#github

Google Summer of Code 2026's 12-week timeline wrapped final evaluations at the end of August, with shorter projects finishing earlier. This post reads the official projects page and Google's program announcements for scale, acceptance rates, and what is marked complete versus still active. It then ranks mentoring organizations by volume and highlights where the largest slots landed. The centerpiece is a personal list of 50 completed projects from orgs including Apache, Debian, Django, Git, the Linux Foundation, OWASP, and PSF. Bias is declared up front: security-related work, hardware, frameworks I use, and communities I am close to.

Part 1 covered preparation and choosing an organization. This part focuses on contribution and communication -- the habits that make technical skill visible to maintainers. It covers Git and GitHub Flow, keeping forks current, and pull-request hygiene that respects review bandwidth. There is also guidance on reading project guidelines, handling feedback, and using AI responsibly without dumping unowned volume on mentors. The closing thread is how to talk to communities clearly so your work gets noticed for the right reasons.

Unsolicited, low-effort pull requests burn maintainer attention on open projects, and AI made that volume cheaper to produce. This post starts from OWASP Nest queue pressure around mentorship seasons and the project's issue-first, assignment-before-code workflow. It then contrasts the archived check-pr-issue-action -- an assignee gate with an issue-link prerequisite -- with check-contribution-action's multi-check maintainer DX. The newer action adds selectable gates, selective auto-close, optional DCO and commit signatures, and safer wiring guidance for pull_request_target. Context also spans OWASP Nettacker and the Open World Holidays Framework, without pretending the bots can detect AI.