GitHub witnesses bizarre repository deletion: Company acquired by Anthropic cleans up code, causing client code to vanish within two seconds, initially suspected to be a hacker intrusion.

Beating AI News Flash: In May of this year, Anthropic acquired SDK generation tool company Stainless. The latter subsequently announced the gradual shutdown of its original hosting services. On October 27, a Stainless staff member deleted one of their own private GitHub repositories, and unexpectedly, the client's code was deleted along with it.

The affected party was payment platform Dodo Payments. It had previously forked (copied) a piece of code from Stainless's private repository, and its entire SDK generation process depended on this repository. After Stainless deleted the original repository, in less than two seconds, Dodo's private repository was also automatically deleted, without prior notification.

It turns out GitHub has a rule: when a private repository is deleted, all private forks under it are deleted as well. Even more absurdly, Dodo's audit log only showed that an external party executed `repo.destroy`, without noting that this was a chain reaction caused by an upstream repository deletion. Co-founder Ayush Agarwal could not find any authorization record for the other party, and the repository was not in the recoverable list, leading him to initially believe the company had suffered a hacker attack.

GitHub customer service subsequently helped the team clarify the cause. Fortunately, Dodo had a local code copy and ultimately re-uploaded it as an independent repository, and the SDK has resumed operation.

Agarwal hopes GitHub will clearly indicate the reason for upstream repository deletion in audit logs. He also reminds other Stainless customers to convert private forks still dependent on upstream repositories into independent repositories as soon as possible.