GitHub repositories are great for making SDK and other artifacts developers will need to put an API to work, but you can also publish OpenAPI, examples, and even run your entire API portal using GitHub pages. A GitHub repository has proven itself to be an essential building block of any public API program, and powers API Commons.

Also known as: GitHub Repo, Source Repository, Git Repository

Standards

• GitHub GitHub REST API — Repositories
• GitHub GitHub GraphQL API
• schema.org schema.org SoftwareSourceCode
• OpenSSF OpenSSF Scorecard
• Linux Foundation SPDX License List
• IETF RFC 9116 — security.txt
• Community standard Contributor Covenant Code of Conduct

HTTP Headers

Well-Known Paths

• /.well-known/security.txt — RFC 9116 — Security contact disclosure; commonly mirrored from a SECURITY.md.
• /.well-known/funding-manifest-urls — GitHub Sponsors (de facto) — Funding sources discovery; relates to FUNDING.yml in repos.

Media Types

• application/vnd.github+json — Canonical media type for the GitHub REST API.
• application/vnd.github.raw — Raw file contents from the Contents API.
• application/vnd.github.html — HTML-rendered Markdown content.

Link Relations

• next — RFC 8288 / GitHub Link header pagination
• prev — RFC 8288 / GitHub Link header pagination

Governance Rules

• repo-has-readme (Community convention) — README.md present at repo root.
• repo-has-license (SPDX / OpenSSF Scorecard "License" check) — LICENSE file detected and SPDX-identifiable.
• repo-has-security-md (GitHub Community Standards) — SECURITY.md present advertising disclosure policy.
• repo-has-contributing (GitHub Community Standards) — CONTRIBUTING.md describes contribution flow.
• repo-has-code-of-conduct (GitHub Community Standards) — CODE_OF_CONDUCT.md present.
• repo-has-codeowners (GitHub) — CODEOWNERS file routes reviews to the right maintainers.
• repo-branch-protected (OpenSSF Scorecard "Branch-Protection") — Default branch requires reviews and status checks.

Risk & Compliance

Security: Public repos can leak secrets, tokens, and internal URLs in code or git history. Enforce secret scanning, push protection, branch protection on the default branch, signed commits where possible, and Dependabot/SCA alerts. OpenSSF Scorecard surfaces these signals.

Tools

• GitHub CLI (gh) — Repo management (MIT)
• OpenSSF Scorecard — Repo health scoring (Apache-2.0)
• gitleaks — Secret scanning (MIT)
• trufflehog — Secret scanning (AGPL-3.0)
• GitHub Actions — CI/CD
• Dependabot — Dependency updates

Suggested Metrics

• stars_count — Repository stargazers.
• forks_count — Forks of the repository.
• open_issues_count — Open issues including pull requests in the REST API count.
• scorecard_score — Aggregate OpenSSF Scorecard score (0–10).
• time_to_first_review_p50 — Median time from PR open to first human review.

Example Implementations

• Stripe — github.com/stripe/stripe-node and openapi specs in github.com/stripe/openapi.
• Twilio — github.com/twilio repos host SDKs and OpenAPI.
• GitHub — github.com/github/rest-api-description ships the official OpenAPI for the GitHub API.
• Kubernetes — github.com/kubernetes/kubernetes is the canonical source repo.

Related Properties

• Github org
• Source code
• Openapi
• Sdks
• License
• Security

Tags

• GitHub

All Community Properties