61–65 of 65 posts
Earlier quoted context omitted.
Right, such as travis, circleci, gitlab, etc. All of which are pretty popular, so clearly there is interest in SaaS CI/CD.
Yes, they are popular. But on-premises ones also exist, are popular too, and mostly do not have this one problem. It's a relevant distinction on this context.
Earlier quoted context omitted.
This isn't much different than other CI/CD pipelines. Docker images come to mind.
This isn't much different than other SaaS CI/CD pipelines.
There's something to be said for on-premise solutions, but they won't save you from a malicious maintainer.
The same could be said for any use of docker images. Seems a little unfair to single out Github.
With Gitlab.com:
https://docs.gitlab.com/ee/user/packages/container_registry/
Currently the closest equivalents are making a request via the API (but then you need a token with it, and all the security concerns it opens) or sending a special message using an empty commit (but I haven't found a simple way to do that from inside VSCode, unless I missed it somewhere).
This also applies to most library, docker (as mentioned) and basically anything you use that's 3rd party. I suppose it varies on your level of paranoia, though honestly if you rely on a github action in your production flow you should fork the project. Never mind doing something malicious, they could just as easily delete the entire repo and now your critical feature you needed to deliver are blocked because the libr…
Unlike git commit hashes, docker image tags can be overwritten by the maintainer at any time, even if they map to a hit commit hash.