Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Actions has a package manager, and it might be the worst

nesbitt.io

Post reply on HN
Print view View original

111–120 of 267 posts

Re: GitHub Actions has a package manager, and it might be the worst

#111

Post by everfrustrated »

crote wrote: post #38
coryrc wrote: post #17

Earlier quoted context omitted.

https://github.com/search?q=org%3Aactions+%22we+are+allocati... i.e. from https://github.com/actions/cache/?tab=readme-ov-file#note Thank you for your interest in this GitHub repo, however, right now we are not taking contributions. We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision,…

That's insane, so they are basically dropping support on a core feature of GH Actions?

What they are really saying is they don't want third party contributions. They don't have anyone triaging Issues or PRs so don't send them.

They will occasionally make changes if it aligns with a new product effort driven from within the org.

Saying they're dropping support is a stretch esp as very few people actually pay for their Support package anyway..... (Yes they do offer it as a paid option to Enterprise customers)

Re: GitHub Actions has a package manager, and it might be the worst

#112

Post by kokada »

captn3m0 wrote: post #85
weikju wrote: post #73

Earlier quoted context omitted.

they probably have a half-assed plan to push some sort of checkout action copilot button instead of dependable scripts/actions.

https://githubnext.com/projects/agentic-workflows/ > Instead of writing bespoke scripts that operate over GitHub using the GitHub API, you describe the desired behavior in plain language. This is converted into an executable GitHub Actions workflow that runs on GitHub using an agentic "engine" such as Claude Code or Open AI Codex. It's a GitHub Action, but the "source code" is natural language in a markdown file.

This looks like backwards. I would understand using a LLM to generate a GitHub Actions YAML, but always running your action from a Markdown file seems extremely wasteful in terms of resources.

Edit: ok, looking at example it makes more sense. The idea is to run specific actions that are probably not well automated, like generating and keeping documentation up-to-date. I hope people don't use it to automate things like CI runs though.

Re: GitHub Actions has a package manager, and it might be the worst

#113

Post by everfrustrated »

jamescrowley wrote: post #58
regularfry wrote: post #39

Earlier quoted context omitted.

We're iterating towards GHA for CI, AWS CodeBuild for the CD. At least on AWS projects. Mainly because managing IAM permissions to permit the github runner to do everything the deployment wants is an astonishingly large waste of time. But you need a secret to trigger one from the other.

You actually don’t need (long-lived / hard-coded) secrets in this scenario if you use OIDC: https://docs.github.com/en/actions/how-tos/secure-your-work/...

And even better can scope assuming an AWS IAM role to a specific branch name & workflow filename so only code/workflows that have been through review have access to CD secrets/prod infra.

IE no prod access by editing the workflow definition and pushing it to a branch.

Re: GitHub Actions has a package manager, and it might be the worst

#114

Post by ChrisMarshallNY »

gcr wrote: post #104
ChrisMarshallNY wrote: post #78

Earlier quoted context omitted.

> VSS I just had trauma! I will say that SourceSafe had one advantage: You could create "composite" proxy workspaces. You could add one or two files from one workspace, and a few from another, etc. The resulting "avatar" workspace would act like they were all in the same workspace. It was cool. However, absolutely everything else sucked. I don't miss it.

So it’s a workspace that includes changes from multiple branches at once, like `jj new revset-1 revset-2 revset-3 …` ? (Git has octopus merges, jj just calls them “merge commits” even though they may have more than two parents)

Don't remember exactly. If I think about it, it could be quite complex.

Git has the concept of "atomic repos." Repos are a single unit, including all files, branches, tags, etc.

Older systems basically had a single repo, with "lenses" into sections of the repo (usually called "workspaces," or somesuch. VSS called them something else, but I can't remember).

I find the atomic repo thing awkward; especially wrt libraries. If I include a package, I get the whole kit & kaboodle; including test harnesses and whatnot. My libraries thend to have a lot more testing code than library code.

Also, I would love to create a "dependency repo," that aggregates the exported parts of the libraries that I'm including into my project, pinned at the required versions. I guess you could say package managers are that, but they are kind of a blunt instrument. Since I eat my own dog food, I'd like to be able to write changes into the dependency, and have them propagate back to their home repo, which I can sort of do now, if I make it a point to find the dependency checkout, make a change, then push that change, but it's awkward.

But that seems crazy complex (and dangerous), so I'm OK with the way things work now.

Re: GitHub Actions has a package manager, and it might be the worst

#115

Post by nijave »

amluto wrote: post #8

> The researchers identified four fundamental security properties that CI/CD systems need: admittance control, execution control, code control, and access to secrets. Why do CI/CD systems need access to secrets? I would argue need access to APIs and they need privileges to perform specific API calls. But there is absolutely nothing about calling an API that fundamentally requires that the caller know a secret. I woul…

While good in theory, in practice secrets are used to validate those privileges have been assigned. Even in schemes like metadata servers, you still use a secret.

Pedantically I'd say maybe it's more fair to say they shouldn't have access to long lived secrets and should only use short lived values.

The "I" stands for Integration so it's inevitable CI needs to talk to multiple things--at the very least a git repo which most cases requires a secret to pull.

Re: GitHub Actions has a package manager, and it might be the worst

#116

Post by nijave »

themafia wrote: post #47
hinkley wrote: post #24

Earlier quoted context omitted.

CI is arguable, but how do you intend to do deployments with no secrets?

AWS is great for this. IAM policies can allow IP Addresses or more safely just named EC2 instances. Our deploy server requires nothing.

CircleCI and I believe GHA support injecting signed JWTs you can use to bootstrap identity be it an IAM role or some other platform where you can trust an OIDC issuer

Re: GitHub Actions has a package manager, and it might be the worst

#117

Post by cindyllm »

ChrisMarshallNY wrote: post #114
gcr wrote: post #104

Earlier quoted context omitted.

So it’s a workspace that includes changes from multiple branches at once, like `jj new revset-1 revset-2 revset-3 …` ? (Git has octopus merges, jj just calls them “merge commits” even though they may have more than two parents)

Don't remember exactly. If I think about it, it could be quite complex. Git has the concept of "atomic repos." Repos are a single unit, including all files, branches, tags, etc. Older systems basically had a single repo, with "lenses" into sections of the repo (usually called "workspaces," or somesuch. VSS called them something else, but I can't remember). I find the atomic repo thing awkward; especially wrt librarie…

[dead]

Re: GitHub Actions has a package manager, and it might be the worst

#120

Post by gcr »

ChrisMarshallNY wrote: post #114
gcr wrote: post #104

Earlier quoted context omitted.

So it’s a workspace that includes changes from multiple branches at once, like `jj new revset-1 revset-2 revset-3 …` ? (Git has octopus merges, jj just calls them “merge commits” even though they may have more than two parents)

Don't remember exactly. If I think about it, it could be quite complex. Git has the concept of "atomic repos." Repos are a single unit, including all files, branches, tags, etc. Older systems basically had a single repo, with "lenses" into sections of the repo (usually called "workspaces," or somesuch. VSS called them something else, but I can't remember). I find the atomic repo thing awkward; especially wrt librarie…

Your workflow is fascinating! What languages do you work in, if you don’t mind me asking?

Both git and jj have sparse checkouts these days, it sounds like you’d be into that

Do you vendor the libraries you use? Python packages typically don’t include the testing or docs in wheels uploaded to PyPI, for instance

These days in Pythonland, it’s typical to use a package manager with a lockfile that enforces build reproducibility and SHA signatures for package attestation. If you haven’t worked with tools like uv, you might like their concepts (or you might be immediately put off by their idea of hermetically isolated environments idk)

Post reply on HN