Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing GitHub Actions policies in the dumbest way possible

blog.yossarian.net

Post reply on HN
Print view View original

121–129 of 129 posts

Re: Bypassing GitHub Actions policies in the dumbest way possible

#121

Post by tough »

zmgsabst wrote: post #120
kstrauser wrote: post #110

Earlier quoted context omitted.

In my experience, that’s rare. Everywhere I’ve worked had devs working on code directly on their laptops.

My experience is the opposite: I haven’t worked somewhere we ran code locally in a long, long time. Your IDE is local, but the testing is remote — typically in an environment where you can match the runtime environment more closely (eg, ensuring the same dependencies, access to cloud resources, etc).

isn't that just CI?

does that mean you will never compile it or build it locally?

don't 99% of people just use docker nowadays to have all that environment matches?

Re: Bypassing GitHub Actions policies in the dumbest way possible

#122

Post by janstice »

kstrauser wrote: post #109
janstice wrote: post #96

Earlier quoted context omitted.

For example, if someone installs the wrong version of Oracle Java on a VM in our farm, the licencing cost is seven figures as they want to charge per core that it could conceivably run on - this would be career-limiting for a number of people at once.

Or VirtualBox’s extensions which make it usable. Those are free to download but could make you an audit target.

Or even Docker Desktop, which is a bunch of $$ that no-one expects (and I think Microsoft is still recommending in the WSL docs).

Re: Bypassing GitHub Actions policies in the dumbest way possible

#123

Post by samplatt »

davkan wrote: post #100
samplatt wrote: post #99

Earlier quoted context omitted.

False dichotomy. The manager of the receptionist, or the head of their department, can decide what's appropriate for their job and dictate this to IT, and then they can lock it down. At my work currently IT have the first say and final say on all software, regardless of what it does or who is using it. It's an insane situation. Decisions are being made without any input from anyone even in the department of the users…

No, it’s unreasonable for end users and non technical managers to simply dictate to IT what software is to be installed on corporate devices. They can submit requests to IT with a business justification which should be approved if can be accommodated. Maybe your employer’s IT department is in the habit of saying no without a proper attempt to accommodate which can be a problem but, the solution is not to put the monk…

>No, it’s unreasonable for end users and non technical managers to simply dictate to IT

Again, false dichotomy. It's possible to meet in the middle, collaborate and discuss technical requirements. It's just that that rarely happens.

Our software (built by us, has regular code reviews and yearly external security audits and is internal-use-only amongst electrical engineers and computer-science guys) regularly gets disabled or removed by IT without warning by accident, and it's usually a few days before it's re-enabled/able to be reinstalled, since the tiny IT dept is forced to rely on external agencies to control their white-listing software.

Your "monkeys in charge of the zoo" metaphor is in full effect at my workplace, but in this case, the monkeys are IT and their security theater.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#124

Post by davkan »

samplatt wrote: post #123
davkan wrote: post #100

Earlier quoted context omitted.

No, it’s unreasonable for end users and non technical managers to simply dictate to IT what software is to be installed on corporate devices. They can submit requests to IT with a business justification which should be approved if can be accommodated. Maybe your employer’s IT department is in the habit of saying no without a proper attempt to accommodate which can be a problem but, the solution is not to put the monk…

>No, it’s unreasonable for end users and non technical managers to simply dictate to IT Again, false dichotomy. It's possible to meet in the middle, collaborate and discuss technical requirements. It's just that that rarely happens. Our software (built by us, has regular code reviews and yearly external security audits and is internal-use-only amongst electrical engineers and computer-science guys) regularly gets dis…

> The manager of the receptionist, or the head of their department, can decide what's appropriate for their job and dictate this to IT, and then they can lock it down.

You said exactly that.

Again, maybe your IT team is garbage, I don’t really care to litigate your issue with them. I specifically said IT should accommodate requests when possible and not be overzealous when saying no.

What you previously suggested is that is that stakeholders should give their demands to IT and that IT should figure out how to make it happen. Doesn’t sound like collaboration to me.

In my experience end users and management are very rarely aware of the requirements placed upon IT to ensure the security of company infrastructure when it comes passing audits, whether that’s for cyber insurance, or CMMC compliance or whatever else.

It’s plainly obvious that products don’t exist to sell without developers or engineers. But you can’t sell your product to customers if they require SOC and you don’t have it or if your entire infrastructure gets ransomwared.

I’ve had to tell very intelligent and hard working people that if I accommodated their request the government would no longer buy products from our company.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#125

Post by samplatt »

davkan wrote: post #124
samplatt wrote: post #123

Earlier quoted context omitted.

>No, it’s unreasonable for end users and non technical managers to simply dictate to IT Again, false dichotomy. It's possible to meet in the middle, collaborate and discuss technical requirements. It's just that that rarely happens. Our software (built by us, has regular code reviews and yearly external security audits and is internal-use-only amongst electrical engineers and computer-science guys) regularly gets dis…

> The manager of the receptionist, or the head of their department, can decide what's appropriate for their job and dictate this to IT, and then they can lock it down. You said exactly that. Again, maybe your IT team is garbage, I don’t really care to litigate your issue with them. I specifically said IT should accommodate requests when possible and not be overzealous when saying no. What you previously suggested is…

>What you previously suggested is that is that stakeholders should give their demands to IT and that IT should figure out how to make it happen. Doesn’t sound like collaboration to me.

That's fair; I did make it sound pretty one-sided there.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#126

Post by EatFlamingDeath »

monster_truck wrote: post #19

Had these exact same thoughts while I was configuring a series of workflows and scripts to get around the multiple unjustified and longstanding restrictions on what things are allowed to happen when. That sinking feeling when you search for how to do something and all of the top results are issues that were opened over a decade ago... It is especially painful trying to use github to do anything useful at all after be…

I've been saying for years, GitHub Actions is alpha software.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#128

Post by Already__Taken »

Arbortheus wrote: post #118
Already__Taken wrote: post #56

Earlier quoted context omitted.

I'm baffled you can't clone internal/private repos with anything other than a developer PAT. They have a UI to share access for workflows, let cloning use that...

Use a GitHub app, that’s what it’s for.

what with actions/checkout@v4, hows that documented?

https://github.com/actions/checkout/issues/567#issuecomment-...

GH has a `permissions:` entry and this mechanism already for internal repo action sharing. And thousands of our dollars per month.

Re: Bypassing GitHub Actions policies in the dumbest way possible

#129

Post by saghm »

monster_truck wrote: post #114
saghm wrote: post #57

Earlier quoted context omitted.

It used 1.8 days of time to run for a single day? I'm less curious about who's paying for it than who's _using _ it on your repo, because I can't even imagine having an average of almost two people scanning a codebase every single minute of the day.

Have you looked at the default configuration? It runs any time there is a push to main.

2600 minutes still seems pretty high to me; even if every run took 10 minutes, that's 260 pushes! Even the busiest projects I've worked on have never merged triple-digit numbers of changes in a single day. It's hard for me to imagine seeing that level of activity outside of something like a monorepo with a lot of different projects in it or something with a huge number of external contributors, and I wouldn't have any expectation that the default configuration would make sense for me if I were managing a repo like that. Maybe I've just worked on smaller projects than the average developer, or I've just been in charge of creating new CI actions infrequently enough to be paranoid about what exactly would be happening, but I wouldn't even consider enabling something on a repo with that much traffic before spending a lot of time looking at the configurations.
Post reply on HN