Government Open Source: An Analysis

Every government GitHub organization on the official government.github.com list, counted: what they publish, how much of it is still maintained, and how much of it anyone outside government has actually contributed to.

Read the report: https://opensource-joe.github.io/gov-oss-analysis/

Measured 11 August 2026, against the live gh-pages copy of _data/governments.yml.

Two structural findings sit behind those numbers. 482 of the 1,079 listed organizations (44.7%) have not pushed a single commit in a year. And the layers of government closest to residents are the least active: U.S. counties at 11.6% and cities at 13.4%, against a U.K. figure of 34.9%.

The list is opt-in. No government appears on it that did not choose to. Every figure here therefore describes governments that already decided to present themselves as open source participants. This is a best case, not a representative sample, and the population that never appeared is unlikely to be doing better.

A repository being public is not the same as it being open. This analysis classifies the author of every recent merged pull request by their relationship to the owning organization, using GitHub's authorAssociation field.

The complication is that GitHub organization membership can be private. When it is, a staff engineer's pull request carries exactly the same author association as a stranger's. Spot checking confirmed this: on alphagov/govuk-frontend, several accounts labelled as outside contributors are in fact GOV.UK Design System developers.

So the raw figure is an upper bound, not an estimate. To get a floor, the analysis excludes any "outside" author who merged pull requests into three or more separate repositories belonging to the same organization, a pattern that describes staff rather than a passing contributor.

Because that threshold is a judgement call, the full sensitivity range is published in data/sensitivity.csv rather than a single number:

The defensible claim is a range: at most 15.8%, and realistically nearer 5%.

The census answers a question about the estate. To ask it of one repository, use scripts/openness_probe.py, which reads the last 80 merged pull requests live and reports the breakdown:

python3 scripts/openness_probe.py ckan/ckan alphagov/govuk-frontend

Two things it corrects for, both of which invert the naive reading:

• Bots are excluded first. On ckan/ckan, 17 of the last 80 merges carried NONE, which reads as a healthy stream of newcomers. All 17 were ckanbot. On GSA/notifications-admin, 61 of 80 merges are Dependabot.
• CONTRIBUTOR is not an insider label. It means "has merged before, is not a member", so a contractor roster and a real community both land there. What separates them is shape: how many distinct people, and how concentrated their merges are.

These figures are a point-in-time API read rather than part of the crawl, so unlike every other number published here they are not covered by verify_all.py.

Tidy CSVs in data/, sufficient to check every figure in the report without re-running the crawl:

The scripts run in order and checkpoint to JSONL, so an interrupted run resumes rather than restarting. A full crawl takes roughly 90 minutes and needs an authenticated gh CLI. Raw crawl output is about 57 MB and is not committed.

cd scripts
python3 parse_list.py      # governments.yml -> gov.json  (--live to refetch)
python3 fetch_orgs.py      # resolve all 1,079 handles      -> orgs.json
python3 fetch_repos.py     # every public repo              -> repos.jsonl
python3 fetch_prs.py       # merge history of live repos    -> prs.jsonl
python3 fetch_authors.py   # author logins where needed     -> authors.jsonl
python3 verify_all.py      # recompute and assert every published figure
python3 export_csv.py      # regenerate data/*.csv
python3 build_doc.py       # rebuild index.html

verify_all.py is an independent recomputation: it shares no code with the analysis path, reads only the raw crawl output, and asserts each of the 72 figures the report publishes. It prints a per-check OK/FAIL line and exits non-zero if any drift.

GitHub's annual Octoverse report covers the platform as a whole and carries no government or public sector breakdown: the 2025 edition reports 180M+ developers and 630M repositories with no sector segmentation. government.github.com itself is a registry, not a study. The closest existing work is U.S. federal only and built on Code.gov rather than a direct crawl: GSA's code-gov-stats and the paper Measuring Public Open-Source Software in the Federal Government.

This analysis differs in being cross-national, measured at the organization and repository level directly from the GitHub API, and focused on whether outside contribution actually happens rather than on counts of published code.

• Alive means pushed within 12 months. A single commit qualifies, which is generous and makes the activity figures optimistic.
• Outside contribution is read from the 15 most recently updated merged PRs per repository. A repo whose recent merges are all internal, but which accepted an outside patch earlier in the window, can be missed. This biases the count downward on very high-traffic repositories.
• Private organization membership is the main source of error and inflates apparent openness. The staff filter is a heuristic correction, not a measurement.
• Contractors cut the other way. Vendor staff are often added as collaborators and are therefore counted as internal, even though the work is not done by the government itself.
• Counts reflect the GitHub API at a single moment and will drift.

Code in scripts/ is MIT licensed, see LICENSE. The report text and the derived data in data/ are released under CC BY 4.0: use them freely with attribution.