UK Public Sector GitHub Observatory
Every other measurement on this site is about how a repository is run - who committed, when, whether there is a licence. This one is about what is actually in it. No file was read to produce it: everything below comes from the names of the files and the shape of the changes, both of which are in the clone already.
A dataset in a repository is not a breach. Most of these are test fixtures, reference tables, lookup files and published open data sitting exactly where it belongs. The finding is the pattern and the outliers - not any individual file, and this page deliberately publishes counts rather than an index of them.
Committed data
130,837 files with a data extension - .csv,
.xlsx, .sqlite, .db and relatives -
live in 3,426 repositories. Everyone scans government code for
secrets. Almost nobody asks whether a spreadsheet went in by accident, which
is both more common and easier to do without noticing.
Where committed datasets are, by sector
Count of data files in repositories belonging to each sector. Sector sizes differ enormously, so read this against the repository counts on the comparison page rather than as a league table.
Which formats
By extension, across the sampled paths.
Things a build should have produced
23,374 compiled binaries (.exe, .dll,
.jar, .pyc and friends) and 31,909
archives are committed across the estate. 1,495 repositories
carry vendored dependencies and 1,118 carry build output.
None of this is dangerous. It is the cheapest possible signal of whether a
repository was set up by someone who does this often: a missing
.gitignore line is what separates most of these from the rest.
Tests
Of the repositories containing code, 9,095 have no test directory at all and 10,914 have one. Among those that do, the median ratio of test files to code files is 0.52.
Treat this gently. A repository can be thoroughly tested with its tests
beside the code rather than in a test/ directory, and a
three-file utility does not need a suite. What the number is good for is the
shape of the estate, not the verdict on any one repository.
The biggest structural changes
Counting files changed per commit finds the moments a repository was restructured rather than edited. Framework migrations, monorepo reorganisations, an initial import of code that already existed somewhere else, and - the interesting one - the day a project moved from a supplier to an in-house team, or the reverse.
| Repository | Files changed | Date | Commit |
|---|---|---|---|
| govuk-one-login/di-account-management-backend | 172,470 | 2024-01-25 | e26fef191971 |
| digital-land/infrastructure-funding-statement-collection | 170,721 | 2024-03-13 | 44d15989760b |
| digital-land/infrastructure-funding-statement-collection | 170,719 | 2024-03-08 | 8b6794b97d63 |
| digital-land/brownfield-land | 168,250 | 2020-12-15 | 25648bb9aff5 |
| digital-land/radon | 166,841 | 2025-05-23 | 32a0ef8650e2 |
| digital-land/brownfield-land | 166,398 | 2020-12-16 | 92bddcd372fc |
| NaturalHistoryMuseum/plant-traits-old | 165,802 | 2024-10-14 | 21ffa603427d |
| govuk-one-login/di-account-management-backend | 155,216 | 2024-01-26 | dc385369e60c |
| alphagov/govuk-topic-taxonomy-static-suggestions-experiment | 111,559 | 2026-03-16 | 76164221cc55 |
| digital-land/ancient-woodland | 87,838 | 2021-11-08 | 778fc49c40d1 |
| digital-land/ancient-woodland | 87,828 | 2021-09-24 | 3b3dc423db48 |
| bbc/material-design-icons | 77,779 | 2016-09-01 | 9b3e836f27a3 |
| digital-land/conservation-area-collection | 75,918 | 2024-03-13 | f2a428bf6582 |
| digital-land/conservation-area-collection | 75,917 | 2024-03-08 | 8788817d8f6c |
82,910 commits across the estate changed 100 files or more. The threshold is arbitrary; the distribution behind it is in the per-repository data.
Method: derived from trees and tree-to-tree diffs in blobless clones, so no file content was fetched or read. Per-file sizes are not available in such a clone without downloading every blob, and are therefore not reported. The churn walk is capped at 30,000 commits per repository; 59 repositories hit that cap and their structural-change counts are therefore lower bounds. 0 repositories failed extraction and are excluded rather than counted as zero. See Method.