whatever

Go uses the package name to retrieve the pagacke source - a package named github.com/example/whatever will be downloaded by basically cloning it with git & then checking out the specified version as a tag. That's in itself a really simple system and doesn't rely on a single third party, but obviously comes with the ownership issue (unless when pinning a specific commit) - in my opinion a good compromise.

It genuinely surprises the shit out of me that people haven't created a "middleware" layer that treats GitHub as its backend / source of truth, but everything gets routed through a custom domain. E.g., spin up this glorified reverse proxy on Heroku, and now example.com/bugs is really just example.github.io/bugs, which is a page with all its form actions pointing to the Heroku service acting as a go-between for managing github.com/example/whatever/issues with full backups, etc.