Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions is the weakest link

nesbitt.io

Post reply on HN
Print view View original

71–80 of 95 posts

Re: GitHub Actions is the weakest link

#71

Post by shykes »

ostkai wrote: post #70
shykes wrote: post #14

I apologize in advance for the plug. I've spent the last 5 years warning of the importance of not leaving CI locked in a black box platform and proprietary DSL. All the while going on a quest to reinvent CI as an open, programmable platform. Honestly it's still a work-in-progress: it turns out that reinvention is hard! But, if you want a glimpse of what CI can be when you shed 30 years of legacy, consider checking ou…

I ALMOST chose dagger, but the idea of writing code to build my code felt like maintaining two applications. While I didn't chose it, the idea that new paradigms are needed was the draw.

Yes, it can be a double-edged sword. One reason I called Dagger a "work in progress" is that we took it too far. It's one thing that you can write custom code for your pipeline; it's another that you must write custom code.

We are actively overhauling our design (in a backwards compatible way) to reach a better balance. The result is that, for most users, writing custom code will not be required to use Dagger. But it will be available for power users who want to extend and customize the platform. Writing code for Dagger will be less like using a frameworok, and more like writing a plugin for a devops tool.

If you're interested, you can track our progress in our combined changelog / roadmap page: https://dagger.io/changelog/#modules-v2 . The overhaul project is called "modules v2".

Perhaps once it ships, you can give Dagger another try :)

Re: GitHub Actions is the weakest link

#72

Post by rmunn »

deepsun wrote: post #68
rmunn wrote: post #4

Back when GitHub Actions first came out, I used commit hashes rather than tags in all my `uses:` lines. Some of my colleagues disagreed, saying that tags were secure enough. I eventually said, "Well, for well-known actions like actions/checkout, sure; if that one gets compromised it'll be all over the news within minutes." But for all the third-party actions, I kept commit hashes. I feel rather vindicated now. There'…

Maybe it's better to pull that dependency source in your action altogether?

I hadn't previously considered vendoring GHA dependencies, but yes, that might be a good idea. Perhaps not in all circumstances, but for anything that might be at risk of supply-chain compromise, the same arguments that apply to NPM apply to GHA.

Re: GitHub Actions is the weakest link

#74

Post by woodruffw »

a1o wrote: post #69

Question: could someone make a GitHub pages website that runs zismor in a dropped yml file and tells if it’s bad in some way?

You’d need to build zizmor for WASM. I’ve thought about doing that work, but I’d happily accept contributions from people towards that who understand WASM better than I do.

Re: GitHub Actions is the weakest link

#75

Post by peterldowns »

a_t48 wrote: post #24
peterldowns wrote: post #22

Yup! Still haven't switched off of Github, but considering it at this point. If you're in my shoes, here's some tools we use that help: - https://github.com/sethvargo/ratchet for pinning external Actions/Workflows to specific commit hashes - https://www.warpbuild.com/ for much faster runners (also: runs-on/namespace/buildjet/blacksmith/depot/... take your pick) - soon moving to Buildkite for orchestration of our CI j…

Why warpbuild over the alternatives? I've seen depot before and am tempted, but open to other platforms.

Founder is active on HN and the service is high quality. Support is reasonable. Machines are fast and work well. There are a bunch of alternatives, the switching cost is extremely low, pick whatever you'd like.

Re: GitHub Actions is the weakest link

#76

Post by arionmiles »

mmarian wrote: post #34
arionmiles wrote: post #11

Earlier quoted context omitted.

I feel pretty happy we use Renovator (EDIT: It's Renovate) at my current workplace which by default will raise PRs to change any tags for actions with the SHA instead. Then, even when it bumps the version in future PRs, it bumps the SHA (with a comment of which tag version it represents)

If you auto merge those PRs you're back to square 1 as you're not vetting your dependency updates. And if you don't, you incur operational overhead unless you put in a fair amount of effort centralizing. Wrote a couple of posts that touched on this https://developerwithacat.com/blog/202604/github-actions-sup...

Valid point. We have minimum age requirements set on some rules to avoid absorbing every latest change instantly.

Re: GitHub Actions is the weakest link

#77

Post by cenamus »

LelouBil wrote: post #59
cenamus wrote: post #16

Earlier quoted context omitted.

You can do the same in jenkins, but a bit of scripting is probably more readable in Groovy than whatever Yaml dsl. But I totally agree that the Jenkins langs are terrible, the errors even worse, somehow they managed to make jvm backtraces even more unreadable.

I don't know why they don't pivot to Kotlin. Gradle did it successfully and it's great now.

Don't they have a major thing going on with CSP (as with Scheme) that sort ot persists pipeline state automatically? That would allow you to kill Jenkins and afterwards restart the pipeline from exactly where you left off?

But I never tried it personally

Re: GitHub Actions is the weakest link

#78

Post by mmarian »

arionmiles wrote: post #76
mmarian wrote: post #34

Earlier quoted context omitted.

If you auto merge those PRs you're back to square 1 as you're not vetting your dependency updates. And if you don't, you incur operational overhead unless you put in a fair amount of effort centralizing. Wrote a couple of posts that touched on this https://developerwithacat.com/blog/202604/github-actions-sup...

Valid point. We have minimum age requirements set on some rules to avoid absorbing every latest change instantly.

How would that solve the problem though? You're still bringing compromises in, just with a delay. And the fixes will come in after the compromise, in accordance with the delay policy.

To make matters worse, you'd lose getting alerts on vulnerabilities. Dependabot won't send them, and neither will Renovate last time I checked.

Re: GitHub Actions is the weakest link

#79

Post by mitchjj »

peterldowns wrote: post #22

Yup! Still haven't switched off of Github, but considering it at this point. If you're in my shoes, here's some tools we use that help: - https://github.com/sethvargo/ratchet for pinning external Actions/Workflows to specific commit hashes - https://www.warpbuild.com/ for much faster runners (also: runs-on/namespace/buildjet/blacksmith/depot/... take your pick) - soon moving to Buildkite for orchestration of our CI j…

VP at Buildkite here; let me know if you need anything as you begin to move over to us for orchestration. The new trial we just released unlocks everything in the platform, and we can extend past 30 days if you need.

Re: GitHub Actions is the weakest link

#80

Post by pabs3 »

mmarian wrote: post #34
arionmiles wrote: post #11

Earlier quoted context omitted.

I feel pretty happy we use Renovator (EDIT: It's Renovate) at my current workplace which by default will raise PRs to change any tags for actions with the SHA instead. Then, even when it bumps the version in future PRs, it bumps the SHA (with a comment of which tag version it represents)

If you auto merge those PRs you're back to square 1 as you're not vetting your dependency updates. And if you don't, you incur operational overhead unless you put in a fair amount of effort centralizing. Wrote a couple of posts that touched on this https://developerwithacat.com/blog/202604/github-actions-sup...

How many people actually audit the code changes in their dependencies when updating them?
Post reply on HN