
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
A module to surface GitHub issues labeled "Good First Issue" (and similar variants) for any GitHub organization, repo, or pre-defined project.
To use Good First Issue, you'll need to have a few things installed:
npm i -g npmInstallation:
npm install libgfi
An example of how libgfi can be used in a Node.js application:
const gfi = require('libgfi')
let log = async () => {
let issues = await gfi('microsoft') // search the 'microsoft' GitHub organization
issues.forEach(function (issue) {
console.log('#' + issue.pr + ': ' + issue.title)
})
}
log()
Search a specific repository:
const gfi = require('libgfi')
gfi('golang/dep')
.then((issues) => {
console.log(issues)
})
.catch((error) => {
console.error(error)
})
Passing in a custom set of organizations to search:
const gfi = require('libgfi')
const options = {
projects: {
node: {
name: 'Node.js', // Human readable name
q: 'org:nodejs is:issue is:open label:"good first issue"', //GitHub search query
description: "Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine." // Human readable description
}
}
}
let log = async () => {
console.log(await goodFirstIssue('node', options)) // search the 'node' property
}
log()
Passing in GitHub credentials (see Octokit's authentication documentation for more details) for authentication to exponentially increase the rate limit:
const gfi = require('libgfi')
const options = {
auth: '<replace_with_your_github_secret_personal_access_token>' // or username/password + 2fa, or app installation access token
}
let log = async () => {
let issues = await gfi('microsoft', options) // search the 'microsoft' GitHub organization
issues.forEach(function (issue) {
console.log('#' + issue.pr + ': ' + issue.title)
})
}
log()
Good First Issue has an examples/ directory, in which we try to maintain various examples of how Good First Issue can be used as a module. If you'd like to contribute to the examples, please don't hesitate to submit a PR! 🤗
You can pull your queries directly from a standard GitHub search! If you want to build something a bit more complex, you can use the advanced search tool if you want to build more specific custom queries: https://github.com/search/advanced
As a CLI, good-first-issue uses the Commander.js CLI framework. If you want to better understand how our CLI is built, commander.js is pretty well documented. Also used are Chalk for terminal coloring and boxen to simplify the output container implementation.
Good First Issue follows a relatively strict release process intended to ensure the spice flows.
| Semantic Version | Type | Reason |
|---|---|---|
| Major (x.x.x) | Breaking changes and non-trivial upgrades | Ensuring that end-users can rely on Good First Issue not breaking however they're consuming it |
| Minor (x.x.x) | Project additions, other feature additions | Following the SemVer standard, project additions and feature additions are backwards-compatible enhancements. We generally try to ship one addition per Minor. |
| Patch (x.x.x) | Bug fixes, minor enhancements to metadata and content | Tiny, hardly visible fixes to improve UX/DX or fix the module |
We use both GitHub Labels and Milestones to track releases. Since project additions count as a minor release, we prefer to space those out and ship them individually rather than shipping many at once. This pace may be revised later, but for now, it introduces the need for a release queue and setting things up to be released ahead of them actually being released.
We use the release queue label and milestone to queue up PRs that have been reviewed and are ready to be released.
Once a PR is ready to be released, a milestone will be added that correlates to the SemVer version it will be released in. Ideally this will eventually be used for changelog tracking but for now it's just a good way to keep organized. To keep things tidy, once a new version has shipped the milestone will be closed out.
If you are interested in fixing issues and contributing directly to the code base, please see the document CONTRIBUTING.md
FAQs
A module for finding good-first-issues in open source projects.
We found that libgfi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.