<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>DEV Community: Arnaud Porterie</title>
    <description>The latest articles on DEV Community by Arnaud Porterie (@icecrime).</description>
    <link>https://dev.to/icecrime</link>
    <image>
      <url>https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F851706%2Fb1ae7842-e83a-433e-9eef-4dbb56c16ee5.jpeg</url>
      <title>DEV Community: Arnaud Porterie</title>
      <link>https://dev.to/icecrime</link>
    </image>
    <atom:link rel="self" type="application/rss+xml" href="https://dev.to/feed/icecrime"/>
    <language>en</language>
    <item>
      <title>Echoes: a one-year update on our vision</title>
      <dc:creator>Arnaud Porterie</dc:creator>
      <pubDate>Mon, 12 Sep 2022 12:27:31 +0000</pubDate>
      <link>https://dev.to/icecrime/echoes-a-one-year-update-on-our-vision-52po</link>
      <guid>https://dev.to/icecrime/echoes-a-one-year-update-on-our-vision-52po</guid>
      <description>&lt;p&gt;Roughly one year ago, an eternity in startup time, &lt;a href="https://twitter.com/arnaudporterie/status/1412440306788843527"&gt;we shared what we were building at Echoes HQ&lt;/a&gt;. We went through YCombinator during the summer of 2021, and launched our first version of the product the following September. This post is an update to our vision, one year into the life of the product.&lt;/p&gt;

&lt;h2&gt;
  
  
  How our experiences shaped Echoes
&lt;/h2&gt;

&lt;p&gt;In 2014, blown away by &lt;a href="https://docker.com"&gt;Docker&lt;/a&gt;'s potential for wide-scale developer empowerment, I left my job as software engineer in the banking industry in France to lead the Docker Engine team and its associated open source project. The mission spoke to me deeply: giving power to the builders, creating tools of mass innovation. I cannot understate how revolutionary this sounded as an outsider to tech companies and Silicon Valley: a world where engineers were at the center of value creation existed.&lt;/p&gt;

&lt;p&gt;I later decided to take these learnings to Veepee which I joined as VP Engineering. My personal goal was to create the environment in which I would have wanted to evolve as an engineer. I tried to instill a culture of engineering empowerment, taking heavy inspiration from open source as to how code is maintained and how teams interact. In this journey, I learned the challenges of leading a successful engineering organization at scale.&lt;/p&gt;

&lt;h2&gt;
  
  
  The state of engineering management tools
&lt;/h2&gt;

&lt;p&gt;Despite the variety of organizations I joined or advised, the same problems keep coming up. From one point of view: too many topics at once, and a difficulty to assess and communicate how we are succeeding (or not) as a tech organization. From another point of view: a perceived opacity of tech, and that nothing ever goes fast enough&lt;sup id="fnref1"&gt;1&lt;/sup&gt;. As widespread as these problems are, none of the solutions on the market are appealing to me.&lt;/p&gt;

&lt;p&gt;On one end of the spectrum are top-down management tools, with a bias for control. They go against the engineers' best interest in several ways: operationally, by imposing a unique view of how software development should be done; ethically, by imposing a form of surveillance which later feeds into misguided performance management.&lt;/p&gt;

&lt;p&gt;On the other end of the spectrum are engineering productivity tools, measuring the efficiency of the development process through git and tickets analytics. Their insights are actionable to the teams but fail to inform management decisions&lt;sup id="fnref2"&gt;2&lt;/sup&gt;; when used as success metrics, they perpetuate the outdated idea that an engineering team's responsibility is solely about shipping code.&lt;/p&gt;

&lt;p&gt;What all these tools appear to have in common is an underlying assumption that an engineering manager's role is to get &lt;em&gt;more&lt;/em&gt; out of the engineers. They ignore the decades of learnings which have repeatedly proven how software development is a creative, poorly predictable, team effort. They define success in terms of outputs, but succeeding as an engineering organization takes a lot more than productivity. Arguably, engineering efficiency is &lt;em&gt;not&lt;/em&gt; the bottleneck to most organizations' performance&lt;sup id="fnref3"&gt;3&lt;/sup&gt;.&lt;/p&gt;

&lt;h2&gt;
  
  
  Echoes approach
&lt;/h2&gt;

&lt;blockquote&gt;
&lt;p&gt;&lt;strong&gt;Echoes' mission is to empower developers everywhere, by helping engineering managers create the best conditions for success.&lt;/strong&gt; Our first step in this journey is to offer managers a value-centric and developer-friendly way to follow and report on activity.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;h3&gt;
  
  
  Value-centric
&lt;/h3&gt;

&lt;p&gt;What we mean by value-centricity is that Echoes focuses on the &lt;em&gt;purpose&lt;/em&gt; of the work over the velocity alone. It surfaces the determinants of an organization's performance which a manager can directly act upon: the clarity of goals, the alignment to the strategy, the focus, and challenges faced by the teams. The question Echoes aims to answer is: &lt;em&gt;does my team have what it needs to succeed?&lt;/em&gt;&lt;/p&gt;

&lt;p&gt;This is not to say that engineering efficiency is irrelevant to the performance of an organization, but that it should not be an engineering manager's primary concern, and of lesser and lesser significance as one goes up the management chain. Measures of efficiency belong where they can be acted upon: in the hands of the individual contributors.&lt;/p&gt;

&lt;p&gt;An interesting side-effect of focusing on value is that it makes for a great communication medium. By connecting engineering day-to-day efforts to company impact, Echoes presents activity in a way that anybody can understand, including a non-technical CEO, CFO, or HR partner. &lt;/p&gt;

&lt;h3&gt;
  
  
  Developer-friendly
&lt;/h3&gt;

&lt;p&gt;What we mean by developer-friendliness takes many different forms. At the most fundamental level, Echoes does not and will never surface any individual metrics, nor anything which could be misinterpreted as a proxy for individual performance. Echoes shifts the focus away from developer efficiency as the main lever to performance, and toward organizational effectiveness.&lt;/p&gt;

&lt;p&gt;Echoes is designed to let the builders pick the tools and processes which make them most productive. This is no small feat, as aggregation across teams traditionally mandates a level of standardization incompatible with developer empowerment&lt;sup id="fnref4"&gt;4&lt;/sup&gt;. Echoes is designed around the smallest possible contract: code changes are to be linked to an intent; how each team choses to create this link is at their own discretion. Finally, Echoes knows to stay out of the way: engineers’ interactions with the platform can happen entirely through the tools they already use, such as GitHub and GitLab.&lt;/p&gt;

&lt;h2&gt;
  
  
  The results, one year in
&lt;/h2&gt;

&lt;p&gt;What we've built with Echoes is different. It may look like a goal setting tool, but truly connects work to purpose. It may look like a measure of developer productivity, but truly says a lot more about the quality of management.&lt;/p&gt;

&lt;p&gt;Echoes is different, and it shows in our user base. We naturally see Echoes being used by managers from the EM up to the CTO; but we’re also seeing it adopted by product managers, CPOs, Staff Engineers, and TPMs (Technical Program Managers). We see Echoes chosen by organizations of hundreds of engineers, where the pain of following activity is more acute; but we’re also seeing it in organizations under 10 engineers, where it helps focus efforts where they matter most.&lt;/p&gt;

&lt;p&gt;We have learned a lot along the way, but as expected when trying something different, we are often left with more questions than we have answers. What is certain is that we are determined to continue exploring this path, because developers deserve it.&lt;/p&gt;




&lt;ol&gt;

&lt;li id="fn1"&gt;
&lt;p&gt;We wrote about the common disconnect between planning and execution in &lt;a href="https://echoeshq.com/post/the-disconnect-between-planning-and-execution/"&gt;this post&lt;/a&gt;. ↩&lt;/p&gt;
&lt;/li&gt;

&lt;li id="fn2"&gt;
&lt;p&gt;We wrote about the value of engineering metrics in &lt;a href="https://www.echoeshq.com/post/the-value-of-engineering-metrics/"&gt;this post&lt;/a&gt;. ↩&lt;/p&gt;
&lt;/li&gt;

&lt;li id="fn3"&gt;
&lt;p&gt;We wrote about the disproportionate focus on developer productivity in &lt;a href="https://www.echoeshq.com/post/beyond-developer-productivity/"&gt;this post&lt;/a&gt;. ↩&lt;/p&gt;
&lt;/li&gt;

&lt;li id="fn4"&gt;
&lt;p&gt;We wrote about the tension between management and developer needs in &lt;a href="https://www.echoeshq.com/post/the-ticketing-conundrum/"&gt;this post&lt;/a&gt;. ↩&lt;/p&gt;
&lt;/li&gt;

&lt;/ol&gt;

</description>
      <category>startup</category>
      <category>devrel</category>
      <category>leadership</category>
    </item>
    <item>
      <title>Transitioning from CTO to founder</title>
      <dc:creator>Arnaud Porterie</dc:creator>
      <pubDate>Fri, 05 Aug 2022 09:22:00 +0000</pubDate>
      <link>https://dev.to/icecrime/transitioning-from-cto-to-founder-2baa</link>
      <guid>https://dev.to/icecrime/transitioning-from-cto-to-founder-2baa</guid>
      <description>&lt;p&gt;Roughly 18 months ago I took the jump of leaving my CTO job managing 600 engineers to start &lt;a href="https://echoeshq.com"&gt;Echoes HQ&lt;/a&gt;, my first company as a founder. This post is a personal reflection of what I've learned and what surprised me in that transition, in no particular order.&lt;/p&gt;

&lt;p&gt;&lt;em&gt;For context, at the time of writing Echoes is 3 people: &lt;a href="https://twitter.com/arnaudporterie"&gt;Arnaud&lt;/a&gt; (founder), &lt;a href="https://twitter.com/AdrienWoot"&gt;Adrien&lt;/a&gt;, and &lt;a href="https://twitter.com/lucasdicioccio"&gt;Lucas&lt;/a&gt; (founding engineers, who both joined roughly one year ago).&lt;/em&gt;&lt;/p&gt;

&lt;h2&gt;
  
  
  Table of contents
&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Emotional stability&lt;/li&gt;
&lt;li&gt;Emotional transparency&lt;/li&gt;
&lt;li&gt;Goal setting&lt;/li&gt;
&lt;li&gt;Communities&lt;/li&gt;
&lt;li&gt;Prioritizing what hurts most&lt;/li&gt;
&lt;/ul&gt;




&lt;h2&gt;
  
  
  Emotional stability
&lt;/h2&gt;

&lt;p&gt;Managing a large team inevitably involves a daily dose of bad news. Each day may bring a key person's resignation, a major production incident, or that budget cut you're going to have to handle.&lt;/p&gt;

&lt;p&gt;Startups, especially at their early stage, are way bigger rollercoasters. But despite the frequency and relative amplitude of events being stronger, I feel like my time as CTO was a great preparation for it. One of the most important skill I gained is &lt;strong&gt;the ability to separate how I may feel about a particular event and how I'm going to act on it&lt;/strong&gt;. That doesn't mean you should bury emotions, we're humans!, but that you should not &lt;em&gt;react&lt;/em&gt; on emotions.&lt;/p&gt;

&lt;p&gt;Startups are built on learnings and every event, good and bad, is an opportunity to learn. Be disappointed, upset, sad even about that customer you lost, but accept that fact and don't let emotions cloud your analysis of the situation.&lt;/p&gt;

&lt;h2&gt;
  
  
  Emotional transparency
&lt;/h2&gt;

&lt;p&gt;I believe a founder at an early stage startup has more room, but also more duty, to be transparent about their feelings.&lt;/p&gt;

&lt;p&gt;Your doubts as a CTO can be detrimental to your organization's success. Teams tend to mimic and through their size amplify the sentiment of their leaders. This can in some cases turn into self-fulfilling prophecies, when for example that project you say might get cancelled inevitably loses steam.&lt;/p&gt;

&lt;p&gt;Startups on the other hand cannot succeed without embracing their doubts. The whole journey is a thug of war between the confidence in your vision and the reality of what works and doesn't (which in the beginning is roughly everything).&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;This cognitive dissonance is uncomfortable but healthy, and isolating the founding team from it is not doing anyone a favor&lt;/strong&gt;. Early startup employees have a different aversion to risk than members of large organizations: doubt mustn't be an issue.&lt;/p&gt;

&lt;h2&gt;
  
  
  Goal setting
&lt;/h2&gt;

&lt;p&gt;Setting goals is something that most CTOs would be very familiar with. I soon realized how different an exercise that was for an early stage startup, as our first attempts felt very much like wishful thinking. Indeed, while you may now be in full control of your goals, being pre-product market fit means that you have much less ability to predict their outcomes.&lt;/p&gt;

&lt;p&gt;This required doing the opposite of what goal setting typically looks like in a mature company. Instead of setting goals on outcomes and largely leaving the solution space open, I was left setting goals on outputs. For example a revenue target becomes a number of demos, and an increase in conversion rate becomes a number of shipped experiments.&lt;/p&gt;

&lt;h2&gt;
  
  
  Communities
&lt;/h2&gt;

&lt;p&gt;What was most unexpected to me in this transition is how founder (and even solo founder in my particular case) feels surprisingly less lonely than CTO.&lt;/p&gt;

&lt;p&gt;Part of the reason is tied to the previous section on doubts: running a large organization forces you to constantly censor your thoughts, and you may not always have room to share things transparently.&lt;/p&gt;

&lt;p&gt;Part of the reason is that while communities of CTO do exist, I personally find the ones I participated in to be quite mechanical. What I mean by that is that conversations are very much practical: discussing processes, organizations, tools, etc. That doesn't make them useless, but I can't say I've met many friends in these places (again, my personal experience!).&lt;/p&gt;

&lt;p&gt;There's something very unintuitive here, but I believe that &lt;strong&gt;the little &lt;em&gt;practical&lt;/em&gt; overlap between early stage startups makes for deeper conversations between founders&lt;/strong&gt;. We each play such different games that there's little to discuss about practicalities: the personal journey is where we have the most overlap. It's been heart-warming to discover how other founders genuinely want to help, and have mostly no issues being vulnerable in conversations. &lt;/p&gt;

&lt;p&gt;We had the chance with Echoes to be part of &lt;a href="https://www.ycombinator.com/"&gt;YCombinator&lt;/a&gt; S21 batch, which put us from day 1 in one the best communities we could hope for.&lt;/p&gt;

&lt;h2&gt;
  
  
  Prioritizing what hurts most
&lt;/h2&gt;

&lt;p&gt;My time as a CTO taught me (sometimes painfully) that problems don't fix themselves but only tend to get worse. I've therefore developed a habit of doing what I hated most first, which proved very useful as a founder.&lt;/p&gt;

&lt;p&gt;There are so many aspects to the role that some of them will inevitably suck, although different people will naturally have an aversion to different things. For me, it's administrative work (surprise!), such as legal and accounting. And I've been doing it &lt;em&gt;flawlessly&lt;/em&gt;, because I know that if I don't do it immediately I'm only going to get a double dose of it.&lt;/p&gt;




&lt;p&gt;&lt;em&gt;We're building with &lt;a href="https://echoeshq.com"&gt;Echoes HQ&lt;/a&gt; the product I wish existed during my time as an engineering leader. Check us out and &lt;a href="https://twitter.com/arnaudporterie"&gt;reach out&lt;/a&gt; if you'd like to learn more!&lt;/em&gt;&lt;/p&gt;

</description>
      <category>leadership</category>
      <category>management</category>
      <category>startup</category>
    </item>
    <item>
      <title>Beyond developer productivity</title>
      <dc:creator>Arnaud Porterie</dc:creator>
      <pubDate>Tue, 14 Jun 2022 08:24:33 +0000</pubDate>
      <link>https://dev.to/icecrime/beyond-developer-productivity-d85</link>
      <guid>https://dev.to/icecrime/beyond-developer-productivity-d85</guid>
      <description>&lt;p&gt;Developer productivity receives disproportionate attention considering the share of organizations where it happens to be a bottleneck.&lt;/p&gt;

&lt;p&gt;With tech being at the center of value creation engine for an increasing number of businesses, it's natural to look into every opportunity to be more efficient. There is however a misleading assumption that developer productivity is a universal leverage to an organization's performance.&lt;/p&gt;

&lt;h2&gt;
  
  
  Scaling productivity
&lt;/h2&gt;

&lt;p&gt;A single team has little collaboration overhead and, constrained by its limited capacity, tends to have few goals and strong focus. Delivery performance in that context can therefore be directly attributed to developer productivity.&lt;/p&gt;

&lt;p&gt;This ideal however tends to break down as early as having two or three teams. &lt;strong&gt;As an organization scales, the influence of individual developer productivity on the performance of the whole diminishes.&lt;/strong&gt; A group of locally-efficient teams does not make an efficient organization: there is a point where collaboration, dependencies, and &lt;a href="https://www.youtube.com/watch?v=hu_lQJgiE60"&gt;team cognitive load&lt;/a&gt; become the bottlenecks.&lt;/p&gt;

&lt;p&gt;One of the reasons for this is that as an organization grows, the number of independently taken decisions increases. A fraction of these decisions result in the fascinating phenomenon of ✨ creating work ✨, for example by prioritizing the development of a new feature, or planning a technical migration.&lt;/p&gt;

&lt;p&gt;The ability to make design and product decisions is, as &lt;a href="https://twitter.com/andybudd"&gt;Andy Budd&lt;/a&gt; pointed out in this &lt;a href="https://twitter.com/andybudd/status/1530524477456539648"&gt;excellent thread&lt;/a&gt;, a lot of fun. It's also one the most consequential decisions one can make because it spends an organization's crucially valuable resource: focus.&lt;/p&gt;

&lt;h2&gt;
  
  
  From developer productivity to organizational e*&lt;em&gt;ffectiveness&lt;/em&gt;*
&lt;/h2&gt;

&lt;p&gt;Developer productivity matters at all stages of a company, if only because it contributes to no small part to the broader developer experience. But developer productivity is, and should remain, &lt;a href="https://about.sourcegraph.com/blog/developer-productivity-thoughts"&gt;a concern to the builders&lt;/a&gt; first and foremost.&lt;/p&gt;

&lt;p&gt;While comfortable to management, it is a trap past a certain size to continue considering developer productivity as the main leverage to the organization's performance. First, there's an upper limit to efficiency which an untamed ability to create work will eventually exceed. Second, there are inevitably initiatives which contribution to goals does not justify their cost in engineering focus. Or as Peter Drucker puts it:&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;“There is nothing quite so useless, as doing with great efficiency, something that should not be done at all.” &lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Engineering managers who disproportionately focus on measuring and improving developer productivity are not only doing their team a disservice, they are also failing on their mission to bring clarity of goals, alignment, and focus. As &lt;a href="https://twitter.com/pedroh96/status/1535361628002189312"&gt;Pedro Franceschi pointed out&lt;/a&gt;, the difference between the best and worst projects is not found in their individual contributors skills, but in their leadership.&lt;/p&gt;

&lt;p&gt;For all these reasons, Echoes does not pretend to measure or improve developer productivity, or at least not in the commonly-understood sense. &lt;strong&gt;How Echoes makes developers more productive is by helping management create the right context for them to deliver their best work.&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;Echoes shines a light on the reality of the day-to-day, so that the &lt;a href="https://www.echoeshq.com/post/the-disconnect-between-planning-and-execution"&gt;complexity of execution informs planning decisions&lt;/a&gt;. Echoes shifts focus away from local efficiency and individual developer productivity to the bigger goal: the organization's collective ability to succeed.&lt;/p&gt;

&lt;p&gt;Interested to learn more? Check out &lt;a href="https://www.echoeshq.com/"&gt;https://www.echoeshq.com&lt;/a&gt;.&lt;/p&gt;

</description>
      <category>management</category>
      <category>productivity</category>
    </item>
    <item>
      <title>Deliberate software developmemt</title>
      <dc:creator>Arnaud Porterie</dc:creator>
      <pubDate>Wed, 08 Jun 2022 12:47:19 +0000</pubDate>
      <link>https://dev.to/icecrime/deliberate-software-developmemt-168d</link>
      <guid>https://dev.to/icecrime/deliberate-software-developmemt-168d</guid>
      <description>&lt;h1&gt;
  
  
  Introduction
&lt;/h1&gt;

&lt;p&gt;Discourse on &lt;em&gt;how&lt;/em&gt; to organize work has taken a lot of space: whether discussing methodologies (e.g., OKRs, Agile, Scrum), roles and responsibilities (e.g., Product Management), or organizational models (e.g., "Spotify").&lt;/p&gt;

&lt;p&gt;While important, these topics tend to confuse startup founders and engineering leaders in more established companies alike, who struggle to figure out what is "right" for them. Countless time have I heard these questions: should we adopt OKRs? Should we move to a micro-services architecture? How should we set and communicate priorities?&lt;/p&gt;

&lt;h1&gt;
  
  
  On being deliberate
&lt;/h1&gt;

&lt;p&gt;Discussions on the how can sometimes overshadow the one thing they should be in support of: the purpose of work. Putting aside sprints, objectives, tickets, and roadmaps for a minute:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;We do things for a reason.&lt;/li&gt;
&lt;li&gt;That reason is to have observable impact on some behaviors.&lt;/li&gt;
&lt;li&gt;These behaviors should align with our definition of success.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Methodologies, organizational models, architecture choices are in service of the purpose. OKRs are a popular way to align teams behind a priority with well-defined success criteria at a fixed cadence. The North Star Framework is a popular way to capture the longer term strategy and provide a stable frame for goal settings. Micro-services architecture are a popular way to decouple the deployment of independent parts of the codebase. None of them can help if you are not sure which problem you're solving in the first place.&lt;/p&gt;

&lt;h1&gt;
  
  
  Back to basics
&lt;/h1&gt;

&lt;p&gt;The most important thing you can do to succeed as an engineering organization is to define what success means &lt;em&gt;for your particular context&lt;/em&gt; and frame activities with their purpose. Which goal setting framework, day-to-day execution methodology, and architecture you chose is ever going to be in support of that.&lt;/p&gt;

&lt;p&gt;‍&lt;/p&gt;

</description>
      <category>management</category>
      <category>leadership</category>
    </item>
    <item>
      <title>Building with the GitHub API</title>
      <dc:creator>Arnaud Porterie</dc:creator>
      <pubDate>Fri, 22 Apr 2022 09:29:55 +0000</pubDate>
      <link>https://dev.to/icecrime/building-with-the-github-api-59om</link>
      <guid>https://dev.to/icecrime/building-with-the-github-api-59om</guid>
      <description>&lt;p&gt;I have a long history of building things with the GitHub API.&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Many years ago when running the Docker open source project, where we needed tools for GitHub tasks automation (&lt;a href="http://github.com/icecrime/poule"&gt;icecrime/poule&lt;/a&gt;) and project health metrics (&lt;a href="https://github.com/icecrime/vossibility-stack"&gt;icecrime/vossibility-stack&lt;/a&gt;).&lt;/li&gt;
&lt;li&gt;Today with &lt;a href="https://echoeshq.com/"&gt;Echoes&lt;/a&gt;, which integrates with GitHub (among others) to help engineering leaders create high performing organizations.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;a href="https://res.cloudinary.com/practicaldev/image/fetch/s--mg7qKKEt--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_880/https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qiunzll3an1vu7odt7dr.png" class="article-body-image-wrapper"&gt;&lt;img src="https://res.cloudinary.com/practicaldev/image/fetch/s--mg7qKKEt--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_880/https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qiunzll3an1vu7odt7dr.png" alt="Mona watching me write this post" width="600" height="600"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;We will look in this post at an unordered list of things that I've learned along the way.&lt;/p&gt;

&lt;h2&gt;
  
  
  GitHub Apps or OAuth Apps
&lt;/h2&gt;

&lt;p&gt;There are two ways to integrate with GitHub: as a GitHub App or as an OAuth App. While the difference is explained in &lt;a href="https://docs.github.com/en/developers/apps/getting-started-with-apps/differences-between-github-apps-and-oauth-apps"&gt;GitHub documentation&lt;/a&gt;, it's worth reinforcing how neat GitHub Apps are.&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;GitHub App use their own identity, not that of a user. In other words, actions performed by the app will appear as originating from the app itself, not "whoever lended a token".&lt;/li&gt;
&lt;li&gt;GitHub Apps have &lt;a href="https://docs.github.com/en/rest/overview/permissions-required-for-github-apps"&gt;fine grained permissions&lt;/a&gt;. Considering the sensitivity of GitHub data, this is crucial in order to build integrations which follow the principle of least privilege. In the example of Echoes, this is how we drastically reduce our security requirements by not requesting access to the content of the git repository.&lt;/li&gt;
&lt;li&gt;GitHub Apps provide an excellent installation experience, which includes: installing on all or selected repositories, reviewing permissions and permissions scope updates.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;a href="https://res.cloudinary.com/practicaldev/image/fetch/s--rd3ZT6bX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_880/https://archbee.imgix.net/cnN9HGi_h1eJLSFAvJkF4/CZLrFpnsnTb7Uc9SKJjWk_cleanshot-2021-08-23-at-1612182x.png" class="article-body-image-wrapper"&gt;&lt;img src="https://res.cloudinary.com/practicaldev/image/fetch/s--rd3ZT6bX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_880/https://archbee.imgix.net/cnN9HGi_h1eJLSFAvJkF4/CZLrFpnsnTb7Uc9SKJjWk_cleanshot-2021-08-23-at-1612182x.png" alt="https://archbee.imgix.net/cnN9HGi_h1eJLSFAvJkF4/CZLrFpnsnTb7Uc9SKJjWk_cleanshot-2021-08-23-at-1612182x.png" width="880" height="1035"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;If you're building in Go, &lt;a href="https://github.com/bradleyfalzon/ghinstallation"&gt;bradleyfalzon/ghinstallation&lt;/a&gt; is an implementation of &lt;code&gt;http.RoundTripper&lt;/code&gt; which authenticates as a GitHub App, for example to use in combination with &lt;a href="https://github.com/google/go-github"&gt;google/go-github&lt;/a&gt;.&lt;/p&gt;

&lt;h2&gt;
  
  
  GitHub v3 or GitHub v4
&lt;/h2&gt;

&lt;p&gt;GitHub has two active versions of its API: a v3 REST API, and a v4 GraphQL API. Which one you should build against is partly a matter of personal preference, but chances are high that you will end up using both.&lt;/p&gt;

&lt;p&gt;The entire API surface is not available in both versions. For example, the &lt;a href="https://docs.github.com/en/rest/webhooks/repo-deliveries"&gt;Webhook Deliveries API&lt;/a&gt; referenced later in this post is only available in v3.&lt;/p&gt;

&lt;p&gt;Another, trickier, aspect is that while &lt;a href="https://docs.github.com/en/rest/overview/permissions-required-for-github-apps"&gt;GitHub Apps permissions naturally map to v3 endpoints&lt;/a&gt;, things are not as clear when using the v4. A GraphQL query requires the union of all permissions of its individual fields to succeed, or will result in a confusing “resource not accessible by integration” error. It is not always obvious which part of the query causes the error, especially when a seemingly equivalent call using the v3 REST API succeeds under the same permissions.&lt;/p&gt;

&lt;p&gt;In our particular codebase, the interactions with the GitHub API appear to converge to using v4 GraphQL API for data retrieval, and to using v3 REST API for mutations (e.g., adding a label to an issue) or situations where v4 didn't behave the way we expected.&lt;/p&gt;

&lt;h2&gt;
  
  
  Defending against GitHub-side issues
&lt;/h2&gt;

&lt;p&gt;GitHub, like any other complex system, is imperfect. Two issues we have seen are minor API downtimes (with 502 responses), and occasional authentication issues (with 401 responses) using a freshly-issued access token.&lt;/p&gt;

&lt;p&gt;Both cases can be mitigated with automated retries. We went with &lt;a href="https://github.com/hashicorp/go-retryablehttp"&gt;hashicorp/go-retryablehttp&lt;/a&gt; as Echoes is built in Go. The library's &lt;a href="https://github.com/hashicorp/go-retryablehttp/blob/v0.7.1/client.go#L452-L494"&gt;default retry policy&lt;/a&gt; rightly doesn't consider a 401 response as a recoverable error, but this can be changed using the &lt;a href="https://pkg.go.dev/github.com/hashicorp/go-retryablehttp#CheckRetry"&gt;&lt;code&gt;CheckRetry&lt;/code&gt; hook&lt;/a&gt;.&lt;/p&gt;

&lt;h2&gt;
  
  
  Defending against integration-side issues
&lt;/h2&gt;

&lt;p&gt;Chances are that your integration won't be perfect either. What will happen to GitHub events when your app is unresponsive or fails to handle a message?&lt;/p&gt;

&lt;p&gt;GitHub has &lt;a href="https://docs.github.com/en/developers/webhooks-and-events/webhooks/testing-webhooks#listing-recent-deliveries"&gt;a UI for inspecting recent deliveries&lt;/a&gt; and manually triggering new deliveries. This is immensely useful for development and debugging, but cannot help if you need to recover from any significant number of missed messages.&lt;/p&gt;

&lt;p&gt;At Echoes, like we did at Docker, we're using our own durable queues to handle message processing. However, GitHub has since introduced the &lt;a href="https://docs.github.com/en/rest/webhooks/repo-deliveries"&gt;Webhook Deliveries API&lt;/a&gt; which allows listing past deliveries and triggering redeliveries.&lt;/p&gt;

&lt;h2&gt;
  
  
  Learn about secondary rate limits
&lt;/h2&gt;

&lt;p&gt;GitHub API has &lt;strong&gt;two&lt;/strong&gt; rate limiting mechanisms: one based on a number of requests per hour (&lt;a href="https://docs.github.com/en/developers/apps/building-github-apps/rate-limits-for-github-apps#server-to-server-requests"&gt;5,000 in the case of GitHub Apps for github.com&lt;/a&gt;), and one based &lt;a href="https://docs.github.com/en/rest/guides/best-practices-for-integrators#dealing-with-secondary-rate-limits"&gt;on the nature of the interactions themselves&lt;/a&gt;. The former is quite typical and easy to account for by examining &lt;a href="https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limit-http-headers"&gt;GitHub API’s response headers&lt;/a&gt;. Complying with the latter, however, requires to be thoughtful and review how the system as a whole interacts with the GitHub API, including all services, tasks, and jobs in combination with various retry-policies.&lt;/p&gt;

&lt;p&gt;Two of the guidelines to avoid hitting the secondary rate limits deserve particular attention:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;"Do not make requests for a single user or client ID concurrently."&lt;/li&gt;
&lt;li&gt;"If you're making a large number of POST, PATCH, PUT, or DELETE requests for a single user or client ID, wait at least one second between each request."&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;As a general rule of thumb, we would recommend against multiplying systems that will have to share the API budget.&lt;/p&gt;

&lt;h2&gt;
  
  
  Conclusion
&lt;/h2&gt;

&lt;p&gt;GitHub is the place where most development work happens, and building tools for it can be extremely rewarding. GitHub puts a lot of effort in its platform, as seen by the introduction of GitHub Apps, and how the API continues to evolve.&lt;/p&gt;

&lt;p&gt;We hope this post will help you with some of the less-obvious lessons of interacting with the GitHub API. If you curious to learn more about what we’ve built with it and how we believe it can help every engineering organization out there have more focus, more clarity, and more success, check us out at &lt;a href="https://echoeshq.com"&gt;https://echoeshq.com&lt;/a&gt;!&lt;/p&gt;

</description>
      <category>github</category>
      <category>go</category>
      <category>api</category>
    </item>
  </channel>
</rss>
