Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions is the weakest link

nesbitt.io

Post reply on HN
Print view View original

21–30 of 95 posts

Re: GitHub Actions is the weakest link

#21

Post by jamietanna »

arionmiles wrote: post #11
rmunn wrote: post #4

Back when GitHub Actions first came out, I used commit hashes rather than tags in all my `uses:` lines. Some of my colleagues disagreed, saying that tags were secure enough. I eventually said, "Well, for well-known actions like actions/checkout, sure; if that one gets compromised it'll be all over the news within minutes." But for all the third-party actions, I kept commit hashes. I feel rather vindicated now. There'…

I feel pretty happy we use Renovator (EDIT: It's Renovate) at my current workplace which by default will raise PRs to change any tags for actions with the SHA instead. Then, even when it bumps the version in future PRs, it bumps the SHA (with a comment of which tag version it represents)

Glad to hear you're enjoying Renovate - I'm biased, but I agree that the SHA pinning PR updates are a very nice feature

We recently found (in Renovate) some edge cases with how tags work in GitHub Actions which was fun (https://news.ycombinator.com/item?id=47892740) and there's a few things in there Dependabot doesn't seem to support too

Re: GitHub Actions is the weakest link

#22

Post by peterldowns »

Yup! Still haven't switched off of Github, but considering it at this point. If you're in my shoes, here's some tools we use that help:

- https://github.com/sethvargo/ratchet for pinning external Actions/Workflows to specific commit hashes

- https://www.warpbuild.com/ for much faster runners (also: runs-on/namespace/buildjet/blacksmith/depot/... take your pick)

- soon moving to Buildkite for orchestration of our CI jobs

I still just need a reasonable alternative for the "store our git repo, allow us to make and merge prs" part of things. Hopefully someone takes all the pieces that the Pierre team is publishing and makes this available soon. The Github UI and the `gh` cli are actually really nice and the existing alternative code storage tools are not great IMO.

Re: GitHub Actions is the weakest link

#23

Post by sureglymop »

shykes wrote: post #14

I apologize in advance for the plug. I've spent the last 5 years warning of the importance of not leaving CI locked in a black box platform and proprietary DSL. All the while going on a quest to reinvent CI as an open, programmable platform. Honestly it's still a work-in-progress: it turns out that reinvention is hard! But, if you want a glimpse of what CI can be when you shed 30 years of legacy, consider checking ou…

Looks cool. Can it be self hosted? I.e. can I self host it next to my self hosted forgejo instance?

Re: GitHub Actions is the weakest link

#24

Post by a_t48 »

peterldowns wrote: post #22

Yup! Still haven't switched off of Github, but considering it at this point. If you're in my shoes, here's some tools we use that help: - https://github.com/sethvargo/ratchet for pinning external Actions/Workflows to specific commit hashes - https://www.warpbuild.com/ for much faster runners (also: runs-on/namespace/buildjet/blacksmith/depot/... take your pick) - soon moving to Buildkite for orchestration of our CI j…

Why warpbuild over the alternatives? I've seen depot before and am tempted, but open to other platforms.

Re: GitHub Actions is the weakest link

#25

Post by AlecBG »

rmunn wrote: post #4

Back when GitHub Actions first came out, I used commit hashes rather than tags in all my `uses:` lines. Some of my colleagues disagreed, saying that tags were secure enough. I eventually said, "Well, for well-known actions like actions/checkout, sure; if that one gets compromised it'll be all over the news within minutes." But for all the third-party actions, I kept commit hashes. I feel rather vindicated now. There'…

You can enforce at the org level to only allow actions pinned to hashes. You can also choose a small whitelist of actions to allow.

Re: GitHub Actions is the weakest link

#26

Post by lstodd »

bastardoperator wrote: post #15
recursivedoubts wrote: post #10

Programming in YAML has always seemed crazy to me. Actions seem like a great place to create a simple mixed imperative/declarative scripting language (js extension or whatever) with a solid instrumented/observable/debuggable runtime and an OO API that can be run locally against mock infrastructure.

No thanks, Jenkins has three DSL languages and none of it is good. You dont have to inline code in yaml, you can call a script and call it day, write that script in any language you want.

idk I always just wrote shell to be called by jenkins. none of this idiocy of programming with html comboboxes. DSL for the domain is shell, no need to invent hyperwheels here.

Re: GitHub Actions is the weakest link

#27

Post by Munksgaard »

maxloh wrote: post #12
rmunn wrote: post #4

Back when GitHub Actions first came out, I used commit hashes rather than tags in all my `uses:` lines. Some of my colleagues disagreed, saying that tags were secure enough. I eventually said, "Well, for well-known actions like actions/checkout, sure; if that one gets compromised it'll be all over the news within minutes." But for all the third-party actions, I kept commit hashes. I feel rather vindicated now. There'…

GitHub Actions doesn't have a lock file, so your repo is still prone to transitive attacks if the SHA-locked actions you use also happen to use other composite actions by tags, which could be compromised in the future.

Even with a lock file, the action can download and execute arbitrary code from the internet.

Re: GitHub Actions is the weakest link

#28

Post by tecleandor »

arionmiles wrote: post #19
tecleandor wrote: post #18

Earlier quoted context omitted.

Is it Renovator or Renovate? I'm trying to find it to check it out...

Oops, my bad. We keep calling it Renovator internally but the name is RenovateBot or Renovate. https://docs.renovatebot.com/

Thanks! I'll take a look :)

Re: GitHub Actions is the weakest link

#30

Post by ossianericson »

The OIDC federation between the runner and the cloud resources it touches , that credential gets created once. Permissive enough to not block the first deploy, and it is not what is reviewed when a pinning incident happens. Every one is looking at the action. The identity it runs as just sits there.
Post reply on HN