14.2 How GitHub Supports Open-Source Projects

Why GH-900 tests GitHub's open-source support

Domain 7.2 asks you to explain how GitHub supports and advances open-source projects. That is a product-surface list, not a history essay. GitHub's own contributing guide, Finding ways to contribute to open source on GitHub, is the discovery source. GitHub's plans page is the billing source for what is free on public repositories. If a scenario is "an unpaid maintainer needs CI, a website, and vulnerability alerts on a public repo," the answer is the public-repo feature set—not "upgrade to Enterprise first."

GitHub's contributing docs open with a scale claim you should be able to paraphrase: open source powers daily technology, from browsers to spacecraft software, and contributing builds expertise, a portfolio, the direction of a project, and a global network. Domain 7.2 is the platform half of that sentence: GitHub hosts the repo, the conversation, the automation, the security scanning, the discovery index, and the funding button.

The public-repository collaboration stack

A public repository on GitHub Free already includes the tools maintainers use to run a project in the open:

• Issues track bugs, features, and tasks. Labels such as good first issue and help wanted are how new contributors find work. Issue templates in .github/ turn a blank form into a structured report.
• Pull requests are the review-and-merge path. CI from Actions can block merge until checks pass. CODEOWNERS can request the right reviewers.
• Discussions are a forum for questions, ideas, and announcements that are not a tracked bug. GitHub documents Discussions as a collaborative communication forum for the community around an open source or internal project. Repository owners and people with write access can enable Discussions on public and private repositories. Visibility follows the repository.
• GitHub Pages hosts a project site from the repository. GitHub Free for personal accounts includes GitHub Pages in public repositories. A docs site, a landing page, or an Open Source Guide-style handbook can ship without a separate host.
• Wikis and README / CONTRIBUTING / CODE_OF_CONDUCT / SECURITY files are the written contract with the community. GitHub surfaces CONTRIBUTING.md when someone opens an issue or pull request.

None of those features require the project to be famous. They require a public (or appropriately permissioned) repository and a maintainer who turns them on. GH-900's trap is claiming Pages, Discussions, or Issues are Enterprise-only. They are not.

Automation and security that stay free on public repos

GitHub Actions is free for standard GitHub-hosted runners in public repositories, and for self-hosted runners. GitHub's plans documentation states that included-minute quotas (2,000 on Free, 3,000 on Pro and Team, 50,000 on Enterprise Cloud) apply to private repository usage of hosted runners. A public open-source workflow that builds on ubuntu-latest does not burn that private quota. Larger hosted runners are a different, billed product; GH-900's Domain 7 answer is "standard hosted runners on public repos are free."

Dependabot alerts notify you when a dependency has a known vulnerability. They are available on all GitHub plans, public and private. Dependabot security updates and version updates can open pull requests automatically; on public repositories those automation minutes do not consume the private Actions quota the way private-repo Dependabot compute can. The dependency graph is free for everyone and is the substrate Dependabot reads.

Secret scanning on public repositories is part of how GitHub protects the commons. For every plan, GitHub runs secret scanning alerts for partners: when a leaked partner secret appears in a public repository (or a public npm package), GitHub notifies the provider. Secret scanning alerts for users and push protection are available for public repositories by default, without purchasing GitHub Secret Protection. Push protection for users also blocks you from accidentally pushing secrets to public repositories, even when the destination repo has not enabled scanning. Code scanning and dependency review are likewise available for public repositories by default under GitHub's Code Security public-repo policy.

The exam story is: GitHub subsidizes public open source with compute and security that private repos on Free do not all receive. That is how the company "advances" the ecosystem, not merely how it "hosts git."

Discovery: how people find a project to help

GitHub's contributing guide lists the discovery tools Domain 7.2 expects you to name.

Topics. Visit github.com/topics/<topic> (for example github.com/topics/machine-learning) to browse repositories classified with that topic. Search also supports a topic qualifier. Maintainers should add topics so the project is findable.

Trending. github.com/trending lists popular repositories of the day (and other windows). Trending is a traffic spike, not a quality certificate, but it is an official discovery surface.

Explore. github.com/explore personalizes recommendations for projects and good first issues from your stars, contributions, and activity.

Copilot Chat. GitHub now documents asking Copilot Chat for open-source repositories that match a language, accept new contributors, use good first issue or help wanted, and meet a star threshold. Copilot returns links and a search you can open. GH-900 will accept Copilot as a finder, not as a substitute for reading CONTRIBUTING.md.

Labels. good first issue and help wanted are the two labels the official contributing page repeats. They signal that maintainers want first-time or extra hands. A search for those labels is the classic "how do I start" answer.

Before you contribute, confirm the repository is actively maintained. GitHub documents asking Copilot "Is this repository being actively maintained?" and checking the Pulse view under Insights. An abandoned tracker full of good first issue tags is a trap in real life and a "check Pulse first" cue on the exam.

Other documented contribution paths, once you pick a live project: read the issue tracker; test a pull request locally and comment the result; install the project and file bugs; improve documentation; add tests. Open an issue before a large feature. Non-code work is first-class.

Funding, students, and skills

GitHub Sponsors (section 14.1) is also a Domain 7.2 support mechanism. The platform does not only list projects; it lets users and companies pay maintainers without leaving GitHub. A public README with a Sponsors button is GitHub advancing sustainability, not a third-party tip jar GitHub merely embeds.

The GitHub Student Developer Pack is GitHub Education's bundle for verified students: free GitHub Pro while you are a student, plus partner offers (cloud credit, IDEs, domains, learning sites) and GitHub Copilot Student. GitHub Education's student page also lists Pro-level Codespaces hours. The Pack is how GitHub onboard the next wave of open-source contributors onto the same professional tools, at no cost. Exam trap: the Pack is not "GitHub Enterprise for every student," and it is not the same product as Sponsors. Sponsors pays maintainers; the Pack equips learners.

GitHub Skills (now presented through GitHub Learn at learn.github.com/skills) are interactive courses that teach GitHub inside GitHub: you typically copy a template repository, follow issues, and complete tasks until a bot marks the course done. Domain 7.2 lists Skills as a support path because it trains contributors before they open a messy pull request on a production project. If the scenario is "a newcomer should learn pull requests in a safe sandbox," Skills/Learn is a better first answer than "fork Kubernetes."

GitHub also publishes a Green Software Directory for projects that reduce software carbon emissions—an official niche discovery list in the contributing docs—and the broader GitHub Advisory Database that open-source maintainers and Dependabot share.

Exam scenarios and traps

• "We cannot run CI on a public repo unless we buy Team" → false. Standard GitHub-hosted runners are free on public repositories.
• "Secret scanning is Advanced Security only" → incomplete. Partner alerts run on public repos for every plan; user alerts and push protection are available on public repositories by default. Private-repo coverage is where Secret Protection licensing matters.
• "Dependabot alerts require Enterprise" → false. Alerts are on all plans.
• "How does a first-time contributor find work?" → Explore, topics, Trending, Copilot Chat, and especially good first issue / help wanted. Then read CONTRIBUTING and check Pulse.
• "Discussions are only for GitHub Enterprise InnerSource" → false. Discussions exist for open-source and internal projects; owners can enable them on public repositories.
• "Pages needs a paid host" → false for a public project site on Free.
• "Student Developer Pack pays maintainers" → no, that is Sponsors. The Pack gives verified students GitHub Pro and partner tools.
• "GitHub Skills is a Marketplace paid app" → no. Skills/Learn are free interactive courses that run as GitHub repositories and issues.

If you can list the free public-repo stack (Issues, PRs, Discussions, Pages, standard Actions, Dependabot, public secret scanning), name the discovery trio (Explore, Trending, topics) plus the two labels, and separate Sponsors from the Student Pack from Skills, you have Domain 7.2. Domain 7.5 then takes the same workflows inside a company firewall.