The Community Has Questions

The situation

Code Nexus wants to let a few partner engineers contribute to the creator-service utility. Before anyone outside the team gets access, the repository needs to be set up so a well-meaning contributor can't accidentally break main or read something they shouldn't. And 8-BIT has already 'helped' by committing a config change that pastes a real-looking token straight into the repo.

What you'll learn

• GH-900 modern practices, security and community: hosted editors (Codespaces, dev containers, github.dev), repository visibility and roles, branch protection, a required status check, contribution files, and InnerSource vs open source.
• GitHub Actions workflow structure and checkout; Copilot suggestions, chat and agents with current personal/organisation plan distinctions; hosted editors; identity, repository roles, Enterprise visibility, branch rules, contribution and community features.

Who you work with

• 

  Maya Chen

  Senior AI Engineer · Your mentor

• 

  Lydia Roe

  Security Engineer

• 8-BIT

  Code Nexus Internal AI Assistant

Scenes

1. 1.Before we hand out keys
2. 2.Which editor for which job
3. 3.Read the workflow
4. 4.Which tool for the job?
5. 5.Set the repo up for contributors
6. 6.The token 8-BIT pasted in
7. 7.Practices and security check

What you leave with

The creator-service repo is ready for partner contributors: internal visibility, triage access, a protected main with a required CI check, and the contribution rules written down. And you kept 8-BIT's useful timeout change while removing the token it exposed — flagged for rotation.