to build software and not just an app, which is a slightly different goal.

I want to get you in. I want to get you comfortable. I think the best thing for me, as someone who did not traditionally come into software development way, way, way back, is that I want anyone to be able to breach that chasm and not be in—I don't know. I feel like we're still in an era of “STEM, STEM, STEM.” I've got a 12-year-old and an 8-year-old, and it's like, we have to get them into STEM over and over.

I do the things that good parents do. I was like, “Oh, we want to do coding.” “Yes, I want to do coding. Do coding classes.” But now they're just not afraid of doing software. That's honestly the thing that's kept me at GitHub for so long. Anyone should be able to go and build a thing, just like I can go change a light switch in my house. I'm not going to go into the breaker box because I'll probably kill myself, but I can go change that light switch.

Everyone should be able to say, “This freaking app doesn't do what I want. I want it to work like this.” That, I think, is what's kept us all connected with GitHub through the years, during the easiest of times and during the hard times, because of that opportunity. We're the home for all developers, and we want everyone to be able to have that feeling we've had: “I had an idea, I created it, and here it is.”

Shawn Wang

Here it is. All right, I'm going to try to ask more spicy questions. Great. Is it an easy time now or a hard time?

Mario Rodriguez

At GitHub? Yes. I mean, it's a hard time, and it's also the best and most exciting time that I think I can remember at GitHub. I was just with my team, and I said, “This is also the best and most exciting time that I think I can remember at GitHub.”

We talk about Octoverse reports, and usually we do an Octoverse report once a year. We look at the numbers and say, “Oh, my goodness.” I was at Universe in October saying, “This is the fastest year of growth that we've ever had,” and now we're doing more in a month than we did in a year last year.

Shawn Wang

Best of times, worst of times—never.

Shawn Wang

You're talking about PRs—

Mario Rodriguez

Commits, PRs, kind of—you name it. By roughly every measure that we're looking at, there's some amount of growth that's much, much bigger. And that is breaking our system in new ways, not old ways.

Webhooks were notoriously unreliable over the years. Whose fault is that?

Shawn Wang

Whose fault is that?

Mario Rodriguez

Not mine anymore, but for a period of time, I'm sure you could pull up a tweet that said, “It was me. I'm sorry.” But now that got rewritten at scale, and it's still working without problems today.

Thomas Dohmke

What we're finding now isn't just the simple stuff that folks on Twitter or on the internet are sometimes saying, like, “Hey, why is this like this?” Sure, there are absolutely silly problems that shouldn't exist. But now we're talking about unique, novel permission problems that happen only at a scale across all different objects, where we have to rewrite the underlying system.

There are problems that caught us off guard. I think I said that the growth is astronomical, but we're also making such material progress. I'm excited about what's going to be possible once we've reimagined the underlying foundation layer, or at least pieces of it—not just all of us, but all the new people who are becoming developers, and all of their agents and all the tools working together.

That will still happen in that GitHub tool, that GitHub community. But it's a hard day anytime we can't give you what you're looking for. We have the same problem internally. We operate through GitHub.com, of course, and we have backups when things go down, but we feel it, too. If it's not working, it's not working for us.

That's the promise of dogfooding for GitHub. It's always been true: we're using the same tool you're using. We're not using a super-secret version. We need it to be great for us, for our customers, of course, and for open source—and now with an exponential growth of agents doing it, too.

swyx

I wanted to lay out for audio listeners who maybe haven't seen your tweets or whatever: 1 billion commits in 2025, and now 275 million per week, on pace for 14 billion this year. If growth remains linear, is that still the pace?

Yeah, it's speeding up. It's still speeding up. Exactly. This was in April.

swyx

All right. So basically, you have 14x growth, year on year. I think that's a scaling issue. I'm going to try to steelman this thing, right? People have experienced 14x growth. They haven't had your downtime. Can we dig into that? What broke? What are we doing to fix it? Anything for the community to reassure them?

Yeah. There are a couple of different places where we've seen growth issues. Some of them, which is why we're pushing hard on more CPUs, are in Actions in particular. More tools, more agents, and more PRs mean more builds. More builds need more CPUs, so we're expanding through not just our data center but, as we were talking about, moving to Azure and adding additional cloud compute because we simply need more CPUs.

It's not as much GPUs. We definitely need GPUs, too, but now CPUs are becoming a factor underneath the hood when it comes to some of the underlying services. We've been breaking up our database infrastructure over the years so that we have more logical separation between the various services.

The place where we continue to have pain is permissioning. Many of our permissioning layers sit in a database that we internally call MySQL 1. Old Hubbers will know what I'm talking about. We've been pulling things out of MySQL 1 for many years because we use Vitess and other technologies, so Shale was born from this.

And so, part of it is that I think there are some other places where more projects appear to be moving toward monorepos, whereas we were going the other direction for many years in the industry. Repos were smaller, but there were more of them. Now we're seeing the opposite: repos are bigger. It's not that there are fewer of them, per se, because there's new growth; we're just seeing many more big repos.

Big monorepos have always had a unique performance problem because each one is slightly different, particularly if the underlying blobs are incredibly big inside the repos. We've been doing a ton of work that most people probably haven't experienced unless they're in this situation with a monorepo. But that Git infrastructure layer improvement does help the overall system, because many of the improvements that make monorepos work better make all repo infrastructure work better.

I can keep going down the line. Another thing is that we're changing how we do—I'll just say—job queuing, for lack of a better explanation, changing the underlying technologies there.

swyx

I spent 2 years being a job-queuing guy.

So it's a little bit piece by piece. It's mostly because, as we built it, we built everything in a way that assumed, I guess, in some ways, that the size of the pipe of work was going to remain the same. There were just going to be more people coming through each of those pipes.

But instead, now, in places where a git push was generally a certain size, for example, that's no longer true.

swyx

Oh, yeah. You know, even the average online commit—

Same thing with PRs. A PR is the same thing, and we've talked about optimizing that and making changes. There were technology choices that did not work there; it got slow, it wasn't fast, and it didn't do what users wanted.

So we've been ripping that all out and saying, “Okay, that's just not right. Let's stop putting good money after bad and do it the right way.”

So, there are a lot of things. It’s not quite like when I’ve experienced scale at GitHub historically. It’s almost always been 1 of 2 options that we’ve used: vertical scaling, particularly with databases, or horizontal scaling. We just have more people using the service, so we add more servers and rack them in our data center or use them in a cloud.

Now we’re sort of in a diagonal where vertical scaling doesn’t really work anymore. Horizontal scaling doesn’t work either, because we all have CPU or GPU constraints in the world now. We have to crack open services that have been running for 10 or 15 years and say, “Okay, the rules of this service have legitimately changed, and now we have to rewrite them.” None of this is an excuse. We have to do the work. We have to make it better.

Alessio Fanelli

I mean, actually, as an infra guy, this is one of the most fascinating scaling challenges I’ve ever seen.

Thomas Dohmke

That’s the thing that’s hard. When we weren’t talking about it publicly, I came out and said, “Hey, I just want to explain what’s going on.” Part of it comes from a very old GitHub ethos, which is: it’s our uptime; it’s down. I know you’re a developer, so you’re inclined to want to understand more about what’s going on, but at the same time, us saying, “This service didn’t perform the way we expected, and now we have to go change it”—we weren’t trying to hide anything from you in that. That’s our problem, because you expect us to be up.

I think that’s really baked into the core origins of GitHub. What we’re trying to do as a team now is all that work, but also talk about it more. We want to share more technical details, write these blogs and posts, and get the engineers who built it to tell you, after they’ve finished the work, “This is what we did.” I think that’s the contract we want to bring back to the community: we’re still very serious about what we’re doing. We just haven’t been telling you about each piece.

So, let’s do that. We’re going to keep building this and scaling it in a way that supports whatever the next exponential growth is going to be—if it’s not 14, then it’s 30 or 50 or whatever.

Alessio Fanelli

Yeah. First of all, fantastic answer.

Thomas Dohmke

I apologize in advance if any of that is slightly incorrect, simply because I’m still in the weeds with this, but it’s not my day-to-day. That’s the thing: we’re all looking at it to that level. Obviously, if people want to help, they can join.

Alessio Fanelli

Absolutely. I think that’s good. I think people also just want to know: when are you through the thick of it? Have we identified all the issues? Is this just never-ending? Is Git broken? Do we have to change the Git protocol? How much is breaking? It’s been a while.

I think people do want to know what the path back is to the reliability that everyone expects out of GitHub.

Thomas Dohmke

Yeah. Our availability in the recent few weeks has been much better than the 3 weeks before that, or the 3 weeks before that, and so forth. A lot of these improvements are still very much paying off for us. We’re still working on the database piece that I mentioned, and that just takes a little bit of time to get fixed up.

swyx

My answer in my head was, “Call YouTube.”

So, YouTube ultimately—

swyx

They also use Vitess.

They also use Vitess, but I think some of it is that our move to get additional compute will alleviate a fair amount of this, particularly on the Actions side. A lot of the underlying outages are actually related to Actions.

swyx

I’ll tell you that Actions is the root of all evil.

I mean, it has its pros in that it’s the core compute layer for either CI or side projects.

swyx

Actions.

Thomas Dohmke

No, I don’t know.

swyx

I mean, I pay a lot for compute, right?

Yeah. Actions is definitely a piece of the overall business, but we also give away so many minutes as part of our entitlements that everyone’s using it. We talk about it as CI/CD, but the reality is people use it for CI/CD, various processing, and automation. Part of it is also that compute piece, which is alleviating some of our availability issues.

swyx

My abuse of Actions—I’ve been scraping with it every day.

Thank you for your service.

swyx

But this is also how I track Actions uptime.

Sure.

swyx

So, anyway—

Thomas Dohmke

Some of it is going to be that. I would say that each month, over the next 3 months, you’re going to see fewer and fewer moments where we have an availability problem or things go down. It’s not that the growth has stopped. We’re still experiencing faster growth than ever before. It’s just that the underlying improvements we’ve been hard at work on are finally paying off.

These improvements take time. It’s less about incremental improvements, where you make a small change and get a big output. It’s now material change that takes a bit of time, and then you see a step change in our availability.

swyx

There’s a thing we used to do at Amazon—I don’t know if it’s still a thing—like automated software verification, simulation, load testing, and all that. At this point, you have a whole map of GitHub. You can assume whatever growth rates you care about on whatever dimensions and run it through the system. I feel like there’s a way to have a systems model of GitHub and see what breaks, but obviously I’m not that close to the problems.

Kyle Daigle

Yeah, totally. I would say that’s been the journey and the work happening since November. October was when we even said, “Look at the growth,” and then you start to see the chart really pick up. It’s like, “Oh, we tested it at N amount of scale, and now it’s at N cubed, maybe, in some vectors.” So now we have to build it that way and make sure it can handle all of that scale.

Shawn Wang

Let’s talk Copilot. How many original creators of Copilot are there?

Kyle Daigle

Oh, jeez.

Shawn Wang

I count around 12.

Kyle Daigle

I forget the number of people who were on the original GitHub Copilot team. There was a bigger group.

Shawn Wang

It’s Alex.

Kyle Daigle

Alex worked on it. Ugo worked on it. There are a bunch of people.

Shawn Wang

And their entire management line.

Kyle Daigle

It was enormously successful in its day. I think the last number I heard was that Mario came to my conference and talked about the $100 million mark. I think most recently it was $300 million, but I might be out of date there.

Shawn Wang

I don’t think we’ve shared the dollar amounts.

What’s the state of Copilot? As a concept, it’s obviously been brought into more of Microsoft, but what’s its state at GitHub?

Kyle Daigle

One of the challenges we had with Copilot is that we came out of the gate with code completion. It was super great and powerful. What we initially worked on after that first year or year and a half was fine-tuning, because our customers and the industry as a whole were talking about how to get more correct or better performance out of this.

We were working on a whole bunch of efforts to fine-tune larger and larger code completions, next-edit suggestions, and so on. We were fine-tuning one model for overall use, as well as fine-tuning per customer for customers that wanted that as a service.

Around that time, the next generation of models arrived. That’s also when all these other AI coding tools came to be, because the models really sped up. Everyone would ask, “What happened to GitHub Copilot? There’s all this time.” I would say that we were in an era of thinking, “We want to improve everyone’s results, so let’s focus on fine-tuning, because that will give us better results.” Then the models got better.

Since then, we’ve been on this journey of saying, “Of course we have great code completion, and we’ve invested a ton in better underlying models.” We’ve post-trained better next-edit suggestions and post-trained language-specific models. All the stuff that sits in the ether of GitHub Copilot is not just code completion anymore. We now have a single underlying SDK and harness for our coding agent, Copilot itself, the new CLI, the new desktop app, and cloud agents that all use the same SDK.

And so there was this moment of really trying to figure out what our customers want, with models sherlocking us a little bit, and then asking, okay, what does everyone ultimately need? What we think is that it's not solely about code generation. It's really about having the ability to use these coding-agent-based harnesses or runtimes across not just the coding experience—where I'm going to send a bunch of tasks out, or use Fleet to break up a single task, or use Autopilot—but also elsewhere.

How do I do that for all of my security remediation? How do I do that for every GitHub issue that comes in? Just stick a coding agent on it to see if it's possible. How do I go through my repository, see all of my documentation, and extract, okay, this doesn't actually match?

That amount of AI coding-agent automation is a big part of what we see when we're looking at, okay, we're still going through a similar but very different flow. It's all happening at the same time. There's not really the same, “I'm going to create an issue to track my idea of building this”; you're probably just going to go do it. You're going to say, “Hey, just build this.”

There are still tons of open issues and projects that are using agents like Peter and OpenClaw to be able to sic all of his agents on that infrastructure layer. A really great coding experience that allows you to handle the multiplexing aspect is what we've built and are still building with GitHub Copilot.

For folks who haven't really used GitHub Copilot since the thing that got them excited about it, I really encourage you to look at, especially, the GitHub Copilot app. That's my new daily driver. Obviously, if you prefer the CLI, you can also use the CLI and all the models, including the bring-your-own-key side of it. We're still improving our own models and using those too.

It's just a very different experience, but I think that broader sense of software development—and how coding agents can help throughout, not just writing the code or even verifying it or deploying it—is where we have this unique angle. The other side is the context piece.

Shawn Wang

Oh, God.

Kyle Daigle

We're still—it's one of those things where I think the final thing that will let me ultimately feel complete at GitHub is when we have this ability for GitHub to act like Kyle wants it to act, or Shawn, or whatever. We all codify that in rules and memory and everything else.

Shawn Wang

And that's an open research problem, right?

Kyle Daigle

100%. But if we can even just do it where my team, without me having to codify everything—and as our methods shift on purpose—we're able to have that full experience and all the understanding of what's happening in my dependencies or open source, that feels like a big place for us to continue to provide something really unique and valuable with GitHub Copilot.

Shawn Wang

Is there a form factor that we haven't explored? I think we did code completion. Then we did, broadly, what we'll call an agentic IDE, which Cursor famously popularized. Now it's all about agent orchestration, background agents, whatever, whatever. Then there's security review. I feel like everyone has just thrown agents at everything. The entire SDLC is covered with agents.

Are we at the end of history here, basically? Is it just refinements from here on out?

Kyle Daigle

I think that we're all still in such a hyper-myopic era of AI that the reality is, for various boring security and governance reasons, at least for most people's work, why is my coding agent—even if it's all background agents running in the background—not losing all the context that's available to it across everything that I'm doing outside of coding?

Shawn Wang

Yeah.

Kyle Daigle

I think the most interesting thing to me in AI is actual ambient AI, not an inserted assistant name or something. I've tried just about every AI Pin and tool, and they don't work the way that I'm looking for them to work because they're just trying to capture, codify, and recall.

The thing that I'm looking for goes back to the very beginning: I'm looking to build out the next version of webhooks or implement a new feature, and for it to know every spec doc, every email, the conversations that I've had online, everything about how this could be implemented, and be able to use that as part of its decision-making. None of these tools are ultimately doing this.

I think it's as if software development were a single-lane task where it only needs a developer: once I write the perfect code, we'll be done here. But that's just never been true. It's all the context of the other team members, what the business is doing, and what's popular right now.

I think that's this huge opportunity for us to go much broader than really excellent coding agents, and that is honestly why OpenClaw has been so interesting: it's connecting to all the data sources that Kyle, the human, cares about. Now my question is, okay, how can I take all that and use it every day as a software developer, connected together, and not just have a new way to kick off a coding agent?

Shawn Wang

And that's where we're at. We're saying, “Okay, I'm going to go use this CLI under the hood or this SDK.” But that's not what I'm talking about. I'm talking about having a conversation with you: it downloads the podcast and realizes, “Oh, Kyle sounds like Kyle needs this app or this thing.”

Kyle Daigle

Exactly. That level of connectivity is where we still have a ton of ways to go in software, because when we have that red thread and want to pull that idea, it can not only use the perfect way to write that code, but also all of the taste and judgment calls and expertise that I've earned, or that we've earned as a group, and use it as part of the actual implementation.

Shawn Wang

Yeah. The extreme of it is AI runs your life, right? I think there's a scary inversion of control in the way that I literally mean it and in the way that developers mean it in terms of frameworks like the Hollywood Principle: “Don't call me; I'll call you.”

Kyle Daigle

Yeah.

Shawn Wang

At some point there's an inversion of control where you stop telling the AI what to do; AI tells you what to do. That's a little scary, but maybe better. Nat Friedman shared this at a Stripe event, talking about how OpenClaw was like—he connected OpenClaw to his cameras, and it was watching and directed his Uber.

Kyle Daigle

Yeah.

Shawn Wang

There's a degree of this where I was like, I actually would love OpenClaw to tell me to drink water. I don't know that I want it changing where my car goes, but I do think that's kind of what I'm talking about: it needs to have so much more information at its disposal for it to be helpful to me.

Kyle Daigle

I still don't think we're anywhere near talking about AGI. I'm just talking about every time I have to tell you something I care about that I've said a dozen times, it should be able to know that, codify that, or gain access to it. The dreaming ideas are an attempt to do some version of this, but I think there's a much more proactive angle that will help software developers if we can test that out a bit more.

Shawn Wang

Yeah, yeah, yeah. The other thing about OpenClaw that reminded me is Microsoft has a CVP dedicated to OpenClaw.

Kyle Daigle

Yeah.

Shawn Wang

Why?

Kyle Daigle

Because you don't think they should.

Shawn Wang

I don't know. I think CVP is a high title.

Guest

Yeah, yeah.

swyx

Why is this so important? Microsoft doesn't even own OpenClaw.

We're talking a lot more about this at Microsoft Build this year too. I think the main thing is that what OpenClaw has done is made this connection for people to have access to the resources that they have access to and be able to do things for them in a way that previously people were trying to codify into their own agents.

When you think about it in the work context, wouldn't it be great to have a Claw-like object that I could run on my work device, that had access to my work assets, and worked well on Windows? That's what that would look like.

I think that OpenClaw has become a personification of a valuable agent that understands me because it has access to all of my information and it can use a computer. Thus, it can do a lot more than just a task-oriented process or a chat tool.

That's a big part of the goal of Build, right? We're at Build this year trying to take a very different approach. It's unapologetically aimed at developers. We're trying to show the bigger investment, not just to say, “Hey, like you said, why do you have a CVP of OpenClaw?”

One of the problems that we have is that if you install our agents not on a Mac mini or a hosted device, but on a personal device or a work device, we need better sandboxing at the OS level.

I need to be able to use that OpenClaw and not get fired. Microsoft is like, “Okay, great. Let’s do that, too.” And then it’s, “Okay, well, where should I be able to talk to this agent? Should each of us just have an OpenClaw available to us at work?”

swyx

Probably.

Guest

And so there you go, continuing to contribute a ton to the open-source project, too. Microsoft, I think, as I’ve gotten more and more information, there’s so much investment in the open-source projects themselves that, for whatever reason, there’s this—I think those teams don’t want to come off as taking any credit or getting any recognition. But so many of these core contributors on these teams are full-time just pushing into open-source projects.

I think that kind of shows the difference between, well, why are we looking so hard at something like OpenClaw? Why are we looking at sandboxing on Windows? Why are we looking at cloud versions of sandboxing? Why are we looking at these things? Because ultimately, we need more platform components. We don’t need everyone to be building the same exact top-line product over and over and over again. If we’re building for builders, that requires us to give you all these components and tell you what they are, how they work, and why you should be interested, versus only delivering that single vertical over and over and over again.

swyx

Yeah. I think maybe one way of framing it is that Microsoft is the original operating systems company, and here’s the new operating system for AI.

Yeah, yeah, yeah. I mean, I think that we’re also in an era where we need to help build that bridge. All joking aside, operating systems need to look different than they looked 5 years ago because it’s not just you using them anymore. That’s changed the whole idea. It’s not, “Okay, my OpenClaw is going to create a user account.” It doesn’t work like that.

Just like all of us, we all have to look much, much more deeply in the stack, all the way down to the silicon layer in Azure, and be like, “Okay, well, what do we need now?” Because the workloads are different. It’s not just, “Okay, we need more inference.” It’s, “Okay, well, what type of inference do we need? What type of compute do we need to run these agents or run these agentic flows?” It’s a really interesting, multilayer problem, versus software in the last 5 or 6 years. We’re all going to our events and kind of saying a version of the same thing: “SaaS product has new SaaS thing. It’s the best SaaS thing ever.”

swyx

It was boring for a while.

And so now it’s like, “Oh my goodness, we’re at physics. We’re at physics problems.”

swyx

Yeah. I mean, we’re now trying to make room-temperature superconductors.

Still.

swyx

Yep, yep. That’s never going away. No, I think that’s a really good overview of everything. Have we left anything unsaid that you wanted to really get out there that we should cover?

Guest

Yeah, I’m really excited for folks to check out the announcements we have at Build. You can go look at them online and take a look. I’m hoping that it’s driving a degree of curiosity and interest, because there’s such a big shift that we’re making at Microsoft for developers.

If you’re a daily driver of a Mac device or a Linux device and you’re like, “Okay, I don’t use Windows,” there are improvements being made that I think are going to surprise folks, just to be like, “Oh, they really want to do that.” I’m talking about developers. I’m not talking about, “I play video games on the weekends on my Windows computer.” I’m talking about my daily driver, all the way from that to, “Okay, well, what is it like to build an agent or build an app and deploy it and run it at work in particular?”

I think that is a big piece of it. I talk all the time with the team about how I build on the weekend should be how I build at work. But if you’re working in a Fortune 100 or Fortune 500, you’re probably not building an app and then shipping it to some service. You’ve got to go through security and compliance. How can we move just as fast at work? That’s something that we have a bunch of different offerings for, to give you that same sort of agility and power but in the work context.

And then I will tell you, as I’ve mentioned a couple of times, it’s very freaking cool: if you are in the Microsoft 365 world in any way, check out Work IQ and Foundry IQ. These little—oversimplifying it—context engines are wildly good. We’ve given them to our developers at GitHub; we’ve given them to employees at GitHub. We’ve used these tools to be able to just ask questions around everything that you have in your work context, and with Foundry IQ, be able to do the same exact thing across all your existing stores. Don’t move to new tools; just connect them in. It’s surprisingly powerful.

You’re still not going to get fired, and IT isn’t going to turn it off because it’s leaking all this private information. That’s the trick that I think is sometimes getting lost when we’re talking about all these great new platforms, because I can use them. I’m like, “Oh, this is super powerful.”

swyx

Oh, and I can’t use it.

And it’s not because I’m at work at GitHub. It’s not because I’m not allowed; it’s because they can’t do all the things that large, complicated companies need. And so whether it be, like I said, just the interesting daily-driver curiosity all the way through to, “Oh my gosh, I can go use this at work tomorrow, potentially,” and have that context layer, have that intelligence, it’s a huge shift.

And so, check it out. I’d love to hear feedback. I’m not shy on social: what’s working, what’s not? Hopefully, we surprise folks a little bit.

swyx

What I’m hearing—I mean, first of all, I think that’s a great pitch. What I’m hearing, actually, is that you should put the Work IQ people next to the Copilot people because the exact context problem that you named, they’ve solved enough for you to do your job, which is nuts.

So, the thing that we are—literally, that’s what has been happening the last several months.

swyx

I already forecasted you.

It’s, like, totally—because you’re totally right. The code and the code asset problem is a little bit unique, but otherwise, yeah, we’re all working with each other now. It’s all just context.

swyx

Exactly. Yeah, yeah. Amazing. Great. I’m going to be there. I’m going to be doing a couple of sessions there. I’m going to be interviewing Satya. I know when I first started the pod, though, I had Jeff Dean on. Jeff is in the Hall of Fame of people I want to meet someday. Satya’s on there, so what should I ask Satya?

I think the best question to ask is what he thinks is true in 2 or 3 years from now. It seems like such a throwaway question, but ultimately, the way that he is looking at this AI problem—inference problem, token problem, and how we’re actually going to be working—I think you can see some of the recent shifts that have been happening inside Microsoft to drive us to a place where it’s not 4, 5, 6, 7, 8 different things. It’s not a lack of context everywhere, but why is this approach in 2 years going to pay off? Because that, I think—

swyx

Wow, that’s a bold question. Okay, I’ll ask it. I’ll say, “Prompted by you,” but absolutely. It’s a bold question because I think there’s a lot of doubt, to be honest, externally. And so, yes, I want a straight answer from him on that. I think it would reassure a lot of people and honestly give me a lot of food for writing.

Thank you so much for spending your time. Thank you for doing what you do. As a co— you don’t need to be the external face, but because you are authoritative, because you have so much background with GitHub, and because it’s so authentic, we on the outside feel it. So thank you for that.

Of course, I appreciate it. Thank you so much, Shawn.

GitHub’s Agent Era: 14x Commits, 200M Developers, Copilot’s Next Act — Kyle Daigle | BidClub