UK public sector / The GOV.UK tooling that GOV.UK does not maintain

14 August 2026 · open source supply chain community conventions

X-GOVUK describes itself, in its own GitHub profile, as an organisation for projects "useful when working with GOV.UK tools but aren't linked with GOV.UK in any official capacity". That is an accurate and rather modest description of something a good deal of government now runs on.

What it is

31 live repositories, 16,466 commits, 525 stars, mostly MIT-licensed, going back to 2019. The work is glue: a Rails form builder that produces GOV.UK Design System markup, a component library for Rails, an ASP.NET Core integration of the same design system, an Eleventy plugin that publishes Markdown in GOV.UK styles, a design-history template, and a pile of prototype-kit filters and components. None of it is a service. All of it is the layer between a department's developers and the government's own design standards.

The adoption is not marginal. On 14 August 2026 the two flagship Ruby gems — govuk_design_system_formbuilder and govuk-components — had 1,118,877 and 774,894 downloads against 2,028,567 for govuk_publishing_components, the official GDS-maintained one. The unofficial pair pull close to the official flagship's volume. Whatever "not linked in any official capacity" means, it does not mean "not depended upon".

It is also better maintained

This site scores every public body's repositories on the same set of ordinary engineering conventions. Running X-GOVUK through the identical scorer — live repositories, forks and archives excluded, same extractor, same week — produces this:

81% of X-GOVUK's repositories have CI, against 34% across the estate. 65% have dependency automation, against 13%. Tests: 52% against 28%.

One measure refuses to play along, and it is worth reporting because it was expected to be the strongest. Repositories committed to within the last year: X-GOVUK 65%, the estate 58%. Practically level. Government's reputation for abandoned repositories comes almost entirely from archived ones, and once those are excluded — as they are everywhere on this site — departments tend their live code about as attentively as the volunteers do. The gap is in tooling, not attention: the same people, without CI and without dependency updates.

Two conventions run the other way, and they are the interesting ones. X-GOVUK scores zero on CODEOWNERS and zero on pull request templates — both artefacts of an organisation large enough to need routing rules for review, and X-GOVUK is a handful of people who all know who reviews what. That is not a gap. It is what the absence of bureaucracy looks like when you measure it, and it is a fair warning about reading any of these scores as a ranking.

Why an unofficial project wins on maintenance

The obvious explanation is size: forty small libraries are easier to keep green than twenty-one thousand repositories including a decade of dead prototypes. That is true and it is most of the answer.

The rest of the answer is that a library has users and a prototype does not. Every one of these repositories exists because somebody outside the team installs it, and a broken release generates an issue the same afternoon. Government's repository estate is dominated by work with no such feedback: the service was delivered, the team moved on, and nothing tells anyone that the repository has quietly stopped building. A published package is accountable to its users in a way an internal repository is accountable to nobody.

The part that should worry somebody

This is a supply chain, and it is not procured, funded, or supported. Government services depend on libraries maintained by volunteers, in an organisation that says on its own profile that it has no official standing. Nobody has a contract. Nobody has an SLA. If the maintainers stop, the services do not break immediately — they stop getting security updates, which is worse, because it is invisible.

This is not a criticism of X-GOVUK, which has done the work and done it well. It is a question about the departments consuming it. The NCSC's own guidance on protecting a code repository is largely about knowing what you depend on and who maintains it. A department shipping a service built on govuk_design_system_formbuilder has a dependency on a small volunteer group, and the honest question is whether anyone in that department has ever written that down.

The pattern is not unusual — a great deal of public infrastructure runs on unfunded maintenance — but it is unusually visible here, because the organisation went to the trouble of saying so in its own profile text and nobody appears to have read it.

Why it is not on the rest of this site

X-GOVUK does not appear on the comparison pages, is not in any "across UK government" figure here, and has no organisation page. It is not a public body. The basis on which this site processes public sector developers' names and work addresses is that public bodies are accountable for what they publish; volunteers are not, and stretching the argument to cover them because their code happens to be useful to government would be exactly the kind of scope creep this project is meant to avoid.

Method: repository counts, conventions and activity from a one-off harvest of github.com/x-govuk into a separate directory outside the estate, scored with the same extractor as every organisation on this site. The committer file that harvest produces was deleted rather than read: no contributor to X-GOVUK is named, counted or measured anywhere in this post. Package download totals were read from rubygems.org and the npm registry on 14 August 2026 and are stated as of that date. See Method and the organisation itself, which is worth your stars more than it is worth this analysis.

← All writeups