devto 2026-10-21 원문 보기 ↗
50+ repositories went offline in the middle of Google Summer of Code. Here's how our community kept moving, and how an unexpected project became our new home.
This one is a bit of a rollercoaster, so buckle up. 🎢
It was the middle of Google Summer of Code (GSoC).
OWASP BLT (Bug Logging Tool) had more than 50 repositories under a single GitHub organization. We had everything from the core application to Slack bots, a browser extension, a hackathon platform, a GSoC tracker, and a long list of tools built and maintained by our contributors.
Things were moving along nicely.
Mentors were reviewing. Contributors were shipping. Leaderboards were updating. The usual open-source chaos, but the good kind.
Then we decided to do some housekeeping.
Good security hygiene, right?
We applied an organization-wide GitHub ruleset to enforce consistent repository protections across all our projects.
A security-focused project enforcing security rules on its own organization.
What could possibly go wrong?
We woke up to find our GitHub repositories offline.
All 50+ of them.
And here's where things got confusing.
At almost exactly the same time, GitHub itself was experiencing an outage.
So for several hours, we genuinely had no idea what was happening.
Was it our new ruleset? Was something wrong with the BLT organization? Was it GitHub's outage? Or was the timing just a coincidence?
We contacted GitHub support.
Then we followed up.
And followed up again.
Days passed, and we never received a clear explanation for what had happened to our organization.
Mostly, we got silence.
Meanwhile, Google Summer of Code wasn't going to pause for us.
Contributors had active branches. Mentors had pull requests waiting for review. Projects had deadlines.
When developers can't clone repositories or open pull requests, that's more than an inconvenience. It brings development to a halt.
We needed another option.
Rather than keep waiting for answers, we moved our repositories to GitLab.
We pushed the code, redirected contributors to the new location, and worked on getting everything running again.
Repositories were accessible. CI pipelines were migrated where possible. Contributors could get back to work.
It wasn't the migration we'd planned.
Actually, we hadn't planned a migration at all.
But the community adapted, and development continued.
We still wanted our original GitHub organization restored, of course.
We kept reaching out to GitHub over the following months.
Unfortunately, we still didn't get a clear answer.
Here's where the story gets interesting.
Some time later, we learned that one of our community members, Kaif, had built something of his own.
While we had been dealing with the fallout of losing access to our GitHub organization, Kaif had turned the situation into a project.
He built ForkMesh, a self-hosted Git forge.
Think of it as having your own GitHub-like platform, with:
The funny part?
We hadn't set out to build or commission our own Git hosting platform.
We had moved to GitLab to keep things going, and later discovered that someone in our community had built an entirely different option.
So we gave ForkMesh a try.
And it stuck.
Today, OWASP BLT has a very different setup.
Our official source of truth is now git.owaspblt.org/BLT, running on ForkMesh.
And we took the opportunity to do something we'd wanted to do for a while: consolidate our projects.
### One repository, all our history
Instead of maintaining 50+ separate repositories, BLT projects now live together in one repository, organized into their own folders.
We preserved their commit histories along the way.
That means:
That's a lot of community history, and we wanted to make sure it came with us.
### GitHub is now our mirror
Yes, you read that correctly.
GitHub went from being our primary home to being our backup.
Our repository at github.com/OWASP/BLT is now a read-only mirror, automatically synchronized from our forge.
The source of truth is the forge we host.
Funny how things turn around.
### GitLab is archived, not forgotten
We didn't just abandon our temporary GitLab home.
Every open merge request was reviewed. Contributions worth bringing forward were merged into the new repository, with the original authors credited.
Other merge requests were closed with explanations.
Open issues were migrated to the forge, with references back to their original locations.
The GitLab repositories remain archived so old links and project history are still accessible.
### A little cleanup along the way
We also used the migration as an opportunity to clean up some technical debt.
For example, scheduled data jobs now write to Cloudflare storage instead of filling the Git history with automated bot commits.
A bunch of little improvements that might not have happened otherwise.
Sometimes an unexpected migration gives you a good excuse to fix things you've been putting off.
There are a few lessons we're taking away from the experience.
GitHub is an important part of the open-source ecosystem, but relying entirely on one platform introduces risks.
Your source code, issues, contributions, and project history represent years of community effort.
Having a backup is inexpensive. Losing access without an explanation can be extremely costly.
We now have much more control over where our work lives.
We still don't know exactly what caused our GitHub organization to become unavailable.
It would be unfair to claim the ruleset was responsible without confirmation.
But we learned something important regardless.
When making changes that affect more than 50 repositories, start small.
Test the behavior, understand the impact, and expand gradually.
Because when a large change goes wrong, the consequences can be just as large.
This is probably the biggest takeaway.
What kept BLT going wasn't a particular platform.
It was the people.
Contributors continued working. Mentors kept supporting students. The community found alternatives.
And one community member went a step further and built a Git forge that eventually became our new home.
That's the part of open source we love most: people turning problems into opportunities to build something useful.
If you already contribute to OWASP BLT, or you've been thinking about getting started, our new forge is where the action happens.
👉 Explore the OWASP BLT repository
You can browse the projects, clone the repository, open issues, submit pull requests, and help us improve both BLT and the contributor experience.
We're still learning what works best with our new setup, and we'd genuinely appreciate feedback.
Because apparently moving 50+ repositories wasn't adventurous enough, there's also something fun to explore.
The forge comes with its own virtual world.
OWASP BLT has its own hex, complete with:
It's a playful little addition to what started as a pretty frustrating situation.
👉 Take a walk around the BLT World
We started with more than 50 GitHub repositories, lost access to them in the middle of GSoC, moved to GitLab to keep development going, and eventually found a new home thanks to something a community member built.
Not exactly the infrastructure roadmap we'd imagined.
But here we are: 45,000+ commits, 260+ contributors, one forge, and a community still building.
See you on the forge. 🐝