21–30 of 584 posts
[1] https://github.com/actions/runner/blob/6654f6b3ded8463331fb0...
Earlier quoted context omitted.
Definitely not a skill issue if you read the details in their post - https://www.feldera.com/blog/the-pain-that-is-github-actions - they're clearly very experienced with using GitHub Actions and have run into legitimate challenges due to the complexity of what they're using it for.
I did read the post. The documentation of the product does explain how to use it, so it is unfair to blame the product in my opinion.
Earlier quoted context omitted.
I did read the post. The documentation of the product does explain how to use it, so it is unfair to blame the product in my opinion.
GitHub Actions may cover this stuff in the documentation but it's still difficult to use. That means the product could be designed better (and the documentation could be easier to follow.)
Could we not usually say most software could be documented better. I do not think GitHub Actions ranks near the bottom in terms of documentation and user experience overall. I do understand your point though.
I worked at companies using Gitlab for a decade, and got familiar with runners. Recently switched to a company using Github, and assumed I'd be blown away by their offering because of their size. Well, I was, but not in the way I'd hoped. They're absolutely awful in comparison, and I'm beyond confused how it got to that state. If I were running a company and had to choose between the two, I'd pick Gitlab every time j…
I have some GitHub actions for some side projects and it just seems so much more confusing to setup for some reason.
In my experience, the best strategy is to minimize your use of it — call out to binaries or shell scripts and minimize your dependence on any of the GHA world. Makes it easier to test locally too.
Outside of locking down edit access to the .github workflow yml files I'm not sure how vulnerabilities like this can be prevented.