September 2026 on GitHub: The Month ctm Was Born

Back when I got started in open source, you mailed a patch to a mailing list, waited a week, and thanked your lucky stars if a human read it. In September 2026 I opened 200 pull requests, and I’m pretty sure I never waited a week for anything. Times change. Some of those PRs were even interesting, and one of them became a whole new project.

This is another in a series of monthly recaps of my public GitHub activity — numbers first, with the stories behind the interesting bits. The series started with September 2025, back when the robots weren’t reviewing anything yet. They review everything now. Progress, I guess.

By the Numbers

Yes, two hundred PRs in one month. Before you picture me as some kind of productivity demigod: 34 of those were the data-curated repo filing its daily “Update GitHub data” paperwork all by itself, the way it does. The robots are tireless and I am merely their supervisor. The other 166 were human-shaped — well, human-supervised — and 195 of the 200 merged, which either means my ideas were good or that nobody was standing in the way. History will decide.

The busiest repos were the brand-new ctm (27 PRs), template-repo (18), and gh-observer (17), with this very website pulling in a respectable 11. Thirty repos touched in a month is a lot of context switching, which is either a sign of broad curiosity or an inability to focus. I’ve decided to call it curiosity.

Releases Shipped

ctm v0.1 and v0.2

The big story of the month: ctm — “Control Time Machines” — a Go CLI for bossing around the Time Machines Corp LED clocks over UDP: status, timers, colors, dimming, the works. v0.1 shipped September 10 with the whole launch checklist — ffcli subcommands, unit tests with an injectable dialer, a modular justfile, and the full quality/security workflow suite I’ve been refining across the fleet. Two days later, v0.2 added a local-test recipe for sanity checks against real clocks and, more importantly, a release pipeline that ships cosign-signed binaries with SLSA build provenance. A project that went from nothing to signed, provenance-attested releases in ten days is a good month by any measure.

gh-observer v4.0

gh-observer v4.0 (September 13) was mostly a maintenance release — Go module updates and the usual dependency parade from renovate and dependabot. The interesting gh-observer work landed after the tag, and you’ll find it below in the notable PRs.

The maintenance fleet

The rest of the month’s releases were the unglamorous-but-necessary kind, spread across seven repos: gh-amp v0.4, emoji-bag v1.2, fini-infra v4.4, datadog-service-analyzer v1.1, presentation-notes v2026.09, google-plus-posts-dumper v1.2, and data-curated v1.4. Mostly gh-process version bumps, workflow hardening, and security housekeeping. Nobody writes folk songs about dependency updates, but somebody’s got to keep the lights on.

Notable Pull Requests

ctm #44: release workflow with signed binaries and SLSA provenance

This one earned its spot the old-fashioned way: multiple review cycles, one evening, no mercy. 339 additions of release pipeline, reviewed and re-reviewed four times between 9pm and midnight — each round a fresh review, my point-by-point responses (“Round 2 review — point by point”), and a fix. The back-and-forth caught a real guard-rail bug in the version regex and the injection-hardening around $rel_version. The result was worth it: keyless cosign signing, SLSA provenance, and binaries you can actually verify.

ctm #32 and #33: the CLI grows its spine

The feature work that made ctm a real tool rather than a script with ideas above its station. #32 (192 additions) modernized the CLI parsing to ffcli subcommands with proper flags, and #33 added the downtimer subcommands and the API 2.0 status decode — the actual clock-wrangling functionality. From here, everything else in the project was polish.

gh-observer #480: GitHub Enterprise URL support

The biggest diff of the month by a comfortable margin: 1,183 additions and 352 deletions to teach gh-observer to talk to GitHub Enterprise servers. That’s a feature people actually ask for — plenty of shops live behind a GHE fence and were previously stuck watching CI the old-fashioned, miserable way. Now they can be miserable slightly less.

gh-amp #41: harden untrusted-input parsing, add fuzz targets

807 additions of defensive engineering: hardened parsing of untrusted input, function tests, and fuzz targets for the parsers. The PR that reminds you that tools that read other tools’ output need to be suspicious of everything. A security-minded reviewer (GitHub’s Advanced Security bot) showed up for this one too, which feels appropriate.

Honorable mention to template-repo #352, the gh-process v9.1 security hardening work that generated seven comments of lively discussion — it just lost the cut to the four above.

Embedded Metadata

These are times where it seems good to be explicit about our choices about and usage of AI (Artificial Intelligence). Plus any links to cross-posts I do.

• This post was drafted by GLM-5.3 in OpenCode using the new gh-recap skill; the numbers came straight from GitHub’s API via the gh CLI on 2026-10-30. The notable-PR review-cycle counts are from the actual PR comment threads, bots included, warts and all.
• The PR carrying this series was code-reviewed in CI by Claude Code — robots reviewing robots, which felt thematically correct.
• The draft was reviewed and edited by me before publishing. The opinions, jokes, and any errors are mine.