The Dependency You Never Declared

GitHub Models is dead. If you never used it, here's what you missed: a model playground and a single unified API that spoke to a pile of different LLM providers, run by GitHub, free at the tier most people lived in. Simon Willison called it "an odd-shaped duck," and he meant it kindly — the thing had one property nothing else had. Code running inside a GitHub Action could call a language model using the credential that was already sitting in the environment. No signup. No key to provision. No secret to rotate. You wrote a workflow step and it worked.

That property is why people built on it, and exactly why the retirement hurt.

The wind-down was orderly enough on paper. Closed to new customers on June 16. Full retirement announced July 1. Two scheduled brownouts, July 16 and July 23, to shake loose anyone who hadn't noticed. Dark on July 30 — playground, catalog, inference API, bring-your-own-key, all of it, even for customers with active usage. GitHub pointed the displaced toward Microsoft Foundry and Copilot. From the announcement that it was ending to the day it ended: four weeks. Notice given, alternatives named. By platform standards, that's a polite exit.

And it still broke things, because of what kind of dependency it was.

i · the thing that wasn't in the file

Every serious codebase keeps a list of what it needs. A lockfile, a requirements file, a manifest — the declared surface, the stuff you can audit, pin, mirror, and worry about. That list is where we've trained ourselves to look for fragility.

GitHub Models was never on it.

There was nothing to declare. The capability wasn't imported, wasn't installed, wasn't versioned. It arrived as a property of the place you were standing — an ambient token in a runner, a base URL that happened to answer. You didn't add a dependency; you noticed an affordance and used it. And an affordance leaves no trace. Nowhere in any repository is there a line that reads this workflow assumes Microsoft continues to subsidize inference tokens, because no tool exists that would have made you write it.

That's the part worth carrying out of this, and it outlasts the specific outage: the dependencies most likely to take you down are the ones that never looked like dependencies. They didn't look like dependencies because they were frictionless. And they were frictionless because someone spent money making them so.

ii · free was the design, not the discount

The last time I wrote about this pattern, the subject was a firmware flag — AMD silently disabling memory encryption on consumer Ryzen chips — and the lesson was locational: find where the off switch actually lives, because it's rarely where the toggle is. That's still true. But GitHub Models adds a harder layer, because here the toggle didn't just live elsewhere. The toggle was deliberately removed to make adoption effortless.

I want to be careful not to moralize this. Willison's read on the shutdown is that coding agents made subsidized tokens prohibitively expensive, and that's probably right — a plausible, unglamorous story about a spreadsheet. Nobody needs to have been cynical for the structure to work the way it worked. The point isn't motive. The point is that convenience and capture are the same gesture viewed from opposite ends of time.

Coherenceism states it plainly: environments shape behavior more reliably than intentions do. Remove friction from a path and people walk it — not because they decided to, but because deciding was the friction you removed. That principle is usually offered as advice for designing your own systems. It cuts the other way too. Someone else designed the environment you're building in, and every removed step is a step you never consciously took. You didn't choose GitHub Models over its alternatives. You never held an alternative in your hand long enough to compare.

The bill for a designed environment doesn't arrive as a bill. It arrives as a changelog entry.

iii · what made the exit cheap

Here's the part that's actually reusable, and it isn't foresight.

Willison didn't predict the retirement. What he describes doing about it is small: he got an OpenAI API key, put a monthly spending limit on it, and pointed his summarizer at a different model. New credential, new model name, done. The vendor-specific part of his system was the size of a config line, so replacing the vendor cost about a config line.

That's the whole trick, and it has nothing to do with anticipating the future. Migration cost isn't determined by how good your prediction was. It's determined by how much of your system knew the vendor's name. If exactly one file knows, you have a swap. If forty call sites know, you have a project. The prediction is unknowable; the blast radius is a thing you get to decide, today, before you know which vendor dies.

So here are the moves, in the order I'd actually do them.

Inventory by credential, not by manifest. Every capability running on a credential you did not create is a dependency with no declaration — an ambient CI token, an inherited cloud role, a free tier you never attached a payment method to. Start with one command: grep -rn "secrets.GITHUB_TOKEN" .github/workflows/, then read each hit asking not does this work but who is paying for the thing on the other end of it. A platform-minted token reaching a platform-funded service is the exact shape GitHub Models had. Then make the same pass over the base URLs in your service code: any endpoint you call without a key from your own vault goes on the list. That list, which took twenty minutes, is the audit surface you didn't have this morning.

Apply the invoice test. If nothing bills you, nothing binds them. Free tiers aren't cheap versions of paid tiers; they're a different instrument entirely — marketing spend with no contract, no deprecation SLA, no support path, retractable on the timeline of a budget meeting. Paid access isn't safe either, but money buys you a counterparty who owes you notice. Sort your list by that line and you know where to spend your remaining attention.

Put the seam where the switch is. Last time the instruction was to locate the real off switch. This is what you do once you've found it: build your boundary at that exact line. One adapter, one config value, one file that speaks the vendor's dialect and nothing else that does. This is the build-once-use-forever move — the seam outlives whichever vendor sits on the far side of it, and it pays out every time someone upstream changes their pricing.

Exercise the fallback, or don't call it one. An untested alternate path is a wish with indentation. Run the second provider once a quarter, or behind a flag on a low-stakes job, or in CI on Sundays. You want to discover the incompatible response format on a Tuesday of your choosing.

Price the migration while it's hypothetical. For each item on the list: if this goes dark Friday, how many hours? Not to schedule the work — to surface the ones where you genuinely don't know. Those are the load-bearing unknowns, and the not-knowing is the finding.

None of this requires you to stop using free things. Nearly everything any of us builds sits on rented ground, and that trade is usually correct — renting capability is how a small operation punches above its size. The failure isn't renting. The failure is renting so smoothly that you never registered a transaction took place.

iv · the shape is yours

You will not own the models. You won't own most of the layers under you, and pretending otherwise just makes you slow. What you can own is the shape — where your system's boundaries sit, which parts know a vendor's name, how long it takes to swap one out. That's not a thing anyone can retire out from under you. It survives every changelog, and it gets more valuable each time the ground moves, because you built it once.

GitHub Models is gone. The people who barely felt it weren't luckier or better at forecasting. They just happened to have their system organized such that a vendor's exit was a line to edit rather than a week to survive.

That organization is available to you this afternoon. Start with the list.